[ 4.095278][ T28] audit: type=1400 audit(1733061124.977:10): avc: denied { getattr } for pid=85 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=2 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 4.279940][ T102] udevd[102]: starting version 3.2.11
[ 4.323057][ T103] udevd[103]: starting eudev-3.2.11
[ 4.324608][ T102] udevd (102) used greatest stack depth: 22256 bytes left
[ 12.446257][ T28] kauditd_printk_skb: 50 callbacks suppressed
[ 12.446273][ T28] audit: type=1400 audit(1733061133.357:61): avc: denied { transition } for pid=226 comm="sshd" path="/bin/sh" dev="sda1" ino=89 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 12.456330][ T28] audit: type=1400 audit(1733061133.357:62): avc: denied { noatsecure } for pid=226 comm="sshd" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 12.463248][ T28] audit: type=1400 audit(1733061133.357:63): avc: denied { write } for pid=226 comm="sh" path="pipe:[14542]" dev="pipefs" ino=14542 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1
[ 12.470085][ T28] audit: type=1400 audit(1733061133.357:64): avc: denied { rlimitinh } for pid=226 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 12.474684][ T28] audit: type=1400 audit(1733061133.357:65): avc: denied { siginh } for pid=226 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
Warning: Permanently added '10.128.10.26' (ED25519) to the list of known hosts.
executing program
executing program
executing program
executing program
executing program
[ 74.885579][ T28] audit: type=1400 audit(1733061195.797:66): avc: denied { execmem } for pid=342 comm="syz-executor415" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 74.892595][ T28] audit: type=1400 audit(1733061195.797:67): avc: denied { create } for pid=349 comm="syz-executor415" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1
[ 74.904644][ T28] audit: type=1400 audit(1733061195.807:68): avc: denied { ioctl } for pid=349 comm="syz-executor415" path="socket:[13244]" dev="sockfs" ino=13244 ioctlcmd=0x48e1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1
[ 74.909813][ T8] Bluetooth: hci1: Frame reassembly failed (-84)
[ 74.928759][ T10] Bluetooth: hci2: Frame reassembly failed (-84)
[ 74.934392][ T43] Bluetooth: hci3: Frame reassembly failed (-84)
[ 74.940333][ T10] Bluetooth: hci4: Frame reassembly failed (-84)
[ 76.971153][ T356] Bluetooth: hci3: Opcode 0x1003 failed: -110
[ 76.971178][ T359] Bluetooth: hci4: command 0x1003 tx timeout
[ 76.971200][ T359] Bluetooth: hci3: command 0x1003 tx timeout
[ 76.977090][ T349] Bluetooth: hci0: Opcode 0x080f failed: -110
[ 76.982905][ T355] Bluetooth: hci2: Opcode 0x1003 failed: -110
[ 77.000503][ T357] Bluetooth: hci4: Opcode 0x1003 failed: -110
[ 77.006439][ T352] Bluetooth: hci1: Opcode 0x1003 failed: -110
[ 77.006470][ T359] Bluetooth: hci2: command 0x1003 tx timeout
