* [syzbot] [bluetooth?] WARNING in l2cap_chan_le_send_credits
@ 2026-11-13 23:38 syzbot
2026-11-15 4:46 ` syzbot
0 siblings, 1 reply; 2+ messages in thread
From: syzbot @ 2026-11-13 23:38 UTC (permalink / raw)
To: linux-bluetooth, linux-kernel, luiz.dentz, marcel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 18f2d01bfce9 arm64: kexec_file: Do not use CMA for images ..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=11e3a44d580000
kernel config: https://syzkaller.appspot.com/x/.config?x=4e8e6c1701ad8af2
dashboard link: https://syzkaller.appspot.com/bug?extid=9dc8780713b11155dd74
compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8bc8f56b5c77/disk-18f2d01b.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/0964f39ade28/vmlinux-18f2d01b.xz
kernel image: https://storage.googleapis.com/syzbot-assets/03ec4e4b937f/Image-18f2d01b.gz.xz
AI-generated root cause summary:
In net/bluetooth/l2cap_core.c, l2cap_chan_le_send_credits() allocates an L2CAP
transaction identifier via l2cap_get_ident() and unconditionally calls
ida_free(&conn->tx_ida, ident) after transmission under the assumption that
L2CAP_LE_CREDITS never expects a response. However, if the remote peer rejects
the packet with L2CAP_COMMAND_REJ or sends a signaling response bearing that
identifier, the asynchronous RX signaling handler l2cap_put_ident() sees the ID
as currently allocated and frees it first. When l2cap_chan_le_send_credits()
then executes ida_free() on the already-released identifier, ida_free() detects
that the ID is not allocated and triggers the warning in lib/idr.c.
full analysis: https://syzkaller.appspot.com/x/ai_root_cause?x=9dc8780713b11155dd74
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9dc8780713b11155dd74@syzkaller.appspotmail.com
------------[ cut here ]------------
ida_free called for id=2 which is not allocated.
WARNING: lib/idr.c:594 at ida_free+0x24c/0x2d4 lib/idr.c:594, CPU#0: syz.4.2428/12785
Modules linked in:
CPU: 0 UID: 0 PID: 12785 Comm: syz.4.2428 Tainted: G L syzkaller #0 PREEMPT
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : ida_free+0x24c/0x2d4 lib/idr.c:594
lr : ida_free+0x24c/0x2d4 lib/idr.c:594
sp : ffff800094d27880
x29: ffff800094d27910 x28: 00000000000000cc x27: 1fffe0001fc18211
x26: 0000000000000002 x25: dfff800000000000 x24: ffff800094d27880
x23: ffff7000129a4f10 x22: 00000000000000ca x21: 0000000000000000
x20: 0000000000000002 x19: 0000000000000000 x18: 00000000ffffffff
x17: 0000000000000000 x16: 0000000000000000 x15: ffff80008b586000
x14: 0000000000001f42 x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000080000 x9 : 8f9eb4c3589ac800
x8 : 8f9eb4c3589ac800 x7 : 756372735f656c6f x6 : 5f656c6f736e6f63
x5 : ffff0000e4be4ffc x4 : 0000000000000000 x3 : ffff80008030d4c8
x2 : 0000000100000000 x1 : ffff0000dc3b0000 x0 : 0000000000000001
Call trace:
ida_free+0x24c/0x2d4 lib/idr.c:594 (P)
l2cap_chan_le_send_credits+0x17c/0x29c net/bluetooth/l2cap_core.c:7113
l2cap_chan_rx_avail+0xb4/0x134 net/bluetooth/l2cap_core.c:7126
l2cap_publish_rx_avail+0x110/0x168 net/bluetooth/l2cap_sock.c:-1
l2cap_sock_recvmsg+0x280/0x7b8 net/bluetooth/l2cap_sock.c:1317
sock_recvmsg_nosec net/socket.c:1154 [inline]
sock_recvmsg+0xd4/0x170 net/socket.c:1176
__sys_recvfrom+0x1ec/0x31c net/socket.c:2333
__do_sys_recvfrom net/socket.c:2348 [inline]
__se_sys_recvfrom net/socket.c:2344 [inline]
__arm64_sys_recvfrom+0xec/0x10c net/socket.c:2344
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797
el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
irq event stamp: 584
hardirqs last enabled at (583): [<ffff8000804a47b4>] vprintk_store+0x924/0xb94 kernel/printk/printk.c:2385
hardirqs last disabled at (584): [<ffff800086954058>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:484
softirqs last enabled at (552): [<ffff8000800204f4>] __do_softirq+0x14/0x20 kernel/softirq.c:703
softirqs last disabled at (547): [<ffff8000800204f4>] __do_softirq+0x14/0x20 kernel/softirq.c:703
---[ end trace 0000000000000000 ]---
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [syzbot] [bluetooth?] WARNING in l2cap_chan_le_send_credits
2026-11-13 23:38 [syzbot] [bluetooth?] WARNING in l2cap_chan_le_send_credits syzbot
@ 2026-11-15 4:46 ` syzbot
0 siblings, 0 replies; 2+ messages in thread
From: syzbot @ 2026-11-15 4:46 UTC (permalink / raw)
To: linux-bluetooth, linux-kernel, luiz.dentz, marcel, syzkaller-bugs
syzbot has found a reproducer for the following issue on:
HEAD commit: ad3fc05c7e65 arm64: suspend: Only track cpuidle context fo..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=108eebfd580000
kernel config: https://syzkaller.appspot.com/x/.config?x=4e8e6c1701ad8af2
dashboard link: https://syzkaller.appspot.com/bug?extid=9dc8780713b11155dd74
compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
userspace arch: arm64
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13a329ad580000
AI-generated root cause summary:
In net/bluetooth/l2cap_core.c, l2cap_chan_le_send_credits() allocates an L2CAP
transaction identifier via l2cap_get_ident() and unconditionally calls
ida_free(&conn->tx_ida, ident) after transmission under the assumption that
L2CAP_LE_CREDITS never expects a response. However, if the remote peer rejects
the packet with L2CAP_COMMAND_REJ or sends a signaling response bearing that
identifier, the asynchronous RX signaling handler l2cap_put_ident() sees the ID
as currently allocated and frees it first. When l2cap_chan_le_send_credits()
then executes ida_free() on the already-released identifier, ida_free() detects
that the ID is not allocated and triggers the warning in lib/idr.c.
full analysis: https://syzkaller.appspot.com/x/ai_root_cause?x=9dc8780713b11155dd74
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9dc8780713b11155dd74@syzkaller.appspotmail.com
------------[ cut here ]------------
ida_free called for id=3 which is not allocated.
WARNING: lib/idr.c:594 at ida_free+0x24c/0x2d4 lib/idr.c:594, CPU#0: syz-executor357/5073
Modules linked in:
CPU: 0 UID: 0 PID: 5073 Comm: syz-executor357 Not tainted syzkaller #0 PREEMPT
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : ida_free+0x24c/0x2d4 lib/idr.c:594
lr : ida_free+0x24c/0x2d4 lib/idr.c:594
sp : ffff800094f27880
x29: ffff800094f27910 x28: 00000000000000cc x27: 1fffe0001aec2a11
x26: 0000000000000003 x25: dfff800000000000 x24: ffff800094f27880
x23: ffff7000129e4f10 x22: 0000000000000001 x21: 0000000000000000
x20: 0000000000000003 x19: 0000000000000000 x18: 00000000ffffffff
x17: 0000000000000003 x16: ffff8000898b7000 x15: ffff80008b586000
x14: 000000000000067b x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: ffff70001135360e x9 : b56adb3a1390ea00
x8 : b56adb3a1390ea00 x7 : ffff8000804a121c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80008030d4c8
x2 : 0000000100000000 x1 : ffff0000d8109d80 x0 : 0000000000000000
Call trace:
ida_free+0x24c/0x2d4 lib/idr.c:594 (P)
l2cap_chan_le_send_credits+0x17c/0x29c net/bluetooth/l2cap_core.c:7113
l2cap_chan_rx_avail+0xb4/0x134 net/bluetooth/l2cap_core.c:7126
l2cap_publish_rx_avail+0x110/0x168 net/bluetooth/l2cap_sock.c:-1
l2cap_sock_recvmsg+0x280/0x7b8 net/bluetooth/l2cap_sock.c:1317
sock_recvmsg_nosec net/socket.c:1154 [inline]
sock_recvmsg+0xd4/0x170 net/socket.c:1176
__sys_recvfrom+0x1ec/0x31c net/socket.c:2333
__do_sys_recvfrom net/socket.c:2348 [inline]
__se_sys_recvfrom net/socket.c:2344 [inline]
__arm64_sys_recvfrom+0xec/0x10c net/socket.c:2344
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797
el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
irq event stamp: 8486
hardirqs last enabled at (8485): [<ffff8000804a47b4>] vprintk_store+0x924/0xb94 kernel/printk/printk.c:2385
hardirqs last disabled at (8486): [<ffff800086954060>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:484
softirqs last enabled at (8478): [<ffff8000800204f4>] __do_softirq+0x14/0x20 kernel/softirq.c:703
softirqs last disabled at (8455): [<ffff8000800204f4>] __do_softirq+0x14/0x20 kernel/softirq.c:703
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
ida_free called for id=5 which is not allocated.
