Bluetooth: hci4: command 0x0406 tx timeout
Bluetooth: hci3: command 0x0406 tx timeout
Bluetooth: hci7: command 0x0406 tx timeout
Bluetooth: hci6: command 0x0406 tx timeout
Bluetooth: hci1: command 0x0406 tx timeout
watchdog: BUG: soft lockup - CPU#1 stuck for 23s! [syz-executor.5:6329]
Modules linked in:
irq event stamp: 6306305
hardirqs last  enabled at (6306304): [<ffffffff8460144a>] asm_sysvec_apic_timer_interrupt+0x1a/0x20
hardirqs last disabled at (6306305): [<ffffffff843dbf9f>] sysvec_apic_timer_interrupt+0xf/0xc0
softirqs last  enabled at (6300692): [<ffffffff8118221b>] __irq_exit_rcu+0x11b/0x180
softirqs last disabled at (6300695): [<ffffffff8118221b>] __irq_exit_rcu+0x11b/0x180
CPU: 1 PID: 6329 Comm: syz-executor.5 Not tainted 6.1.0-rc5-next-20221116 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:_raw_spin_unlock_irqrestore+0x32/0x60
Code: 48 83 c7 18 53 48 89 f3 48 8b 74 24 10 e8 b6 21 ec fc 48 89 ef e8 7e 99 ec fc 80 e7 02 74 06 e8 a4 10 10 fd fb bf 01 00 00 00 <e8> 39 f6 e1 fc 65 8b 05 ca a0 c3 7b 85 c0 74 07 5b 5d e9 3b 29 00
RSP: 0018:ffff88806cf09ea0 EFLAGS: 00000206
RAX: 0000000000603996 RBX: 0000000000000246 RCX: ffffffff812b698f
RDX: 0000000000000000 RSI: 0000000000000102 RDI: 0000000000000001
RBP: ffff8880422d1628 R08: 0000000000000001 R09: ffffffff8762f847
R10: fffffbfff0ec5f08 R11: 0000000000000001 R12: 0000000000000000
R13: ffff8880422d1628 R14: ffff8880422d1610 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0d35d81e28 CR3: 0000000018fe6000 CR4: 0000000000350ee0
Call Trace:
 <IRQ>
 skb_dequeue+0x129/0x180
 ieee80211_tasklet_handler+0x10c/0x140
 tasklet_action_common.constprop.0+0x208/0x2f0
 __do_softirq+0x1c7/0x8f9
 __irq_exit_rcu+0x11b/0x180
 irq_exit_rcu+0x9/0x30
 sysvec_apic_timer_interrupt+0x92/0xc0
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:__rcu_read_unlock+0xc8/0x520
Code: b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e 9f 01 00 00 8b 85 f8 03 00 00 85 c0 75 58 <65> 48 8b 1c 25 c0 86 03 00 48 8d bb f4 03 00 00 48 b8 00 00 00 00
RSP: 0018:ffff888052627610 EFLAGS: 00000206
RAX: 000000000028c89f RBX: ffff888043418000 RCX: ffffffff812b698f
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000001 R09: ffffffff8762f847
R10: fffffbfff0ec5f08 R11: 0000000000000001 R12: ffff88806cf39e00
R13: ffffea0000ecf900 R14: 0000000000000200 R15: 0000000000000000
 unlock_page_memcg+0xc7/0x230
 page_remove_rmap+0x1ca/0x780
 unmap_page_range+0x2002/0x2c30
 unmap_single_vma+0x190/0x2a0
 unmap_vmas+0x226/0x380
 exit_mmap+0x158/0x680
 mmput+0xd5/0x390
 do_exit+0x99b/0x2720
 do_group_exit+0xd4/0x2a0
 get_signal+0x21a5/0x22e0
 arch_do_signal_or_restart+0x79/0x5a0
 exit_to_user_mode_prepare+0x131/0x1a0
 syscall_exit_to_user_mode+0x1d/0x50
 do_syscall_64+0x4c/0x90
 entry_SYSCALL_64_after_hwframe+0x72/0xdc
RIP: 0033:0x7f5e9749ab19
Code: Unable to access opcode bytes at 0x7f5e9749aaef.
RSP: 002b:00007f5e94a10188 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: 0000000000000005 RBX: 00007f5e975adf60 RCX: 00007f5e9749ab19
RDX: 00000000000026e1 RSI: 00000000200014c0 RDI: ffffffffffffff9c
RBP: 00007f5e974f4f6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000062 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc600521af R14: 00007f5e94a10300 R15: 0000000000022000
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0 skipped: idling at default_idle+0xf/0x20
----------------
Code disassembly (best guess):
   0:	48 83 c7 18          	add    $0x18,%rdi
   4:	53                   	push   %rbx
   5:	48 89 f3             	mov    %rsi,%rbx
   8:	48 8b 74 24 10       	mov    0x10(%rsp),%rsi
   d:	e8 b6 21 ec fc       	callq  0xfcec21c8
  12:	48 89 ef             	mov    %rbp,%rdi
  15:	e8 7e 99 ec fc       	callq  0xfcec9998
  1a:	80 e7 02             	and    $0x2,%bh
  1d:	74 06                	je     0x25
  1f:	e8 a4 10 10 fd       	callq  0xfd1010c8
  24:	fb                   	sti
  25:	bf 01 00 00 00       	mov    $0x1,%edi
* 2a:	e8 39 f6 e1 fc       	callq  0xfce1f668 <-- trapping instruction
  2f:	65 8b 05 ca a0 c3 7b 	mov    %gs:0x7bc3a0ca(%rip),%eax        # 0x7bc3a100
  36:	85 c0                	test   %eax,%eax
  38:	74 07                	je     0x41
  3a:	5b                   	pop    %rbx
  3b:	5d                   	pop    %rbp
  3c:	e9                   	.byte 0xe9
  3d:	3b 29                	cmp    (%rcx),%ebp