------------[ cut here ]------------
WARNING: CPU: 0 PID: 302 at net/bluetooth/hci_conn.c:646 hci_conn_timeout+0x246/0x330
Modules linked in:
CPU: 0 PID: 302 Comm: kworker/u5:1 Not tainted 6.1.0-rc4-next-20221108 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Workqueue: hci2 hci_conn_timeout
RIP: 0010:hci_conn_timeout+0x246/0x330
Code: ff e8 3e c2 88 fd 4c 89 e7 e8 76 ba 0a 00 0f b6 e8 e8 2e c2 88 fd 89 ee 4c 89 e7 e8 84 f3 ff ff e9 1a ff ff ff e8 1a c2 88 fd <0f> 0b e9 36 fe ff ff 84 c0 74 93 4c 89 ef e8 67 95 bc fd eb 89 48
RSP: 0018:ffff88803fa0fce8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff8880177f6250 RCX: 0000000000000000
RDX: ffff88800d39d040 RSI: ffffffff83bfcdd6 RDI: 0000000000000005
RBP: 00000000fffffffb R08: 0000000000000005 R09: 0000000000000000
R10: 00000000fffffffb R11: 0000000000000001 R12: ffff88803fa0fdb0
R13: ffff88800d7e8258 R14: ffff888014222000 R15: ffff888015e7ee00
FS: 0000000000000000(0000) GS:ffff88806d000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f98c35a2718 CR3: 000000001761e000 CR4: 0000000000350ef0
Call Trace:
process_one_work+0xa17/0x16a0
worker_thread+0x63b/0x1260
kthread+0x2f1/0x3a0
ret_from_fork+0x2c/0x50
irq event stamp: 20211
hardirqs last enabled at (20221): [] __up_console_sem+0x78/0x80
hardirqs last disabled at (20250): [] __up_console_sem+0x5d/0x80
softirqs last enabled at (20246): [] __irq_exit_rcu+0x11b/0x180
softirqs last disabled at (20241): [] __irq_exit_rcu+0x11b/0x180
---[ end trace 0000000000000000 ]---
Bluetooth: hci2: command 0x0406 tx timeout
Bluetooth: hci7: command 0x0406 tx timeout
Bluetooth: hci6: command 0x0406 tx timeout
Bluetooth: hci4: command 0x0406 tx timeout
Bluetooth: hci0: command 0x0406 tx timeout
Bluetooth: hci3: command 0x0406 tx timeout
sr 1:0:0:0: [sr0] tag#0 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s
sr 1:0:0:0: [sr0] tag#0 Sense Key : Not Ready [current]
sr 1:0:0:0: [sr0] tag#0 Add. Sense: Medium not present
sr 1:0:0:0: [sr0] tag#0 CDB: Read(10) 28 00 00 00 00 00 00 00 40 00
blk_print_req_error: 1 callbacks suppressed
I/O error, dev sr0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 32 prio class 2
BUG: unable to handle page fault for address: fffffbc6ed68de06
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 6dfd0067 P4D 6dfd0067 PUD 6d1fc067 PMD 6d1fb067 PTE 0
Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 1 PID: 9986 Comm: syz-executor.6 Tainted: G W 6.1.0-rc4-next-20221108 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:get_desc+0x128/0x460
Code: e2 02 00 00 83 e0 07 38 c2 0f 9e c1 84 d2 0f 95 c0 84 c1 0f 85 cd 02 00 00 48 ba 00 00 00 00 00 fc ff df 48 89 d8 48 c1 e8 03 <0f> b6 0c 10 48 8d 43 07 48 89 c6 48 c1 ee 03 0f b6 14 16 48 89 de
RSP: 0000:ffff888044167bf8 EFLAGS: 00010216
RAX: 1fffffc6ed68de06 RBX: fffffe376b46f030 RCX: 0000000000000001
RDX: dffffc0000000000 RSI: 0000000000000001 RDI: 0000000000000006
RBP: ffff888044167cb8 R08: 0000000000000006 R09: 000000000000007f
R10: 0000000000000030 R11: 0000000000000001 R12: 1ffff1100882cf7f
R13: dffffc0000000000 R14: 0000000000000000 R15: 000000000000007f
FS: 00007fc681694700(0000) GS:ffff88806d100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbc6ed68de06 CR3: 00000000404ee000 CR4: 0000000000350ee0
Call Trace:
insn_get_code_seg_params+0xab/0x1b0
insn_decode_from_regs+0x72/0x190
fixup_umip_exception+0xcb/0x6d0