[ 77.012568][ T356] Bluetooth: hci1: command 0x1003 tx timeout
executing program
[ 79.051120][ T351] Bluetooth: hci0: Opcode 0x080f failed: -110
[ 79.097283][ T10] Bluetooth: hci1: Frame reassembly failed (-84)
executing program
executing program
executing program
executing program
[ 79.902797][ T354] Bluetooth: hci0: Opcode 0x080f failed: -4
[ 79.908685][ T353] Bluetooth: hci0: Opcode 0x080f failed: -4
[ 79.914685][ T348] Bluetooth: hci0: Opcode 0x080f failed: -4
[ 79.927611][ T10] Bluetooth: hci0: Frame reassembly failed (-84)
[ 79.975201][ T10] Bluetooth: hci2: Frame reassembly failed (-84)
[ 79.983295][ T43] Bluetooth: hci3: Frame reassembly failed (-84)
[ 79.983297][ T10] Bluetooth: hci4: Frame reassembly failed (-84)
executing program
[ 81.131162][ T359] Bluetooth: hci1: command 0x1003 tx timeout
[ 81.131157][ T356] Bluetooth: hci1: Opcode 0x1003 failed: -110
[ 81.148935][ T10] Bluetooth: hci1: Frame reassembly failed (-84)
[ 81.931135][ T45] Bluetooth: hci0: Opcode 0x1003 failed: -110
[ 81.931156][ T355] Bluetooth: hci0: command 0x1003 tx timeout
[ 81.942971][ T370] Bluetooth: hci0: Opcode 0x080f failed: -22
[ 81.948908][ T371] Bluetooth: hci0: Opcode 0x080f failed: -22
[ 81.954785][ T373] Bluetooth: hci0: Opcode 0x080f failed: -22
[ 81.960725][ T372] Bluetooth: hci0: Opcode 0x080f failed: -22
[ 81.966845][ T377] Bluetooth: hci0: Opcode 0x080f failed: -22
executing program
executing program
executing program
[ 82.011193][ T352] Bluetooth: hci2: Opcode 0x1003 failed: -110
[ 82.011185][ T363] Bluetooth: hci4: Opcode 0x1003 failed: -110
[ 82.011262][ T363] Bluetooth: hci3: command 0x1003 tx timeout
[ 82.017146][ T358] Bluetooth: hci3: Opcode 0x1003 failed: -110
[ 82.037340][ T10] Bluetooth: hci0: Frame reassembly failed (-84)
[ 82.043784][ T10] Bluetooth: hci2: Frame reassembly failed (-84)
executing program
[ 82.055821][ T8] Bluetooth: hci3: Frame reassembly failed (-84)
[ 82.085889][ T8] Bluetooth: hci4: Frame reassembly failed (-84)
executing program
[ 83.211153][ T359] Bluetooth: hci1: command 0x1003 tx timeout
[ 83.211174][ T356] Bluetooth: hci1: Opcode 0x1003 failed: -110
[ 83.228933][ T8] Bluetooth: hci1: Frame reassembly failed (-84)
[ 84.091149][ T358] Bluetooth: hci0: Opcode 0x1003 failed: -110
[ 84.091191][ T359] Bluetooth: hci4: command 0x1003 tx timeout
[ 84.097098][ T358] Bluetooth: hci3: command 0x1003 tx timeout
[ 84.102895][ T352] Bluetooth: hci4: Opcode 0x1003 failed: -110
[ 84.108945][ T358] Bluetooth: hci2: command 0x1003 tx timeout
[ 84.114634][ T363] Bluetooth: hci3: Opcode 0x1003 failed: -110
[ 84.114661][ T45] Bluetooth: hci2: Opcode 0x1003 failed: -110
[ 85.291124][ T356] Bluetooth: hci1: Opcode 0x1003 failed: -110
[ 85.291134][ T358] Bluetooth: hci1: command 0x1003 tx timeout
[ 86.171127][ T378] Bluetooth: hci0: Opcode 0x080f failed: -110
executing program
[ 87.035132][ T379] Bluetooth: hci0: Opcode 0x080f failed: -4
