Kernel Oops happened in hci_send_acl() in Linux

[wangtao13]

I hit a kernel oops in Linux-5.10.150 as follows,

[  101.717826] CPU 0 Unable to handle kernel paging request at virtual address 000002d4, epc == 805be290, ra == 805be560
[  101.717838] Oops[#1]:
[  101.717851] CPU: 0 PID: 1763 Comm: bttest Not tainted 5.10.150 #4
[  101.717858] $ 0   : 00000000 00000001 00000010 a8be6d21
[  101.717894] $ 4   : a8be6d21 00000001 81015fa0 005f5000
[  101.717919] $ 8   : 00000000 00000000 05355555 00000000
[  101.717943] $12   : ffffffff 00000000 ffffffea 00000000
[  101.717969] $16   : 8166f000 00000000 8224dd80 00000000
[  101.717995] $20   : 00000000 00000019 81c2f308 81e11020
[  101.718023] $24   : 00000000 8001190c
[  101.718043] $28   : 8224c000 8224dc88 82134380 805be560
[  101.718061] Hi    : 02f5db53
[  101.718066] Lo    : 24a9f11c
[  101.718084] epc   : 805be290 hci_send_acl+0xa0/0x43c
[  101.718093] ra    : 805be560 hci_send_acl+0x370/0x43c
[  101.718098] Status: 34001c03 KERNEL EXL IE
[  101.718115] Cause : 00800008 (ExcCode 02)
[  101.718119] BadVA : 000002d4
[  101.718124] PrId  : 00132000 (MiPs)
[  101.718129] Modules linked in:
[  101.718142] Process bttest (pid: 1763, threadinfo=58765d16, task=15407a97, tls=6f9fd920)
[  101.718147] Stack : 8224ddf0 8166f3c8 00000001 8224dae0 80820000 805e2944 82189c00 00000019
[  101.718175]         8224dd80 8224dd78 00000000 00000019 81c2f308 821f1900 81e11020 805e7b48
[  101.718203]         8224dd08 82189c00 00000019 81d8b0f0 8224dd80 a8be6d21 80bfcc00 81c9d400
[  101.718229]         80990000 805b5298 80990000 81c9d400 a8be6d21 00000001 00000000 6f9f5d28
[  101.718256]         00000000 a8be6d21 82189e04 00000000 8224dd78 00000019 82189c00 00000001
[  101.718281]         ...
[  101.718292] Call Trace:
[  101.718301] [<805be290>] hci_send_acl+0xa0/0x43c
[  101.718315] [<805e7b48>] l2cap_chan_send+0x1f4/0xf34
[  101.718325] [<805f30d0>] l2cap_sock_sendmsg+0xac/0x11c
[  101.718333] [<804bd550>] sock_write_iter+0xc8/0x14c
[  101.718344] [<80130544>] do_iter_readv_writev+0x1c8/0x1ec
[  101.718351] [<80131920>] do_iter_write+0xb0/0x1f8
[  101.718358] [<80131b08>] vfs_writev+0x80/0x280
[  101.718365] [<80131d80>] do_writev+0x78/0x134
[  101.718375] [<8002a2f8>] syscall_common+0x34/0x58
[  101.718382]
[  101.718387] Code: 2c441000  148000a5  3c048090 <8c5402c4> 2e821000  144000c8  3c048090  02203825  03c03025
[  101.718422]
[  101.718538] ---[ end trace 87e7cd85f44c4db0 ]---

And here is another occurance.

