Bluetooth: hci0: command 0x0406 tx timeout
==================================================================
BUG: KASAN: global-out-of-bounds in record_print_text+0x309/0x330 kernel/printk/printk.c:1401
Write of size 1 at addr ffffffff8f59ed16 by task kworker/1:4/9668

CPU: 1 PID: 9668 Comm: kworker/1:4 Not tainted 5.11.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events hci_cmd_timeout
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x137/0x1be lib/dump_stack.c:120
 print_address_description+0x5f/0x3a0 mm/kasan/report.c:230
 __kasan_report mm/kasan/report.c:396 [inline]
 kasan_report+0x15e/0x200 mm/kasan/report.c:413
 record_print_text+0x309/0x330 kernel/printk/printk.c:1401
 console_unlock+0x683/0xcf0 kernel/printk/printk.c:2555
 vprintk_emit+0x15e/0x200 kernel/printk/printk.c:2092
 printk+0x62/0x83 kernel/printk/printk.c:2140
 bt_err+0xbc/0xe0 net/bluetooth/lib.c:180
 hci_cmd_timeout+0xb1/0x1d0 net/bluetooth/hci_core.c:2758
 process_one_work+0x789/0xfc0 kernel/workqueue.c:2275
 worker_thread+0xac1/0x1300 kernel/workqueue.c:2421
 kthread+0x39a/0x3c0 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296

The buggy address belongs to the variable:
 devkmsg_open.__key+0x16/0x40

Memory state around the buggy address:
 ffffffff8f59ec00: 04 f9 f9 f9 f9 f9 f9 f9 01 f9 f9 f9 f9 f9 f9 f9
 ffffffff8f59ec80: 01 f9 f9 f9 f9 f9 f9 f9 01 f9 f9 f9 f9 f9 f9 f9
>ffffffff8f59ed00: 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9
                         ^
 ffffffff8f59ed80: 00 f9 f9 f9 f9 f9 f9 f9 01 f9 f9 f9 f9 f9 f9 f9
 ffffffff8f59ee00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================