[ 87.063956][ T380] Bluetooth: hci0: Opcode 0x080f failed: -4
executing program
[ 87.083822][ T10] Bluetooth: hci2: Frame reassembly failed (-84)
[ 87.090054][ T382] Bluetooth: hci0: Opcode 0x080f failed: -4
executing program
executing program
executing program
[ 88.234302][ T384] Bluetooth: hci0: Opcode 0x080f failed: -4
[ 88.244008][ T10] Bluetooth: hci0: Frame reassembly failed (-84)
[ 88.294549][ T43] Bluetooth: hci1: Frame reassembly failed (-84)
[ 88.300750][ T43] Bluetooth: hci1: Frame reassembly failed (-84)
executing program
executing program
[ 89.131139][ T359] Bluetooth: hci3: command 0x1003 tx timeout
[ 89.131155][ T358] Bluetooth: hci3: Opcode 0x1003 failed: -110
[ 89.131187][ T359] Bluetooth: hci2: command 0x1003 tx timeout
[ 89.136990][ T356] Bluetooth: hci2: Opcode 0x1003 failed: -110
[ 89.156204][ T43] Bluetooth: hci2: Frame reassembly failed (-84)
[ 89.166128][ T10] Bluetooth: hci3: Frame reassembly failed (-84)
[ 89.172371][ T10] Bluetooth: hci3: Frame reassembly failed (-84)
executing program
[ 89.211158][ T363] Bluetooth: hci4: command 0x1003 tx timeout
[ 89.211288][ T45] Bluetooth: hci4: Opcode 0x1003 failed: -110
[ 89.228964][ T8] Bluetooth: hci4: Frame reassembly failed (-84)
executing program
[ 90.251159][ T359] Bluetooth: hci0: command 0x1003 tx timeout
[ 90.251167][ T357] Bluetooth: hci0: Opcode 0x1003 failed: -110
[ 90.263051][ T394] Bluetooth: hci0: Opcode 0x080f failed: -22
[ 90.268936][ T395] Bluetooth: hci0: Opcode 0x080f failed: -22
[ 90.274848][ T397] Bluetooth: hci0: Opcode 0x080f failed: -22
[ 90.280731][ T398] Bluetooth: hci0: Opcode 0x080f failed: -22
[ 90.287582][ T399] Bluetooth: hci0: Opcode 0x080f failed: -22
[ 90.318815][ T363] ==================================================================
[ 90.326699][ T363] BUG: KASAN: use-after-free in enqueue_timer+0xa6/0x480
[ 90.333553][ T363] Write of size 8 at addr ffff888111de0a00 by task kworker/u5:7/363
[ 90.341360][ T363]
[ 90.343540][ T363] CPU: 0 PID: 363 Comm: kworker/u5:7 Not tainted 6.1.115-syzkaller-00041-ga887a44ace2a #0
[ 90.353254][ T363] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[ 90.363147][ T363] Workqueue: hci0 hci_cmd_work
[ 90.367747][ T363] Call Trace:
[ 90.370877][ T363]
[ 90.373651][ T363] dump_stack_lvl+0x151/0x1b7
[ 90.378162][ T363] ? nf_tcp_handle_invalid+0x3f1/0x3f1
[ 90.383456][ T363] ? _printk+0xd1/0x111
[ 90.387448][ T363] ? __virt_addr_valid+0x242/0x2f0
[ 90.392395][ T363] print_report+0x158/0x4e0
[ 90.396753][ T363] ? __virt_addr_valid+0x242/0x2f0
[ 90.401683][ T363] ? kasan_complete_mode_report_info+0x90/0x1b0
[ 90.407757][ T363] ? enqueue_timer+0xa6/0x480
[ 90.412271][ T363] kasan_report+0x13c/0x170
[ 90.416611][ T363] ? enqueue_timer+0xa6/0x480
[ 90.421126][ T363] __asan_report_store8_noabort+0x17/0x20
[ 90.426679][ T363] enqueue_timer+0xa6/0x480
[ 90.431018][ T363] __mod_timer+0x8d3/0xcf0
