Bluetooth: hci1: command 0x0406 tx timeout
Bluetooth: hci2: command 0x0406 tx timeout
Bluetooth: hci3: command 0x0406 tx timeout
Bluetooth: hci4: command 0x0406 tx timeout
Bluetooth: hci5: command 0x0406 tx timeout
rcu: INFO: rcu_preempt self-detected stall on CPU
rcu: 	0-....: (1 GPs behind) idle=c16/1/0x4000000000000004 softirq=18272/18337 fqs=5177 
rcu: 	 (t=10500 jiffies g=13689 q=121185)
NMI backtrace for cpu 0
CPU: 0 PID: 8988 Comm: syz-executor.5 Not tainted 4.19.143-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2fe lib/dump_stack.c:118
 nmi_cpu_backtrace.cold+0x63/0xa2 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x1a6/0x1eb lib/nmi_backtrace.c:62
 trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline]
 rcu_dump_cpu_stacks+0x15f/0x19c kernel/rcu/tree.c:1340
 print_cpu_stall kernel/rcu/tree.c:1478 [inline]
 check_cpu_stall kernel/rcu/tree.c:1550 [inline]
 __rcu_pending kernel/rcu/tree.c:3293 [inline]
 rcu_pending kernel/rcu/tree.c:3336 [inline]
 rcu_check_callbacks.cold+0x62d/0xe19 kernel/rcu/tree.c:2682
 update_process_times+0x2a/0xb0 kernel/time/timer.c:1650
 tick_sched_handle+0x9b/0x180 kernel/time/tick-sched.c:168
 tick_sched_timer+0xfc/0x290 kernel/time/tick-sched.c:1278
 __run_hrtimer kernel/time/hrtimer.c:1401 [inline]
 __hrtimer_run_queues+0x3f6/0xe60 kernel/time/hrtimer.c:1463
 hrtimer_interrupt+0x32a/0x930 kernel/time/hrtimer.c:1521
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1067 [inline]
 smp_apic_timer_interrupt+0x10c/0x550 arch/x86/kernel/apic/apic.c:1092
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
RIP: 0010:trace_timer_expire_exit include/trace/events/timer.h:121 [inline]
RIP: 0010:call_timer_fn+0x619/0x700 kernel/time/timer.c:1339
Code: 8b 34 24 81 e1 ff ff ff 7f 89 ea 48 c7 c7 20 2a 8c 87 e8 e5 01 e3 ff 0f 0b e9 08 fc ff ff e8 ae 0b 0f 00 e8 79 e6 fc ff 31 ff <89> c3 89 c6 e8 0e 0d 0f 00 85 db 0f 85 d7 fe ff ff e8 91 0b 0f 00
RSP: 0018:ffff8880ae607d18 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000000
RDX: dffffc0000000000 RSI: 00000000ffffffff RDI: 0000000000000000
RBP: 0000000000000101 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000000000000 R12: ffff8880ae607d48
R13: 1ffff11015cc0fa5 R14: 0000000000000000 R15: 0000000000000000
 expire_timers+0x243/0x4e0 kernel/time/timer.c:1375
 __run_timers kernel/time/timer.c:1703 [inline]
 run_timer_softirq+0x21c/0x670 kernel/time/timer.c:1716
 __do_softirq+0x26c/0x9a0 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:372 [inline]
 irq_exit+0x215/0x260 kernel/softirq.c:412
 exiting_irq arch/x86/include/asm/apic.h:544 [inline]
 smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1094
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
 </IRQ>
RIP: 0010:__schedule+0x5a/0x2040 kernel/sched/core.c:3428
Code: ec a0 00 00 00 48 89 85 50 ff ff ff 4c 01 f0 48 c7 85 78 ff ff ff b3 8a b5 41 48 c7 45 80 1d 13 86 88 48 c7 45 88 20 84 3c 87 <c7> 00 f1 f1 f1 f1 c7 40 04 00 00 f3 f3 65 48 8b 04 25 28 00 00 00
RSP: 0018:ffff88804c7bf738 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13
RAX: ffffed10098f7eef RBX: 0000000000000001 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001
RBP: ffff88804c7bf800 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88804c2f04c0
R13: 000000000002c2c0 R14: dffffc0000000000 R15: 000000000002c2c0
 preempt_schedule_irq+0xb0/0x140 kernel/sched/core.c:3744
 retint_kernel+0x1b/0x2d
RIP: 0010:native_ptep_get_and_clear arch/x86/include/asm/pgtable_64.h:88 [inline]
RIP: 0010:ptep_get_and_clear arch/x86/include/asm/pgtable.h:1108 [inline]
RIP: 0010:vunmap_pte_range mm/vmalloc.c:67 [inline]
RIP: 0010:vunmap_pmd_range mm/vmalloc.c:84 [inline]
RIP: 0010:vunmap_pud_range mm/vmalloc.c:100 [inline]
RIP: 0010:vunmap_p4d_range mm/vmalloc.c:116 [inline]
RIP: 0010:vunmap_page_range+0x640/0x770 mm/vmalloc.c:131
Code: ee 49 83 c6 08 4c 89 ff e8 ad 9e d1 ff 49 39 ef 0f 84 69 fe ff ff e8 8f 9d d1 ff be 08 00 00 00 4c 89 f7 31 db e8 60 ab 07 00 <49> 87 1e 49 89 dd 31 ff 49 83 e5 9f 4c 89 ee e8 fc 9e d1 ff 4d 85
RSP: 0018:ffff88804c7bf8e8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff02
RAX: ffffed1009f95553 RBX: 0000000000000000 RCX: ffffffff81981450
RDX: ffffed1009f95553 RSI: 0000000000000008 RDI: ffff88804fcaaa90
RBP: ffffc90012200000 R08: 0000000000000001 R09: ffffed1009f95552
R10: ffff88804fcaaa97 R11: 0000000000000000 R12: ffff88821bc31480
R13: 800000004fcc4103 R14: ffff88804fcaaa90 R15: ffffc90012152000
 unmap_vmap_area mm/vmalloc.c:608 [inline]
 free_unmap_vmap_area mm/vmalloc.c:743 [inline]
 remove_vm_area+0x25b/0x2f0 mm/vmalloc.c:1495
 __vunmap+0x187/0x3f0 mm/vmalloc.c:1523
 vfree+0x65/0x100 mm/vmalloc.c:1598
 kcov_put kernel/kcov.c:237 [inline]
 kcov_put+0x1f/0x30 kernel/kcov.c:234
 kcov_close+0xc/0x10 kernel/kcov.c:323
 __fput+0x2ce/0x890 fs/file_table.c:278
 task_work_run+0x148/0x1c0 kernel/task_work.c:113
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0xbb2/0x2b70 kernel/exit.c:887
 do_group_exit+0x125/0x310 kernel/exit.c:990
 get_signal+0x3f2/0x1f70 kernel/signal.c:2588
 do_signal+0x8f/0x1670 arch/x86/kernel/signal.c:821
 exit_to_usermode_loop+0x204/0x2a0 arch/x86/entry/common.c:163
 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
 do_syscall_64+0x538/0x620 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45d5b9
Code: Bad RIP value.
RSP: 002b:00007f7c72574cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: 0000000000000000 RBX: 000000000118cf48 RCX: 000000000045d5b9
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000118cf48
RBP: 000000000118cf40 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118cf4c
R13: 00007ffd2aebbf3f R14: 00007f7c725759c0 R15: 000000000118cf4c