Bluetooth: hci3: command 0x0406 tx timeout
------------[ cut here ]------------
WARNING: net/bluetooth/hci_conn.c:641 at hci_conn_timeout+0xfc/0x20c net/bluetooth/hci_conn.c:641, CPU#0: kworker/u9:8/4731
Modules linked in:
CPU: 0 UID: 0 PID: 4731 Comm: kworker/u9:8 Tainted: G             L      syzkaller #0 PREEMPT 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
Workqueue: hci4 hci_conn_timeout
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : hci_conn_timeout+0xfc/0x20c net/bluetooth/hci_conn.c:641
lr : hci_conn_timeout+0xfc/0x20c net/bluetooth/hci_conn.c:641
sp : ffff8000982e7b20
x29: ffff8000982e7b20 x28: ffff0000ce26f400 x27: ffff0000c6e4ca50
x26: dfff800000000000 x25: ffff0000d3fc9d80 x24: ffff0000ce26f408
x23: ffff0000dce65168 x22: dfff800000000000 x21: 00000000ffffffff
x20: ffff0000c6e4ca50 x19: ffff0000c6e4c000 x18: 00000000ffffffff
x17: 0000000000000003 x16: ffff800088a77000 x15: ffff80008a728000
x14: ffff80008af602b0 x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: ffff600018dc9803 x9 : 0000000000000000
x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
x5 : ffff80008a746240 x4 : 0000000000000008 x3 : ffff800085af2494
x2 : 00000000ffffffff x1 : ffff0000d3fc9d80 x0 : 0000000000000000
Call trace:
 hci_conn_timeout+0xfc/0x20c net/bluetooth/hci_conn.c:641 (P)
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3479
 worker_thread+0x798/0xbd0 kernel/workqueue.c:3560
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
irq event stamp: 4594
hardirqs last  enabled at (4593): [<ffff80008688ce24>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline]
hardirqs last  enabled at (4593): [<ffff80008688ce24>] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:221
hardirqs last disabled at (4594): [<ffff8000868689ac>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:483
softirqs last  enabled at (4512): [<ffff800084bbe704>] __alloc_skb+0x1c0/0x610 net/core/skbuff.c:698
softirqs last disabled at (4506): [<ffff800084bbe6ec>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (4506): [<ffff800084bbe6ec>] __alloc_skb+0x1a8/0x610 net/core/skbuff.c:697
---[ end trace 0000000000000000 ]---
Bluetooth: hci4: command 0x2016 tx timeout