Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:580
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 1268, name: kworker/u5:1
preempt_count: 0, expected: 0
RCU nest depth: 1, expected: 0
4 locks held by kworker/u5:1/1268:
 #0: ffff888100f95d38 ((wq_completion)hci0#2){....}-{0:0}, at: process_one_work+0x1d7/0x4a0 kernel/workqueue.c:2572
 #1: ffffc90002bf3e48 ((work_completion)(&hdev->rx_work)){....}-{0:0}, at: process_one_work+0x201/0x4a0 kernel/workqueue.c:2574
 #2: ffff88810b68c078 (&hdev->lock){....}-{3:3}, at: hci_le_create_big_complete_evt+0x5b/0x250 net/bluetooth/hci_event.c:6947
 #3: ffffffff8377e740 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30 include/trace/events/initcall.h:48
CPU: 0 PID: 1268 Comm: kworker/u5:1 Not tainted 6.5.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: hci0 hci_rx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x83/0xd0 lib/dump_stack.c:106
 __might_resched+0x1a3/0x1c0 kernel/sched/core.c:10189
 __mutex_lock_common+0x7d/0xe50 kernel/locking/mutex.c:580
 __mutex_lock kernel/locking/mutex.c:747 [inline]
 mutex_lock_nested+0x1b/0x30 kernel/locking/mutex.c:799
 hci_connect_cfm include/net/bluetooth/hci_core.h:1852 [inline]
 hci_le_create_big_complete_evt+0x131/0x250 net/bluetooth/hci_event.c:6970
 hci_event_func net/bluetooth/hci_event.c:7512 [inline]
 hci_event_packet+0x30b/0x540 net/bluetooth/hci_event.c:7567
 hci_rx_work+0x1c1/0x4d0 net/bluetooth/hci_core.c:4090
 process_one_work+0x253/0x4a0 kernel/workqueue.c:2600
 worker_thread+0x1d6/0x380 kernel/workqueue.c:2751
 kthread+0xf8/0x110 kernel/kthread.c:389
 ret_from_fork+0x32/0x40 arch/x86/kernel/process.c:145
 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:304
 </TASK>
Bluetooth: hci0: command 0x0409 tx timeout
Bluetooth: hci0: command 0x041b tx timeout
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:580
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 1268, name: kworker/u5:1
preempt_count: 0, expected: 0
RCU nest depth: 1, expected: 0
4 locks held by kworker/u5:1/1268:
 #0: ffff888100f95d38 ((wq_completion)hci0#2){....}-{0:0}, at: process_one_work+0x1d7/0x4a0 kernel/workqueue.c:2572
 #1: ffffc90002bf3e48 ((work_completion)(&hdev->rx_work)){....}-{0:0}, at: process_one_work+0x201/0x4a0 kernel/workqueue.c:2574
 #2: ffff88810b68c078 (&hdev->lock){....}-{3:3}, at: hci_le_create_big_complete_evt+0x5b/0x250 net/bluetooth/hci_event.c:6947
 #3: ffffffff8377e740 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30 include/trace/events/initcall.h:48
CPU: 1 PID: 1268 Comm: kworker/u5:1 Tainted: G        W          6.5.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: hci0 hci_rx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x83/0xd0 lib/dump_stack.c:106
 __might_resched+0x1a3/0x1c0 kernel/sched/core.c:10189
 __mutex_lock_common+0x7d/0xe50 kernel/locking/mutex.c:580
 __mutex_lock kernel/locking/mutex.c:747 [inline]
 mutex_lock_nested+0x1b/0x30 kernel/locking/mutex.c:799
 hci_connect_cfm include/net/bluetooth/hci_core.h:1852 [inline]
 hci_le_create_big_complete_evt+0x131/0x250 net/bluetooth/hci_event.c:6970
 hci_event_func net/bluetooth/hci_event.c:7512 [inline]
 hci_event_packet+0x30b/0x540 net/bluetooth/hci_event.c:7567
 hci_rx_work+0x1c1/0x4d0 net/bluetooth/hci_core.c:4090
 process_one_work+0x253/0x4a0 kernel/workqueue.c:2600
 worker_thread+0x1d6/0x380 kernel/workqueue.c:2751
 kthread+0xf8/0x110 kernel/kthread.c:389
 ret_from_fork+0x32/0x40 arch/x86/kernel/process.c:145
 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:304
 </TASK>
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:580
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 1268, name: kworker/u5:1
preempt_count: 0, expected: 0
RCU nest depth: 1, expected: 0
4 locks held by kworker/u5:1/1268:
 #0: ffff888100f95d38 ((wq_completion)hci0#2){....}-{0:0}, at: process_one_work+0x1d7/0x4a0 kernel/workqueue.c:2572
 #1: ffffc90002bf3e48 ((work_completion)(&hdev->rx_work)){....}-{0:0}, at: process_one_work+0x201/0x4a0 kernel/workqueue.c:2574
 #2: ffff88810b68c078 (&hdev->lock){....}-{3:3}, at: hci_le_create_big_complete_evt+0x5b/0x250 net/bluetooth/hci_event.c:6947