WARNING: lib/idr.c:594 at ida_free+0x24c/0x2d4 lib/idr.c:594, CPU#0: syz-executor357/5073
Modules linked in:
CPU: 0 UID: 0 PID: 5073 Comm: syz-executor357 Tainted: G W syzkaller #0 PREEMPT
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : ida_free+0x24c/0x2d4 lib/idr.c:594
lr : ida_free+0x24c/0x2d4 lib/idr.c:594
sp : ffff800094f27880
x29: ffff800094f27910 x28: 00000000000000cc x27: 1fffe0001aec2a11
x26: 0000000000000005 x25: dfff800000000000 x24: ffff800094f27880
x23: ffff7000129e4f10 x22: 0000000000000001 x21: 0000000000000000
x20: 0000000000000005 x19: 0000000000000000 x18: 1fffe000359cf228
x17: 0000000000000003 x16: ffff8000898b7000 x15: ffff80008b586000
x14: 00000000000006c5 x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: ffff70001135360e x9 : b56adb3a1390ea00
x8 : b56adb3a1390ea00 x7 : ffff8000804a121c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80008030d4c8
x2 : 0000000100000000 x1 : ffff0000d8109d80 x0 : 0000000000000000
Call trace:
ida_free+0x24c/0x2d4 lib/idr.c:594 (P)
l2cap_chan_le_send_credits+0x17c/0x29c net/bluetooth/l2cap_core.c:7113
l2cap_chan_rx_avail+0xb4/0x134 net/bluetooth/l2cap_core.c:7126
l2cap_publish_rx_avail+0x110/0x168 net/bluetooth/l2cap_sock.c:-1
l2cap_sock_recvmsg+0x280/0x7b8 net/bluetooth/l2cap_sock.c:1317
sock_recvmsg_nosec net/socket.c:1154 [inline]
sock_recvmsg+0xd4/0x170 net/socket.c:1176
__sys_recvfrom+0x1ec/0x31c net/socket.c:2333
__do_sys_recvfrom net/socket.c:2348 [inline]
__se_sys_recvfrom net/socket.c:2344 [inline]
__arm64_sys_recvfrom+0xec/0x10c net/socket.c:2344
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797
el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
irq event stamp: 8834
hardirqs last enabled at (8833): [<ffff8000804a47b4>] vprintk_store+0x924/0xb94 kernel/printk/printk.c:2385
hardirqs last disabled at (8834): [<ffff800086954060>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:484
softirqs last enabled at (8818): [<ffff800084c8f174>] __alloc_skb+0x1c0/0x610 net/core/skbuff.c:699
softirqs last disabled at (8816): [<ffff800084c8f15c>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (8816): [<ffff800084c8f15c>] __alloc_skb+0x1a8/0x610 net/core/skbuff.c:698
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
ida_free called for id=8 which is not allocated.
WARNING: lib/idr.c:594 at ida_free+0x24c/0x2d4 lib/idr.c:594, CPU#0: syz-executor357/5073
Modules linked in:
CPU: 0 UID: 0 PID: 5073 Comm: syz-executor357 Tainted: G W syzkaller #0 PREEMPT
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : ida_free+0x24c/0x2d4 lib/idr.c:594
lr : ida_free+0x24c/0x2d4 lib/idr.c:594
sp : ffff800094f27880
x29: ffff800094f27910 x28: 00000000000000cc x27: 1fffe0001aec2a11
x26: 0000000000000008 x25: dfff800000000000 x24: ffff800094f27880
x23: ffff7000129e4f10 x22: 0000000000000001 x21: 0000000000000000
x20: 0000000000000008 x19: 0000000000000000 x18: 1fffe000359cf228
x17: ffff800123625000 x16: ffff80008f910000 x15: 0000000000000001
x14: 000000000042ed3e x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: ffff7000129e4eb8 x9 : b56adb3a1390ea00
x8 : b56adb3a1390ea00 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000001 x4 : 0000000000000008 x3 : ffff8000803cfd0c
x2 : 0000000000000001 x1 : ffff0000d8109d80 x0 : 0000000000000001
Call trace:
ida_free+0x24c/0x2d4 lib/idr.c:594 (P)
l2cap_chan_le_send_credits+0x17c/0x29c net/bluetooth/l2cap_core.c:7113
l2cap_chan_rx_avail+0xb4/0x134 net/bluetooth/l2cap_core.c:7126
l2cap_publish_rx_avail+0x110/0x168 net/bluetooth/l2cap_sock.c:-1
l2cap_sock_recvmsg+0x280/0x7b8 net/bluetooth/l2cap_sock.c:1317
sock_recvmsg_nosec net/socket.c:1154 [inline]
sock_recvmsg+0xd4/0x170 net/socket.c:1176
__sys_recvfrom+0x1ec/0x31c net/socket.c:2333
__do_sys_recvfrom net/socket.c:2348 [inline]
__se_sys_recvfrom net/socket.c:2344 [inline]
__arm64_sys_recvfrom+0xec/0x10c net/socket.c:2344
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797
el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
irq event stamp: 9170
hardirqs last enabled at (9169): [<ffff8000803cfcbc>] raw_spin_rq_unlock_irq kernel/sched/sched.h:1719 [inline]
hardirqs last enabled at (9169): [<ffff8000803cfcbc>] finish_lock_switch kernel/sched/core.c:5314 [inline]
hardirqs last enabled at (9169): [<ffff8000803cfcbc>] finish_task_switch+0x234/0x858 kernel/sched/core.c:5432
hardirqs last disabled at (9170): [<ffff800086954060>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:484
softirqs last enabled at (9150): [<ffff800084c8f174>] __alloc_skb+0x1c0/0x610 net/core/skbuff.c:699
softirqs last disabled at (9148): [<ffff800084c8f15c>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (9148): [<ffff800084c8f15c>] __alloc_skb+0x1a8/0x610 net/core/skbuff.c:698
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
ida_free called for id=10 which is not allocated.
WARNING: lib/idr.c:594 at ida_free+0x24c/0x2d4 lib/idr.c:594, CPU#0: syz-executor357/5073
Modules linked in:
CPU: 0 UID: 0 PID: 5073 Comm: syz-executor357 Tainted: G W syzkaller #0 PREEMPT
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : ida_free+0x24c/0x2d4 lib/idr.c:594
lr : ida_free+0x24c/0x2d4 lib/idr.c:594
sp : ffff800094f27880
x29: ffff800094f27910 x28: 00000000000000cc x27: 1fffe0001aec2a11
x26: 000000000000000a x25: dfff800000000000 x24: ffff800094f27880
x23: ffff7000129e4f10 x22: 0000000000000001 x21: 0000000000000000
x20: 000000000000000a x19: 0000000000000000 x18: 1fffe000359cf228
x17: 0000000000000003 x16: ffff8000898b7000 x15: ffff80008996b3e0
x14: 0000000000000760 x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: ffff70001135360e x9 : b56adb3a1390ea00
x8 : b56adb3a1390ea00 x7 : ffff8000804a121c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80008030d4c8
x2 : 0000000100000000 x1 : ffff0000d8109d80 x0 : 0000000000000000
Call trace:
ida_free+0x24c/0x2d4 lib/idr.c:594 (P)
l2cap_chan_le_send_credits+0x17c/0x29c net/bluetooth/l2cap_core.c:7113
l2cap_chan_rx_avail+0xb4/0x134 net/bluetooth/l2cap_core.c:7126
l2cap_publish_rx_avail+0x110/0x168 net/bluetooth/l2cap_sock.c:-1
l2cap_sock_recvmsg+0x280/0x7b8 net/bluetooth/l2cap_sock.c:1317
sock_recvmsg_nosec net/socket.c:1154 [inline]
sock_recvmsg+0xd4/0x170 net/socket.c:1176
__sys_recvfrom+0x1ec/0x31c net/socket.c:2333
__do_sys_recvfrom net/socket.c:2348 [inline]
__se_sys_recvfrom net/socket.c:2344 [inline]
__arm64_sys_recvfrom+0xec/0x10c net/socket.c:2344
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797
el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
irq event stamp: 9406
hardirqs last enabled at (9405): [<ffff8000804a47b4>] vprintk_store+0x924/0xb94 kernel/printk/printk.c:2385
hardirqs last disabled at (9406): [<ffff800086954060>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:484
softirqs last enabled at (9390): [<ffff800084c8f174>] __alloc_skb+0x1c0/0x610 net/core/skbuff.c:699
softirqs last disabled at (9388): [<ffff800084c8f15c>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (9388): [<ffff800084c8f15c>] __alloc_skb+0x1a8/0x610 net/core/skbuff.c:698
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
ida_free called for id=12 which is not allocated.
