Bluetooth: hci4: command 0x2016 tx timeout
------------[ cut here ]------------
WARNING: net/bluetooth/hci_conn.c:631 at hci_conn_timeout+0xfc/0x20c net/bluetooth/hci_conn.c:631, CPU#0: kworker/u9:2/4714
Modules linked in:
CPU: 0 UID: 0 PID: 4714 Comm: kworker/u9:2 Tainted: G   M         L      syzkaller #0 PREEMPT 
Tainted: [M]=MACHINE_CHECK, [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
Workqueue: hci4 hci_conn_timeout
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : hci_conn_timeout+0xfc/0x20c net/bluetooth/hci_conn.c:631
lr : hci_conn_timeout+0xfc/0x20c net/bluetooth/hci_conn.c:631
sp : ffff8000928c7b20
x29: ffff8000928c7b20 x28: 1fffe0001a820090 x27: 0000000000000000
x26: ffff0000c1dd0b58 x25: ffff0000f0e2ca40 x24: 1fffe0001e795181
x23: ffff0000d4100000 x22: dfff800000000000 x21: 00000000ffffffff
x20: ffff0000f0e2ca40 x19: ffff0000f0e2c000 x18: 00000000ffffffff
x17: ffff80008a791000 x16: 0000000000000004 x15: ffff80008a31ada0
x14: 00000000ffff8000 x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: ffff60001e1c5803 x9 : 0000000000000000
x8 : 0000000000000000 x7 : ffff800080365bf4 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff800085b2a730
x2 : 00000000ffffffff x1 : ffff0000d4100000 x0 : 0000000000000000
Call trace:
 hci_conn_timeout+0xfc/0x20c net/bluetooth/hci_conn.c:631 (P)
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0x788/0x10b8 kernel/workqueue.c:3405
 worker_thread+0x798/0xbd0 kernel/workqueue.c:3486
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:842
irq event stamp: 13896
hardirqs last  enabled at (13895): [<ffff80008690522c>] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:187 [inline]
hardirqs last  enabled at (13895): [<ffff80008690522c>] _raw_spin_unlock_irq+0x30/0x80 kernel/locking/spinlock.c:206
hardirqs last disabled at (13896): [<ffff8000868dfe78>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:425
softirqs last  enabled at (13848): [<ffff800084c10fac>] __alloc_skb+0x1c0/0x610 net/core/skbuff.c:698
softirqs last disabled at (13846): [<ffff800084c10f94>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (13846): [<ffff800084c10f94>] __alloc_skb+0x1a8/0x610 net/core/skbuff.c:697
---[ end trace 0000000000000000 ]---
Bluetooth: hci4: command 0x2016 tx timeout