[ 90.435270][ T363] ? wake_up_process+0x10/0x20
[ 90.439876][ T363] ? insert_work+0x283/0x310
[ 90.444298][ T363] ? __queue_work+0x9d9/0xd70
[ 90.448811][ T363] ? mod_timer_pending+0x30/0x30
[ 90.453588][ T363] ? queue_work_on+0x135/0x170
[ 90.458184][ T363] add_timer+0x68/0x80
[ 90.462092][ T363] __queue_delayed_work+0x16d/0x1f0
[ 90.467126][ T363] queue_delayed_work_on+0x10f/0x180
[ 90.472243][ T363] ? delayed_work_timer_fn+0x80/0x80
[ 90.477372][ T363] hci_cmd_work+0x2b1/0x310
[ 90.481705][ T363] process_one_work+0x73d/0xcb0
[ 90.486394][ T363] worker_thread+0xa60/0x1260
[ 90.490913][ T363] ? __kasan_check_read+0x11/0x20
[ 90.495769][ T363] kthread+0x26d/0x300
[ 90.499670][ T363] ? worker_clr_flags+0x1a0/0x1a0
[ 90.504541][ T363] ? kthread_blkcg+0xd0/0xd0
[ 90.508959][ T363] ret_from_fork+0x1f/0x30
[ 90.513238][ T363]
[ 90.516077][ T363]
[ 90.518248][ T363] Allocated by task 394:
[ 90.522324][ T363] kasan_set_track+0x4b/0x70
[ 90.526758][ T363] kasan_save_alloc_info+0x1f/0x30
[ 90.531697][ T363] __kasan_kmalloc+0x9c/0xb0
[ 90.536253][ T363] __kmalloc+0xb4/0x1e0
[ 90.540242][ T363] hci_alloc_dev_priv+0x27/0x1c00
[ 90.545105][ T363] hci_uart_tty_ioctl+0x401/0xa70
[ 90.549962][ T363] tty_ioctl+0x903/0xc50
[ 90.554044][ T363] __se_sys_ioctl+0x114/0x190
[ 90.558556][ T363] __x64_sys_ioctl+0x7b/0x90
[ 90.562982][ T363] x64_sys_call+0x98/0x9a0
[ 90.567235][ T363] do_syscall_64+0x3b/0xb0
[ 90.571486][ T363] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 90.577215][ T363]
[ 90.579383][ T363] Freed by task 399:
[ 90.583118][ T363] kasan_set_track+0x4b/0x70
[ 90.587543][ T363] kasan_save_free_info+0x2b/0x40
[ 90.592404][ T363] ____kasan_slab_free+0x131/0x180
[ 90.597463][ T363] __kasan_slab_free+0x11/0x20
[ 90.602062][ T363] __kmem_cache_free+0x21d/0x410
[ 90.606836][ T363] kfree+0x7a/0xf0
[ 90.610392][ T363] hci_release_dev+0x14d3/0x1640
[ 90.615168][ T363] bt_host_release+0x83/0xa0
[ 90.619593][ T363] device_release+0x95/0x1c0
[ 90.624020][ T363] kobject_put+0x178/0x260
[ 90.628272][ T363] put_device+0x1f/0x30
[ 90.632265][ T363] hci_dev_cmd+0x2be/0x9b0
[ 90.636521][ T363] hci_sock_ioctl+0x415/0x7f0
[ 90.641035][ T363] sock_do_ioctl+0x152/0x450
[ 90.645456][ T363] sock_ioctl+0x455/0x740
[ 90.649629][ T363] __se_sys_ioctl+0x114/0x190
[ 90.654196][ T363] __x64_sys_ioctl+0x7b/0x90
[ 90.658563][ T363] x64_sys_call+0x98/0x9a0
[ 90.662817][ T363] do_syscall_64+0x3b/0xb0
[ 90.667068][ T363] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 90.672799][ T363]
[ 90.674965][ T363] Last potentially related work creation:
[ 90.680523][ T363] kasan_save_stack+0x3b/0x60
[ 90.685034][ T363] __kasan_record_aux_stack+0xb4/0xc0
[ 90.690242][ T363] kasan_record_aux_stack_noalloc+0xb/0x10
[ 90.695884][ T363] insert_work+0x56/0x310
[ 90.700048][ T363] __queue_work+0x9b6/0xd70
[ 90.704397][ T363] queue_work_on+0x105/0x170