WARNING: lib/idr.c:594 at ida_free+0x24c/0x2d4 lib/idr.c:594, CPU#0: syz-executor357/5073
Modules linked in:
CPU: 0 UID: 0 PID: 5073 Comm: syz-executor357 Tainted: G W syzkaller #0 PREEMPT
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : ida_free+0x24c/0x2d4 lib/idr.c:594
lr : ida_free+0x24c/0x2d4 lib/idr.c:594
sp : ffff800094f27880
x29: ffff800094f27910 x28: 00000000000000cc x27: 1fffe0001aec2a11
x26: 000000000000000c x25: dfff800000000000 x24: ffff800094f27880
x23: ffff7000129e4f10 x22: 0000000000000001 x21: 0000000000000000
x20: 000000000000000c x19: 0000000000000000 x18: 1fffe000359cf228
x17: 0000000000000003 x16: ffff8000898b7000 x15: ffff80008996b3e0
x14: 00000000000007af x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: ffff70001135360e x9 : b56adb3a1390ea00
x8 : b56adb3a1390ea00 x7 : ffff8000804a121c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80008030d4c8
x2 : 0000000100000000 x1 : ffff0000d8109d80 x0 : 0000000000000000
Call trace:
ida_free+0x24c/0x2d4 lib/idr.c:594 (P)
l2cap_chan_le_send_credits+0x17c/0x29c net/bluetooth/l2cap_core.c:7113
l2cap_chan_rx_avail+0xb4/0x134 net/bluetooth/l2cap_core.c:7126
l2cap_publish_rx_avail+0x110/0x168 net/bluetooth/l2cap_sock.c:-1
l2cap_sock_recvmsg+0x280/0x7b8 net/bluetooth/l2cap_sock.c:1317
sock_recvmsg_nosec net/socket.c:1154 [inline]
sock_recvmsg+0xd4/0x170 net/socket.c:1176
__sys_recvfrom+0x1ec/0x31c net/socket.c:2333
__do_sys_recvfrom net/socket.c:2348 [inline]
__se_sys_recvfrom net/socket.c:2344 [inline]
__arm64_sys_recvfrom+0xec/0x10c net/socket.c:2344
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797
el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
irq event stamp: 9622
hardirqs last enabled at (9621): [<ffff8000804a47b4>] vprintk_store+0x924/0xb94 kernel/printk/printk.c:2385
hardirqs last disabled at (9622): [<ffff800086954060>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:484
softirqs last enabled at (9606): [<ffff800084c8f174>] __alloc_skb+0x1c0/0x610 net/core/skbuff.c:699
softirqs last disabled at (9604): [<ffff800084c8f15c>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (9604): [<ffff800084c8f15c>] __alloc_skb+0x1a8/0x610 net/core/skbuff.c:698
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
ida_free called for id=156 which is not allocated.
WARNING: lib/idr.c:594 at ida_free+0x24c/0x2d4 lib/idr.c:594, CPU#0: syz-executor357/5073
Modules linked in:
CPU: 0 UID: 0 PID: 5073 Comm: syz-executor357 Tainted: G W syzkaller #0 PREEMPT
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : ida_free+0x24c/0x2d4 lib/idr.c:594
lr : ida_free+0x24c/0x2d4 lib/idr.c:594
sp : ffff800094f27880
x29: ffff800094f27910 x28: 00000000000000cc x27: 1fffe0001aec2a11
x26: 000000000000009c x25: dfff800000000000 x24: ffff800094f27880
x23: ffff7000129e4f10 x22: 0000000000000001 x21: 0000000000000000
x20: 000000000000009c x19: 0000000000000000 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000001
x14: 00000000000007fa x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: ffff70001135360e x9 : b56adb3a1390ea00
x8 : b56adb3a1390ea00 x7 : ffff8000804a121c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80008030d4c8
x2 : 0000000100000000 x1 : ffff0000d8109d80 x0 : 0000000000000000
Call trace:
ida_free+0x24c/0x2d4 lib/idr.c:594 (P)
l2cap_chan_le_send_credits+0x17c/0x29c net/bluetooth/l2cap_core.c:7113
l2cap_chan_rx_avail+0xb4/0x134 net/bluetooth/l2cap_core.c:7126
l2cap_publish_rx_avail+0x110/0x168 net/bluetooth/l2cap_sock.c:-1
l2cap_sock_recvmsg+0x280/0x7b8 net/bluetooth/l2cap_sock.c:1317
sock_recvmsg_nosec net/socket.c:1154 [inline]
sock_recvmsg+0xd4/0x170 net/socket.c:1176
__sys_recvfrom+0x1ec/0x31c net/socket.c:2333
__do_sys_recvfrom net/socket.c:2348 [inline]
__se_sys_recvfrom net/socket.c:2344 [inline]
__arm64_sys_recvfrom+0xec/0x10c net/socket.c:2344
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797
el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
irq event stamp: 24500
hardirqs last enabled at (24499): [<ffff8000804a47b4>] vprintk_store+0x924/0xb94 kernel/printk/printk.c:2385
hardirqs last disabled at (24500): [<ffff800086954060>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:484
softirqs last enabled at (24488): [<ffff800084c8f174>] __alloc_skb+0x1c0/0x610 net/core/skbuff.c:699
softirqs last disabled at (24486): [<ffff800084c8f15c>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (24486): [<ffff800084c8f15c>] __alloc_skb+0x1a8/0x610 net/core/skbuff.c:698
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
ida_free called for id=220 which is not allocated.
WARNING: lib/idr.c:594 at ida_free+0x24c/0x2d4 lib/idr.c:594, CPU#0: syz-executor357/5073
Modules linked in:
CPU: 0 UID: 0 PID: 5073 Comm: syz-executor357 Tainted: G W syzkaller #0 PREEMPT
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : ida_free+0x24c/0x2d4 lib/idr.c:594
lr : ida_free+0x24c/0x2d4 lib/idr.c:594
sp : ffff800094f27880
x29: ffff800094f27910 x28: 00000000000000cc x27: 1fffe0001aec2a11
x26: 00000000000000dc x25: dfff800000000000 x24: ffff800094f27880
x23: ffff7000129e4f10 x22: 0000000000000001 x21: 0000000000000000
x20: 00000000000000dc x19: 0000000000000000 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000001
x14: 0000000000000845 x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: ffff70001135360e x9 : b56adb3a1390ea00
x8 : b56adb3a1390ea00 x7 : ffff8000804a121c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80008030d4c8
x2 : 0000000100000000 x1 : ffff0000d8109d80 x0 : 0000000000000000
Call trace:
ida_free+0x24c/0x2d4 lib/idr.c:594 (P)
l2cap_chan_le_send_credits+0x17c/0x29c net/bluetooth/l2cap_core.c:7113
l2cap_chan_rx_avail+0xb4/0x134 net/bluetooth/l2cap_core.c:7126
l2cap_publish_rx_avail+0x110/0x168 net/bluetooth/l2cap_sock.c:-1
l2cap_sock_recvmsg+0x280/0x7b8 net/bluetooth/l2cap_sock.c:1317
sock_recvmsg_nosec net/socket.c:1154 [inline]
sock_recvmsg+0xd4/0x170 net/socket.c:1176
__sys_recvfrom+0x1ec/0x31c net/socket.c:2333
__do_sys_recvfrom net/socket.c:2348 [inline]
__se_sys_recvfrom net/socket.c:2344 [inline]
__arm64_sys_recvfrom+0xec/0x10c net/socket.c:2344
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797
el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
irq event stamp: 31398
hardirqs last enabled at (31397): [<ffff8000804a47b4>] vprintk_store+0x924/0xb94 kernel/printk/printk.c:2385
hardirqs last disabled at (31398): [<ffff800086954060>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:484
softirqs last enabled at (31386): [<ffff800084c8f174>] __alloc_skb+0x1c0/0x610 net/core/skbuff.c:699
softirqs last disabled at (31384): [<ffff800084c8f15c>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (31384): [<ffff800084c8f15c>] __alloc_skb+0x1a8/0x610 net/core/skbuff.c:698
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
ida_free called for id=235 which is not allocated.
