------------[ cut here ]------------
workqueue: cannot queue hci_cmd_timeout on wq hci1
WARNING: CPU: 1 PID: 5957 at kernel/workqueue.c:2257 __queue_work+0xc9c/0x10f0 kernel/workqueue.c:2256
Modules linked in:
CPU: 1 UID: 0 PID: 5957 Comm: syz-executor Not tainted 6.16.0-rc5-syzkaller-00266-g3f31a806a62e #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:__queue_work+0xc9c/0x10f0 kernel/workqueue.c:2256
Code: 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 28 04 00 00 48 8b 75 18 4c 89 f2 48 c7 c7 c0 05 ac 8b e8 45 44 f7 ff 90 <0f> 0b 90 90 e9 96 f7 ff ff e8 a6 f3 37 00 90 0f 0b 90 e9 1b f6 ff
RSP: 0018:ffffc90000590be8 EFLAGS: 00010082
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817ab108
RDX: ffff8880206ba440 RSI: ffffffff817ab115 RDI: 0000000000000001
RBP: ffff888025930970 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 1ffff920000b218f
R13: 0000000000000101 R14: ffff888024c99978 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff888097620000(0063) knlGS:000000005845f440
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f7424230 CR3: 0000000066df4000 CR4: 0000000000352ef0
Call Trace:
 <IRQ>
 call_timer_fn+0x197/0x620 kernel/time/timer.c:1747
 expire_timers kernel/time/timer.c:1793 [inline]
 __run_timers+0x569/0x960 kernel/time/timer.c:2372
 __run_timer_base kernel/time/timer.c:2384 [inline]
 __run_timer_base kernel/time/timer.c:2376 [inline]
 run_timer_base+0x114/0x190 kernel/time/timer.c:2393
 run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2403
 handle_softirqs+0x219/0x8e0 kernel/softirq.c:579
 __do_softirq kernel/softirq.c:613 [inline]
 invoke_softirq kernel/softirq.c:453 [inline]
 __irq_exit_rcu+0x109/0x170 kernel/softirq.c:680
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1050
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:check_preemption_disabled+0x25/0xe0 lib/smp_processor_id.c:56
Code: 90 90 90 90 90 41 54 55 53 48 83 ec 08 65 8b 1d 35 7c 4b 08 65 8b 05 2a 7c 4b 08 a9 ff ff ff 7f 74 0f 48 83 c4 08 89 d8 5b 5d <41> 5c e9 44 df 02 00 9c 58 f6 c4 02 74 ea 48 89 fd 65 48 8b 05 ea
RSP: 0018:ffffc9000109f6c8 EFLAGS: 00000286
RAX: 0000000000000001 RBX: ffffffff8e5c4c40 RCX: 00000000dc25c6d3
RDX: 0000000000000000 RSI: ffffffff8c157860 RDI: ffffffff8c1578a0
RBP: 00000000f70be579 R08: 7e0d6be19d00a299 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffffffff81a64f94
R13: ffffc9000109f858 R14: 0000000000000000 R15: ffff8880206ba440
 rcu_is_watching_curr_cpu include/linux/context_tracking.h:128 [inline]
 rcu_is_watching+0x12/0xc0 kernel/rcu/tree.c:745
 trace_lock_release include/trace/events/lock.h:69 [inline]
 lock_release+0x201/0x2f0 kernel/locking/lockdep.c:5882
 rcu_lock_release include/linux/rcupdate.h:341 [inline]
 rcu_read_unlock include/linux/rcupdate.h:871 [inline]
 class_rcu_destructor include/linux/rcupdate.h:1155 [inline]
 is_module_text_address+0x149/0x230 kernel/module/main.c:3822
 kernel_text_address kernel/extable.c:119 [inline]
 kernel_text_address+0x81/0x100 kernel/extable.c:94
 __kernel_text_address+0xd/0x40 kernel/extable.c:79
 unwind_get_return_address+0x59/0xa0 arch/x86/kernel/unwind_orc.c:369
 arch_stack_walk+0xa6/0x100 arch/x86/kernel/stacktrace.c:26
 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576
 poison_slab_object mm/kasan/common.c:247 [inline]
 __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264
 kasan_slab_free include/linux/kasan.h:233 [inline]
 slab_free_hook mm/slub.c:2381 [inline]
 slab_free mm/slub.c:4643 [inline]
 kfree+0x2b4/0x4d0 mm/slub.c:4842
 ref_tracker_free+0x375/0x830 lib/ref_tracker.c:272
 __netns_tracker_free include/net/net_namespace.h:374 [inline]
 put_net_track include/net/net_namespace.h:389 [inline]
 __sk_destruct+0x493/0x980 net/core/sock.c:2376
 sk_destruct+0xc2/0xf0 net/core/sock.c:2409
 __sk_free+0xf4/0x3e0 net/core/sock.c:2420
 sk_free+0x6a/0x90 net/core/sock.c:2431
 sock_put include/net/sock.h:1960 [inline]
 tcp_close+0xd3/0x120 net/ipv4/tcp.c:3281
 inet_release+0x13f/0x280 net/ipv4/af_inet.c:435
 __sock_release+0xb0/0x270 net/socket.c:647
 sock_close+0x1c/0x30 net/socket.c:1391
 __fput+0x3ff/0xb70 fs/file_table.c:465
 fput_close_sync+0x118/0x260 fs/file_table.c:570
 __do_sys_close fs/open.c:1589 [inline]
 __se_sys_close fs/open.c:1574 [inline]
 __ia32_sys_close+0x8b/0x120 fs/open.c:1574
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
 __do_fast_syscall_32+0x7c/0x3a0 arch/x86/entry/syscall_32.c:306
 do_fast_syscall_32+0x32/0x80 arch/x86/entry/syscall_32.c:331
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf70be579
Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
RSP: 002b:00000000ffd32cb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000006
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000005845f440
RDX: 0000000000000000 RSI: 00000000f7423ff4 RDI: 00000000ffd33370
RBP: 00000000ffd32d20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000282 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
----------------
Code disassembly (best guess):
   0:	90                   	nop
   1:	90                   	nop
   2:	90                   	nop
   3:	90                   	nop
   4:	90                   	nop
   5:	41 54                	push   %r12
   7:	55                   	push   %rbp
   8:	53                   	push   %rbx
   9:	48 83 ec 08          	sub    $0x8,%rsp
   d:	65 8b 1d 35 7c 4b 08 	mov    %gs:0x84b7c35(%rip),%ebx        # 0x84b7c49
  14:	65 8b 05 2a 7c 4b 08 	mov    %gs:0x84b7c2a(%rip),%eax        # 0x84b7c45
  1b:	a9 ff ff ff 7f       	test   $0x7fffffff,%eax
  20:	74 0f                	je     0x31
  22:	48 83 c4 08          	add    $0x8,%rsp
  26:	89 d8                	mov    %ebx,%eax
  28:	5b                   	pop    %rbx
  29:	5d                   	pop    %rbp
* 2a:	41 5c                	pop    %r12 <-- trapping instruction
  2c:	e9 44 df 02 00       	jmp    0x2df75
  31:	9c                   	pushf
  32:	58                   	pop    %rax
  33:	f6 c4 02             	test   $0x2,%ah
  36:	74 ea                	je     0x22
  38:	48 89 fd             	mov    %rdi,%rbp
  3b:	65                   	gs
  3c:	48                   	rex.W
  3d:	8b                   	.byte 0x8b
  3e:	05                   	.byte 0x5
  3f:	ea                   	(bad)