[ 56.227383] Bluetooth: hci5: command 0x0419 tx timeout [ 56.233700] Bluetooth: hci4: command 0x0419 tx timeout [ 56.263081] Bluetooth: hci2: command 0x0419 tx timeout [ 56.309148] Bluetooth: hci3: command 0x0419 tx timeout [ 170.382846] Bluetooth: hci3: command 0x0406 tx timeout [ 170.388918] Bluetooth: hci4: command 0x0406 tx timeout [ 170.416094] Bluetooth: hci0: command 0x0406 tx timeout [ 170.441622] Bluetooth: hci1: command 0x0406 tx timeout [ 170.466009] Bluetooth: hci2: command 0x0406 tx timeout [ 170.485774] Bluetooth: hci5: command 0x0406 tx timeout [ 463.218480] syz-executor.3 (6586) used greatest stack depth: 23168 bytes left [ 463.560671] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 463.567428] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 463.575849] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 463.583024] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 463.592043] device bridge_slave_1 left promiscuous mode [ 463.597829] bridge0: port 2(bridge_slave_1) entered disabled state [ 463.607402] device bridge_slave_0 left promiscuous mode [ 463.612975] bridge0: port 1(bridge_slave_0) entered disabled state [ 463.627154] device veth1_macvtap left promiscuous mode [ 463.632887] device veth0_macvtap left promiscuous mode [ 463.638247] device veth1_vlan left promiscuous mode [ 463.643580] device veth0_vlan left promiscuous mode [ 463.713150] device hsr_slave_1 left promiscuous mode [ 463.720388] device hsr_slave_0 left promiscuous mode [ 463.735214] team0 (unregistering): Port device team_slave_1 removed [ 463.744724] team0 (unregistering): Port device team_slave_0 removed [ 463.754949] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 463.766868] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 463.794261] bond0 (unregistering): Released all slaves Warning: Permanently added '10.128.10.63' (ECDSA) to the list of known hosts. [ 465.134364] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 465.144418] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 465.152456] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 465.160232] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 465.168547] device bridge_slave_1 left promiscuous mode [ 465.174026] bridge0: port 2(bridge_slave_1) entered disabled state [ 465.181252] device bridge_slave_0 left promiscuous mode [ 465.186700] bridge0: port 1(bridge_slave_0) entered disabled state [ 465.195842] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 465.202641] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 465.210278] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 465.217005] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 465.224885] device bridge_slave_1 left promiscuous mode [ 465.231131] bridge0: port 2(bridge_slave_1) entered disabled state [ 465.238390] device bridge_slave_0 left promiscuous mode [ 465.243807] bridge0: port 1(bridge_slave_0) entered disabled state [ 465.252380] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 465.259141] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 465.266520] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 465.273250] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 465.281378] device bridge_slave_1 left promiscuous mode [ 465.286784] bridge0: port 2(bridge_slave_1) entered disabled state [ 465.293861] device bridge_slave_0 left promiscuous mode [ 465.299650] bridge0: port 1(bridge_slave_0) entered disabled state [ 465.308026] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 465.314730] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 465.323620] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 465.330675] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 465.339551] device bridge_slave_1 left promiscuous mode [ 465.344964] bridge0: port 2(bridge_slave_1) entered disabled state [ 465.352425] device bridge_slave_0 left promiscuous mode [ 465.358679] bridge0: port 1(bridge_slave_0) entered disabled state [ 465.367050] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 