 #3: ffffffff8377e740 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30 include/trace/events/initcall.h:48
CPU: 0 PID: 1268 Comm: kworker/u5:1 Tainted: G        W          6.5.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: hci0 hci_rx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x83/0xd0 lib/dump_stack.c:106
 __might_resched+0x1a3/0x1c0 kernel/sched/core.c:10189
 __mutex_lock_common+0x7d/0xe50 kernel/locking/mutex.c:580
 __mutex_lock kernel/locking/mutex.c:747 [inline]
 mutex_lock_nested+0x1b/0x30 kernel/locking/mutex.c:799
 hci_connect_cfm include/net/bluetooth/hci_core.h:1852 [inline]
 hci_le_create_big_complete_evt+0x131/0x250 net/bluetooth/hci_event.c:6970
 hci_event_func net/bluetooth/hci_event.c:7512 [inline]
 hci_event_packet+0x30b/0x540 net/bluetooth/hci_event.c:7567
 hci_rx_work+0x1c1/0x4d0 net/bluetooth/hci_core.c:4090
 process_one_work+0x253/0x4a0 kernel/workqueue.c:2600
 worker_thread+0x1d6/0x380 kernel/workqueue.c:2751
 kthread+0xf8/0x110 kernel/kthread.c:389
 ret_from_fork+0x32/0x40 arch/x86/kernel/process.c:145
 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:304
 </TASK>
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:580
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 1268, name: kworker/u5:1
preempt_count: 0, expected: 0
RCU nest depth: 1, expected: 0
4 locks held by kworker/u5:1/1268:
 #0: ffff888100f95d38 ((wq_completion)hci0#2){....}-{0:0}, at: process_one_work+0x1d7/0x4a0 kernel/workqueue.c:2572
 #1: ffffc90002bf3e48 ((work_completion)(&hdev->rx_work)){....}-{0:0}, at: process_one_work+0x201/0x4a0 kernel/workqueue.c:2574
 #2: ffff88810b68c078 (&hdev->lock){....}-{3:3}, at: hci_le_create_big_complete_evt+0x5b/0x250 net/bluetooth/hci_event.c:6947
 #3: ffffffff8377e740 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30 include/trace/events/initcall.h:48
CPU: 0 PID: 1268 Comm: kworker/u5:1 Tainted: G        W          6.5.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: hci0 hci_rx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x83/0xd0 lib/dump_stack.c:106
 __might_resched+0x1a3/0x1c0 kernel/sched/core.c:10189
 __mutex_lock_common+0x7d/0xe50 kernel/locking/mutex.c:580
 __mutex_lock kernel/locking/mutex.c:747 [inline]
 mutex_lock_nested+0x1b/0x30 kernel/locking/mutex.c:799
 hci_connect_cfm include/net/bluetooth/hci_core.h:1852 [inline]
 hci_le_create_big_complete_evt+0x131/0x250 net/bluetooth/hci_event.c:6970
 hci_event_func net/bluetooth/hci_event.c:7512 [inline]
 hci_event_packet+0x30b/0x540 net/bluetooth/hci_event.c:7567
 hci_rx_work+0x1c1/0x4d0 net/bluetooth/hci_core.c:4090
 process_one_work+0x253/0x4a0 kernel/workqueue.c:2600
 worker_thread+0x1d6/0x380 kernel/workqueue.c:2751
 kthread+0xf8/0x110 kernel/kthread.c:389
 ret_from_fork+0x32/0x40 arch/x86/kernel/process.c:145
 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:304
 </TASK>
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:580
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 1268, name: kworker/u5:1
preempt_count: 0, expected: 0
RCU nest depth: 1, expected: 0
4 locks held by kworker/u5:1/1268:
 #0: ffff888100f95d38 ((wq_completion)hci0#2){....}-{0:0}, at: process_one_work+0x1d7/0x4a0 kernel/workqueue.c:2572
 #1: ffffc90002bf3e48 ((work_completion)(&hdev->rx_work)){....}-{0:0}, at: process_one_work+0x201/0x4a0 kernel/workqueue.c:2574
 #2: ffff88810b68c078 (&hdev->lock){....}-{3:3}, at: hci_le_create_big_complete_evt+0x5b/0x250 net/bluetooth/hci_event.c:6947
 #3: ffffffff8377e740 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30 include/trace/events/initcall.h:48
CPU: 0 PID: 1268 Comm: kworker/u5:1 Tainted: G        W          6.5.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: hci0 hci_rx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x83/0xd0 lib/dump_stack.c:106
 __might_resched+0x1a3/0x1c0 kernel/sched/core.c:10189
 __mutex_lock_common+0x7d/0xe50 kernel/locking/mutex.c:580
 __mutex_lock kernel/locking/mutex.c:747 [inline]
 mutex_lock_nested+0x1b/0x30 kernel/locking/mutex.c:799
 hci_connect_cfm include/net/bluetooth/hci_core.h:1852 [inline]