[ 90.708912][ T363] __hci_cmd_sync_sk+0xc2a/0xf70
[ 90.713698][ T363] hci_cmd_sync_status+0x52/0x130
[ 90.718561][ T363] hci_dev_cmd+0x771/0x9b0
[ 90.722816][ T363] hci_sock_ioctl+0x415/0x7f0
[ 90.727323][ T363] sock_do_ioctl+0x152/0x450
[ 90.731751][ T363] sock_ioctl+0x455/0x740
[ 90.735920][ T363] __se_sys_ioctl+0x114/0x190
[ 90.740430][ T363] __x64_sys_ioctl+0x7b/0x90
[ 90.744856][ T363] x64_sys_call+0x98/0x9a0
[ 90.749108][ T363] do_syscall_64+0x3b/0xb0
[ 90.753362][ T363] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 90.759090][ T363]
[ 90.761262][ T363] Second to last potentially related work creation:
[ 90.767686][ T363] kasan_save_stack+0x3b/0x60
[ 90.772198][ T363] __kasan_record_aux_stack+0xb4/0xc0
[ 90.777403][ T363] kasan_record_aux_stack_noalloc+0xb/0x10
[ 90.783044][ T363] insert_work+0x56/0x310
[ 90.787210][ T363] __queue_work+0x9b6/0xd70
[ 90.791550][ T363] queue_work_on+0x105/0x170
[ 90.795976][ T363] __hci_cmd_sync_sk+0xc2a/0xf70
[ 90.800750][ T363] hci_cmd_sync_status+0x52/0x130
[ 90.805614][ T363] hci_dev_cmd+0x771/0x9b0
[ 90.809871][ T363] hci_sock_ioctl+0x415/0x7f0
[ 90.814377][ T363] sock_do_ioctl+0x152/0x450
[ 90.818805][ T363] sock_ioctl+0x455/0x740
[ 90.822970][ T363] __se_sys_ioctl+0x114/0x190
[ 90.827482][ T363] __x64_sys_ioctl+0x7b/0x90
[ 90.831909][ T363] x64_sys_call+0x98/0x9a0
[ 90.836164][ T363] do_syscall_64+0x3b/0xb0
[ 90.840416][ T363] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 90.846144][ T363]
[ 90.848312][ T363] The buggy address belongs to the object at ffff888111de0000
[ 90.848312][ T363] which belongs to the cache kmalloc-8k of size 8192
[ 90.862204][ T363] The buggy address is located 2560 bytes inside of
[ 90.862204][ T363] 8192-byte region [ffff888111de0000, ffff888111de2000)
[ 90.875483][ T363]
[ 90.877649][ T363] The buggy address belongs to the physical page:
[ 90.883912][ T363] page:ffffea0004477800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x111de0
[ 90.893966][ T363] head:ffffea0004477800 order:3 compound_mapcount:0 compound_pincount:0
[ 90.902124][ T363] flags: 0x4000000000010200(slab|head|zone=1)
[ 90.908047][ T363] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100043500
[ 90.916462][ T363] raw: 0000000000000000 0000000000020002 00000001ffffffff 0000000000000000
[ 90.924869][ T363] page dumped because: kasan: bad access detected
[ 90.931131][ T363] page_owner tracks the page as allocated
[ 90.936672][ T363] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 391, tgid 391 (syz-executor415), ts 87123277698, free_ts 87070620016
[ 90.957937][ T363] post_alloc_hook+0x213/0x220
[ 90.962537][ T363] prep_new_page+0x1b/0x110
[ 90.966872][ T363] get_page_from_freelist+0x2980/0x2a10
[ 90.972254][ T363] __alloc_pages+0x234/0x610
[ 90.976682][ T363] alloc_slab_page+0x6c/0xf0
[ 90.981109][ T363] new_slab+0x90/0x3e0
[ 90.985011][ T363] ___slab_alloc+0x6f9/0xb80
