Bluetooth: hci3: command 0x0406 tx timeout Bluetooth: hci6: command 0x0406 tx timeout Bluetooth: hci1: command 0x0406 tx timeout Bluetooth: hci7: command 0x0406 tx timeout Bluetooth: hci2: command 0x0406 tx timeout watchdog: BUG: soft lockup - CPU#0 stuck for 27s! [syz-executor.1:4300] Modules linked in: irq event stamp: 163364 hardirqs last enabled at (163363): [] asm_sysvec_apic_timer_interrupt+0x1a/0x20 hardirqs last disabled at (163364): [] sysvec_apic_timer_interrupt+0xf/0x90 softirqs last enabled at (163362): [] irq_exit_rcu+0x93/0xc0 softirqs last disabled at (163353): [] irq_exit_rcu+0x93/0xc0 CPU: 0 PID: 4300 Comm: syz-executor.1 Not tainted 6.4.0-rc6-next-20230613 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:__ip6_append_data.isra.0+0xc3c/0x4560 Code: 4c 89 fe 4c 89 e7 e8 a3 c8 88 fd 4d 39 fc 76 08 e8 89 cd 88 fd 44 89 fb e8 81 cd 88 fd 48 8b 04 24 48 c1 e8 03 42 80 3c 28 00 <0f> 85 8c 2e 00 00 48 8b 04 24 4c 8b 20 49 8d bc 24 f0 00 00 00 48 RSP: 0018:ffff88803e567328 EFLAGS: 00000246 RAX: 1ffff11001cdcef0 RBX: 0000000000000001 RCX: ffffc90006fff000 RDX: 0000000000040000 RSI: ffffffff83c33bdf RDI: 0000000000000006 RBP: 0000000000000028 R08: 0000000000000006 R09: 000000000000ffd8 R10: 0000000000000001 R11: 0000000000000001 R12: 000000000000ffd8 R13: dffffc0000000000 R14: ffff8880094a4b40 R15: 0000000000000001 FS: 00007fa138ae9700(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2c62b000 CR3: 000000003db32000 CR4: 0000000000350ef0 Call Trace: ip6_append_data+0x1d4/0x530 rawv6_sendmsg+0x156e/0x3dc0 inet_sendmsg+0x121/0x150 sock_sendmsg+0x19b/0x200 splice_to_socket+0x949/0xe10 direct_splice_actor+0x119/0x180 splice_direct_to_actor+0x349/0x9d0 do_splice_direct+0x1bb/0x290 do_sendfile+0xb4b/0x12f0 __x64_sys_sendfile64+0x1d5/0x210 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 RIP: 0033:0x7fa13b594b19 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fa138ae9188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 RAX: ffffffffffffffda RBX: 00007fa13b6a8020 RCX: 00007fa13b594b19 RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000006 RBP: 00007fa13b5eef6d R08: 0000000000000000 R09: 0000000000000000 R10: 000000000001a000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fff09413e0f R14: 00007fa138ae9300 R15: 0000000000022000 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 263 Comm: syz-fuzzer Not tainted 6.4.0-rc6-next-20230613 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0033:0x41f0b4 Code: c9 48 85 c9 0f 84 0f 01 00 00 48 85 c9 0f 84 f8 00 00 00 48 89 0c 24 48 89 5c 24 08 e8 c5 05 00 00 48 8b 44 24 58 48 8b 48 18 <48> 81 f9 d0 07 00 00 0f 8c bb 00 00 00 48 8d 1d 38 d3 b2 01 f0 48 RSP: 002b:000000c000a53f38 EFLAGS: 00000216 RAX: 000000c00001f698 RBX: 00007f6cf047b119 RCX: 0000000000000248 RDX: 0000000000000040 RSI: 0000000000000003 RDI: 0000000000000040 RBP: 000000c000a53f80 R08: 00007f6cf0535fff R09: 000000c0028a2300 R10: 000000c00001f698 R11: 0000000000000040 R12: 00000000000000fa R13: 000000c000af6c00 R14: 0000000000000000 R15: 0000000000000000 FS: 000000c00009dc90 GS: 0000000000000000 Bluetooth: hci4: command 0x0406 tx timeout Bluetooth: hci5: command 0x0406 tx timeout ---------------- Code disassembly (best guess): 0: 4c 89 fe mov %r15,%rsi 3: 4c 89 e7 mov %r12,%rdi 6: e8 a3 c8 88 fd callq 0xfd88c8ae b: 4d 39 fc cmp %r15,%r12 e: 76 08 jbe 0x18 10: e8 89 cd 88 fd callq 0xfd88cd9e 15: 44 89 fb mov %r15d,%ebx 18: e8 81 cd 88 fd callq 0xfd88cd9e 1d: 48 8b 04 24 mov (%rsp),%rax 21: 48 c1 e8 03 shr $0x3,%rax 25: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) * 2a: 0f 85 8c 2e 00 00 jne 0x2ebc <-- trapping instruction 30: 48 8b 04 24 mov (%rsp),%rax 34: 4c 8b 20 mov (%rax),%r12 37: 49 8d bc 24 f0 00 00 lea 0xf0(%r12),%rdi 3e: 00 3f: 48 rex.W