<6>[  792.290270] rtk_btcoex: HCI Disconnect, handle 0010, reason 0x13
<7>[  792.290344] sk 7418ee2b, opt 2
<7>[  792.290383] channel 2 len 10
<7>[  792.290854] sock b24b2818, sk 7d072167
<7>[  792.291326] cmd 400448d2 arg 7420b3e8
<7>[  792.291380] cmd 400448d3 arg 6e1f27d8
<7>[  792.291396] hci0 orig refcnt 8
<7>[  792.291425] sock 6489db1a sk 7418ee2b
<7>[  792.291484] sock 1e6777c6
<7>[  792.291522] 0
<7>[  792.291546] channel 2 len 36
<7>[  792.291743] sk 7418ee2b, opt 2
<7>[  792.291806] hci0 cmd_cnt 0 cmd queued 2
<7>[  792.292777] hdev 7d478bdd len 6
<7>[  792.292805] hci0 opcode 0x0406
<7>[  792.292824] hci0 opcode 0x0406
<7>[  792.292864] hci0 type 1 len 5
<7>[  792.293969] hci0
<7>[  792.294010] hci0 Event packet
<7>[  792.294034] opcode 0xfc19 status 0x00
<7>[  792.294068] hci0 cmd_cnt 1 cmd queued 1
<7>[  792.294090] hdev 7d478bdd len 35
<7>[  792.295284] hdev 7d478bdd len 6
<7>[  792.295326] hci0 opcode 0x2008
<7>[  792.295335] opcode 0x2008 status 0x00
<7>[  792.295343] hci0 opcode 0x2008
<7>[  792.295378] sock 1e6777c6, sk 7418ee2b
<7>[  792.295444] sk 7418ee2b, opt 2
<7>[  792.295469] sock 1e6777c6 sk 7418ee2b
<7>[  792.295482] channel 2 len 10
<7>[  792.295497] hci0 orig refcnt 9
<7>[  792.295521] sock 698473ee
<7>[  792.295546] cmd 400448d2 arg 7420b3e8
<7>[  792.295564] channel 2 len 36
<7>[  792.295580] cmd 400448d3 arg 6e1f2820
<7>[  792.295587] 0
<7>[  792.295595] hci0 orig refcnt 8
<7>[  792.295603] hci0 orig refcnt 9
<7>[  792.295620] sock 698473ee sk 7418ee2b
<7>[  792.295631] channel 2 len 10
<7>[  792.295664] sock 1381f6de
<7>[  792.295687] sock 1381f6de sk 7418ee2b
<7>[  792.295696] 0
<7>[  792.295703] hci0 orig refcnt 8
<7>[  792.295716] channel 2 len 36
<7>[  792.296011] sk 7418ee2b, opt 2
<7>[  792.296028] sk 7418ee2b, opt 2
<7>[  792.296046] sock 1381f6de sk 7418ee2b
<7>[  792.296087] hci0 cmd_cnt 1 cmd queued 1
<7>[  792.296102] hci0 type 1 len 35
<7>[  792.296112] hdev 7d478bdd len 35
<7>[  792.297227] hci0
<7>[  792.297245] hdev 7d478bdd len 6
<7>[  792.297273] hci0 Event packet
<7>[  792.297285] hci0 opcode 0x2009
<7>[  792.297294] opcode 0x2009 status 0x00
<7>[  792.297301] hci0 opcode 0x2009
<7>[  792.297340] sock 1381f6de, sk 7418ee2b
<7>[  792.297362] sk 7418ee2b, opt 2
<7>[  792.297378] sock 1381f6de sk 7418ee2b
<7>[  792.297391] channel 2 len 10
<7>[  792.297407] hci0 orig refcnt 9
<7>[  792.297550] sock d349e53e
<7>[  792.297583] cmd 400448d2 arg 7420b3e8
<7>[  792.297606] channel 2 len 36
<7>[  792.297624] cmd 400448d3 arg 6e1f2808
<7>[  792.297633] 0
<7>[  792.297653] hci0 orig refcnt 8
<7>[  792.297661] hci0 orig refcnt 9
<7>[  792.297682] sock d349e53e sk 7418ee2b
<7>[  792.297693] channel 2 len 10
<7>[  792.297729] sock cf16efc4
<7>[  792.297753] sock cf16efc4 sk 7418ee2b
<7>[  792.297762] 0
<7>[  792.297769] hci0 orig refcnt 8
<7>[  792.297784] channel 2 len 36