WARNING: lib/idr.c:594 at ida_free+0x24c/0x2d4 lib/idr.c:594, CPU#0: syz-executor357/5073
Modules linked in:
CPU: 0 UID: 0 PID: 5073 Comm: syz-executor357 Tainted: G W syzkaller #0 PREEMPT
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : ida_free+0x24c/0x2d4 lib/idr.c:594
lr : ida_free+0x24c/0x2d4 lib/idr.c:594
sp : ffff800094f27880
x29: ffff800094f27910 x28: 00000000000000cc x27: 1fffe0001aec2a11
x26: 00000000000000eb x25: dfff800000000000 x24: ffff800094f27880
x23: ffff7000129e4f10 x22: 0000000000000001 x21: 0000000000000000
x20: 00000000000000eb x19: 0000000000000000 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000001
x14: 0000000000000890 x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: ffff70001135360e x9 : b56adb3a1390ea00
x8 : b56adb3a1390ea00 x7 : ffff8000804a121c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80008030d4c8
x2 : 0000000100000000 x1 : ffff0000d8109d80 x0 : 0000000000000000
Call trace:
ida_free+0x24c/0x2d4 lib/idr.c:594 (P)
l2cap_chan_le_send_credits+0x17c/0x29c net/bluetooth/l2cap_core.c:7113
l2cap_chan_rx_avail+0xb4/0x134 net/bluetooth/l2cap_core.c:7126
l2cap_publish_rx_avail+0x110/0x168 net/bluetooth/l2cap_sock.c:-1
l2cap_sock_recvmsg+0x280/0x7b8 net/bluetooth/l2cap_sock.c:1317
sock_recvmsg_nosec net/socket.c:1154 [inline]
sock_recvmsg+0xd4/0x170 net/socket.c:1176
__sys_recvfrom+0x1ec/0x31c net/socket.c:2333
__do_sys_recvfrom net/socket.c:2348 [inline]
__se_sys_recvfrom net/socket.c:2344 [inline]
__arm64_sys_recvfrom+0xec/0x10c net/socket.c:2344
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797
el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
irq event stamp: 33188
hardirqs last enabled at (33187): [<ffff8000804a47b4>] vprintk_store+0x924/0xb94 kernel/printk/printk.c:2385
hardirqs last disabled at (33188): [<ffff800086954060>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:484
softirqs last enabled at (33176): [<ffff800084c8f174>] __alloc_skb+0x1c0/0x610 net/core/skbuff.c:699
softirqs last disabled at (33174): [<ffff800084c8f15c>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (33174): [<ffff800084c8f15c>] __alloc_skb+0x1a8/0x610 net/core/skbuff.c:698
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
ida_free called for id=237 which is not allocated.
WARNING: lib/idr.c:594 at ida_free+0x24c/0x2d4 lib/idr.c:594, CPU#0: syz-executor357/5073
Modules linked in:
CPU: 0 UID: 0 PID: 5073 Comm: syz-executor357 Tainted: G W syzkaller #0 PREEMPT
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : ida_free+0x24c/0x2d4 lib/idr.c:594
lr : ida_free+0x24c/0x2d4 lib/idr.c:594
sp : ffff800094f27880
x29: ffff800094f27910 x28: 00000000000000cc x27: 1fffe0001aec2a11
x26: 00000000000000ed x25: dfff800000000000 x24: ffff800094f27880
x23: ffff7000129e4f10 x22: 0000000000000001 x21: 0000000000000000
x20: 00000000000000ed x19: 0000000000000000 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000001
x14: 00000000000008db x13: 0000000000000001 x12: ffff800123625000
x11: ffff0001ace79308 x10: 0000000000000001 x9 : b56adb3a1390ea00
x8 : b56adb3a1390ea00 x7 : ffff8000804a121c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80008030d4c8
x2 : 0000000100000000 x1 : ffff0000d8109d80 x0 : 0000000000000000
Call trace:
ida_free+0x24c/0x2d4 lib/idr.c:594 (P)
l2cap_chan_le_send_credits+0x17c/0x29c net/bluetooth/l2cap_core.c:7113
l2cap_chan_rx_avail+0xb4/0x134 net/bluetooth/l2cap_core.c:7126
l2cap_publish_rx_avail+0x110/0x168 net/bluetooth/l2cap_sock.c:-1
l2cap_sock_recvmsg+0x280/0x7b8 net/bluetooth/l2cap_sock.c:1317
sock_recvmsg_nosec net/socket.c:1154 [inline]
sock_recvmsg+0xd4/0x170 net/socket.c:1176
__sys_recvfrom+0x1ec/0x31c net/socket.c:2333
__do_sys_recvfrom net/socket.c:2348 [inline]
__se_sys_recvfrom net/socket.c:2344 [inline]
__arm64_sys_recvfrom+0xec/0x10c net/socket.c:2344
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797
el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
irq event stamp: 33428
hardirqs last enabled at (33427): [<ffff8000804a47b4>] vprintk_store+0x924/0xb94 kernel/printk/printk.c:2385
hardirqs last disabled at (33428): [<ffff800086954060>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:484
softirqs last enabled at (33408): [<ffff800084c8f174>] __alloc_skb+0x1c0/0x610 net/core/skbuff.c:699
softirqs last disabled at (33406): [<ffff800084c8f15c>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (33406): [<ffff800084c8f15c>] __alloc_skb+0x1a8/0x610 net/core/skbuff.c:698
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
ida_free called for id=166 which is not allocated.
WARNING: lib/idr.c:594 at ida_free+0x24c/0x2d4 lib/idr.c:594, CPU#0: syz-executor357/5073
Modules linked in:
CPU: 0 UID: 0 PID: 5073 Comm: syz-executor357 Tainted: G W syzkaller #0 PREEMPT
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : ida_free+0x24c/0x2d4 lib/idr.c:594
lr : ida_free+0x24c/0x2d4 lib/idr.c:594
sp : ffff800094f27880
x29: ffff800094f27910 x28: 00000000000000cc x27: 1fffe0001aec2a11
x26: 00000000000000a6 x25: dfff800000000000 x24: ffff800094f27880
x23: ffff7000129e4f10 x22: 0000000000000001 x21: 0000000000000000
x20: 00000000000000a6 x19: 0000000000000000 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000001
x14: 0000000000000926 x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: ffff70001135360e x9 : b56adb3a1390ea00
x8 : b56adb3a1390ea00 x7 : ffff8000804a121c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80008030d4c8
x2 : 0000000100000000 x1 : ffff0000d8109d80 x0 : 0000000000000000
Call trace:
ida_free+0x24c/0x2d4 lib/idr.c:594 (P)
l2cap_chan_le_send_credits+0x17c/0x29c net/bluetooth/l2cap_core.c:7113
l2cap_chan_rx_avail+0xb4/0x134 net/bluetooth/l2cap_core.c:7126
l2cap_publish_rx_avail+0x110/0x168 net/bluetooth/l2cap_sock.c:-1
l2cap_sock_recvmsg+0x280/0x7b8 net/bluetooth/l2cap_sock.c:1317
sock_recvmsg_nosec net/socket.c:1154 [inline]
sock_recvmsg+0xd4/0x170 net/socket.c:1176
__sys_recvfrom+0x1ec/0x31c net/socket.c:2333
__do_sys_recvfrom net/socket.c:2348 [inline]
__se_sys_recvfrom net/socket.c:2344 [inline]
__arm64_sys_recvfrom+0xec/0x10c net/socket.c:2344
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797
el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
irq event stamp: 53042
hardirqs last enabled at (53041): [<ffff8000804a47b4>] vprintk_store+0x924/0xb94 kernel/printk/printk.c:2385
hardirqs last disabled at (53042): [<ffff800086954060>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:484
softirqs last enabled at (53030): [<ffff800084c8f174>] __alloc_skb+0x1c0/0x610 net/core/skbuff.c:699
softirqs last disabled at (53028): [<ffff800084c8f15c>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (53028): [<ffff800084c8f15c>] __alloc_skb+0x1a8/0x610 net/core/skbuff.c:698
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
ida_free called for id=172 which is not allocated.