[ 90.989437][ T363] __slab_alloc+0x5d/0xa0
[ 90.993604][ T363] __kmem_cache_alloc_node+0x207/0x2a0
[ 90.998898][ T363] __kmalloc+0xa3/0x1e0
[ 91.002889][ T363] hci_alloc_dev_priv+0x27/0x1c00
[ 91.007749][ T363] hci_uart_tty_ioctl+0x401/0xa70
[ 91.012609][ T363] tty_ioctl+0x903/0xc50
[ 91.016696][ T363] __se_sys_ioctl+0x114/0x190
[ 91.021202][ T363] __x64_sys_ioctl+0x7b/0x90
[ 91.025631][ T363] x64_sys_call+0x98/0x9a0
[ 91.029882][ T363] page last free stack trace:
[ 91.034482][ T363] free_unref_page_prepare+0x83d/0x850
[ 91.039778][ T363] free_unref_page+0xb2/0x5c0
[ 91.044288][ T363] __free_pages+0x61/0xf0
[ 91.048579][ T363] __free_slab+0xce/0x1a0
[ 91.052742][ T363] __unfreeze_partials+0x165/0x1a0
[ 91.057695][ T363] put_cpu_partial+0xa9/0x100
[ 91.062199][ T363] __slab_free+0x1c8/0x280
[ 91.066659][ T363] ___cache_free+0xc6/0xd0
[ 91.070899][ T363] qlist_free_all+0xc5/0x140
[ 91.075320][ T363] kasan_quarantine_reduce+0x15a/0x180
[ 91.080726][ T363] __kasan_slab_alloc+0x24/0x80
[ 91.085418][ T363] slab_post_alloc_hook+0x53/0x2c0
[ 91.090360][ T363] __kmem_cache_alloc_node+0x193/0x2a0
[ 91.095655][ T363] kmalloc_trace+0x2a/0xa0
[ 91.099914][ T363] kobject_uevent_env+0x262/0x720
[ 91.104769][ T363] kobject_uevent+0x1f/0x30
[ 91.109113][ T363]
[ 91.111275][ T363] Memory state around the buggy address:
[ 91.116750][ T363] ffff888111de0900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 91.124653][ T363] ffff888111de0980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 91.132549][ T363] >ffff888111de0a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 91.140445][ T363] ^
[ 91.144347][ T363] ffff888111de0a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 91.152246][ T363] ffff888111de0b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 91.160141][ T363] ==================================================================
executing program
[ 91.168042][ T363] Disabling lock debugging due to kernel taint
[ 91.174203][ T359] Bluetooth: hci1: command 0x1003 tx timeout
[ 91.180024][ T352] Bluetooth: hci1: Opcode 0x1003 failed: -110
[ 91.186015][ T10] Bluetooth: hci0: Frame reassembly failed (-84)
[ 91.192256][ T10] Bluetooth: hci0: Frame reassembly failed (-84)
[ 91.198581][ T10] Bluetooth: hci1: Frame reassembly failed (-84)
[ 91.211124][ T356] Bluetooth: hci2: Opcode 0x1003 failed: -110
[ 91.211161][ T358] Bluetooth: hci3: Opcode 0x1003 failed: -110
executing program
executing program
[ 91.217036][ T356] Bluetooth: hci3: command 0x1003 tx timeout
[ 91.235929][ T10] Bluetooth: hci3: Frame reassembly failed (-84)
[ 91.238381][ T43] Bluetooth: hci2: Frame reassembly failed (-84)
executing program
[ 91.291132][ T352] Bluetooth: hci4: command 0x1003 tx timeout
[ 91.291138][ T45] Bluetooth: hci4: Opcode 0x1003 failed: -110
[ 91.311526][ T43] Bluetooth: hci4: Frame reassembly failed (-84)
