BUG: sleeping function called from invalid context at kernel/locking/mutex.c:585
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 5237, name: kworker/u9:4
preempt_count: 0, expected: 0
RCU nest depth: 1, expected: 0
4 locks held by kworker/u9:4/5237:
 #0: ffff88802246e148 ((wq_completion)hci4#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline]
 #0: ffff88802246e148 ((wq_completion)hci4#2){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312
 #1: ffffc9000364fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline]
 #1: ffffc9000364fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312
 #2: ffff888024a70078 (&hdev->lock){+.+.}-{3:3}, at: hci_le_create_big_complete_evt+0xcf/0xae0 net/bluetooth/hci_event.c:6853
 #3: ffffffff8e937720 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
 #3: ffffffff8e937720 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #3: ffffffff8e937720 (rcu_read_lock){....}-{1:2}, at: hci_le_create_big_complete_evt+0xdb/0xae0 net/bluetooth/hci_event.c:6854
CPU: 0 UID: 0 PID: 5237 Comm: kworker/u9:4 Not tainted 6.11.0-rc3-next-20240813-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Workqueue: hci4 hci_rx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 __might_resched+0x5d4/0x780 kernel/sched/core.c:8590
 __mutex_lock_common kernel/locking/mutex.c:585 [inline]
 __mutex_lock+0xc1/0xd70 kernel/locking/mutex.c:752
 hci_connect_cfm include/net/bluetooth/hci_core.h:1962 [inline]
 hci_le_create_big_complete_evt+0x3d9/0xae0 net/bluetooth/hci_event.c:6878
 hci_event_func net/bluetooth/hci_event.c:7443 [inline]
 hci_event_packet+0xa55/0x1540 net/bluetooth/hci_event.c:7498
 hci_rx_work+0x3e8/0xca0 net/bluetooth/hci_core.c:4022
 process_one_work kernel/workqueue.c:3231 [inline]
 process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
 worker_thread+0x86d/0xd10 kernel/workqueue.c:3389
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:144
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>

=============================
[ BUG: Invalid wait context ]
6.11.0-rc3-next-20240813-syzkaller #0 Tainted: G        W         
-----------------------------
kworker/u9:4/5237 is trying to lock:
ffffffff8fdf7368 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1962 [inline]
ffffffff8fdf7368 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_le_create_big_complete_evt+0x3d9/0xae0 net/bluetooth/hci_event.c:6878
other info that might help us debug this:
context-{4:4}
4 locks held by kworker/u9:4/5237:
 #0: ffff88802246e148 ((wq_completion)hci4#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline]
 #0: ffff88802246e148 ((wq_completion)hci4#2){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312
 #1: ffffc9000364fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline]
 #1: ffffc9000364fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312
 #2: ffff888024a70078 (&hdev->lock){+.+.}-{3:3}, at: hci_le_create_big_complete_evt+0xcf/0xae0 net/bluetooth/hci_event.c:6853
 #3: ffffffff8e937720 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
 #3: ffffffff8e937720 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #3: ffffffff8e937720 (rcu_read_lock){....}-{1:2}, at: hci_le_create_big_complete_evt+0xdb/0xae0 net/bluetooth/hci_event.c:6854
stack backtrace:
CPU: 0 UID: 0 PID: 5237 Comm: kworker/u9:4 Tainted: G        W          6.11.0-rc3-next-20240813-syzkaller #0
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Workqueue: hci4 hci_rx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 print_lock_invalid_wait_context kernel/locking/lockdep.c:4753 [inline]
 check_wait_context kernel/locking/lockdep.c:4823 [inline]
 __lock_acquire+0x153b/0x2040 kernel/locking/lockdep.c:5095
 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5762
 __mutex_lock_common kernel/locking/mutex.c:608 [inline]
 __mutex_lock+0x136/0xd70 kernel/locking/mutex.c:752
 hci_connect_cfm include/net/bluetooth/hci_core.h:1962 [inline]
 hci_le_create_big_complete_evt+0x3d9/0xae0 net/bluetooth/hci_event.c:6878
 hci_event_func net/bluetooth/hci_event.c:7443 [inline]
 hci_event_packet+0xa55/0x1540 net/bluetooth/hci_event.c:7498
 hci_rx_work+0x3e8/0xca0 net/bluetooth/hci_core.c:4022
 process_one_work kernel/workqueue.c:3231 [inline]
 process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
 worker_thread+0x86d/0xd10 kernel/workqueue.c:3389
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:144
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
------------[ cut here ]------------
Voluntary context switch within RCU read-side critical section!
WARNING: CPU: 0 PID: 5237 at kernel/rcu/tree_plugin.h:331 rcu_note_context_switch+0xcf4/0xff0 kernel/rcu/tree_plugin.h:331
Modules linked in:
CPU: 0 UID: 0 PID: 5237 Comm: kworker/u9:4 Tainted: G        W          6.11.0-rc3-next-20240813-syzkaller #0
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Workqueue: hci4 hci_rx_work
RIP: 0010:rcu_note_context_switch+0xcf4/0xff0 kernel/rcu/tree_plugin.h:331
Code: 00 ba 02 00 00 00 e8 2b f8 fd ff 4c 8b b4 24 80 00 00 00 eb 91 c6 05 c2 6f 87 0e 01 90 48 c7 c7 80 29 0c 8c e8 1d e6 da ff 90 <0f> 0b 90 90 e9 3b f4 ff ff 90 0f 0b 90 45 84 ed 0f 84 00 f4 ff ff
RSP: 0018:ffffc9000364f3e0 EFLAGS: 00010046
RAX: 6ac9a64d9a4d4e00 RBX: ffff8880620bde44 RCX: 0000000000100000
RDX: ffffc900145e3000 RSI: 00000000000fffff RDI: 0000000000100000
RBP: ffffc9000364f530 R08: ffffffff8155ae72 R09: fffffbfff1cf9f4c
R10: dffffc0000000000 R11: fffffbfff1cf9f4c R12: ffff8880620bda00
R13: 0000000000000000 R14: 1ffff920006c9e94 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc927bffd58 CR3: 000000006e890000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __schedule+0x348/0x4ad0 kernel/sched/core.c:6527
 __schedule_loop kernel/sched/core.c:6716 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6731
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6788
 mutex_optimistic_spin kernel/locking/mutex.c:510 [inline]
 __mutex_lock_common kernel/locking/mutex.c:612 [inline]
 __mutex_lock+0x391/0xd70 kernel/locking/mutex.c:752
 hci_connect_cfm include/net/bluetooth/hci_core.h:1962 [inline]
 hci_le_create_big_complete_evt+0x3d9/0xae0 net/bluetooth/hci_event.c:6878
 hci_event_func net/bluetooth/hci_event.c:7443 [inline]
 hci_event_packet+0xa55/0x1540 net/bluetooth/hci_event.c:7498
 hci_rx_work+0x3e8/0xca0 net/bluetooth/hci_core.c:4022
 process_one_work kernel/workqueue.c:3231 [inline]
 process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
 worker_thread+0x86d/0xd10 kernel/workqueue.c:3389
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:144
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>