------------[ cut here ]------------
WARNING: net/bluetooth/hci_conn.c:641 at hci_conn_timeout+0xfc/0x20c net/bluetooth/hci_conn.c:641, CPU#1: kworker/u9:2/4710
Modules linked in:
CPU: 1 UID: 0 PID: 4710 Comm: kworker/u9:2 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
Workqueue: hci0 hci_conn_timeout
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : hci_conn_timeout+0xfc/0x20c net/bluetooth/hci_conn.c:641
lr : hci_conn_timeout+0xfc/0x20c net/bluetooth/hci_conn.c:641
sp : ffff8000935d7b20
x29: ffff8000935d7b20 x28: ffff0000f3edcc00 x27: ffff0000d0634a50
x26: dfff800000000000 x25: ffff0000d3f6d880 x24: ffff0000f3edcc08
x23: ffff0000f47a8968 x22: dfff800000000000 x21: 00000000ffffffff
x20: ffff0000d0634a50 x19: ffff0000d0634000 x18: 00000000ffffffff
x17: 0000000000000003 x16: ffff800088a77000 x15: ffff80008a728000
x14: 00000000001b7db0 x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: ffff60001a0c6803 x9 : 0000000000000000
x8 : 0000000000000000 x7 : ffff80008036025c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff800085af2494
x2 : 00000000ffffffff x1 : ffff0000d3f6d880 x0 : 0000000000000000
Call trace:
 hci_conn_timeout+0xfc/0x20c net/bluetooth/hci_conn.c:641 (P)
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3479
 worker_thread+0x798/0xbd0 kernel/workqueue.c:3560
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
irq event stamp: 22672
hardirqs last  enabled at (22671): [<ffff80008688ceb4>] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:219 [inline]
hardirqs last  enabled at (22671): [<ffff80008688ceb4>] _raw_spin_unlock_irq+0x30/0x80 kernel/locking/spinlock.c:229
hardirqs last disabled at (22672): [<ffff8000868689ac>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:483
softirqs last  enabled at (22632): [<ffff80008030af1c>] softirq_handle_end kernel/softirq.c:491 [inline]
softirqs last  enabled at (22632): [<ffff80008030af1c>] handle_softirqs+0xb2c/0xcbc kernel/softirq.c:673
softirqs last disabled at (22473): [<ffff8000800203f0>] __do_softirq+0x14/0x20 kernel/softirq.c:679
---[ end trace 0000000000000000 ]---