[ 92.331146][ T357] Bluetooth: hci0: Opcode 0x1003 failed: -110
[ 92.331194][ C0] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
[ 92.348599][ C0] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
[ 92.356837][ C0] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G B 6.1.115-syzkaller-00041-ga887a44ace2a #0
[ 92.367605][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[ 92.377491][ C0] RIP: 0010:__queue_work+0x4f1/0xd70
[ 92.382611][ C0] Code: 39 03 0f 84 40 01 00 00 e8 0c 6c 2a 00 4c 89 e7 e8 d4 73 d6 03 49 bd 00 00 00 00 00 fc ff df 4c 8b 65 d0 4c 89 f0 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 f7 e8 d0 da 71 00 49 8b 3e e8 88 6c d6
[ 92.402057][ C0] RSP: 0018:ffffc90000007c78 EFLAGS: 00010046
[ 92.407956][ C0] RAX: 0000000000000000 RBX: 000000007fffffff RCX: ffffffff8701d4c0
[ 92.415764][ C0] RDX: 0000000000000100 RSI: 000000007fffffff RDI: 000000007fffffff
[ 92.423579][ C0] RBP: ffffc90000007d00 R08: ffffffff814b185b R09: 0000000000000007
[ 92.431389][ C0] R10: ffffffffffffffff R11: dffffc0000000001 R12: ffff888111de09c8
[ 92.439384][ C0] R13: dffffc0000000000 R14: 0000000000000000 R15: ffff888111de09e0
[ 92.447190][ C0] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
[ 92.455952][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 92.462375][ C0] CR2: 00007fff8832f838 CR3: 0000000124913000 CR4: 00000000003506b0
[ 92.470186][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 92.477995][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 92.485807][ C0] Call Trace:
[ 92.488935][ C0]
[ 92.491627][ C0] ? __die_body+0x62/0xb0
[ 92.495787][ C0] ? die_addr+0x9f/0xd0
[ 92.499783][ C0] ? exc_general_protection+0x317/0x4c0
[ 92.505164][ C0] ? cpu_curr_snapshot+0x200/0x200
[ 92.510110][ C0] ? asm_exc_general_protection+0x27/0x30
[ 92.515670][ C0] ? __queue_work+0x28b/0xd70
[ 92.520178][ C0] ? __queue_work+0x4f1/0xd70
[ 92.524690][ C0] ? __queue_work+0x29c/0xd70
[ 92.529203][ C0] delayed_work_timer_fn+0x61/0x80
[ 92.534150][ C0] ? queue_work_node+0x1d0/0x1d0
[ 92.538924][ C0] call_timer_fn+0x3b/0x2d0
[ 92.543263][ C0] ? queue_work_node+0x1d0/0x1d0
[ 92.548036][ C0] __run_timers+0x756/0xa10
[ 92.552380][ C0] ? calc_index+0x270/0x270
[ 92.556717][ C0] ? sched_clock+0x9/0x10
[ 92.560880][ C0] ? sched_clock_cpu+0x71/0x2b0
[ 92.565569][ C0] run_timer_softirq+0x69/0xf0
[ 92.570172][ C0] handle_softirqs+0x1db/0x650
[ 92.574783][ C0] ? irqtime_account_irq+0xdc/0x260
[ 92.579800][ C0] __irq_exit_rcu+0x52/0xf0
[ 92.584143][ C0] irq_exit_rcu+0x9/0x10
[ 92.588221][ C0] sysvec_apic_timer_interrupt+0xa9/0xc0
[ 92.593793][ C0]
[ 92.596551][ C0]
[ 92.599466][ C0] asm_sysvec_apic_timer_interrupt+0x1b/0x20
[ 92.605255][ C0] RIP: 0010:acpi_idle_enter+0x416/0x760
[ 92.610635][ C0] Code: 89 de 48 83 e6 08 31 ff e8 27 1c 54 fc 48 83 e3 08 0f 85 b1 00 00 00 0f 1f 44 00 00 e8 d3 17 54 fc 0f 00 2d 7c e8 ce 00 fb f4 e9 e3 00 00 00 49 83 c7 04 4c 89 f8 48 c1 e8 03 42 0f b6 04 30
