Bluetooth: hci3: command 0x0406 tx timeout
Bluetooth: hci0: command 0x0406 tx timeout
Bluetooth: hci4: command 0x0406 tx timeout
Bluetooth: hci2: command 0x0406 tx timeout
Bluetooth: hci5: command 0x0406 tx timeout
INFO: task syz-executor.3:12074 blocked for more than 140 seconds.
      Not tainted 4.19.177-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.3  D27576 12074   8476 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2828 [inline]
 __schedule+0x80c/0x1f70 kernel/sched/core.c:3517
 schedule+0x7f/0x1b0 kernel/sched/core.c:3561
 schedule_timeout+0x6f6/0xd20 kernel/time/timer.c:1794
 do_wait_for_common kernel/sched/completion.c:83 [inline]
 __wait_for_common kernel/sched/completion.c:104 [inline]
 wait_for_common+0x3fb/0x5d0 kernel/sched/completion.c:115
 wait_for_completion+0x18/0x20 kernel/sched/completion.c:136
 __flush_work+0x401/0x820 kernel/workqueue.c:2925
 __cancel_work_timer+0x2f1/0x430 kernel/workqueue.c:3012
 cancel_work_sync+0xb/0x10 kernel/workqueue.c:3048
 p9_conn_destroy net/9p/trans_fd.c:904 [inline]
 p9_fd_close+0x2bf/0x4e0 net/9p/trans_fd.c:934
 p9_client_destroy+0xc3/0x2c0 net/9p/client.c:1101
 v9fs_session_init+0xd51/0x13d0 fs/9p/v9fs.c:497
 v9fs_mount+0x73/0x770 fs/9p/vfs_super.c:135
 mount_fs+0x7f/0x2b0 fs/super.c:1261
 vfs_kern_mount.part.11+0x58/0x3d0 fs/namespace.c:961
 vfs_kern_mount fs/namespace.c:951 [inline]
 do_new_mount fs/namespace.c:2469 [inline]
 do_mount+0x376/0x2710 fs/namespace.c:2799
 ksys_mount+0xb1/0xd0 fs/namespace.c:3015
 __do_sys_mount fs/namespace.c:3029 [inline]
 __se_sys_mount fs/namespace.c:3026 [inline]
 __x64_sys_mount+0xb9/0x150 fs/namespace.c:3026
 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x465b09
Code: Bad RIP value.
RSP: 002b:00007f4bcfb30188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 000000000056c158 RCX: 0000000000465b09
RDX: 0000000020000240 RSI: 0000000020000200 RDI: 0000000000000000
RBP: 00000000004b069f R08: 0000000020000580 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056c158
R13: 00007ffdcb40cf6f R14: 00007f4bcfb30300 R15: 0000000000022000

Showing all locks held in the system:
1 lock held by khungtaskd/1562:
 #0: 00000000a514760c (rcu_read_lock){....}, at: debug_show_all_locks+0x5b/0x27a kernel/locking/lockdep.c:4442
1 lock held by in:imklog/7788:
 #0: 00000000972a98f4 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0xa7/0xd0 fs/file.c:767
2 locks held by kworker/1:4/8315:
 #0: 000000003ad4f432 ((wq_completion)"events"){+.+.}, at: process_one_work+0x6e8/0x15a0 kernel/workqueue.c:2123
 #1: 000000006789f276 ((work_completion)(&m->wq)){+.+.}, at: process_one_work+0x71b/0x15a0 kernel/workqueue.c:2127

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 1562 Comm: khungtaskd Not tainted 4.19.177-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x17c/0x226 lib/dump_stack.c:118
 nmi_cpu_backtrace.cold.0+0x3c/0x78 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0xf6/0x120 lib/nmi_backtrace.c:62
 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:203 [inline]
 watchdog+0x5c3/0xb40 kernel/hung_task.c:287
 kthread+0x347/0x410 kernel/kthread.c:259
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1 skipped: idling at native_safe_halt+0x12/0x20 arch/x86/include/asm/irqflags.h:60