 hci_le_create_big_complete_evt+0x131/0x250 net/bluetooth/hci_event.c:6970
 hci_event_func net/bluetooth/hci_event.c:7512 [inline]
 hci_event_packet+0x30b/0x540 net/bluetooth/hci_event.c:7567
 hci_rx_work+0x1c1/0x4d0 net/bluetooth/hci_core.c:4090
 process_one_work+0x253/0x4a0 kernel/workqueue.c:2600
 worker_thread+0x1d6/0x380 kernel/workqueue.c:2751
 kthread+0xf8/0x110 kernel/kthread.c:389
 ret_from_fork+0x32/0x40 arch/x86/kernel/process.c:145
 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:304
 </TASK>
Bluetooth: hci0: command 0x0419 tx timeout
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:580
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 1268, name: kworker/u5:1
preempt_count: 0, expected: 0
RCU nest depth: 1, expected: 0
4 locks held by kworker/u5:1/1268:
 #0: ffff888100f95d38 ((wq_completion)hci0#2){....}-{0:0}, at: process_one_work+0x1d7/0x4a0 kernel/workqueue.c:2572
 #1: ffffc90002bf3e48 ((work_completion)(&hdev->rx_work)){....}-{0:0}, at: process_one_work+0x201/0x4a0 kernel/workqueue.c:2574
 #2: ffff88810b68c078 (&hdev->lock){....}-{3:3}, at: hci_le_create_big_complete_evt+0x5b/0x250 net/bluetooth/hci_event.c:6947
 #3: ffffffff8377e740 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30 include/trace/events/initcall.h:48
CPU: 0 PID: 1268 Comm: kworker/u5:1 Tainted: G        W          6.5.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: hci0 hci_rx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x83/0xd0 lib/dump_stack.c:106
 __might_resched+0x1a3/0x1c0 kernel/sched/core.c:10189
 __mutex_lock_common+0x7d/0xe50 kernel/locking/mutex.c:580
 __mutex_lock kernel/locking/mutex.c:747 [inline]
 mutex_lock_nested+0x1b/0x30 kernel/locking/mutex.c:799
 hci_connect_cfm include/net/bluetooth/hci_core.h:1852 [inline]
 hci_le_create_big_complete_evt+0x131/0x250 net/bluetooth/hci_event.c:6970
 hci_event_func net/bluetooth/hci_event.c:7512 [inline]
 hci_event_packet+0x30b/0x540 net/bluetooth/hci_event.c:7567
 hci_rx_work+0x1c1/0x4d0 net/bluetooth/hci_core.c:4090
 process_one_work+0x253/0x4a0 kernel/workqueue.c:2600
 worker_thread+0x1d6/0x380 kernel/workqueue.c:2751
 kthread+0xf8/0x110 kernel/kthread.c:389
 ret_from_fork+0x32/0x40 arch/x86/kernel/process.c:145
 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:304
 </TASK>
Bluetooth: hci0: command 0x206c tx timeout
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:580
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 1268, name: kworker/u5:1
preempt_count: 0, expected: 0
RCU nest depth: 1, expected: 0
4 locks held by kworker/u5:1/1268:
 #0: ffff888100f95d38 ((wq_completion)hci0#2){....}-{0:0}, at: process_one_work+0x1d7/0x4a0 kernel/workqueue.c:2572
 #1: ffffc90002bf3e48 ((work_completion)(&hdev->rx_work)){....}-{0:0}, at: process_one_work+0x201/0x4a0 kernel/workqueue.c:2574
 #2: ffff88810b68c078 (&hdev->lock){....}-{3:3}, at: hci_le_create_big_complete_evt+0x5b/0x250 net/bluetooth/hci_event.c:6947
 #3: ffffffff8377e740 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30 include/trace/events/initcall.h:48
CPU: 0 PID: 1268 Comm: kworker/u5:1 Tainted: G        W          6.5.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: hci0 hci_rx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x83/0xd0 lib/dump_stack.c:106
 __might_resched+0x1a3/0x1c0 kernel/sched/core.c:10189
 __mutex_lock_common+0x7d/0xe50 kernel/locking/mutex.c:580
 __mutex_lock kernel/locking/mutex.c:747 [inline]
 mutex_lock_nested+0x1b/0x30 kernel/locking/mutex.c:799
 hci_connect_cfm include/net/bluetooth/hci_core.h:1852 [inline]
 hci_le_create_big_complete_evt+0x131/0x250 net/bluetooth/hci_event.c:6970
 hci_event_func net/bluetooth/hci_event.c:7512 [inline]
 hci_event_packet+0x30b/0x540 net/bluetooth/hci_event.c:7567
 hci_rx_work+0x1c1/0x4d0 net/bluetooth/hci_core.c:4090
 process_one_work+0x253/0x4a0 kernel/workqueue.c:2600
 worker_thread+0x1d6/0x380 kernel/workqueue.c:2751
 kthread+0xf8/0x110 kernel/kthread.c:389
 ret_from_fork+0x32/0x40 arch/x86/kernel/process.c:145
 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:304
 </TASK>