<7>[  792.297800] sk 7418ee2b, opt 2
<7>[  792.297811] sk 7418ee2b, opt 2
<7>[  792.297827] sock cf16efc4 sk 7418ee2b
<7>[  792.297869] hci0 cmd_cnt 1 cmd queued 1
<7>[  792.297883] hci0 type 1 len 18
<7>[  792.297893] hdev 7d478bdd len 18
<7>[  792.299000] hci0
<7>[  792.299018] hdev 7d478bdd len 6
<7>[  792.299049] hci0 Event packet
<7>[  792.299062] hci0 status 0x00
<7>[  792.299068] hci0 opcode 0x2006
<7>[  792.299077] opcode 0x2006 status 0x00
<7>[  792.299083] hci0 opcode 0x2006
<7>[  792.299117] sock cf16efc4, sk 7418ee2b
<7>[  792.299137] sk 7418ee2b, opt 2
<7>[  792.299157] sock cf16efc4 sk 7418ee2b
<7>[  792.299169] channel 2 len 10
<7>[  792.299184] hci0 orig refcnt 9
<7>[  792.299221] sock 52d94a15
<7>[  792.299249] cmd 400448d2 arg 7420b3e8
<7>[  792.299268] channel 2 len 36
<7>[  792.299283] cmd 400448d3 arg 6e1f2818
<7>[  792.299292] 0
<7>[  792.299300] hci0 orig refcnt 8
<7>[  792.299308] hci0 orig refcnt 9
<7>[  792.299325] sock 52d94a15 sk 7418ee2b
<7>[  792.299336] channel 2 len 10
<7>[  792.299365] sock 95b9376e
<7>[  792.299386] sock 95b9376e sk 7418ee2b
<7>[  792.299395] 0
<7>[  792.299402] hci0 orig refcnt 8
<7>[  792.299416] channel 2 len 36
<7>[  792.299430] sk 7418ee2b, opt 2
<7>[  792.299440] sk 7418ee2b, opt 2
<7>[  792.299456] sock 95b9376e sk 7418ee2b
<7>[  792.299497] hci0 cmd_cnt 1 cmd queued 1
<7>[  792.299510] hci0 type 1 len 4
<7>[  792.299520] hdev 7d478bdd len 4
<7>[  792.300835] hci0
<7>[  792.300881] hci0 Event packet
<7>[  792.300901] hci0 opcode 0x200a
<7>[  792.300917] hci0 opcode 0x200a
<7>[  792.301148] sk 7418ee2b, opt 2
<7>[  792.301181] channel 2 len 10
<7>[  792.302521] sock 820e0de0, sk 34d8b24d
<7>[  792.302735] chan edc822af len 80
<1>[  792.302779] CPU 1 Unable to handle kernel paging request at virtual address 10400048, epc == 805bdf88, ra == 805bdf34
<4>[  792.302804] CPU: 1 PID: 20652 Comm: bttestTainted: G      D           5.10.186-2 #54
<4>[  792.302840] $ 4   : 00000000 00000002 00000000 00000000
<4>[  792.302888] $12   : fffffffd 00000402 8099a868 00000040
<4>[  792.302934] $20   : 81eb7800 10400015 80900000 822c4000
<4>[  792.302982] $28   : 81c6a000 81c6bc88 8214d780 805bdf34
<4>[  792.303009] Lo    : 00000000
<4>[  792.303041] ra    : 805bdf34 hci_send_acl+0x60/0x404
<4>[  792.303069] Cause : 08800008 (ExcCode 02)
<4>[  792.303083] PrId  : 00132000 (MiPs)
<4>[  792.303104] Process bttest (pid: 20652, threadinfo=24345b8d, task=bef1ee64, tls=6e1fa920)
<4>[  792.303148]         81c6bd80 81c6bd78 00000000 00000050 81bb3f08 8227b800 822c4000 805e55f4
<4>[  792.303184]         81c6bd08 8228b400 00000050 823fedb0 81c6bd80 80990000 81c6bcf4 82208000
<4>[  792.303220]         80990000 805b4cb8 00801000 82208000 4451e09f 81c6bb90 80990000 80990000
<4>[  792.303257]         00000000 4451e09f 8228b604 00000000 81c6bd78 00000050 8228b400 00000001
<4>[  792.303294]         ...
