Bluetooth: hci4: command tx timeout
BUG: workqueue leaked atomic, lock or RCU: kworker/u33:0[66]
     preempt=0x00000000 lock=0->1 RCU=0->0 workfn=hci_rx_work
1 lock held by kworker/u33:0/66:
 #0: ffff88802a916518 (&chan->lock#2/1){+.+.}-{3:3}, at: l2cap_chan_lock include/net/bluetooth/l2cap.h:827 [inline]
 #0: ffff88802a916518 (&chan->lock#2/1){+.+.}-{3:3}, at: l2cap_conless_channel net/bluetooth/l2cap_core.c:6764 [inline]
 #0: ffff88802a916518 (&chan->lock#2/1){+.+.}-{3:3}, at: l2cap_recv_frame+0x14f6/0x8e20 net/bluetooth/l2cap_core.c:6830
CPU: 1 UID: 0 PID: 66 Comm: kworker/u33:0 Not tainted 6.10.0-syzkaller-12246-g786c8248dbd3 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: hci9 hci_rx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:93 [inline]
 dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:119
 process_one_work+0x1170/0x1ad0 kernel/workqueue.c:3252
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xf20 kernel/workqueue.c:3390
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>