[ 57.231171] Bluetooth: hci4: command 0x0419 tx timeout [ 57.237853] Bluetooth: hci2: command 0x0419 tx timeout [ 57.243375] Bluetooth: hci1: command 0x0419 tx timeout [ 57.306047] Bluetooth: hci5: command 0x0419 tx timeout [ 175.546358] Bluetooth: hci2: command 0x0406 tx timeout [ 175.552261] Bluetooth: hci5: command 0x0406 tx timeout [ 175.559141] Bluetooth: hci0: command 0x0406 tx timeout [ 175.564841] Bluetooth: hci3: command 0x0406 tx timeout [ 175.571094] Bluetooth: hci4: command 0x0406 tx timeout [ 175.577224] Bluetooth: hci1: command 0x0406 tx timeout [ 399.852271] syz-executor.0 (5899) used greatest stack depth: 23016 bytes left [ 400.243832] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 400.252605] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 400.263193] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 400.272127] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 400.283758] device bridge_slave_1 left promiscuous mode [ 400.291325] bridge0: port 2(bridge_slave_1) entered disabled state [ 400.343519] device bridge_slave_0 left promiscuous mode [ 400.350245] bridge0: port 1(bridge_slave_0) entered disabled state [ 400.407552] device veth1_macvtap left promiscuous mode [ 400.414587] device veth0_macvtap left promiscuous mode [ 400.421313] device veth1_vlan left promiscuous mode [ 400.427280] device veth0_vlan left promiscuous mode [ 400.532269] device hsr_slave_1 left promiscuous mode [ 400.593604] device hsr_slave_0 left promiscuous mode [ 400.650763] team0 (unregistering): Port device team_slave_1 removed [ 400.663203] team0 (unregistering): Port device team_slave_0 removed [ 400.673773] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 400.724135] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 400.781659] bond0 (unregistering): Released all slaves [ 403.264834] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 403.276780] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 403.286631] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 403.299387] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 403.309319] device bridge_slave_1 left promiscuous mode [ 403.318135] bridge0: port 2(bridge_slave_1) entered disabled state [ 403.361621] device bridge_slave_0 left promiscuous mode [ 403.368254] bridge0: port 1(bridge_slave_0) entered disabled state [ 403.412433] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 403.421252] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 403.433508] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 403.441644] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 403.452758] device bridge_slave_1 left promiscuous mode [ 403.460488] bridge0: port 2(bridge_slave_1) entered disabled state [ 403.511140] device bridge_slave_0 left promiscuous mode [ 403.517604] bridge0: port 1(bridge_slave_0) entered disabled state [ 403.562129] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 403.569546] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 403.581689] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 403.589544] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 403.598470] device bridge_slave_1 left promiscuous mode [ 403.604986] bridge0: port 2(bridge_slave_1) entered disabled state [ 403.660790] device bridge_slave_0 left promiscuous mode [ 403.667973] bridge0: port 1(bridge_slave_0) entered disabled state [ 403.723225] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 403.732715] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 403.744318] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 403.753435] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 403.762884] device bridge_slave_1 left promiscuous mode [ 403.771499] bridge0: port 2(bridge_slave_1) entered disabled state [ 403.811154] device bridge_slave_0 left promiscuous mode [ 403.817628] bridge0: port 1(bridge_slave_0) entered disabled state [ 403.872199] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 403.881860] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 403.889871] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 403.897808] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 403.906138] device