WARNING: lib/idr.c:594 at ida_free+0x24c/0x2d4 lib/idr.c:594, CPU#0: syz-executor357/5073
Modules linked in:
CPU: 0 UID: 0 PID: 5073 Comm: syz-executor357 Tainted: G W syzkaller #0 PREEMPT
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : ida_free+0x24c/0x2d4 lib/idr.c:594
lr : ida_free+0x24c/0x2d4 lib/idr.c:594
sp : ffff800094f27880
x29: ffff800094f27910 x28: 00000000000000cc x27: 1fffe0001aec2a11
x26: 00000000000000ac x25: dfff800000000000 x24: ffff800094f27880
x23: ffff7000129e4f10 x22: 0000000000000001 x21: 0000000000000000
x20: 00000000000000ac x19: 0000000000000000 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000001
x14: 0000000000000971 x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: ffff70001135360e x9 : b56adb3a1390ea00
x8 : b56adb3a1390ea00 x7 : ffff8000804a121c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80008030d4c8
x2 : 0000000100000000 x1 : ffff0000d8109d80 x0 : 0000000000000000
Call trace:
ida_free+0x24c/0x2d4 lib/idr.c:594 (P)
l2cap_chan_le_send_credits+0x17c/0x29c net/bluetooth/l2cap_core.c:7113
l2cap_chan_rx_avail+0xb4/0x134 net/bluetooth/l2cap_core.c:7126
l2cap_publish_rx_avail+0x110/0x168 net/bluetooth/l2cap_sock.c:-1
l2cap_sock_recvmsg+0x280/0x7b8 net/bluetooth/l2cap_sock.c:1317
sock_recvmsg_nosec net/socket.c:1154 [inline]
sock_recvmsg+0xd4/0x170 net/socket.c:1176
__sys_recvfrom+0x1ec/0x31c net/socket.c:2333
__do_sys_recvfrom net/socket.c:2348 [inline]
__se_sys_recvfrom net/socket.c:2344 [inline]
__arm64_sys_recvfrom+0xec/0x10c net/socket.c:2344
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797
el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
irq event stamp: 53782
hardirqs last enabled at (53781): [<ffff8000804a47b4>] vprintk_store+0x924/0xb94 kernel/printk/printk.c:2385
hardirqs last disabled at (53782): [<ffff800086954060>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:484
softirqs last enabled at (53770): [<ffff800084c8f174>] __alloc_skb+0x1c0/0x610 net/core/skbuff.c:699
softirqs last disabled at (53768): [<ffff800084c8f15c>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (53768): [<ffff800084c8f15c>] __alloc_skb+0x1a8/0x610 net/core/skbuff.c:698
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
ida_free called for id=224 which is not allocated.
WARNING: lib/idr.c:594 at ida_free+0x24c/0x2d4 lib/idr.c:594, CPU#0: syz-executor357/5073
Modules linked in:
CPU: 0 UID: 0 PID: 5073 Comm: syz-executor357 Tainted: G W syzkaller #0 PREEMPT
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : ida_free+0x24c/0x2d4 lib/idr.c:594
lr : ida_free+0x24c/0x2d4 lib/idr.c:594
sp : ffff800094f27880
x29: ffff800094f27910 x28: 00000000000000cc x27: 1fffe0001aec2a11
x26: 00000000000000e0 x25: dfff800000000000 x24: ffff800094f27880
x23: ffff7000129e4f10 x22: 0000000000000001 x21: 0000000000000000
x20: 00000000000000e0 x19: 0000000000000000 x18: ffff800123625000
x17: ffff0001ace95387 x16: ffff0000d8109d94 x15: 0000000000000001
x14: 00000000000009bc x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: ffff70001135360e x9 : b56adb3a1390ea00
x8 : b56adb3a1390ea00 x7 : ffff8000804a121c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80008030d4c8
x2 : 0000000100000000 x1 : ffff0000d8109d80 x0 : 0000000000000000
Call trace:
ida_free+0x24c/0x2d4 lib/idr.c:594 (P)
l2cap_chan_le_send_credits+0x17c/0x29c net/bluetooth/l2cap_core.c:7113
l2cap_chan_rx_avail+0xb4/0x134 net/bluetooth/l2cap_core.c:7126
l2cap_publish_rx_avail+0x110/0x168 net/bluetooth/l2cap_sock.c:-1
l2cap_sock_recvmsg+0x280/0x7b8 net/bluetooth/l2cap_sock.c:1317
sock_recvmsg_nosec net/socket.c:1154 [inline]
sock_recvmsg+0xd4/0x170 net/socket.c:1176
__sys_recvfrom+0x1ec/0x31c net/socket.c:2333
__do_sys_recvfrom net/socket.c:2348 [inline]
__se_sys_recvfrom net/socket.c:2344 [inline]
__arm64_sys_recvfrom+0xec/0x10c net/socket.c:2344
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797
el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
irq event stamp: 59336
hardirqs last enabled at (59335): [<ffff8000804a47b4>] vprintk_store+0x924/0xb94 kernel/printk/printk.c:2385
hardirqs last disabled at (59336): [<ffff800086954060>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:484
softirqs last enabled at (59316): [<ffff800084c8f174>] __alloc_skb+0x1c0/0x610 net/core/skbuff.c:699
softirqs last disabled at (59314): [<ffff800084c8f15c>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (59314): [<ffff800084c8f15c>] __alloc_skb+0x1a8/0x610 net/core/skbuff.c:698
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
ida_free called for id=239 which is not allocated.
WARNING: lib/idr.c:594 at ida_free+0x24c/0x2d4 lib/idr.c:594, CPU#0: syz-executor357/5073
Modules linked in:
CPU: 0 UID: 0 PID: 5073 Comm: syz-executor357 Tainted: G W syzkaller #0 PREEMPT
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : ida_free+0x24c/0x2d4 lib/idr.c:594
lr : ida_free+0x24c/0x2d4 lib/idr.c:594
sp : ffff800094f27880
x29: ffff800094f27910 x28: 00000000000000cc x27: 1fffe0001aec2a11
x26: 00000000000000ef x25: dfff800000000000 x24: ffff800094f27880
x23: ffff7000129e4f10 x22: 0000000000000001 x21: 0000000000000000
x20: 00000000000000ef x19: 0000000000000000 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000001
x14: 0000000000000a07 x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: ffff70001135360e x9 : b56adb3a1390ea00
x8 : b56adb3a1390ea00 x7 : ffff8000804a121c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80008030d4c8
x2 : 0000000100000000 x1 : ffff0000d8109d80 x0 : 0000000000000000
Call trace:
ida_free+0x24c/0x2d4 lib/idr.c:594 (P)
l2cap_chan_le_send_credits+0x17c/0x29c net/bluetooth/l2cap_core.c:7113
l2cap_chan_rx_avail+0xb4/0x134 net/bluetooth/l2cap_core.c:7126
l2cap_publish_rx_avail+0x110/0x168 net/bluetooth/l2cap_sock.c:-1
l2cap_sock_recvmsg+0x280/0x7b8 net/bluetooth/l2cap_sock.c:1317
sock_recvmsg_nosec net/socket.c:1154 [inline]
sock_recvmsg+0xd4/0x170 net/socket.c:1176
__sys_recvfrom+0x1ec/0x31c net/socket.c:2333
__do_sys_recvfrom net/socket.c:2348 [inline]
__se_sys_recvfrom net/socket.c:2344 [inline]
__arm64_sys_recvfrom+0xec/0x10c net/socket.c:2344
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797
el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
irq event stamp: 60986
hardirqs last enabled at (60985): [<ffff8000804a47b4>] vprintk_store+0x924/0xb94 kernel/printk/printk.c:2385
hardirqs last disabled at (60986): [<ffff800086954060>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:484
softirqs last enabled at (60974): [<ffff800084c8f174>] __alloc_skb+0x1c0/0x610 net/core/skbuff.c:699
softirqs last disabled at (60972): [<ffff800084c8f15c>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (60972): [<ffff800084c8f15c>] __alloc_skb+0x1a8/0x610 net/core/skbuff.c:698
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
ida_free called for id=6 which is not allocated.
WARNING: lib/idr.c:594 at ida_free+0x24c/0x2d4 lib/idr.c:594, CPU#0: syz-executor357/5073
Modules linked in:
CPU: 0 UID: 0 PID: 5073 Comm: syz-executor357 Tainted: G W syzkaller #0 PREEMPT
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : ida_free+0x24c/0x2d4 lib/idr.c:594
lr : ida_free+0x24c/0x2d4 lib/idr.c:594
sp : ffff800094f27880
x29: ffff800094f27910 x28: 00000000000000cc x27: 1fffe0001aec2a11
x26: 0000000000000006 x25: dfff800000000000 x24: ffff800094f27880
x23: ffff7000129e4f10 x22: 0000000000000001 x21: 0000000000000000
x20: 0000000000000006 x19: 0000000000000000 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000001
x14: 0000000000000a52 x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: ffff70001135360e x9 : b56adb3a1390ea00
x8 : b56adb3a1390ea00 x7 : ffff8000804a121c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80008030d4c8
x2 : 0000000100000000 x1 : ffff0000d8109d80 x0 : 0000000000000000
Call trace:
ida_free+0x24c/0x2d4 lib/idr.c:594 (P)
l2cap_chan_le_send_credits+0x17c/0x29c net/bluetooth/l2cap_core.c:7113
l2cap_chan_rx_avail+0xb4/0x134 net/bluetooth/l2cap_core.c:7126
l2cap_publish_rx_avail+0x110/0x168 net/bluetooth/l2cap_sock.c:-1
l2cap_sock_recvmsg+0x280/0x7b8 net/bluetooth/l2cap_sock.c:1317
sock_recvmsg_nosec net/socket.c:1154 [inline]
sock_recvmsg+0xd4/0x170 net/socket.c:1176
__sys_recvfrom+0x1ec/0x31c net/socket.c:2333
__do_sys_recvfrom net/socket.c:2348 [inline]
__se_sys_recvfrom net/socket.c:2344 [inline]
__arm64_sys_recvfrom+0xec/0x10c net/socket.c:2344
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797
el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
irq event stamp: 63392
hardirqs last enabled at (63391): [<ffff8000804a47b4>] vprintk_store+0x924/0xb94 kernel/printk/printk.c:2385
hardirqs last disabled at (63392): [<ffff800086954060>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:484
softirqs last enabled at (63380): [<ffff800084c8f174>] __alloc_skb+0x1c0/0x610 net/core/skbuff.c:699
softirqs last disabled at (63378): [<ffff800084c8f15c>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (63378): [<ffff800084c8f15c>] __alloc_skb+0x1a8/0x610 net/core/skbuff.c:698
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
ida_free called for id=109 which is not allocated.
