Bluetooth: hci5: command 0x0406 tx timeout
Bluetooth: hci6: command 0x0406 tx timeout
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	1-....: (1 GPs behind) idle=eb3c/1/0x4000000000000000 softirq=411432/411434 fqs=20926
rcu: 	(detected by 0, t=105002 jiffies, g=315813, q=69747 ncpus=2)
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 7006 Comm: syz-executor.1 Not tainted 6.5.0-rc1-next-20230714 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:__kasan_check_read+0x8/0x20
Code: 89 c6 48 c7 c7 b0 dc 20 85 5b 5d 41 5c e9 f0 6d ae ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 8b 0c 24 <89> f6 31 d2 e9 7f f1 ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f
RSP: 0018:ffff88806cf09510 EFLAGS: 00000056
RAX: 0000000000000000 RBX: 0000000000000018 RCX: ffffffff812d5b58
RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffffff877d3b00
RBP: ffff88801028dbb0 R08: dffffc0000000000 R09: fffffbfff0efa760
R10: ffffffff877d3b07 R11: 0000000000000001 R12: ffff88801028d1c0
R13: 0000000000000002 R14: dffffc0000000000 R15: 0000000000000002
FS:  00007f9257b6e700(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f925a708000 CR3: 00000000315b2000 CR4: 0000000000350ee0
Call Trace:
 <NMI>
 </NMI>
 <IRQ>
 __lock_acquire+0x758/0x6340
 lock_acquire+0x19a/0x4c0
 perf_event_output_forward+0xa9/0x3c0
 __perf_event_overflow+0x4c2/0x9e0
 perf_swevent_event+0x2c6/0x3f0
 perf_tp_event+0x2dd/0x1280
 perf_trace_run_bpf_submit+0xf3/0x190
 perf_trace_preemptirq_template+0x252/0x420
 trace_hardirqs_on+0xce/0x100
 asm_sysvec_irq_work+0x1a/0x20
RIP: 0010:__rcu_read_unlock+0xc8/0x4f0
Code: b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e 76 01 00 00 8b 85 f8 03 00 00 85 c0 75 58 <65> 48 8b 1c 25 00 8b 03 00 48 8d bb f4 03 00 00 48 b8 00 00 00 00
RSP: 0018:ffff88806cf09db8 EFLAGS: 00000206
RAX: 0000000000030dbe RBX: ffff88806cf3a300 RCX: ffffffff812d209f
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff81378761
RBP: ffffffff85616a00 R08: 0000000000000001 R09: fffffbfff0efa776
R10: ffffffff877d3bb7 R11: 0000000000000001 R12: 0000000000000001
R13: ffffffff8316ad00 R14: 0000000000000200 R15: dffffc0000000000
 ieee80211_iterate_active_interfaces_atomic+0x95/0x1c0
 mac80211_hwsim_beacon+0x105/0x200
 __hrtimer_run_queues+0x59d/0xb60
 hrtimer_run_softirq+0x14c/0x310
 __do_softirq+0x1b7/0x7d4
 irq_exit_rcu+0x93/0xc0
 sysvec_apic_timer_interrupt+0x6e/0x90
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:generic_exec_single+0x90/0x540
Code: 76 95 92 04 0f 92 c3 31 ff 89 de e8 1a e2 0a 00 84 db 0f 84 f4 03 00 00 e8 cd e6 0a 00 4c 89 e6 89 ef 45 31 e4 e8 10 fb ff ff <e8> bb e6 0a 00 44 89 e0 5b 5d 41 5c 41 5d 41 5e e9 eb 4c 14 03 e8
RSP: 0018:ffff888043587b10 EFLAGS: 00000206
RAX: 00000000000001f9 RBX: 0000000000000200 RCX: ffffffff812d209f
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff81419347
RBP: 0000000000000001 R08: 0000000000000001 R09: fffffbfff0efa776
R10: ffffffff877d3bb7 R11: 0000000000000001 R12: 0000000000000000
R13: ffff888043587c38 R14: ffff888043587b88 R15: ffff88801028d1d4
 smp_call_function_single+0x327/0x410
 task_function_call+0xe5/0x180
 perf_install_in_context+0x2cb/0x570
 __do_sys_perf_event_open+0x18bf/0x2a60
 do_syscall_64+0x3f/0x90
 entry_SYSCALL_64_after_hwframe+0x6e/0xd8
RIP: 0033:0x7f925a5f8b19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f9257b6e188 EFLAGS: 00000246 ORIG_RAX: 000000000000012a
RAX: ffffffffffffffda RBX: 00007f925a70bf60 RCX: 00007f925a5f8b19
RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000000020000300
RBP: 00007f925a652f6d R08: 0000000000000000 R09: 0000000000000000
R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffd8ddf62bf R14: 00007f9257b6e300 R15: 0000000000022000
 </TASK>
----------------
Code disassembly (best guess):
   0:	89 c6                	mov    %eax,%esi
   2:	48 c7 c7 b0 dc 20 85 	mov    $0xffffffff8520dcb0,%rdi
   9:	5b                   	pop    %rbx
   a:	5d                   	pop    %rbp
   b:	41 5c                	pop    %r12
   d:	e9 f0 6d ae ff       	jmpq   0xffae6e02
  12:	90                   	nop
  13:	90                   	nop
  14:	90                   	nop
  15:	90                   	nop
  16:	90                   	nop
  17:	90                   	nop
  18:	90                   	nop
  19:	90                   	nop
  1a:	90                   	nop
  1b:	90                   	nop
  1c:	90                   	nop
  1d:	90                   	nop
  1e:	90                   	nop
  1f:	90                   	nop
  20:	90                   	nop
  21:	90                   	nop
  22:	f3 0f 1e fa          	endbr64
  26:	48 8b 0c 24          	mov    (%rsp),%rcx
* 2a:	89 f6                	mov    %esi,%esi <-- trapping instruction
  2c:	31 d2                	xor    %edx,%edx
  2e:	e9 7f f1 ff ff       	jmpq   0xfffff1b2
  33:	66 66 2e 0f 1f 84 00 	data16 nopw %cs:0x0(%rax,%rax,1)
  3a:	00 00 00 00
  3e:	0f                   	.byte 0xf
  3f:	1f                   	(bad)