Extracting prog: 7m35.330472924s
Minimizing prog: 52m36.19025919s
Simplifying prog options: 15m29.13235021s
Extracting C: 5m9.189130775s
Simplifying C: 0s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-syz_open_dev$tty1-dup-syz_open_procfs-mount$9p_fd
detailed listing:
executing program 0:
openat(0xffffffffffffff9c, 0x0, 0x40140, 0x0)
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = dup(r0)
r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
mount$9p_fd(0x0, &(0x7f0000000140)='.\x00', &(0x7f0000000180), 0x0, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}})

program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-syz_open_dev$tty1-dup-syz_open_procfs-mount$9p_fd
detailed listing:
executing program 0:
openat(0xffffffffffffff9c, 0x0, 0x40140, 0x0)
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = dup(r0)
r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
mount$9p_fd(0x0, &(0x7f0000000140)='.\x00', &(0x7f0000000180), 0x0, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}})

program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-syz_open_dev$tty1-dup-syz_open_procfs-mount$9p_fd
detailed listing:
executing program 0:
openat(0xffffffffffffff9c, 0x0, 0x40140, 0x0)
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = dup(r0)
r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
mount$9p_fd(0x0, &(0x7f0000000140)='.\x00', &(0x7f0000000180), 0x0, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}})

program crashed: BUG: MAX_LOCKDEP_CHAINS too low!
single: successfully extracted reproducer
found reproducer with 5 syscalls
minimizing guilty program
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-syz_open_dev$tty1-dup-syz_open_procfs
detailed listing:
executing program 0:
openat(0xffffffffffffff9c, 0x0, 0x40140, 0x0)
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
dup(r0)
syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-syz_open_dev$tty1-dup-mount$9p_fd
detailed listing:
executing program 0:
openat(0xffffffffffffff9c, 0x0, 0x40140, 0x0)
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = dup(r0)
mount$9p_fd(0x0, &(0x7f0000000140)='.\x00', &(0x7f0000000180), 0x0, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r1}})

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-syz_open_dev$tty1-syz_open_procfs-mount$9p_fd
detailed listing:
executing program 0:
openat(0xffffffffffffff9c, 0x0, 0x40140, 0x0)
syz_open_dev$tty1(0xc, 0x4, 0x1)
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
mount$9p_fd(0x0, &(0x7f0000000140)='.\x00', &(0x7f0000000180), 0x0, &(0x7f0000000300)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}})

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-dup-syz_open_procfs-mount$9p_fd
detailed listing:
executing program 0:
openat(0xffffffffffffff9c, 0x0, 0x40140, 0x0)
r0 = dup(0xffffffffffffffff)
r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
mount$9p_fd(0x0, &(0x7f0000000140)='.\x00', &(0x7f0000000180), 0x0, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-dup-syz_open_procfs-mount$9p_fd
detailed listing:
executing program 0:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = dup(r0)
r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
mount$9p_fd(0x0, &(0x7f0000000140)='.\x00', &(0x7f0000000180), 0x0, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}})

program crashed: BUG: MAX_LOCKDEP_CHAINS too low!
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-dup-syz_open_procfs-mount$9p_fd
detailed listing:
executing program 0:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = dup(r0)
r2 = syz_open_procfs(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='.\x00', &(0x7f0000000180), 0x0, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}})

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-dup-syz_open_procfs-mount$9p_fd
detailed listing:
executing program 0:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = dup(r0)
r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
mount$9p_fd(0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}})

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-dup-syz_open_procfs-mount$9p_fd
detailed listing:
executing program 0:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = dup(r0)
r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
mount$9p_fd(0x0, &(0x7f0000000140)='.\x00', 0x0, 0x0, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}})

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-dup-syz_open_procfs-mount$9p_fd
detailed listing:
executing program 0:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
dup(r0)
syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
mount$9p_fd(0x0, &(0x7f0000000140)='.\x00', &(0x7f0000000180), 0x0, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-dup-syz_open_procfs-mount$9p_fd
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
simplifying guilty program options
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-dup-syz_open_procfs-mount$9p_fd
detailed listing:
executing program 0:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = dup(r0)
r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
mount$9p_fd(0x0, &(0x7f0000000140)='.\x00', &(0x7f0000000180), 0x0, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}})

program crashed: BUG: MAX_LOCKDEP_CHAINS too low!
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-dup-syz_open_procfs-mount$9p_fd
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-dup-syz_open_procfs-mount$9p_fd
detailed listing:
executing program 0:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = dup(r0)
r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
mount$9p_fd(0x0, &(0x7f0000000140)='.\x00', &(0x7f0000000180), 0x0, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}})

program did not crash
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-dup-syz_open_procfs-mount$9p_fd
detailed listing:
executing program 0:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = dup(r0)
r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
mount$9p_fd(0x0, &(0x7f0000000140)='.\x00', &(0x7f0000000180), 0x0, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}})

