On Mon, Sep 20, 2021 at 9:13 PM Hao Sun <sunhao.th@xxxxxxxxx> wrote: > > Hello, > > When using Healer to fuzz the latest Linux kernel, the following crash > was triggered. > > HEAD commit: 4357f03d6611 Merge tag 'pm-5.15-rc2 > git tree: upstream > console output: > https://drive.google.com/file/d/10dFvcbiBLWmCS05daXKnBH-ZEa8M7aI9/view?usp=sharing > kernel config: https://drive.google.com/file/d/1HKZtF_s3l6PL3OoQbNq_ei9CdBus-Tz0/view?usp=sharing > > Sorry, I don't have a reproducer for this crash, hope the symbolized > report can help. > If you fix this issue, please add the following tag to the commit: > Reported-by: Hao Sun <sunhao.th@xxxxxxxxx> > > Bluetooth: hci1: command 0x040f tx timeout > ------------[ cut here ]------------ > WARNING: CPU: 2 PID: 10555 at kernel/workqueue.c:1440 > __queue_work+0x437/0x8d0 kernel/workqueue.c:1440 > Modules linked in: > CPU: 2 PID: 10555 Comm: kworker/2:7 Not tainted 5.15.0-rc1+ #19 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS > rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 > Workqueue: events hci_cmd_timeout Add CC to Bluetooth people to deal with it together since the code is also just changed. It seems cmd_timer or cmd_timer.work is still active or pending for unknown reasons when hdev->workqueue is being drained.