[ 92.630076][ C0] RSP: 0018:ffffffff87007bd0 EFLAGS: 000002d3
[ 92.635977][ C0] RAX: ffffffff85216edd RBX: 0000000000000000 RCX: ffffffff8701d4c0
[ 92.643891][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 92.651700][ C0] RBP: ffffffff87007c10 R08: ffffffff85216ec9 R09: fffffbfff0e03a99
[ 92.659515][ C0] R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000001
[ 92.667326][ C0] R13: ffff88810a145004 R14: dffffc0000000000 R15: ffff888109738064
[ 92.675181][ C0] ? acpi_idle_enter+0x3f9/0x760
[ 92.679909][ C0] ? acpi_idle_enter+0x40d/0x760
[ 92.684691][ C0] ? intel_idle_xstate+0xa0/0xa0
[ 92.689459][ C0] cpuidle_enter_state+0x5eb/0x17f0
[ 92.694493][ C0] ? cpuidle_enter_s2idle+0x600/0x600
[ 92.699697][ C0] ? menu_enable_device+0x380/0x380
[ 92.704734][ C0] ? __sched_text_start+0x8/0x8
[ 92.709419][ C0] cpuidle_enter+0x5f/0xa0
[ 92.713671][ C0] do_idle+0x3d1/0x580
[ 92.717577][ C0] ? idle_inject_timer_fn+0x60/0x60
[ 92.722610][ C0] ? radix_tree_lookup+0x23a/0x290
[ 92.727561][ C0] ? debug_smp_processor_id+0x17/0x20
[ 92.732767][ C0] cpu_startup_entry+0x44/0x60
[ 92.737364][ C0] rest_init+0x10b/0x130
[ 92.741446][ C0] ? time_init+0x38/0x38
[ 92.745523][ C0] arch_call_rest_init+0xe/0xe
[ 92.750122][ C0] start_kernel+0x46c/0x4d8
[ 92.754464][ C0] x86_64_start_reservations+0x2a/0x2c
[ 92.759756][ C0] x86_64_start_kernel+0x7c/0x81
[ 92.764531][ C0] secondary_startup_64_no_verify+0xce/0xdb
[ 92.770262][ C0]
[ 92.773122][ C0] Modules linked in:
[ 92.776859][ C0] ---[ end trace 0000000000000000 ]---
[ 92.782156][ C0] RIP: 0010:__queue_work+0x4f1/0xd70
[ 92.787271][ C0] Code: 39 03 0f 84 40 01 00 00 e8 0c 6c 2a 00 4c 89 e7 e8 d4 73 d6 03 49 bd 00 00 00 00 00 fc ff df 4c 8b 65 d0 4c 89 f0 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 f7 e8 d0 da 71 00 49 8b 3e e8 88 6c d6
[ 92.806713][ C0] RSP: 0018:ffffc90000007c78 EFLAGS: 00010046
[ 92.812614][ C0] RAX: 0000000000000000 RBX: 000000007fffffff RCX: ffffffff8701d4c0
[ 92.820425][ C0] RDX: 0000000000000100 RSI: 000000007fffffff RDI: 000000007fffffff
[ 92.828236][ C0] RBP: ffffc90000007d00 R08: ffffffff814b185b R09: 0000000000000007
[ 92.836047][ C0] R10: ffffffffffffffff R11: dffffc0000000001 R12: ffff888111de09c8
[ 92.843868][ C0] R13: dffffc0000000000 R14: 0000000000000000 R15: ffff888111de09e0
[ 92.851672][ C0] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
[ 92.860435][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 92.866858][ C0] CR2: 00007fff8832f838 CR3: 0000000124913000 CR4: 00000000003506b0
[ 92.874672][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 92.883263][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 92.891081][ C0] Kernel panic - not syncing: Fatal exception in interrupt
[ 92.898476][ C0] Kernel Offset: disabled
[ 92.902602][ C0] Rebooting in 86400 seconds..