program crashed: BUG: MAX_LOCKDEP_CHAINS too low!
validation run: crashed=true
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-dup-syz_open_procfs-mount$9p_fd
detailed listing:
executing program 0:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = dup(r0)
r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
mount$9p_fd(0x0, &(0x7f0000000140)='.\x00', &(0x7f0000000180), 0x0, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}})

program crashed: BUG: MAX_LOCKDEP_CHAINS too low!
validation run: crashed=true
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-dup-syz_open_procfs-mount$9p_fd
detailed listing:
executing program 0:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = dup(r0)
r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
mount$9p_fd(0x0, &(0x7f0000000140)='.\x00', &(0x7f0000000180), 0x0, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}})

program crashed: BUG: MAX_LOCKDEP_CHAINS too low!
validation run: crashed=true
reproducing took 1h33m43.566735782s
repro crashed as (corrupted=false):
Bluetooth: hci60: command 0x0419 tx timeout
BUG: MAX_LOCKDEP_CHAINS too low!
turning off the locking correctness validator.
CPU: 1 PID: 4412 Comm: kworker/u5:1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026
Workqueue: hci61 hci_power_on
Call trace:
 dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 dump_stack+0x1c/0x5c lib/dump_stack.c:113
 add_chain_cache kernel/locking/lockdep.c:-1 [inline]
 lookup_chain_cache_add kernel/locking/lockdep.c:3844 [inline]
 validate_chain kernel/locking/lockdep.c:3865 [inline]
 __lock_acquire+0x2618/0x7280 kernel/locking/lockdep.c:5171
 lock_acquire+0x210/0x63c kernel/locking/lockdep.c:5790
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x6c/0xb0 kernel/locking/spinlock.c:162
 debug_object_activate+0x78/0x4c0 lib/debugobjects.c:747
 debug_work_activate kernel/workqueue.c:510 [inline]
 __queue_work+0xcec/0x1280 kernel/workqueue.c:1519
 queue_work_on+0xc0/0x164 kernel/workqueue.c:1548
 queue_work include/linux/workqueue.h:515 [inline]
 hci_req_sync_run net/bluetooth/hci_sync.c:139 [inline]
 __hci_cmd_sync_sk+0x570/0xd4c net/bluetooth/hci_sync.c:168
 __hci_cmd_sync_status_sk net/bluetooth/hci_sync.c:259 [inline]
 __hci_cmd_sync_status net/bluetooth/hci_sync.c:283 [inline]
 hci_reset_sync+0x5c/0x164 net/bluetooth/hci_sync.c:3711
 hci_init1_sync net/bluetooth/hci_sync.c:3797 [inline]
 hci_init_sync net/bluetooth/hci_sync.c:4889 [inline]
 hci_dev_init_sync net/bluetooth/hci_sync.c:5073 [inline]
 hci_dev_open_sync+0xdf8/0x29f4 net/bluetooth/hci_sync.c:5151
 hci_dev_do_open net/bluetooth/hci_core.c:452 [inline]
 hci_power_on+0x14c/0x600 net/bluetooth/hci_core.c:953
 process_one_work+0x7e4/0x13bc kernel/workqueue.c:2292
 worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439
 kthread+0x254/0x2e0 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850
Bluetooth: hci61: command 0x0409 tx timeout
Bluetooth: hci62: unexpected cc 0x0c03 length: 249 > 1
Bluetooth: hci62: unexpected cc 0x1003 length: 249 > 9
Bluetooth: hci62: unexpected cc 0x1001 length: 249 > 9
Bluetooth: hci62: unexpected cc 0x0c23 length: 249 > 4
Bluetooth: hci62: unexpected cc 0x0c25 length: 249 > 3
Bluetooth: hci62: unexpected cc 0x0c38 length: 249 > 2
Bluetooth: hci61: command 0x041b tx timeout
Bluetooth: hci29: command 0x0406 tx timeout
Bluetooth: hci30: command 0x0406 tx timeout
Bluetooth: hci62: command 0x0409 tx timeout
Bluetooth: hci63: command 0x0409 tx timeout
Bluetooth: hci64: unexpected cc 0x0c03 length: 249 > 1
Bluetooth: hci64: unexpected cc 0x1003 length: 249 > 9
Bluetooth: hci64: unexpected cc 0x1001 length: 249 > 9
Bluetooth: hci64: unexpected cc 0x0c23 length: 249 > 4
Bluetooth: hci64: unexpected cc 0x0c25 length: 249 > 3
Bluetooth: hci64: unexpected cc 0x0c38 length: 249 > 2
Bluetooth: hci61: command 0x0419 tx timeout
Bluetooth: hci65: unexpected cc 0x0c03 length: 249 > 1
Bluetooth: hci65: unexpected cc 0x1003 length: 249 > 9
Bluetooth: hci65: unexpected cc 0x1001 length: 249 > 9
Bluetooth: hci65: unexpected cc 0x0c23 length: 249 > 4
Bluetooth: hci65: unexpected cc 0x0c25 length: 249 > 3
Bluetooth: hci65: unexpected cc 0x0c38 length: 249 > 2
Bluetooth: hci63: command 0x041b tx timeout
Bluetooth: hci65: command 0x0409 tx timeout
Bluetooth: hci64: command 0x041b tx timeout

