------------[ cut here ]------------
WARNING: CPU: 1 PID: 11867 at net/bluetooth/hci_conn.c:646 hci_conn_timeout+0x246/0x330
Modules linked in:
CPU: 1 PID: 11867 Comm: kworker/u5:1 Not tainted 6.2.0-rc6-next-20230130 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Workqueue: hci1 hci_conn_timeout
RIP: 0010:hci_conn_timeout+0x246/0x330
Code: ff e8 ee 2a 73 fd 4c 89 e7 e8 96 9c 0a 00 0f b6 e8 e8 de 2a 73 fd 89 ee 4c 89 e7 e8 84 f3 ff ff e9 1a ff ff ff e8 ca 2a 73 fd <0f> 0b e9 36 fe ff ff 84 c0 74 93 4c 89 ef e8 d7 75 a7 fd eb 89 48
RSP: 0018:ffff88803b92fce8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88801945e250 RCX: 0000000000000000
RDX: ffff888035d75040 RSI: ffffffff83d83386 RDI: 0000000000000005
RBP: 00000000fffffffb R08: 0000000000000005 R09: 0000000000000000
R10: 00000000fffffffb R11: 0000000000000001 R12: ffff88803b92fdb0
R13: ffff88800dd45060 R14: ffff88800dd45000 R15: ffff88800fd68600
FS:  0000000000000000(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff35537bd8 CR3: 000000002d8d4000 CR4: 0000000000350ee0
DR0: 0000000020000100 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <TASK>
 process_one_work+0xa0f/0x1790
 worker_thread+0x63b/0x1260
 kthread+0x2e9/0x3a0
 ret_from_fork+0x2c/0x50
 </TASK>
irq event stamp: 4669
hardirqs last  enabled at (4679): [<ffffffff812f9438>] __up_console_sem+0x78/0x80
hardirqs last disabled at (4690): [<ffffffff812f941d>] __up_console_sem+0x5d/0x80
softirqs last  enabled at (4370): [<ffffffff8118d1ec>] __irq_exit_rcu+0xcc/0x110
softirqs last disabled at (4711): [<ffffffff8118d1ec>] __irq_exit_rcu+0xcc/0x110
---[ end trace 0000000000000000 ]---
Bluetooth: hci1: command 0x0406 tx timeout
netlink: 16 bytes leftover after parsing attributes in process `syz-executor.7'.
netlink: 16 bytes leftover after parsing attributes in process `syz-executor.7'.
random: crng reseeded on system resumption
random: crng reseeded on system resumption
netlink: 16 bytes leftover after parsing attributes in process `syz-executor.7'.
netlink: 16 bytes leftover after parsing attributes in process `syz-executor.3'.
netlink: 16 bytes leftover after parsing attributes in process `syz-executor.3'.
netlink: 16 bytes leftover after parsing attributes in process `syz-executor.7'.
semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant.
The task syz-executor.0 (16413) triggered the difference, watch for misbehavior.
netlink: 16 bytes leftover after parsing attributes in process `syz-executor.7'.
netlink: 16 bytes leftover after parsing attributes in process `syz-executor.3'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'.