Bluetooth: hci1: command 0x0406 tx timeout
Bluetooth: hci0: command 0x0406 tx timeout
Bluetooth: hci4: command 0x0406 tx timeout
Bluetooth: hci2: command 0x0406 tx timeout
Bluetooth: hci3: command 0x0406 tx timeout
INFO: task syz-executor.0:4472 blocked for more than 143 seconds.
      Not tainted 7.0.0-rc4-next-20260317 #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.0  state:D stack:30112 pid:4472  tgid:4465  ppid:278    task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 __schedule+0x1059/0x48b0
 schedule+0xdb/0x390
 schedule_preempt_disabled+0x10/0x20
 rwsem_down_write_slowpath+0x372/0x1310
 down_write+0x1c2/0x1f0
 vfs_fileattr_set+0x14d/0xd80
 ioctl_setflags+0x18e/0x1c0
 do_vfs_ioctl+0x11d/0x1470
 __x64_sys_ioctl+0x116/0x210
 do_syscall_64+0x111/0x690
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4076064b19
RSP: 002b:00007f40735b9188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f4076178020 RCX: 00007f4076064b19
RDX: 00000000200000c0 RSI: 0000000040086602 RDI: 0000000000000004
RBP: 00007f40760bef6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffda8ce899f R14: 00007f40735b9300 R15: 0000000000022000
 </TASK>
INFO: task syz-executor.0:4472 is blocked on an rw-semaphore, but the owner is not found.

Showing all locks held in the system:
1 lock held by khungtaskd/32:
 #0: ffffffff86027500 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0
3 locks held by systemd-journal/98:
1 lock held by in:imklog/178:
 #0: ffff888016131270 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2a8/0x380
2 locks held by syz-executor.0/4472:
 #0: ffff88800fd443e8 (sb_writers#3){.+.+}-{0:0}, at: ioctl_setflags+0x115/0x1c0
 #1: ffff888049028d28 (&sb->s_type->i_mutex_key#8){++++}-{4:4}, at: vfs_fileattr_set+0x14d/0xd80

=============================================