WARNING: lib/idr.c:594 at ida_free+0x24c/0x2d4 lib/idr.c:594, CPU#0: syz-executor357/5073
Modules linked in:
CPU: 0 UID: 0 PID: 5073 Comm: syz-executor357 Tainted: G W syzkaller #0 PREEMPT
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : ida_free+0x24c/0x2d4 lib/idr.c:594
lr : ida_free+0x24c/0x2d4 lib/idr.c:594
sp : ffff800094f27880
x29: ffff800094f27910 x28: 00000000000000cc x27: 1fffe0001aec2a11
x26: 000000000000006d x25: dfff800000000000 x24: ffff800094f27880
x23: ffff7000129e4f10 x22: 0000000000000001 x21: 0000000000000000
x20: 000000000000006d x19: 0000000000000000 x18: 1fffe000359cf228
x17: 0000000000000003 x16: ffff8000898b7000 x15: ffff80008996b3e0
x14: 0000000000000a9d x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: ffff70001135360e x9 : b56adb3a1390ea00
x8 : b56adb3a1390ea00 x7 : ffff8000804a121c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80008030d4c8
x2 : 0000000100000000 x1 : ffff0000d8109d80 x0 : 0000000000000000
Call trace:
ida_free+0x24c/0x2d4 lib/idr.c:594 (P)
l2cap_chan_le_send_credits+0x17c/0x29c net/bluetooth/l2cap_core.c:7113
l2cap_chan_rx_avail+0xb4/0x134 net/bluetooth/l2cap_core.c:7126
l2cap_publish_rx_avail+0x110/0x168 net/bluetooth/l2cap_sock.c:-1
l2cap_sock_recvmsg+0x280/0x7b8 net/bluetooth/l2cap_sock.c:1317
sock_recvmsg_nosec net/socket.c:1154 [inline]
sock_recvmsg+0xd4/0x170 net/socket.c:1176
__sys_recvfrom+0x1ec/0x31c net/socket.c:2333
__do_sys_recvfrom net/socket.c:2348 [inline]
__se_sys_recvfrom net/socket.c:2344 [inline]
__arm64_sys_recvfrom+0xec/0x10c net/socket.c:2344
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797
el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
irq event stamp: 74376
hardirqs last enabled at (74375): [<ffff8000804a47b4>] vprintk_store+0x924/0xb94 kernel/printk/printk.c:2385
hardirqs last disabled at (74376): [<ffff800086954060>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:484
softirqs last enabled at (74346): [<ffff800084c8f174>] __alloc_skb+0x1c0/0x610 net/core/skbuff.c:699
softirqs last disabled at (74344): [<ffff800084c8f15c>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (74344): [<ffff800084c8f15c>] __alloc_skb+0x1a8/0x610 net/core/skbuff.c:698
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
ida_free called for id=24 which is not allocated.
WARNING: lib/idr.c:594 at ida_free+0x24c/0x2d4 lib/idr.c:594, CPU#0: syz-executor357/5073
Modules linked in:
CPU: 0 UID: 0 PID: 5073 Comm: syz-executor357 Tainted: G W syzkaller #0 PREEMPT
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : ida_free+0x24c/0x2d4 lib/idr.c:594
lr : ida_free+0x24c/0x2d4 lib/idr.c:594
sp : ffff800094f27880
x29: ffff800094f27910 x28: 00000000000000c2 x27: 1fffe0001aec2a11
x26: 0000000000000018 x25: dfff800000000000 x24: ffff800094f27880
x23: ffff7000129e4f10 x22: 0000000000000001 x21: 0000000000000000
x20: 0000000000000018 x19: 0000000000000000 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000001
x14: 0000000000000aea x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: ffff70001135360e x9 : b56adb3a1390ea00
x8 : b56adb3a1390ea00 x7 : ffff8000804a121c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80008030d4c8
x2 : 0000000100000000 x1 : ffff0000d8109d80 x0 : 0000000000000000
Call trace:
ida_free+0x24c/0x2d4 lib/idr.c:594 (P)
l2cap_chan_le_send_credits+0x17c/0x29c net/bluetooth/l2cap_core.c:7113
l2cap_chan_rx_avail+0xb4/0x134 net/bluetooth/l2cap_core.c:7126
l2cap_publish_rx_avail+0x110/0x168 net/bluetooth/l2cap_sock.c:-1
l2cap_sock_recvmsg+0x280/0x7b8 net/bluetooth/l2cap_sock.c:1317
sock_recvmsg_nosec net/socket.c:1154 [inline]
sock_recvmsg+0xd4/0x170 net/socket.c:1176
__sys_recvfrom+0x1ec/0x31c net/socket.c:2333
__do_sys_recvfrom net/socket.c:2348 [inline]
__se_sys_recvfrom net/socket.c:2344 [inline]
__arm64_sys_recvfrom+0xec/0x10c net/socket.c:2344
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797
el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
irq event stamp: 142656
hardirqs last enabled at (142655): [<ffff8000804a47b4>] vprintk_store+0x924/0xb94 kernel/printk/printk.c:2385
hardirqs last disabled at (142656): [<ffff800086954060>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:484
softirqs last enabled at (142644): [<ffff800084c8f174>] __alloc_skb+0x1c0/0x610 net/core/skbuff.c:699
softirqs last disabled at (142642): [<ffff800084c8f15c>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (142642): [<ffff800084c8f15c>] __alloc_skb+0x1a8/0x610 net/core/skbuff.c:698
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
ida_free called for id=156 which is not allocated.
WARNING: lib/idr.c:594 at ida_free+0x24c/0x2d4 lib/idr.c:594, CPU#0: syz-executor357/5073
Modules linked in:
CPU: 0 UID: 0 PID: 5073 Comm: syz-executor357 Tainted: G W syzkaller #0 PREEMPT
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : ida_free+0x24c/0x2d4 lib/idr.c:594
lr : ida_free+0x24c/0x2d4 lib/idr.c:594
sp : ffff800094f27880
x29: ffff800094f27910 x28: 00000000000000be x27: 1fffe0001aec2a11
x26: 000000000000009c x25: dfff800000000000 x24: ffff800094f27880
x23: ffff7000129e4f10 x22: 0000000000000001 x21: 0000000000000000
x20: 000000000000009c x19: 0000000000000000 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000001
x14: 0000000000000b35 x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: ffff70001135360e x9 : b56adb3a1390ea00
x8 : b56adb3a1390ea00 x7 : ffff8000804a121c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80008030d4c8
x2 : 0000000100000000 x1 : ffff0000d8109d80 x0 : 0000000000000000
Call trace:
ida_free+0x24c/0x2d4 lib/idr.c:594 (P)
l2cap_chan_le_send_credits+0x17c/0x29c net/bluetooth/l2cap_core.c:7113
l2cap_chan_rx_avail+0xb4/0x134 net/bluetooth/l2cap_core.c:7126
l2cap_publish_rx_avail+0x110/0x168 net/bluetooth/l2cap_sock.c:-1
l2cap_sock_recvmsg+0x280/0x7b8 net/bluetooth/l2cap_sock.c:1317
sock_recvmsg_nosec net/socket.c:1154 [inline]
sock_recvmsg+0xd4/0x170 net/socket.c:1176
__sys_recvfrom+0x1ec/0x31c net/socket.c:2333
__do_sys_recvfrom net/socket.c:2348 [inline]
__se_sys_recvfrom net/socket.c:2344 [inline]
__arm64_sys_recvfrom+0xec/0x10c net/socket.c:2344
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797
el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
irq event stamp: 158266
hardirqs last enabled at (158265): [<ffff8000804a47b4>] vprintk_store+0x924/0xb94 kernel/printk/printk.c:2385
hardirqs last disabled at (158266): [<ffff800086954060>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:484
softirqs last enabled at (158254): [<ffff800084c8f174>] __alloc_skb+0x1c0/0x610 net/core/skbuff.c:699
softirqs last disabled at (158252): [<ffff800084c8f15c>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (158252): [<ffff800084c8f15c>] __alloc_skb+0x1a8/0x610 net/core/skbuff.c:698
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
ida_free called for id=180 which is not allocated.
