Bluetooth: hci5: command 0x0c1a tx timeout
Bluetooth: hci3: command 0x0c1a tx timeout
Bluetooth: hci1: command 0x0c1a tx timeout
Bluetooth: hci6: command 0x0406 tx timeout
Bluetooth: hci4: command 0x0406 tx timeout
watchdog: BUG: soft lockup - CPU#0 stuck for 26s! [syz-executor.3:16470]
Modules linked in:
irq event stamp: 2437521
hardirqs last  enabled at (2437520): [<ffffffff84a8272b>] irqentry_exit+0x3b/0x90
hardirqs last disabled at (2437521): [<ffffffff84a810ef>] sysvec_apic_timer_interrupt+0xf/0x80
softirqs last  enabled at (2392258): [<ffffffff813a9e4c>] handle_softirqs+0x50c/0x770
softirqs last disabled at (2392295): [<ffffffff813aa1e4>] __irq_exit_rcu+0xc4/0x100
CPU: 0 UID: 0 PID: 16470 Comm: syz-executor.3 Not tainted 6.13.0-rc3-next-20241220 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:unwind_next_frame+0xac4/0x2490
Code: 85 9a 18 00 00 49 89 47 58 48 3d e0 07 33 81 0f 84 74 0e 00 00 48 ba 00 00 00 00 00 fc ff df 48 89 ee 48 c1 ee 03 80 3c 16 00 <0f> 85 53 15 00 00 4c 89 ea 49 89 47 58 48 b8 00 00 00 00 00 fc ff
RSP: 0018:ffff88806ce09770 EFLAGS: 00000246
RAX: ffffffff835e1176 RBX: 0000000000000002 RCX: ffffffff86aefdb2
RDX: dffffc0000000000 RSI: 1ffff1100d9c1307 RDI: 1ffff1100d9c1307
RBP: ffff88806ce09838 R08: ffffffff86aefdb6 R09: ffff88806ce09820
R10: 000000000003aab6 R11: 000000000009653b R12: ffff88806ce09840
R13: ffff88806ce09828 R14: ffff88806ce09ca0 R15: ffff88806ce097e0
FS:  00007ff1d41ce700(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f054f9d6545 CR3: 00000000331ee000 CR4: 0000000000350ef0
Call Trace:
 <IRQ>
 arch_stack_walk+0x87/0xf0
 stack_trace_save+0x8f/0xc0
 kasan_save_stack+0x24/0x50
 kasan_record_aux_stack+0x89/0xa0
 __call_rcu_common.constprop.0+0x6a/0xb70
 kmem_cache_free+0x2ae/0x470
 skb_release_data+0x814/0x990
 consume_skb+0xd0/0x160
 mac80211_hwsim_tx_frame+0x1f6/0x2a0
 mac80211_hwsim_beacon_tx+0x546/0x950
 __iterate_interfaces+0x2e0/0x650
 ieee80211_iterate_active_interfaces_atomic+0x71/0x1b0
 mac80211_hwsim_beacon+0x105/0x200
 __hrtimer_run_queues+0x1ab/0xa80
 hrtimer_run_softirq+0x14c/0x310
 handle_softirqs+0x1b1/0x770
 __irq_exit_rcu+0xc4/0x100
 irq_exit_rcu+0x9/0x20
 sysvec_apic_timer_interrupt+0x70/0x80
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:put_cpu_partial+0x10a/0x1b0
Code: 24 28 75 5b 49 c7 44 24 28 00 00 00 00 4c 89 e7 48 8d 35 00 00 00 00 e8 04 c6 ab ff 4d 85 ed 74 06 e8 ca 4b d5 ff fb 4d 85 f6 <74> 1c 5b 4c 89 f6 48 89 ef 5d 41 5c 41 5d 41 5e e9 c1 fa ff ff 44
RSP: 0018:ffff888041f57aa8 EFLAGS: 00000286
RAX: 00000000002480e5 RBX: ffffea0000fe0e00 RCX: 1ffffffff0fe1d12
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff81a47796
RBP: ffff888008c41dc0 R08: 0000000000000001 R09: fffffbfff0fdfbe9
R10: ffffffff87efdf4f R11: 0000000000000000 R12: ffff88806ce3f620
R13: 0000000000000200 R14: ffffea0000feda00 R15: ffff88803f838000
 qlist_free_all+0x50/0x160
 kasan_quarantine_reduce+0x19f/0x240
 __kasan_kmalloc+0x6f/0x90
 alloc_pipe_info+0x116/0x5b0
 splice_direct_to_actor+0x78e/0x9d0
 do_splice_direct+0x17a/0x250
 do_sendfile+0xa7e/0xdb0
 __x64_sys_sendfile64+0x1d5/0x210
 do_syscall_64+0xbf/0x1d0
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff1d6c58b19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ff1d41ce188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007ff1d6d6bf60 RCX: 00007ff1d6c58b19
RDX: 0000000000000000 RSI: 000000000000000a RDI: 0000000000000008
RBP: 00007ff1d6cb2f6d R08: 0000000000000000 R09: 0000000000000000
R10: 00000000fffffdef R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffeb1e0f36f R14: 00007ff1d41ce300 R15: 0000000000022000
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1 skipped: idling at default_idle+0x1e/0x30
----------------
Code disassembly (best guess):
   0:	85 9a 18 00 00 49    	test   %ebx,0x49000018(%rdx)
   6:	89 47 58             	mov    %eax,0x58(%rdi)
   9:	48 3d e0 07 33 81    	cmp    $0xffffffff813307e0,%rax
   f:	0f 84 74 0e 00 00    	je     0xe89
  15:	48 ba 00 00 00 00 00 	movabs $0xdffffc0000000000,%rdx
  1c:	fc ff df
  1f:	48 89 ee             	mov    %rbp,%rsi
  22:	48 c1 ee 03          	shr    $0x3,%rsi
  26:	80 3c 16 00          	cmpb   $0x0,(%rsi,%rdx,1)
* 2a:	0f 85 53 15 00 00    	jne    0x1583 <-- trapping instruction
  30:	4c 89 ea             	mov    %r13,%rdx
  33:	49 89 47 58          	mov    %rax,0x58(%r15)
  37:	48                   	rex.W
  38:	b8 00 00 00 00       	mov    $0x0,%eax
  3d:	00 fc                	add    %bh,%ah
  3f:	ff                   	.byte 0xff