bridge_slave_1 left promiscuous mode [ 403.912579] bridge0: port 2(bridge_slave_1) entered disabled state [ 403.960702] device bridge_slave_0 left promiscuous mode [ 403.967096] bridge0: port 1(bridge_slave_0) entered disabled state [ 404.026157] device veth1_macvtap left promiscuous mode [ 404.034367] device veth0_macvtap left promiscuous mode [ 404.041020] device veth1_vlan left promiscuous mode [ 404.047383] device veth0_vlan left promiscuous mode [ 404.054457] device veth1_macvtap left promiscuous mode [ 404.061445] device veth0_macvtap left promiscuous mode [ 404.068056] device veth1_vlan left promiscuous mode [ 404.074667] device veth0_vlan left promiscuous mode [ 404.080989] device veth1_macvtap left promiscuous mode [ 404.088432] device veth0_macvtap left promiscuous mode [ 404.095870] device veth1_vlan left promiscuous mode [ 404.103042] device veth0_vlan left promiscuous mode [ 404.112564] device veth1_macvtap left promiscuous mode [ 404.121828] device veth0_macvtap left promiscuous mode [ 404.131133] device veth1_vlan left promiscuous mode [ 404.138931] device veth0_vlan left promiscuous mode [ 404.147197] device veth1_macvtap left promiscuous mode [ 404.154941] device veth0_macvtap left promiscuous mode [ 404.162828] device veth1_vlan left promiscuous mode [ 404.169340] device veth0_vlan left promiscuous mode [ 404.482810] device hsr_slave_1 left promiscuous mode [ 404.544193] device hsr_slave_0 left promiscuous mode [ 404.588298] team0 (unregistering): Port device team_slave_1 removed [ 404.601654] team0 (unregistering): Port device team_slave_0 removed [ 404.613730] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 404.656575] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 404.719515] bond0 (unregistering): Released all slaves [ 404.805607] device hsr_slave_1 left promiscuous mode [ 404.864470] device hsr_slave_0 left promiscuous mode [ 404.908837] team0 (unregistering): Port device team_slave_1 removed [ 404.922041] team0 (unregistering): Port device team_slave_0 removed [ 404.933442] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 404.964649] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 405.040321] bond0 (unregistering): Released all slaves [ 405.213392] device hsr_slave_1 left promiscuous mode [ 405.292488] device hsr_slave_0 left promiscuous mode [ 405.357307] team0 (unregistering): Port device team_slave_1 removed [ 405.368248] team0 (unregistering): Port device team_slave_0 removed [ 405.380380] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 405.444342] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 405.509465] bond0 (unregistering): Released all slaves [ 405.635396] device hsr_slave_1 left promiscuous mode [ 405.693836] device hsr_slave_0 left promiscuous mode [ 405.757257] team0 (unregistering): Port device team_slave_1 removed [ 405.773300] team0 (unregistering): Port device team_slave_0 removed [ 405.786713] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 405.822795] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 405.900733] bond0 (unregistering): Released all slaves [ 406.022766] device hsr_slave_1 left promiscuous mode [ 406.083530] device hsr_slave_0 left promiscuous mode [ 406.145583] team0 (unregistering): Port device team_slave_1 removed [ 406.158617] team0 (unregistering): Port device team_slave_0 removed [ 406.169532] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 406.203429] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 406.288518] bond0 (unregistering): Released all slaves Warning: Permanently added '10.128.15.213' (ECDSA) to the list of known hosts. [ 406.489183] IPVS: ftp: loaded support on port[0] = 21 [ 408.212807] list_del corruption, ffff8881d627c5c8->next is LIST_POISON1 (dead000000000100) [ 408.223379] ------------[ cut here ]------------ [ 408.228281] kernel BUG at lib/list_debug.c:47! [ 408.233528] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 408.239662] CPU: 1 PID: 25545 Comm: kworker/u5:0 Not tainted 4.19.176-syzkaller #0 [ 408.247698] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 408.258297] Workqueue: hci0 hci_rx_work [ 408.262902] RIP: 