program: bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000142020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000e02800850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f60000008500000043"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000ac0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) [ 74.894215][ T5332] Bluetooth: hci0: command tx timeout [ 74.938642][ T5353] [ 74.939911][ T5353] ============================= [ 74.950165][ T5353] WARNING: suspicious RCU usage [ 74.953738][ T5353] syzkaller #0 Not tainted [ 74.956007][ T5353] ----------------------------- [ 74.958653][ T5353] kernel/events/callchain.c:163 suspicious rcu_dereference_check() usage! [ 74.962120][ T5353] [ 74.962120][ T5353] other info that might help us debug this: [ 74.962120][ T5353] [ 74.967056][ T5353] [ 74.967056][ T5353] rcu_scheduler_active = 2, debug_locks = 1 [ 74.971192][ T5353] 1 lock held by syz.0.0/5353: [ 74.973431][ T5353] #0: ffffffff8e33a2c0 (rcu_read_lock_trace){....}-{0:0}, at: rcu_read_lock_trace+0x38/0x80 [ 74.978305][ T5353] [ 74.978305][ T5353] stack backtrace: [ 74.980877][ T5353] CPU: 0 UID: 0 PID: 5353 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 74.980892][ T5353] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 74.980900][ T5353] Call Trace: [ 74.980907][ T5353] [ 74.980913][ T5353] dump_stack_lvl+0x189/0x250 [ 74.980936][ T5353] ? __pfx_dump_stack_lvl+0x10/0x10 [ 74.980950][ T5353] ? __pfx__printk+0x10/0x10 [ 74.980976][ T5353] lockdep_rcu_suspicious+0x140/0x1d0 [ 74.981031][ T5353] get_callchain_entry+0x2b6/0x3c0 [ 74.981051][ T5353] get_perf_callchain+0xa1/0x6b0 [ 74.981069][ T5353] ? __pfx_get_perf_callchain+0x10/0x10 [ 74.981087][ T5353] ? preempt_schedule+0xae/0xc0 [ 74.981138][ T5353] __bpf_get_stack+0x3fc/0xa60 [ 74.981159][ T5353] ? __pfx___bpf_get_stack+0x10/0x10 [ 74.981172][ T5353] ? __lock_acquire+0xab9/0xd20 [ 74.981187][ T5353] bpf_get_stack+0x33/0x50 [ 74.981198][ T5353] ? bpf_prog_d43750871481577d+0x46/0x4e [ 74.981208][ T5353] bpf_get_stack_raw_tp+0x1a9/0x220 [ 74.981224][ T5353] bpf_prog_d43750871481577d+0x46/0x4e [ 74.981236][ T5353] bpf_prog_run_pin_on_cpu+0x6a/0x150 [ 74.981251][ T5353] bpf_prog_test_run_syscall+0x312/0x4b0 [ 74.981265][ T5353] ? __pfx_bpf_prog_test_run_syscall+0x10/0x10 [ 74.981275][ T5353] ? __fget_files+0x2a/0x420 [ 74.981293][ T5353] ? __pfx_bpf_prog_test_run_syscall+0x10/0x10 [ 74.981305][ T5353] bpf_prog_test_run+0x2c4/0x340 [ 74.981323][ T5353] __sys_bpf+0x581/0x870 [ 74.981338][ T5353] ? __pfx___sys_bpf+0x10/0x10 [ 74.981351][ T5353] ? rcu_is_watching+0x15/0xb0 [ 74.981372][ T5353] ? rcu_is_watching+0x15/0xb0 [ 74.981387][ T5353] __x64_sys_bpf+0x7c/0x90 [ 74.981401][ T5353] do_syscall_64+0xfa/0x3b0 [ 74.981411][ T5353] ? lockdep_hardirqs_on+0x9c/0x150 [ 74.981428][ T5353] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 74.981439][ T5353] ? clear_bhb_loop+0x60/0xb0 [ 74.981453][ T5353] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 74.981462][ T5353] RIP: 0033:0x7f615598eba9 [ 74.981469][ T5353] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 74.981476][ T5353] RSP: 002b:00007f6156761038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 74.981484][ T5353] RAX: ffffffffffffffda RBX: 00007f6155bd5fa0 RCX: 00007f615598eba9 [ 74.981489][ T5353] RDX: 000000000000000c RSI: 00002000000004c0 RDI: 000000000000000a [ 74.981494][ T5353] RBP: 00007f6155a11e19 R08: 0000000000000000 R09: 0000000000000000 [ 74.981500][ T5353] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 74.981506][ T5353] R13: 00007f6155bd6038 R14: 00007f6155bd5fa0 R15: 00007fff33c9a1b8 [ 74.981522][ T5353]