Arch Linux

Description:

Bluetooth stops working due to kernel crash, after a BLE connection was established.
This happens since I updated to linux-5.17. (Issue still persist with linux-5.17.9.arch1-1.)

Additional info:
* package version(s):
linux-5.17.arch1-1 to linux-5.17.9.arch1-1

* There is a bug report in Linux-Bluetooth Archive on lore.kernel.org that describes the same issue:
J4MJR0-0QDKJh8PzQcjWKkfDvQdg@mail.gmail.com/"> https://lore.kernel.org/all/CAMBK1_RrRgdRHhh9MKJh5+J4MJR0-0QDKJh8PzQcjWKkfDvQdg@mail.gmail.com/

* journalctl -k | grep Bluetooth
kernel: Bluetooth: Core ver 2.22
kernel: Bluetooth: HCI device and connection manager initialized
kernel: Bluetooth: HCI socket layer initialized
kernel: Bluetooth: L2CAP socket layer initialized
kernel: Bluetooth: SCO socket layer initialized
kernel: Bluetooth: hci0: BCM: chip id 110
kernel: Bluetooth: hci0: BCM: features 0x2f
kernel: Bluetooth: hci0: BCM4350C5
kernel: Bluetooth: hci0: BCM4350C5 (003.006.007) build 0000
kernel: Bluetooth: hci0: BCM4350C5 'brcm/BCM-0a5c-6412.hcd' Patch
kernel: Bluetooth: hci0: Dell DW1820A
kernel: Bluetooth: hci0: BCM4350C5 (003.006.007) build 0593
kernel: Bluetooth: BNEP (Ethernet Emulation) ver 1.3
kernel: Bluetooth: BNEP filters: protocol multicast
kernel: Bluetooth: BNEP socket layer initialized
kernel: Bluetooth: hci0: Opcode 0x200d failed: -110
kernel: Bluetooth: hci0: request failed to create LE connection: err -110
kernel: ------------[ cut here ]------------
kernel: list_del corruption, ffff8f05148a0000->prev is LIST_POISON2 (dead000000000122)
kernel: WARNING: CPU: 1 PID: 445 at lib/list_debug.c:48 __list_del_entry_valid+0x5e/0xa0
kernel: Modules linked in: rpcrdma rdma_cm cmac algif_hash iw_cm ib_cm algif_skcipher af_alg ib_core bnep intel_pmc_bxt intel_telemetry_pltdrv intel_punit_ipc intel_telemetry_core x86_pkg_temp_thermal intel_powerclamp coretemp btusb kvm_intel ee1004 nls_iso8859_1 btrtl btbcm vfat btintel fat kvm mei_hdcp mei_pxp intel_rapl_msr btmtk bluetooth irqbypass processor_thermal_device_pci_legacy processor_thermal_device rapl i2c_i801 ecdh_generic pcspkr intel_cstate wdat_wdt processor_thermal_rfim crc16 i2c_smbus i915 mac_hid tpm_crb processor_thermal_mbox int3400_thermal int3406_thermal tpm_tis processor_thermal_rapl tpm_tis_core intel_rapl_common dptf_power ttm mei_me acpi_thermal_rel video int3403_thermal intel_gtt intel_soc_dts_iosf int340x_thermal_zone mei nfsd auth_rpcgss nfs_acl lockd grace crypto_user sunrpc fuse bpf_preload ip_tables x_tables btrfs blake2b_generic libcrc32c crc32c_generic xor raid6_pq uas dm_crypt usb_storage cbc encrypted_keys dm_mod trusted asn1_encoder tee tpm
kernel: rng_core brcmfmac mmc_core r8169 crct10dif_pclmul crc32_pclmul realtek crc32c_intel cfg80211 ghash_clmulni_intel aesni_intel crypto_simd mdio_devres rfkill xhci_pci cryptd xhci_pci_renesas libphy brcmutil
kernel: CPU: 1 PID: 445 Comm: kworker/u9:2 Not tainted 5.17.9-arch1-1 #1 e077767f2d3b4d5004a14cb6f791c01d77538db3
kernel: Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./J4105-ITX, BIOS P1.40 08/06/2018
