Bluetooth: hci0: command 0x0409 tx timeout
------------[ cut here ]------------
WARNING: CPU: 0 PID: 4431 at net/bluetooth/hci_conn.c:2875 abort_conn_sync+0x387/0x3c0 net/bluetooth/hci_conn.c:2875
Modules linked in:
CPU: 0 PID: 4431 Comm: kworker/u5:1 Not tainted 6.5.0-rc5-syzkaller-01535-gf0835e7404b7-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
Workqueue: hci0 hci_cmd_sync_work
RIP: 0010:abort_conn_sync+0x387/0x3c0 net/bluetooth/hci_conn.c:2875
Code: f8 48 c7 c2 40 59 97 8b be 0a 03 00 00 48 c7 c7 00 59 97 8b c6 05 b7 fa 60 05 01 e8 43 b4 30 f8 e9 9c fd ff ff e8 c9 87 50 f8 <0f> 0b 31 db e9 1b fe ff ff e8 bb 6c a5 f8 e9 52 fd ff ff 48 89 df
RSP: 0018:ffffc900068afc58 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88802a874000 RCX: 0000000000000000
RDX: ffff88802cf15940 RSI: ffffffff893568c7 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000
R13: ffff88801878d220 R14: ffff88801878c000 R15: 0000000000000f00
FS:  0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f02c7df9378 CR3: 000000000c776000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 hci_cmd_sync_work+0x1a4/0x3c0 net/bluetooth/hci_sync.c:306
 process_one_work+0xaa2/0x16f0 kernel/workqueue.c:2600
 worker_thread+0x687/0x1110 kernel/workqueue.c:2751
 kthread+0x33a/0x430 kernel/kthread.c:389
 ret_from_fork+0x2c/0x70 arch/x86/kernel/process.c:145
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
 </TASK>