0010:__list_del_entry_valid.cold.1+0x26/0x4a [ 408.269612] Code: f9 ff 0f 0b 4c 89 e2 48 89 de 48 c7 c7 c0 89 67 87 e8 0a 6d f9 ff 0f 0b 4c 89 ea 48 89 de 48 c7 c7 60 89 67 87 e8 f6 6c f9 ff <0f> 0b 48 89 de 48 c7 c7 80 8a 67 87 e8 e5 6c f9 ff 0f 0b 48 89 de [ 408.293571] RSP: 0018:ffff8881d5af76f8 EFLAGS: 00010282 [ 408.300256] RAX: 000000000000004e RBX: ffff8881d627c5c8 RCX: 0000000000000000 [ 408.308029] RDX: 0000000000000000 RSI: ffffffff876786c0 RDI: ffffffff8a19eaa0 [ 408.315820] RBP: ffff8881d5af7710 R08: ffffed103ed25081 R09: ffffed103ed25080 [ 408.324906] R10: ffffed103ed25080 R11: ffff8881f6928407 R12: dead000000000200 [ 408.333379] R13: dead000000000100 R14: ffff8881e0b34340 R15: ffff8881e0b343c0 [ 408.342219] FS: 0000000000000000(0000) GS:ffff8881f6900000(0000) knlGS:0000000000000000 [ 408.351003] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 408.357174] CR2: 00000000007ac608 CR3: 000000000846d001 CR4: 00000000001606e0 [ 408.365188] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 408.374259] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 408.382674] Call Trace: [ 408.385719] l2cap_chan_put+0x49/0x1a0 [ 408.390163] l2cap_recv_frame+0xf29/0xa430 [ 408.394576] ? hci_event_packet+0x5ec/0x7230 [ 408.399331] ? quarantine_put+0xda/0x1c0 [ 408.403559] ? update_group_capacity+0x8f/0xb60 [ 408.408613] ? __kasan_slab_free+0x1b0/0x220 [ 408.413190] ? l2cap_ertm_init+0xa30/0xa30 [ 408.417847] ? kthread+0x347/0x410 [ 408.421381] ? ret_from_fork+0x24/0x30 [ 408.425349] ? __lock_acquire+0x764/0x47c0 [ 408.429569] ? update_group_capacity+0xb60/0xb60 [ 408.434585] ? lock_downgrade+0x860/0x860 [ 408.438889] ? __lock_acquire+0x764/0x47c0 [ 408.443471] ? mark_held_locks+0x130/0x130 [ 408.447962] ? __lock_acquire+0x764/0x47c0 [ 408.452532] ? mark_held_locks+0x130/0x130 [ 408.457119] ? __lock_acquire+0x764/0x47c0 [ 408.461598] ? hci_rx_work+0x231/0x8f0 [ 408.465986] ? lock_acquire+0x180/0x3a0 [ 408.470130] ? hci_rx_work+0x231/0x8f0 [ 408.474633] ? mark_held_locks+0x130/0x130 [ 408.478962] ? hci_rx_work+0x5a1/0x8f0 [ 408.483023] ? lock_downgrade+0x860/0x860 [ 408.487414] ? mark_held_locks+0xc7/0x130 [ 408.492068] ? kasan_check_write+0x14/0x20 [ 408.496645] ? __mutex_unlock_slowpath+0xe8/0x6a0 [ 408.502157] ? wait_for_completion_io+0x20/0x20 [ 408.507515] l2cap_recv_acldata+0x756/0x8a0 [ 408.511933] hci_rx_work+0x5d6/0x8f0 [ 408.515765] process_one_work+0x7b9/0x15a0 [ 408.520784] ? pwq_dec_nr_in_flight+0x2c0/0x2c0 [ 408.525481] ? lock_acquire+0x180/0x3a0 [ 408.529907] ? kasan_check_write+0x14/0x20 [ 408.534556] ? do_raw_spin_lock+0xd0/0x240 [ 408.538891] worker_thread+0x85/0xb60 [ 408.543012] ? __kthread_parkme+0x37/0x1c0 [ 408.547770] kthread+0x347/0x410 [ 408.551517] ? process_one_work+0x15a0/0x15a0 [ 408.556091] ? kthread_park+0x100/0x100 [ 408.560314] ret_from_fork+0x24/0x30 [ 408.564423] Modules linked in: [ 408.568618] ---[ end trace aacd3e54d6923e0e ]--- [ 408.575922] RIP: 0010:__list_del_entry_valid.cold.1+0x26/0x4a [ 408.584170] Code: f9 ff 0f 0b 4c 89 e2 48 89 de 48 c7 c7 c0 89 67 87 e8 0a 6d f9 ff 0f 0b 4c 89 ea 48 89 de 48 c7 c7 60 89 67 87 e8 f6 6c f9 ff <0f> 0b 48 89 de 48 c7 c7 80 8a 67 87 e8 e5 6c f9 ff 0f 0b 48 89 de [ 408.605726] RSP: 0018:ffff8881d5af76f8 EFLAGS: 00010282 [ 408.611722] RAX: 000000000000004e RBX: ffff8881d627c5c8 RCX: 0000000000000000 [ 408.620317] RDX: 0000000000000000 RSI: ffffffff876786c0 RDI: ffffffff8a19eaa0 [ 408.628587] RBP: ffff8881d5af7710 R08: ffffed103ed25081 R09: ffffed103ed25080 [ 408.638507] R10: ffffed103ed25080 R11: ffff8881f6928407 R12: dead000000000200 [ 408.647046] R13: dead000000000100 R14: ffff8881e0b34340 R15: ffff8881e0b343c0 [ 408.655043] FS: 0000000000000000(0000) GS:ffff8881f6900000(0000) knlGS:0000000000000000 [ 408.664876] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 408.674177] CR2: 00000000007ac608 CR3: 000000000846d001 CR4: 00000000001606e0 [ 408.683316] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 408.692661] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 408.702217] Kernel panic - not syncing: Fatal exception [ 408.713544] Kernel Offset: disabled [ 408.718145] Rebooting in 86400 seconds..