final repro crashed as (corrupted=false):
Bluetooth: hci60: command 0x0419 tx timeout
BUG: MAX_LOCKDEP_CHAINS too low!
turning off the locking correctness validator.
CPU: 1 PID: 4412 Comm: kworker/u5:1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026
Workqueue: hci61 hci_power_on
Call trace:
 dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 dump_stack+0x1c/0x5c lib/dump_stack.c:113
 add_chain_cache kernel/locking/lockdep.c:-1 [inline]
 lookup_chain_cache_add kernel/locking/lockdep.c:3844 [inline]
 validate_chain kernel/locking/lockdep.c:3865 [inline]
 __lock_acquire+0x2618/0x7280 kernel/locking/lockdep.c:5171
 lock_acquire+0x210/0x63c kernel/locking/lockdep.c:5790
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x6c/0xb0 kernel/locking/spinlock.c:162
 debug_object_activate+0x78/0x4c0 lib/debugobjects.c:747
 debug_work_activate kernel/workqueue.c:510 [inline]
 __queue_work+0xcec/0x1280 kernel/workqueue.c:1519
 queue_work_on+0xc0/0x164 kernel/workqueue.c:1548
 queue_work include/linux/workqueue.h:515 [inline]
 hci_req_sync_run net/bluetooth/hci_sync.c:139 [inline]
 __hci_cmd_sync_sk+0x570/0xd4c net/bluetooth/hci_sync.c:168
 __hci_cmd_sync_status_sk net/bluetooth/hci_sync.c:259 [inline]
 __hci_cmd_sync_status net/bluetooth/hci_sync.c:283 [inline]
 hci_reset_sync+0x5c/0x164 net/bluetooth/hci_sync.c:3711
 hci_init1_sync net/bluetooth/hci_sync.c:3797 [inline]
 hci_init_sync net/bluetooth/hci_sync.c:4889 [inline]
 hci_dev_init_sync net/bluetooth/hci_sync.c:5073 [inline]
 hci_dev_open_sync+0xdf8/0x29f4 net/bluetooth/hci_sync.c:5151
 hci_dev_do_open net/bluetooth/hci_core.c:452 [inline]
 hci_power_on+0x14c/0x600 net/bluetooth/hci_core.c:953
 process_one_work+0x7e4/0x13bc kernel/workqueue.c:2292
 worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439
 kthread+0x254/0x2e0 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850
Bluetooth: hci61: command 0x0409 tx timeout
Bluetooth: hci62: unexpected cc 0x0c03 length: 249 > 1
Bluetooth: hci62: unexpected cc 0x1003 length: 249 > 9
Bluetooth: hci62: unexpected cc 0x1001 length: 249 > 9
Bluetooth: hci62: unexpected cc 0x0c23 length: 249 > 4
Bluetooth: hci62: unexpected cc 0x0c25 length: 249 > 3
Bluetooth: hci62: unexpected cc 0x0c38 length: 249 > 2
Bluetooth: hci61: command 0x041b tx timeout
Bluetooth: hci29: command 0x0406 tx timeout
Bluetooth: hci30: command 0x0406 tx timeout
Bluetooth: hci62: command 0x0409 tx timeout
Bluetooth: hci63: command 0x0409 tx timeout
Bluetooth: hci64: unexpected cc 0x0c03 length: 249 > 1
Bluetooth: hci64: unexpected cc 0x1003 length: 249 > 9
Bluetooth: hci64: unexpected cc 0x1001 length: 249 > 9
Bluetooth: hci64: unexpected cc 0x0c23 length: 249 > 4
Bluetooth: hci64: unexpected cc 0x0c25 length: 249 > 3
Bluetooth: hci64: unexpected cc 0x0c38 length: 249 > 2
Bluetooth: hci61: command 0x0419 tx timeout
Bluetooth: hci65: unexpected cc 0x0c03 length: 249 > 1
Bluetooth: hci65: unexpected cc 0x1003 length: 249 > 9
Bluetooth: hci65: unexpected cc 0x1001 length: 249 > 9
Bluetooth: hci65: unexpected cc 0x0c23 length: 249 > 4
Bluetooth: hci65: unexpected cc 0x0c25 length: 249 > 3
Bluetooth: hci65: unexpected cc 0x0c38 length: 249 > 2
Bluetooth: hci63: command 0x041b tx timeout
Bluetooth: hci65: command 0x0409 tx timeout
Bluetooth: hci64: command 0x041b tx timeout