Bluetooth: hci6: sending frame failed (-49) Bluetooth: hci7: command 0x1001 tx timeout Bluetooth: hci7: sending frame failed (-49) Bluetooth: hci6: command 0x1009 tx timeout Bluetooth: hci7: command 0x1009 tx timeout BUG: sleeping function called from invalid context at net/core/sock.c:2863 in_atomic(): 1, irqs_disabled(): 0, pid: 7348, name: syz-executor.3 3 locks held by syz-executor.3/7348: #0: 00000000f829dc33 (&tty->ldisc_sem){++++}, at: __tty_ldisc_lock drivers/tty/tty_ldisc.c:320 [inline] #0: 00000000f829dc33 (&tty->ldisc_sem){++++}, at: tty_ldisc_lock_pair_timeout drivers/tty/tty_ldisc.c:366 [inline] #0: 00000000f829dc33 (&tty->ldisc_sem){++++}, at: tty_ldisc_lock_pair drivers/tty/tty_ldisc.c:397 [inline] #0: 00000000f829dc33 (&tty->ldisc_sem){++++}, at: tty_ldisc_release+0x2a8/0x440 drivers/tty/tty_ldisc.c:805 #1: 00000000c3a90845 (&tty->ldisc_sem/1){+.+.}, at: __tty_ldisc_lock_nested drivers/tty/tty_ldisc.c:326 [inline] #1: 00000000c3a90845 (&tty->ldisc_sem/1){+.+.}, at: tty_ldisc_lock_pair_timeout drivers/tty/tty_ldisc.c:368 [inline] #1: 00000000c3a90845 (&tty->ldisc_sem/1){+.+.}, at: tty_ldisc_lock_pair drivers/tty/tty_ldisc.c:397 [inline] #1: 00000000c3a90845 (&tty->ldisc_sem/1){+.+.}, at: tty_ldisc_release+0x398/0x440 drivers/tty/tty_ldisc.c:805 #2: 0000000079bddf60 (hci_sk_list.lock){++++}, at: hci_sock_dev_event+0x3db/0x660 net/bluetooth/hci_sock.c:756 Preemption disabled at: [<0000000000000000>] (null) CPU: 1 PID: 7348 Comm: syz-executor.3 Not tainted 4.19.202-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 ___might_sleep.cold+0x235/0x250 kernel/sched/core.c:6192 lock_sock_nested+0x33/0x110 net/core/sock.c:2863 lock_sock include/net/sock.h:1510 [inline] hci_sock_dev_event+0x465/0x660 net/bluetooth/hci_sock.c:758 hci_unregister_dev+0x25b/0x910 net/bluetooth/hci_core.c:3292 hci_uart_tty_close+0x277/0x2e0 drivers/bluetooth/hci_ldisc.c:553 tty_ldisc_close+0xa2/0xd0 drivers/tty/tty_ldisc.c:493 tty_ldisc_kill drivers/tty/tty_ldisc.c:639 [inline] tty_ldisc_release+0xf5/0x440 drivers/tty/tty_ldisc.c:806 tty_release_struct+0x20/0xe0 drivers/tty/tty_io.c:1611 tty_release+0xc70/0x1210 drivers/tty/tty_io.c:1784 __fput+0x2ce/0x890 fs/file_table.c:278 task_work_run+0x148/0x1c0 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:193 [inline] exit_to_usermode_loop+0x251/0x2a0 arch/x86/entry/common.c:167 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline] syscall_return_slowpath arch/x86/entry/common.c:271 [inline] do_syscall_64+0x538/0x620 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4665e9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f46bd786188 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 000000000056bf80 RCX: 00000000004665e9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80 R13: 00007ffc5d6263af R14: 00007f46bd786300 R15: 0000000000022000 IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready overlayfs: overlapping lowerdir path overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. loop_set_block_size: loop7 () has still dirty pages (nrpages=16) IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready netlink: 'syz-executor.5': attribute type 1 has an invalid length. IPv6: ADDRCONF(NETDEV_UP): bond1: link is not ready 8021q: adding VLAN 0 to HW filter on device bond1 netlink: 'syz-executor.3': attribute type 5 has an invalid length. bond1: The slave device specified does not support setting the MAC address IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready netlink: 'syz-executor.5': attribute type 1 has an invalid length. bond1: The slave device specified does not support setting the MAC address netlink: 'syz-executor.3': attribute type 5 has an invalid length. autofs4:pid:7586:autofs_fill_super: called with bogus options autofs4:pid:7596:autofs_fill_super: called with bogus options loop0: p2 < > p3 p4 loop0: p3 size 1912633224 extends beyond EOD, truncated loop0: p4 size 3657465856 extends beyond EOD, truncated device wlan1 entered promiscuous mode IPv6: ADDRCONF(NETDEV_UP): wlan1: link is not ready loop0: p2 < > p3 p4 loop0: p3 size 1912633224 extends beyond EOD, truncated loop0: p4 size 3657465856 extends beyond EOD, truncated netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. IPv6: ADDRCONF(NETDEV_UP): wlan1: link is not ready wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. kvm: vcpu 0: requested 128 ns lapic timer period limited to 200000 ns kvm: vcpu 0: requested 128 ns lapic timer period limited to 200000 ns netlink: 92 bytes leftover after parsing attributes in process `syz-executor.0'. new mount options do not match the existing superblock, will be ignored new mount options do not match the existing superblock, will be ignored IPVS: ftp: loaded support on port[0] = 21 IPVS: ftp: loaded support on port[0] = 21 IPVS: ftp: loaded support on port[0] = 21 IPVS: ftp: loaded support on port[0] = 21