WARNING: lib/idr.c:594 at ida_free+0x24c/0x2d4 lib/idr.c:594, CPU#0: syz-executor357/5073
Modules linked in:
CPU: 0 UID: 0 PID: 5073 Comm: syz-executor357 Tainted: G W syzkaller #0 PREEMPT
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : ida_free+0x24c/0x2d4 lib/idr.c:594
lr : ida_free+0x24c/0x2d4 lib/idr.c:594
sp : ffff800094f27880
x29: ffff800094f27910 x28: 00000000000000b9 x27: 1fffe0001aec2a11
x26: 00000000000000b4 x25: dfff800000000000 x24: ffff800094f27880
x23: ffff7000129e4f10 x22: 0000000000000001 x21: 0000000000000000
x20: 00000000000000b4 x19: 0000000000000000 x18: 1fffe000359cf228
x17: 0000000000000003 x16: ffff8000898b7000 x15: ffff80008996b3e0
x14: 0000000000000b80 x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: ffff70001135360e x9 : b56adb3a1390ea00
x8 : b56adb3a1390ea00 x7 : ffff8000804a121c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80008030d4c8
x2 : 0000000100000000 x1 : ffff0000d8109d80 x0 : 0000000000000000
Call trace:
ida_free+0x24c/0x2d4 lib/idr.c:594 (P)
l2cap_chan_le_send_credits+0x17c/0x29c net/bluetooth/l2cap_core.c:7113
l2cap_chan_rx_avail+0xb4/0x134 net/bluetooth/l2cap_core.c:7126
l2cap_publish_rx_avail+0x110/0x168 net/bluetooth/l2cap_sock.c:-1
l2cap_sock_recvmsg+0x280/0x7b8 net/bluetooth/l2cap_sock.c:1317
sock_recvmsg_nosec net/socket.c:1154 [inline]
sock_recvmsg+0xd4/0x170 net/socket.c:1176
__sys_recvfrom+0x1ec/0x31c net/socket.c:2333
__do_sys_recvfrom net/socket.c:2348 [inline]
__se_sys_recvfrom net/socket.c:2344 [inline]
__arm64_sys_recvfrom+0xec/0x10c net/socket.c:2344
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797
el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
irq event stamp: 161840
hardirqs last enabled at (161839): [<ffff8000804a47b4>] vprintk_store+0x924/0xb94 kernel/printk/printk.c:2385
hardirqs last disabled at (161840): [<ffff800086954060>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:484
softirqs last enabled at (161824): [<ffff800084c8f174>] __alloc_skb+0x1c0/0x610 net/core/skbuff.c:699
softirqs last disabled at (161822): [<ffff800084c8f15c>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (161822): [<ffff800084c8f15c>] __alloc_skb+0x1a8/0x610 net/core/skbuff.c:698
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
ida_free called for id=137 which is not allocated.
WARNING: lib/idr.c:594 at ida_free+0x24c/0x2d4 lib/idr.c:594, CPU#0: syz-executor357/5073
Modules linked in:
CPU: 0 UID: 0 PID: 5073 Comm: syz-executor357 Tainted: G W syzkaller #0 PREEMPT
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : ida_free+0x24c/0x2d4 lib/idr.c:594
lr : ida_free+0x24c/0x2d4 lib/idr.c:594
sp : ffff800094f27880
x29: ffff800094f27910 x28: 00000000000000b9 x27: 1fffe0001aec2a11
x26: 0000000000000089 x25: dfff800000000000 x24: ffff800094f27880
x23: ffff7000129e4f10 x22: 0000000000000001 x21: 0000000000000000
x20: 0000000000000089 x19: 0000000000000000 x18: ffff800123625000
x17: ffff0001ace95387 x16: ffff0000d8109d94 x15: 0000000000000001
x14: 0000000000000bcb x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: ffff70001135360e x9 : b56adb3a1390ea00
x8 : b56adb3a1390ea00 x7 : ffff8000804a121c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80008030d4c8
x2 : 0000000100000000 x1 : ffff0000d8109d80 x0 : 0000000000000000
Call trace:
ida_free+0x24c/0x2d4 lib/idr.c:594 (P)
l2cap_chan_le_send_credits+0x17c/0x29c net/bluetooth/l2cap_core.c:7113
l2cap_chan_rx_avail+0xb4/0x134 net/bluetooth/l2cap_core.c:7126
l2cap_publish_rx_avail+0x110/0x168 net/bluetooth/l2cap_sock.c:-1
l2cap_sock_recvmsg+0x280/0x7b8 net/bluetooth/l2cap_sock.c:1317
sock_recvmsg_nosec net/socket.c:1154 [inline]
sock_recvmsg+0xd4/0x170 net/socket.c:1176
__sys_recvfrom+0x1ec/0x31c net/socket.c:2333
__do_sys_recvfrom net/socket.c:2348 [inline]
__se_sys_recvfrom net/socket.c:2344 [inline]
__arm64_sys_recvfrom+0xec/0x10c net/socket.c:2344
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797
el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
irq event stamp: 204974
hardirqs last enabled at (204973): [<ffff8000804a47b4>] vprintk_store+0x924/0xb94 kernel/printk/printk.c:2385
hardirqs last disabled at (204974): [<ffff800086954060>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:484
softirqs last enabled at (204956): [<ffff800084c8f174>] __alloc_skb+0x1c0/0x610 net/core/skbuff.c:699
softirqs last disabled at (204954): [<ffff800084c8f15c>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (204954): [<ffff800084c8f15c>] __alloc_skb+0x1a8/0x610 net/core/skbuff.c:698
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
ida_free called for id=132 which is not allocated.
WARNING: lib/idr.c:594 at ida_free+0x24c/0x2d4 lib/idr.c:594, CPU#0: syz-executor357/5073
Modules linked in:
CPU: 0 UID: 0 PID: 5073 Comm: syz-executor357 Tainted: G W syzkaller #0 PREEMPT
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : ida_free+0x24c/0x2d4 lib/idr.c:594
lr : ida_free+0x24c/0x2d4 lib/idr.c:594
sp : ffff800094f27880
x29: ffff800094f27910 x28: 00000000000000b5 x27: 1fffe0001aec2a11
x26: 0000000000000084 x25: dfff800000000000 x24: ffff800094f27880
x23: ffff7000129e4f10 x22: 0000000000000001 x21: 0000000000000000
x20: 0000000000000084 x19: 0000000000000000 x18: 1fffe000359cf228
x17: 0000000000000003 x16: ffff8000898b7000 x15: 0000000000000001
x14: 0000000000000c17 x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: ffff70001135360e x9 : b56adb3a1390ea00
x8 : b56adb3a1390ea00 x7 : ffff8000804a121c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80008030d4c8
x2 : 0000000100000000 x1 : ffff0000d8109d80 x0 : 0000000000000000
Call trace:
ida_free+0x24c/0x2d4 lib/idr.c:594 (P)
l2cap_chan_le_send_credits+0x17c/0x29c net/bluetooth/l2cap_core.c:7113
l2cap_chan_rx_avail+0xb4/0x134 net/bluetooth/l2cap_core.c:7126
l2cap_publish_rx_avail+0x110/0x168 net/bluetooth/l2cap_sock.c:-1
l2cap_sock_recvmsg+0x280/0x7b8 net/bluetooth/l2cap_sock.c:1317
sock_recvmsg_nosec net/socket.c:1154 [inline]
sock_recvmsg+0xd4/0x170 net/socket.c:1176
__sys_recvfrom+0x1ec/0x31c net/socket.c:2333
__do_sys_recvfrom net/socket.c:2348 [inline]
__se_sys_recvfrom net/socket.c:2344 [inline]
__arm64_sys_recvfrom+0xec/0x10c net/socket.c:2344
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797
el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
irq event stamp: 253844
hardirqs last enabled at (253843): [<ffff8000804a47b4>] vprintk_store+0x924/0xb94 kernel/printk/printk.c:2385
hardirqs last disabled at (253844): [<ffff800086954060>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:484
softirqs last enabled at (253832): [<ffff800084c8f174>] __alloc_skb+0x1c0/0x610 net/core/skbuff.c:699
softirqs last disabled at (253830): [<ffff800084c8f15c>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (253830): [<ffff800084c8f15c>] __alloc_skb+0x1a8/0x610 net/core/skbuff.c:698
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
ida_free called for id=233 which is not allocated.