<4>[  792.303306] Call Trace:
<4>[  792.303319] [<805bdf88>] hci_send_acl+0xb4/0x404
<4>[  792.303335] [<805e55f4>] l2cap_chan_send+0x1fc/0xf48
<4>[  792.303349] [<805ed62c>] l2cap_sock_sendmsg+0xac/0x11c
<4>[  792.303362] [<804bd2b0>] sock_write_iter+0xc8/0x14c
<4>[  792.303376] [<80130544>] do_iter_readv_writev+0x1c8/0x1ec
<4>[  792.303389] [<80131920>] do_iter_write+0xb0/0x1f8
<4>[  792.303399] [<80131b08>] vfs_writev+0x80/0x280
<4>[  792.303411] [<80131d80>] do_writev+0x78/0x134
<4>[  792.303428] [<8002a2f8>] syscall_common+0x34/0x58
<4>[  792.303438]
<4>[  792.303444] Code: aee00054  00441023  aee20050 <92260033> 10c00058  24020001  14c2003b  02e02025  97c50008
<4>[  792.303488]
<4>[  792.303497] ---[ end trace 0ce93be123ef0abd ]---
<7>[  792.304498] hci0
<7>[  792.304519] hdev 7d478bdd len 21
<7>[  792.304557] hci0 Event packet
<7>[  792.304569] hci0 status 0x00
<7>[  792.304578] hci0 dst 4e:61:6e:75:48:07
<7>[  792.304590] hci0 orig refcnt 8
<7>[  792.304598] conn 7418ee2b
<7>[  792.304615] channel 3 len 19
<7>[  792.304641] channel 2 len 25
<7>[  792.304651] channel 2 len 25
<7>[  792.304659] channel 2 len 25
<7>[  792.304667] channel 2 len 25
<7>[  792.304677] conn 7418ee2b
<7>[  792.304768] hci0 orig refcnt 11
<7>[  792.304783] hcon 7418ee2b bdaddr 4e:61:6e:75:48:07 status 0
<7>[  792.304792] hci0 hcon 7418ee2b
<7>[  792.304801] hcon 7418ee2b conn dbcf7591 hchan 996a01cf
<7>[  792.304810] chan a57ca00c orig refcnt 1
<7>[  792.304817] pchan a57ca00c
<7>[  792.304827] chan 0b6a9ed2
<7>[  792.304833] created chan 0b6a9ed2
<7>[  792.304842] conn dbcf7591, psm 0x00, dcid 0x0006
<7>[  792.304849] chan 0b6a9ed2 orig refcnt 1
<7>[  792.304855] hcon 7418ee2b orig refcnt 0
<7>[  792.304863] chan 58fcd3f3 orig refcnt 2
<7>[  792.304869] chan a57ca00c orig refcnt 2
<7>[  792.304884] chan 44907f49
<7>[  792.304893] chan 44907f49 orig refcnt 1
<7>[  792.304900] sk 3504b714
<7>[  792.304909] parent 0c693357, sk 3504b714
<7>[  792.304927] chan 44907f49 orig refcnt 2
<7>[  792.304946] chan 58fcd3f3 orig refcnt 3
<7>[  792.304961] conn dbcf7591 hcon 7418ee2b level 0x01
<7>[  792.304986] conn dbcf7591 hcon 7418ee2b level 0x00
<7>[  792.305004] hci0 conn dbcf7591
<7>[  792.305048] hci0 ADV monitoring is off

After this oops, there is NO BT advertisement any more from the device.