Bluetooth: hci0: command 0x0406 tx timeout Bluetooth: hci3: command 0x0406 tx timeout Bluetooth: hci7: command 0x0406 tx timeout Bluetooth: hci6: command 0x0406 tx timeout Bluetooth: hci4: command 0x0406 tx timeout watchdog: BUG: soft lockup - CPU#1 stuck for 25s! [syz-executor.6:9863] Modules linked in: irq event stamp: 3019367 hardirqs last enabled at (3019366): [] irqentry_exit+0x3b/0x90 hardirqs last disabled at (3019367): [] sysvec_apic_timer_interrupt+0xf/0x80 softirqs last enabled at (3001612): [] handle_softirqs+0x50c/0x770 softirqs last disabled at (3001623): [] __irq_exit_rcu+0xc4/0x100 CPU: 1 UID: 0 PID: 9863 Comm: syz-executor.6 Not tainted 6.12.0-next-20241122 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:__call_rcu_common.constprop.0+0x609/0xaa0 Code: 3c 02 00 0f 85 d7 03 00 00 48 8b 05 31 23 87 04 49 03 85 18 01 00 00 49 39 c4 0f 8f be 01 00 00 e8 4c 0a 1f 00 fb 48 83 c4 20 <5b> 5d 41 5c 41 5d 41 5e 41 5f e9 08 0e 4c 03 e8 d3 a0 fe ff e9 1d RSP: 0018:ffff88806cf09b68 EFLAGS: 00000282 RAX: 00000000002e1248 RBX: ffff888009a7d648 RCX: 1ffffffff0fdfeb6 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff813afb04 RBP: ffff88806cf3c898 R08: 0000000000000001 R09: fffffbfff0fdddf1 R10: ffffffff87eeef8f R11: 00000000000c398f R12: 00000000000006ff R13: ffff88806cf3c780 R14: ffff88806cf3c820 R15: 0000000000000000 FS: 00007fdfbecd2700(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f20404ece40 CR3: 0000000016ebc000 CR4: 0000000000350ef0 Call Trace: kmem_cache_free+0x2ae/0x470 skb_release_data+0x814/0x990 consume_skb+0xd0/0x160 mac80211_hwsim_tx_frame+0x1f6/0x2a0 mac80211_hwsim_beacon_tx+0x546/0x950 __iterate_interfaces+0x2e0/0x650 ieee80211_iterate_active_interfaces_atomic+0x71/0x1b0 mac80211_hwsim_beacon+0x105/0x200 __hrtimer_run_queues+0x1ab/0xa70 hrtimer_run_softirq+0x14c/0x310 handle_softirqs+0x1b1/0x770 __irq_exit_rcu+0xc4/0x100 irq_exit_rcu+0x9/0x20 sysvec_apic_timer_interrupt+0x70/0x80 asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:qlist_free_all+0x28/0x160 Code: 90 90 48 8b 07 48 85 c0 0f 84 41 01 00 00 41 57 41 56 41 55 49 89 fd 41 54 49 89 f4 55 53 eb 3e 48 63 95 c0 00 00 00 48 8b 18 <48> 89 ef 48 29 d0 48 89 c6 49 89 c6 e8 e7 f0 ff ff 49 89 c7 66 90 RSP: 0018:ffff888032147120 EFLAGS: 00000246 RAX: ffff888016b6f940 RBX: ffff88800dda2940 RCX: ffffea00005adbc0 RDX: 0000000000000000 RSI: ffff888008c4f780 RDI: 0000000000080000 RBP: ffff888008c4f780 R08: ffff888016b6f4a0 R09: 00000000000d000b R10: ffffea00005adb00 R11: 0000000000000000 R12: 0000000000000000 R13: ffff888032147158 R14: ffff888016b6f4a0 R15: ffff888016b6f4a0 kasan_quarantine_reduce+0x19f/0x240 __kasan_slab_alloc+0x49/0x70 kmem_cache_alloc_noprof+0x13d/0x3d0 __kernfs_new_node+0xd4/0x850 kernfs_new_node+0x18b/0x250 __kernfs_create_file+0x55/0x360 sysfs_add_file_mode_ns+0x21c/0x440 internal_create_group+0x573/0xeb0 internal_create_groups.part.0+0x90/0x140 sysfs_create_groups+0x29/0x50 device_add+0x680/0x17f0 netdev_register_kobject+0x182/0x3b0 register_netdevice+0x1332/0x1ab0 register_netdev+0x31/0x60 sit_init_net+0x28b/0x5c0 ops_init+0x1e1/0x650 setup_net+0x1d7/0x7a0 copy_net_ns+0x2e3/0x6f0 create_new_namespaces+0x3f6/0xaf0 copy_namespaces+0x45c/0x580 copy_process+0x2704/0x8e90 kernel_clone+0xeb/0x850 __do_sys_clone3+0x1d9/0x260 do_syscall_64+0xbf/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fdfc175cb19 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fdfbecd2188 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 RAX: ffffffffffffffda RBX: 00007fdfc186ff60 RCX: 00007fdfc175cb19 RDX: 0000000000000000 RSI: 0000000000000058 RDI: 0000000020004c00 RBP: 00007fdfc17b6f6d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe88ff991f R14: 00007fdfbecd2300 R15: 0000000000022000 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 skipped: idling at default_idle+0x1e/0x30 ---------------- Code disassembly (best guess): 0: 3c 02 cmp $0x2,%al 2: 00 0f add %cl,(%rdi) 4: 85 d7 test %edx,%edi 6: 03 00 add (%rax),%eax 8: 00 48 8b add %cl,-0x75(%rax) b: 05 31 23 87 04 add $0x4872331,%eax 10: 49 03 85 18 01 00 00 add 0x118(%r13),%rax 17: 49 39 c4 cmp %rax,%r12 1a: 0f 8f be 01 00 00 jg 0x1de 20: e8 4c 0a 1f 00 callq 0x1f0a71 25: fb sti 26: 48 83 c4 20 add $0x20,%rsp * 2a: 5b pop %rbx <-- trapping instruction 2b: 5d pop %rbp 2c: 41 5c pop %r12 2e: 41 5d pop %r13 30: 41 5e pop %r14 32: 41 5f pop %r15 34: e9 08 0e 4c 03 jmpq 0x34c0e41 39: e8 d3 a0 fe ff callq 0xfffea111 3e: e9 .byte 0xe9 3f: 1d .byte 0x1d