kernel: Workqueue: hci0 hci_cmd_sync_work [bluetooth]
kernel: RIP: 0010:__list_del_entry_valid+0x5e/0xa0
kernel: Code: 00 c3 cc 48 89 fe 48 c7 c7 c0 dc 0c 86 e8 4a a7 5f 00 0f 0b 31 c0 c3 cc 48 89 fe 48 89 ca 48 c7 c7 f8 dc 0c 86 e8 32 a7 5f 00 <0f> 0b eb e6 48 89 fe 48 89 c2 48 c7 c7 30 dd 0c 86 e8 1c a7 5f 00
kernel: RSP: 0018:ffffae6bc080bd98 EFLAGS: 00010286
kernel: RAX: 0000000000000000 RBX: ffff8f05148a0000 RCX: 0000000000000027
kernel: RDX: ffff8f06780a16e8 RSI: 0000000000000001 RDI: ffff8f06780a16e0
kernel: RBP: ffff8f0505248000 R08: 0000000000000000 R09: ffffae6bc080bbb0
kernel: R10: ffffae6bc080bba8 R11: 0000000000000003 R12: 0000000000000092
kernel: R13: ffff8f0505248000 R14: ffff8f05148a0014 R15: ffff8f051f6c3600
kernel: FS: 0000000000000000(0000) GS:ffff8f0678080000(0000) knlGS:0000000000000000
kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
kernel: CR2: 00007f14b5639866 CR3: 0000000122a10000 CR4: 0000000000350ee0
kernel: Call Trace:
kernel: <TASK>
kernel: hci_conn_cleanup+0x33/0x180 [bluetooth 6272d7951221eec0a8c2a88971e453b309aea710]
kernel: hci_conn_del+0xd4/0x1b0 [bluetooth 6272d7951221eec0a8c2a88971e453b309aea710]
kernel: hci_le_conn_failed+0x168/0x210 [bluetooth 6272d7951221eec0a8c2a88971e453b309aea710]
kernel: create_le_conn_complete+0x53/0x80 [bluetooth 6272d7951221eec0a8c2a88971e453b309aea710]
kernel: hci_cmd_sync_work+0xb6/0x150 [bluetooth 6272d7951221eec0a8c2a88971e453b309aea710]
kernel: process_one_work+0x1c4/0x380
kernel: worker_thread+0x4d/0x380
kernel: ? rescuer_thread+0x3a0/0x3a0
kernel: kthread+0xd7/0x100
kernel: ? kthread_complete_and_exit+0x20/0x20
kernel: ret_from_fork+0x1f/0x30
kernel: </TASK>
kernel: ---[ end trace 0000000000000000 ]---
kernel: BUG: kernel NULL pointer dereference, address: 00000000000000a0
kernel: #PF: supervisor write access in kernel mode
kernel: #PF: error_code(0x0002) - not-present page
kernel: PGD 0 P4D 0
kernel: Oops: 0002 [#1] PREEMPT SMP PTI
kernel: CPU: 2 PID: 445 Comm: kworker/u9:2 Tainted: G W 5.17.9-arch1-1 #1 e077767f2d3b4d5004a14cb6f791c01d77538db3
kernel: Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./J4105-ITX, BIOS P1.40 08/06/2018
kernel: Workqueue: hci0 hci_cmd_sync_work [bluetooth]
kernel: RIP: 0010:down_write+0x15/0x40
kernel: Code: e9 40 fe ff ff e8 5b 2e ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 53 48 89 fb 2e 2e 2e 31 c0 31 c0 ba 01 00 00 00 <f0> 48 0f b1 13 75 10 65 48 8b 04 25 c0 0b 02 00 48 89 43 08 5b c3
kernel: RSP: 0018:ffffae6bc080bd18 EFLAGS: 00010246
kernel: RAX: 0000000000000000 RBX: 00000000000000a0 RCX: ffffff8100000000
kernel: RDX: 0000000000000001 RSI: ffffff8100000000 RDI: 00000000000000a0
kernel: RBP: ffffae6bc080bd80 R08: 0000000000000000 R09: 0000000000000000
kernel: R10: 0000000000000001 R11: 0000000000000002 R12: 0000000000000000
kernel: R13: ffff8f0505248000 R14: ffff8f05148a0014 R15: ffff8f051f6c3600
kernel: FS: 0000000000000000(0000) GS:ffff8f0678100000(0000) knlGS:0000000000000000
kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
kernel: CR2: 00000000000000a0 CR3: 0000000122a10000 CR4: 0000000000350ee0
