program: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f00000018c0)={0x0, 0x0, 0x0, 0x0, 0x80002, r0}, 0x38) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000300)={{r0}, &(0x7f0000000240), &(0x7f0000000280)='%pB \x00'}, 0x20) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, r1) [ 103.772165][ T5284] Bluetooth: hci0: command tx timeout [ 105.118565][ T5324] BUG: using smp_processor_id() in preemptible [00000000] code: syz.0.0/5324 [ 105.118588][ T5324] caller is bpf_mem_cache_free_rcu+0x48/0xc0 [ 105.118751][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 105.118766][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 105.118784][ T5324] Call Trace: [ 105.118808][ T5324] [ 105.118840][ T5324] dump_stack_lvl+0xe8/0x150 [ 105.118880][ T5324] check_preemption_disabled+0xcd/0xd0 [ 105.119023][ T5324] bpf_mem_cache_free_rcu+0x48/0xc0 [ 105.119049][ T5324] rhtab_delete_elem+0x1826/0x1b00 [ 105.119069][ T5324] ? rhtab_delete_elem+0x15f/0x1b00 [ 105.119084][ T5324] ? check_and_init_map_value+0x57/0x410 [ 105.119117][ T5324] __rhtab_map_lookup_and_delete_batch+0x935/0xcb0 [ 105.119142][ T5324] ? __pfx_rhtab_map_lookup_and_delete_batch+0x10/0x10 [ 105.119157][ T5324] bpf_map_do_batch+0x445/0x630 [ 105.119177][ T5324] __sys_bpf+0x906/0xda0 [ 105.119213][ T5324] ? __pfx___sys_bpf+0x10/0x10 [ 105.119230][ T5324] ? do_futex+0x458/0x4e0 [ 105.119261][ T5324] ? rcu_is_watching+0x16/0xb0 [ 105.119291][ T5324] __x64_sys_bpf+0xba/0xd0 [ 105.119302][ T5324] do_syscall_64+0x166/0x520 [ 105.119317][ T5324] ? trace_irq_disable+0x3b/0x140 [ 105.119329][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.119362][ T5324] ? clear_bhb_loop+0x70/0xc0 [ 105.119378][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.119391][ T5324] RIP: 0033:0x7f5193b9e159 [ 105.119466][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 105.119480][ T5324] RSP: 002b:00007f518fff4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 105.119522][ T5324] RAX: ffffffffffffffda RBX: 00007f5193e25fa0 RCX: 00007f5193b9e159 [ 105.119531][ T5324] RDX: 0000000000000038 RSI: 00002000000018c0 RDI: 0000000000000019 [ 105.119539][ T5324] RBP: 00007f5193c3506b R08: 0000000000000000 R09: 0000000000000000 [ 105.119548][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 105.119555][ T5324] R13: 00007f5193e26038 R14: 00007f5193e25fa0 R15: 00007ffff59cfc58 [ 105.119568][ T5324]