exc_general_protection+0x161/0x220
asm_exc_general_protection+0x26/0x30
RIP: 0033:0x7fc6840b9497
Code: 03 75 14 c7 05 16 6a 0b 01 04 00 00 00 bf 06 00 00 00 e8 7c f4 01 00 83 3d 05 6a 0b 01 04 75 0b c7 05 f9 69 0b 01 05 00 00 00 83 3d f1 69 0b 01 05 75 14 c7 05 e5 69 0b 01 06 00 00 00 bf 7f
RSP: 002b:00007fc681693dc0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 00007fc681694700 RCX: 00007fc6840d8a41
RDX: 0000000000000000 RSI: 00007fc681693ca0 RDI: 0000000000000002
RBP: 00007fc681694020 R08: 0000000000000000 R09: 00007fc681693ca0
R10: 0000000000000008 R11: 0000000000000246 R12: 00007fc681693f20
R13: 0000000000001000 R14: 0000000000000020 R15: 00007fc684215000
Modules linked in:
CR2: fffffbc6ed68de06
---[ end trace 0000000000000000 ]---
RIP: 0010:get_desc+0x128/0x460
Code: e2 02 00 00 83 e0 07 38 c2 0f 9e c1 84 d2 0f 95 c0 84 c1 0f 85 cd 02 00 00 48 ba 00 00 00 00 00 fc ff df 48 89 d8 48 c1 e8 03 <0f> b6 0c 10 48 8d 43 07 48 89 c6 48 c1 ee 03 0f b6 14 16 48 89 de
RSP: 0000:ffff888044167bf8 EFLAGS: 00010216
RAX: 1fffffc6ed68de06 RBX: fffffe376b46f030 RCX: 0000000000000001
RDX: dffffc0000000000 RSI: 0000000000000001 RDI: 0000000000000006
RBP: ffff888044167cb8 R08: 0000000000000006 R09: 000000000000007f
R10: 0000000000000030 R11: 0000000000000001 R12: 1ffff1100882cf7f
R13: dffffc0000000000 R14: 0000000000000000 R15: 000000000000007f
FS: 00007fc681694700(0000) GS:ffff88806d100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbc6ed68de06 CR3: 00000000404ee000 CR4: 0000000000350ee0
Bluetooth: hci0: Opcode 0x c03 failed: -4
tmpfs: Bad value for 'mpol'
perf: interrupt took too long (5010 > 5007), lowering kernel.perf_event_max_sample_rate to 39000
perf: interrupt took too long (7841 > 7830), lowering kernel.perf_event_max_sample_rate to 25000
perf: interrupt took too long (9809 > 9801), lowering kernel.perf_event_max_sample_rate to 20000
perf: interrupt took too long (12263 > 12261), lowering kernel.perf_event_max_sample_rate to 16000
perf: interrupt took too long (15355 > 15328), lowering kernel.perf_event_max_sample_rate to 13000
perf: interrupt took too long (19217 > 19193), lowering kernel.perf_event_max_sample_rate to 10000
blktrace: Concurrent blktraces are not allowed on sg0
blktrace: Concurrent blktraces are not allowed on sg0
blktrace: Concurrent blktraces are not allowed on sg0
blktrace: Concurrent blktraces are not allowed on sg0
blktrace: Concurrent blktraces are not allowed on sg0
blktrace: Concurrent blktraces are not allowed on sg0
blktrace: Concurrent blktraces are not allowed on sg0
blktrace: Concurrent blktraces are not allowed on sg0
blktrace: Concurrent blktraces are not allowed on sg0
blktrace: Concurrent blktraces are not allowed on sg0
blktrace: Concurrent blktraces are not allowed on sg0
----------------
Code disassembly (best guess):
0: e2 02 loop 0x4
2: 00 00 add %al,(%rax)
4: 83 e0 07 and $0x7,%eax
7: 38 c2 cmp %al,%dl
9: 0f 9e c1 setle %cl
c: 84 d2 test %dl,%dl
e: 0f 95 c0 setne %al
11: 84 c1 test %al,%cl
13: 0f 85 cd 02 00 00 jne 0x2e6
19: 48 ba 00 00 00 00 00 movabs $0xdffffc0000000000,%rdx
20: fc ff df
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 0f b6 0c 10 movzbl (%rax,%rdx,1),%ecx <-- trapping instruction
2e: 48 8d 43 07 lea 0x7(%rbx),%rax
32: 48 89 c6 mov %rax,%rsi
35: 48 c1 ee 03 shr $0x3,%rsi
39: 0f b6 14 16 movzbl (%rsi,%rdx,1),%edx
3d: 48 89 de mov %rbx,%rsi