kernel: Call Trace:
kernel: <TASK>
kernel: simple_recursive_removal+0x9f/0x2a0
kernel: ? start_creating.part.0+0x110/0x110
kernel: ? synchronize_rcu+0x87/0x90
kernel: debugfs_remove+0x40/0x60
kernel: hci_conn_cleanup+0xad/0x180 [bluetooth 6272d7951221eec0a8c2a88971e453b309aea710]
kernel: hci_conn_del+0xd4/0x1b0 [bluetooth 6272d7951221eec0a8c2a88971e453b309aea710]
kernel: hci_le_conn_failed+0x168/0x210 [bluetooth 6272d7951221eec0a8c2a88971e453b309aea710]
kernel: create_le_conn_complete+0x53/0x80 [bluetooth 6272d7951221eec0a8c2a88971e453b309aea710]
kernel: hci_cmd_sync_work+0xb6/0x150 [bluetooth 6272d7951221eec0a8c2a88971e453b309aea710]
kernel: process_one_work+0x1c4/0x380
kernel: worker_thread+0x4d/0x380
kernel: ? rescuer_thread+0x3a0/0x3a0
kernel: kthread+0xd7/0x100
kernel: ? kthread_complete_and_exit+0x20/0x20
kernel: ret_from_fork+0x1f/0x30
kernel: </TASK>
kernel: Modules linked in: rpcrdma rdma_cm cmac algif_hash iw_cm ib_cm algif_skcipher af_alg ib_core bnep intel_pmc_bxt intel_telemetry_pltdrv intel_punit_ipc intel_telemetry_core x86_pkg_temp_thermal intel_powerclamp coretemp btusb kvm_intel ee1004 nls_iso8859_1 btrtl btbcm vfat btintel fat kvm mei_hdcp mei_pxp intel_rapl_msr btmtk bluetooth irqbypass processor_thermal_device_pci_legacy processor_thermal_device rapl i2c_i801 ecdh_generic pcspkr intel_cstate wdat_wdt processor_thermal_rfim crc16 i2c_smbus i915 mac_hid tpm_crb processor_thermal_mbox int3400_thermal int3406_thermal tpm_tis processor_thermal_rapl tpm_tis_core intel_rapl_common dptf_power ttm mei_me acpi_thermal_rel video int3403_thermal intel_gtt intel_soc_dts_iosf int340x_thermal_zone mei nfsd auth_rpcgss nfs_acl lockd grace crypto_user sunrpc fuse bpf_preload ip_tables x_tables btrfs blake2b_generic libcrc32c crc32c_generic xor raid6_pq uas dm_crypt usb_storage cbc encrypted_keys dm_mod trusted asn1_encoder tee tpm
kernel: rng_core brcmfmac mmc_core r8169 crct10dif_pclmul crc32_pclmul realtek crc32c_intel cfg80211 ghash_clmulni_intel aesni_intel crypto_simd mdio_devres rfkill xhci_pci cryptd xhci_pci_renesas libphy brcmutil
kernel: CR2: 00000000000000a0
kernel: ---[ end trace 0000000000000000 ]---
kernel: RIP: 0010:down_write+0x15/0x40
kernel: Code: e9 40 fe ff ff e8 5b 2e ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 53 48 89 fb 2e 2e 2e 31 c0 31 c0 ba 01 00 00 00 <f0> 48 0f b1 13 75 10 65 48 8b 04 25 c0 0b 02 00 48 89 43 08 5b c3
kernel: RSP: 0018:ffffae6bc080bd18 EFLAGS: 00010246
kernel: RAX: 0000000000000000 RBX: 00000000000000a0 RCX: ffffff8100000000
kernel: RDX: 0000000000000001 RSI: ffffff8100000000 RDI: 00000000000000a0
kernel: RBP: ffffae6bc080bd80 R08: 0000000000000000 R09: 0000000000000000
kernel: R10: 0000000000000001 R11: 0000000000000002 R12: 0000000000000000
kernel: R13: ffff8f0505248000 R14: ffff8f05148a0014 R15: ffff8f051f6c3600
kernel: FS: 0000000000000000(0000) GS:ffff8f0678100000(0000) knlGS:0000000000000000
kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
kernel: CR2: 00000000000000a0 CR3: 0000000122a10000 CR4: 0000000000350ee0