465.373900] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 465.381604] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 465.388387] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 465.395861] device bridge_slave_1 left promiscuous mode [ 465.401758] bridge0: port 2(bridge_slave_1) entered disabled state [ 465.408889] device bridge_slave_0 left promiscuous mode [ 465.414311] bridge0: port 1(bridge_slave_0) entered disabled state [ 465.425865] device veth1_macvtap left promiscuous mode [ 465.431223] device veth0_macvtap left promiscuous mode [ 465.436601] device veth1_vlan left promiscuous mode [ 465.441680] device veth0_vlan left promiscuous mode [ 465.446936] device veth1_macvtap left promiscuous mode [ 465.452272] device veth0_macvtap left promiscuous mode [ 465.457800] device veth1_vlan left promiscuous mode [ 465.462859] device veth0_vlan left promiscuous mode [ 465.468874] device veth1_macvtap left promiscuous mode [ 465.474166] device veth0_macvtap left promiscuous mode [ 465.480115] device veth1_vlan left promiscuous mode [ 465.485149] device veth0_vlan left promiscuous mode [ 465.491073] device veth1_macvtap left promiscuous mode [ 465.496408] device veth0_macvtap left promiscuous mode [ 465.501755] device veth1_vlan left promiscuous mode [ 465.506825] device veth0_vlan left promiscuous mode [ 465.512556] device veth1_macvtap left promiscuous mode [ 465.517907] device veth0_macvtap left promiscuous mode [ 465.523199] device veth1_vlan left promiscuous mode [ 465.528450] device veth0_vlan left promiscuous mode [ 465.735847] device hsr_slave_1 left promiscuous mode [ 465.745923] device hsr_slave_0 left promiscuous mode [ 465.756833] team0 (unregistering): Port device team_slave_1 removed [ 465.766901] team0 (unregistering): Port device team_slave_0 removed [ 465.775666] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 465.786270] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 465.811372] bond0 (unregistering): Released all slaves [ 465.843424] device hsr_slave_1 left promiscuous mode [ 465.851435] device hsr_slave_0 left promiscuous mode [ 465.863817] team0 (unregistering): Port device team_slave_1 removed [ 465.873045] team0 (unregistering): Port device team_slave_0 removed [ 465.883232] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 465.893230] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 465.917653] bond0 (unregistering): Released all slaves [ 465.946709] device hsr_slave_1 left promiscuous mode [ 465.956018] device hsr_slave_0 left promiscuous mode [ 465.970230] team0 (unregistering): Port device team_slave_1 removed [ 465.979362] team0 (unregistering): Port device team_slave_0 removed [ 465.990161] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 465.999925] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 466.025734] bond0 (unregistering): Released all slaves [ 466.058156] device hsr_slave_1 left promiscuous mode [ 466.065144] device hsr_slave_0 left promiscuous mode [ 466.079003] team0 (unregistering): Port device team_slave_1 removed [ 466.087801] team0 (unregistering): Port device team_slave_0 removed [ 466.096357] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 466.107040] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 466.133041] bond0 (unregistering): Released all slaves [ 466.162584] device hsr_slave_1 left promiscuous mode [ 466.174130] device hsr_slave_0 left promiscuous mode [ 466.186484] team0 (unregistering): Port device team_slave_1 removed [ 466.195993] team0 (unregistering): Port device team_slave_0 removed [ 466.204759] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 466.214266] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 466.240710] bond0 (unregistering): Released all slaves [ 466.351318] IPVS: ftp: loaded support on port[0] = 21 [ 467.863709] list_del corruption, ffff8880a00fb888->next is LIST_POISON1 (dead000000000100) [ 467.872629] ------------[ cut here ]------------ [ 467.877377] kernel BUG at lib/list_debug.c:47! [ 467.882035] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 467.887385] CPU: 