WARNING: lib/idr.c:594 at ida_free+0x24c/0x2d4 lib/idr.c:594, CPU#0: syz-executor357/5073
Modules linked in:
CPU: 0 UID: 0 PID: 5073 Comm: syz-executor357 Tainted: G W syzkaller #0 PREEMPT
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : ida_free+0x24c/0x2d4 lib/idr.c:594
lr : ida_free+0x24c/0x2d4 lib/idr.c:594
sp : ffff800094f27880
x29: ffff800094f27910 x28: 00000000000000b5 x27: 1fffe0001aec2a11
x26: 00000000000000e9 x25: dfff800000000000 x24: ffff800094f27880
x23: ffff7000129e4f10 x22: 0000000000000001 x21: 0000000000000000
x20: 00000000000000e9 x19: 0000000000000000 x18: ffff800123625000
x17: ffff0001ace95387 x16: ffff0000d8109d94 x15: 0000000000000001
x14: 0000000000000c62 x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: ffff70001135360e x9 : b56adb3a1390ea00
x8 : b56adb3a1390ea00 x7 : ffff8000804a121c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80008030d4c8
x2 : 0000000100000000 x1 : ffff0000d8109d80 x0 : 0000000000000000
Call trace:
ida_free+0x24c/0x2d4 lib/idr.c:594 (P)
l2cap_chan_le_send_credits+0x17c/0x29c net/bluetooth/l2cap_core.c:7113
l2cap_chan_rx_avail+0xb4/0x134 net/bluetooth/l2cap_core.c:7126
l2cap_publish_rx_avail+0x110/0x168 net/bluetooth/l2cap_sock.c:-1
l2cap_sock_recvmsg+0x280/0x7b8 net/bluetooth/l2cap_sock.c:1317
sock_recvmsg_nosec net/socket.c:1154 [inline]
sock_recvmsg+0xd4/0x170 net/socket.c:1176
__sys_recvfrom+0x1ec/0x31c net/socket.c:2333
__do_sys_recvfrom net/socket.c:2348 [inline]
__se_sys_recvfrom net/socket.c:2344 [inline]
__arm64_sys_recvfrom+0xec/0x10c net/socket.c:2344
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797
el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
irq event stamp: 288938
hardirqs last enabled at (288937): [<ffff8000804a47b4>] vprintk_store+0x924/0xb94 kernel/printk/printk.c:2385
hardirqs last disabled at (288938): [<ffff800086954060>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:484
softirqs last enabled at (288918): [<ffff800084c8f174>] __alloc_skb+0x1c0/0x610 net/core/skbuff.c:699
softirqs last disabled at (288916): [<ffff800084c8f15c>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (288916): [<ffff800084c8f15c>] __alloc_skb+0x1a8/0x610 net/core/skbuff.c:698
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
ida_free called for id=24 which is not allocated.
WARNING: lib/idr.c:594 at ida_free+0x24c/0x2d4 lib/idr.c:594, CPU#0: syz-executor357/5073
Modules linked in:
CPU: 0 UID: 0 PID: 5073 Comm: syz-executor357 Tainted: G W syzkaller #0 PREEMPT
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : ida_free+0x24c/0x2d4 lib/idr.c:594
lr : ida_free+0x24c/0x2d4 lib/idr.c:594
sp : ffff800094f27880
x29: ffff800094f27910 x28: 00000000000000b7 x27: 1fffe0001aec2a11
x26: 0000000000000018 x25: dfff800000000000 x24: ffff800094f27880
x23: ffff7000129e4f10 x22: 0000000000000001 x21: 0000000000000000
x20: 0000000000000018 x19: 0000000000000000 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000001
x14: 0000000000000cad x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: ffff70001135360e x9 : b56adb3a1390ea00
x8 : b56adb3a1390ea00 x7 : ffff8000804a121c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80008030d4c8
x2 : 0000000100000000 x1 : ffff0000d8109d80 x0 : 0000000000000000
Call trace:
ida_free+0x24c/0x2d4 lib/idr.c:594 (P)
l2cap_chan_le_send_credits+0x17c/0x29c net/bluetooth/l2cap_core.c:7113
l2cap_chan_rx_avail+0xb4/0x134 net/bluetooth/l2cap_core.c:7126
l2cap_publish_rx_avail+0x110/0x168 net/bluetooth/l2cap_sock.c:-1
l2cap_sock_recvmsg+0x280/0x7b8 net/bluetooth/l2cap_sock.c:1317
sock_recvmsg_nosec net/socket.c:1154 [inline]
sock_recvmsg+0xd4/0x170 net/socket.c:1176
__sys_recvfrom+0x1ec/0x31c net/socket.c:2333
__do_sys_recvfrom net/socket.c:2348 [inline]
__se_sys_recvfrom net/socket.c:2344 [inline]
__arm64_sys_recvfrom+0xec/0x10c net/socket.c:2344
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797
el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
irq event stamp: 293428
hardirqs last enabled at (293427): [<ffff8000804a47b4>] vprintk_store+0x924/0xb94 kernel/printk/printk.c:2385
hardirqs last disabled at (293428): [<ffff800086954060>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:484
softirqs last enabled at (293416): [<ffff800084c8f174>] __alloc_skb+0x1c0/0x610 net/core/skbuff.c:699
softirqs last disabled at (293414): [<ffff800084c8f15c>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (293414): [<ffff800084c8f15c>] __alloc_skb+0x1a8/0x610 net/core/skbuff.c:698
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
ida_free called for id=67 which is not allocated.
WARNING: lib/idr.c:594 at ida_free+0x24c/0x2d4 lib/idr.c:594, CPU#0: syz-executor357/5073
Modules linked in:
CPU: 0 UID: 0 PID: 5073 Comm: syz-executor357 Tainted: G W syzkaller #0 PREEMPT
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : ida_free+0x24c/0x2d4 lib/idr.c:594
lr : ida_free+0x24c/0x2d4 lib/idr.c:594
sp : ffff800094f27880
x29: ffff800094f27910 x28: 00000000000000b4 x27: 1fffe0001aec2a11
x26: 0000000000000043 x25: dfff800000000000 x24: ffff800094f27880
x23: ffff7000129e4f10 x22: 0000000000000001 x21: 0000000000000000
x20: 0000000000000043 x19: 0000000000000000 x18: 1fffe000359cf228
x17: 0000000000000003 x16: ffff8000898b7000 x15: ffff80008996b3e0
x14: 0000000000000cf8 x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: ffff70001135360e x9 : b56adb3a1390ea00
x8 : b56adb3a1390ea00 x7 : ffff8000804a121c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80008030d4c8
x2 : 0000000100000000 x1 : ffff0000d8109d80 x0 : 0000000000000000
Call trace:
ida_free+0x24c/0x2d4 lib/idr.c:594 (P)
l2cap_chan_le_send_credits+0x17c/0x29c net/bluetooth/l2cap_core.c:7113
l2cap_chan_rx_avail+0xb4/0x134 net/bluetooth/l2cap_core.c:7126
l2cap_publish_rx_avail+0x110/0x168 net/bluetooth/l2cap_sock.c:-1
l2cap_sock_recvmsg+0x280/0x7b8 net/bluetooth/l2cap_sock.c:1317
sock_recvmsg_nosec net/socket.c:1154 [inline]
sock_recvmsg+0xd4/0x170 net/socket.c:1176
__sys_recvfrom+0x1ec/0x31c net/socket.c:2333
__do_sys_recvfrom net/socket.c:2348 [inline]
__se_sys_recvfrom net/socket.c:2344 [inline]
__arm64_sys_recvfrom+0xec/0x10c net/socket.c:2344
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797
el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
irq event stamp: 298612
hardirqs last enabled at (298611): [<ffff8000804a47b4>] vprintk_store+0x924/0xb94 kernel/printk/printk.c:2385
hardirqs last disabled at (298612): [<ffff800086954060>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:484
softirqs last enabled at (298596): [<ffff800084c8f174>] __alloc_skb+0x1c0/0x610 net/core/skbuff.c:699
softirqs last disabled at (298594): [<ffff800084c8f15c>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (298594): [<ffff800084c8f15c>] __alloc_skb+0x1a8/0x610 net/core/skbuff.c:698
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
ida_free called for id=69 which is not allocated.
WARNING: lib/idr.c:594 at ida_free+0x24c/0x2d4 lib/idr.c:594, CPU#0: syz-executor357/5073
Modules l
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-11-15 4:46 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-11-13 23:38 [syzbot] [bluetooth?] WARNING in l2cap_chan_le_send_credits syzbot
2026-11-15 4:46 ` syzbot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.