1 PID: 22156 Comm: kworker/u5:0 Not tainted 4.19.154-syzkaller #0 [ 467.895066] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 467.904502] Workqueue: hci0 hci_rx_work [ 467.908501] RIP: 0010:__list_del_entry_valid.cold.1+0x26/0x58 [ 467.914358] Code: 1d fe 0f 0b 4c 89 e2 48 89 de 48 c7 c7 a0 80 67 87 e8 b6 a4 1d fe 0f 0b 4c 89 ea 48 89 de 48 c7 c7 40 80 67 87 e8 a2 a4 1d fe <0f> 0b 48 89 de 48 c7 c7 60 81 67 87 e8 91 a4 1d fe 0f 0b 48 89 de [ 467.933233] RSP: 0018:ffff8880b53476f8 EFLAGS: 00010282 [ 467.938570] RAX: 000000000000004e RBX: ffff8880a00fb888 RCX: 0000000000000000 [ 467.945813] RDX: 0000000000000000 RSI: ffffffff87677da0 RDI: ffffffff8a19da60 [ 467.953057] RBP: ffff8880b5347710 R08: ffffed10174e5081 R09: ffffed10174e5080 [ 467.960300] R10: ffffed10174e5080 R11: ffff8880ba728407 R12: dead000000000200 [ 467.967545] R13: dead000000000100 R14: ffff8880b0c113c0 R15: ffff8880b0c11440 [ 467.974789] FS: 0000000000000000(0000) GS:ffff8880ba700000(0000) knlGS:0000000000000000 [ 467.982986] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 467.988840] CR2: 00000000006e06c0 CR3: 000000000846d000 CR4: 00000000001406e0 [ 467.996084] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 468.003327] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 468.010579] Call Trace: [ 468.013187] l2cap_chan_put+0x49/0x1a0 [ 468.017078] l2cap_recv_frame+0xf29/0xa440 [ 468.021304] ? l2cap_ertm_init+0xa30/0xa30 [ 468.025663] ? __lock_acquire+0x764/0x47c0 [ 468.029908] ? update_group_capacity+0xb60/0xb60 [ 468.034635] ? __lock_acquire+0x764/0x47c0 [ 468.038846] ? mark_held_locks+0x130/0x130 [ 468.043166] ? __lock_acquire+0x764/0x47c0 [ 468.047372] ? mark_held_locks+0x130/0x130 [ 468.051592] ? __lock_acquire+0x764/0x47c0 [ 468.055801] ? hci_rx_work+0x231/0x8e0 [ 468.059661] ? lock_acquire+0x180/0x3a0 [ 468.063607] ? hci_rx_work+0x231/0x8e0 [ 468.067470] ? mark_held_locks+0x130/0x130 [ 468.071677] ? hci_rx_work+0x5b0/0x8e0 [ 468.075538] ? lock_downgrade+0x860/0x860 [ 468.079657] ? mark_held_locks+0xc7/0x130 [ 468.083842] ? kasan_check_write+0x14/0x20 [ 468.088074] ? __mutex_unlock_slowpath+0xe8/0x6a0 [ 468.092889] ? wait_for_completion_io+0x20/0x20 [ 468.097534] l2cap_recv_acldata+0x756/0x8a0 [ 468.101830] hci_rx_work+0x5e1/0x8e0 [ 468.105549] process_one_work+0x7b9/0x15a0 [ 468.109760] ? pwq_dec_nr_in_flight+0x2c0/0x2c0 [ 468.114400] ? lock_acquire+0x180/0x3a0 [ 468.118362] ? kasan_check_write+0x14/0x20 [ 468.122572] ? do_raw_spin_lock+0xd0/0x240 [ 468.126793] worker_thread+0x85/0xb60 [ 468.130575] ? __kthread_parkme+0x37/0x1c0 [ 468.134782] kthread+0x347/0x410 [ 468.138120] ? process_one_work+0x15a0/0x15a0 [ 468.142587] ? kthread_park+0x100/0x100 [ 468.146538] ret_from_fork+0x24/0x30 [ 468.150224] Modules linked in: [ 468.153516] ---[ end trace bc75acf6443f98de ]--- [ 468.158262] RIP: 0010:__list_del_entry_valid.cold.1+0x26/0x58 [ 468.164135] Code: 1d fe 0f 0b 4c 89 e2 48 89 de 48 c7 c7 a0 80 67 87 e8 b6 a4 1d fe 0f 0b 4c 89 ea 48 89 de 48 c7 c7 40 80 67 87 e8 a2 a4 1d fe <0f> 0b 48 89 de 48 c7 c7 60 81 67 87 e8 91 a4 1d fe 0f 0b 48 89 de [ 468.183026] RSP: 0018:ffff8880b53476f8 EFLAGS: 00010282 [ 468.188372] RAX: 000000000000004e RBX: ffff8880a00fb888 RCX: 0000000000000000 [ 468.195615] RDX: 0000000000000000 RSI: ffffffff87677da0 RDI: ffffffff8a19da60 [ 468.202871] RBP: ffff8880b5347710 R08: ffffed10174e5081 R09: ffffed10174e5080 [ 468.210138] R10: ffffed10174e5080 R11: ffff8880ba728407 R12: dead000000000200 [ 468.217391] R13: dead000000000100 R14: ffff8880b0c113c0 R15: ffff8880b0c11440 [ 468.224637] FS: 0000000000000000(0000) GS:ffff8880ba700000(0000) knlGS:0000000000000000 [ 468.232848] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 468.238713] CR2: 00000000006e06c0 CR3: 000000000846d000 CR4: 00000000001406e0 [ 468.245959] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 468.253214] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 468.260470] Kernel panic - not syncing: Fatal exception [ 468.267161] Kernel Offset: disabled [ 468.270771] Rebooting in 86400 seconds..