------------[ cut here ]------------
workqueue: cannot queue hci_cmd_timeout on wq hci0
WARNING: CPU: 2 PID: 6289 at kernel/workqueue.c:2255 __queue_work+0xd03/0x1160 kernel/workqueue.c:2254
Modules linked in:
CPU: 2 UID: 0 PID: 6289 Comm: udevd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:__queue_work+0xd03/0x1160 kernel/workqueue.c:2254
Code: 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 4b 04 00 00 48 8b 75 18 4c 89 fa 48 c7 c7 a0 03 ac 8b e8 be 1e f7 ff 90 <0f> 0b 90 90 e9 2f f7 ff ff e8 ff 79 38 00 90 0f 0b 90 e9 b4 f5 ff
RSP: 0018:ffffc90000648be8 EFLAGS: 00010082
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817a4388
RDX: ffff888022528000 RSI: ffffffff817a4395 RDI: 0000000000000001
RBP: ffff888038b00970 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 1ffff920000c918f
R13: 0000000000000101 R14: ffffffff81833490 R15: ffff88805ed63978
FS: 00007fad7883c880(0000) GS:ffff8880d68b2000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005555819df808 CR3: 0000000058baf000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 00000000000f000e DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
call_timer_fn+0x197/0x620 kernel/time/timer.c:1747
expire_timers kernel/time/timer.c:1793 [inline]
__run_timers+0x569/0x960 kernel/time/timer.c:2372
__run_timer_base kernel/time/timer.c:2384 [inline]
__run_timer_base kernel/time/timer.c:2376 [inline]
run_timer_base+0x114/0x190 kernel/time/timer.c:2393
run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2403
handle_softirqs+0x219/0x8e0 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1050
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x70 kernel/kcov.c:210
Code: f6 ce 55 00 48 89 df 5b e9 7d 56 5b 00 be 03 00 00 00 5b e9 92 53 28 03 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 48 8b 34 24 65 48 8b 15 c8 42 1b 12 65 8b 05 d9 42 1b
RSP: 0018:ffffc9000489f070 EFLAGS: 00000246
RAX: dffffc0000000000 RBX: 00007fad780a7407 RCX: ffffc9000489f02c
RDX: 1ffff92000913e24 RSI: ffffffff8de2d6e8 RDI: 00007fad780a7407
RBP: ffffc9000489f120 R08: ffffffff913acdf6 R09: 0000000000000000
R10: 0000000000000003 R11: 0000000000000001 R12: 0000000000000000
R13: ffffc9000489f198 R14: 0000000000000000 R15: ffff888022528000
in_gate_area_no_mm+0x13/0x70 arch/x86/entry/vsyscall/vsyscall_64.c:321
is_kernel_text include/linux/kallsyms.h:31 [inline]
core_kernel_text kernel/extable.c:68 [inline]
kernel_text_address+0x35/0x100 kernel/extable.c:99
__kernel_text_address+0xd/0x40 kernel/extable.c:79
unwind_get_return_address+0x59/0xa0 arch/x86/kernel/unwind_orc.c:369
arch_stack_walk+0xa6/0x100 arch/x86/kernel/stacktrace.c:26
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:330 [inline]
__kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:356
kasan_slab_alloc include/linux/kasan.h:250 [inline]
slab_post_alloc_hook mm/slub.c:4191 [inline]
kmem_cache_alloc_bulk_noprof+0x41a/0xbc0 mm/slub.c:5426
mt_alloc_bulk lib/maple_tree.c:181 [inline]
mas_alloc_nodes+0x2f1/0x8b0 lib/maple_tree.c:1277
mas_node_count_gfp+0x105/0x130 lib/maple_tree.c:1337
mas_node_count lib/maple_tree.c:1351 [inline]
mas_wr_preallocate lib/maple_tree.c:4292 [inline]
mas_insert lib/maple_tree.c:4325 [inline]
mas_alloc_cyclic+0xe5e/0x17b0 lib/maple_tree.c:4388
mtree_alloc_cyclic+0x170/0x1e0 lib/maple_tree.c:6527
simple_offset_add+0xbf/0x180 fs/libfs.c:297
shmem_mknod+0x26b/0x450 mm/shmem.c:3917
lookup_open.isra.0+0x11d0/0x1580 fs/namei.c:3708
open_last_lookups fs/namei.c:3807 [inline]
path_openat+0x893/0x2cb0 fs/namei.c:4043
do_filp_open+0x20b/0x470 fs/namei.c:4073
do_sys_openat2+0x11b/0x1d0 fs/open.c:1435
do_sys_open fs/open.c:1450 [inline]
__do_sys_openat fs/open.c:1466 [inline]
__se_sys_openat fs/open.c:1461 [inline]
__x64_sys_openat+0x174/0x210 fs/open.c:1461
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x4e0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fad780a7407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffc6d4aa130 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fad7883c880 RCX: 00007fad780a7407
RDX: 0000000000080241 RSI: 00007ffc6d4aa690 RDI: ffffffffffffff9c
RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000000001b6 R11: 0000000000000202 R12: 000056168a726dfc
R13: 000056168a726dfc R14: 0000000000000001 R15: 000056168a741140
----------------
Code disassembly (best guess):
0: f6 ce 55 test $0x55,%dh
3: 00 48 89 add %cl,-0x77(%rax)
6: df 5b e9 fistps -0x17(%rbx)
9: 7d 56 jge 0x61
b: 5b pop %rbx
c: 00 be 03 00 00 00 add %bh,0x3(%rsi)
12: 5b pop %rbx
13: e9 92 53 28 03 jmp 0x32853aa
18: 66 90 xchg %ax,%ax
1a: 90 nop
1b: 90 nop
1c: 90 nop
1d: 90 nop
1e: 90 nop
1f: 90 nop
20: 90 nop
21: 90 nop
22: 90 nop
23: 90 nop
24: 90 nop
25: 90 nop
26: 90 nop
27: 90 nop
28: 90 nop
29: 90 nop
* 2a: f3 0f 1e fa endbr64 <-- trapping instruction
2e: 48 8b 34 24 mov (%rsp),%rsi
32: 65 48 8b 15 c8 42 1b mov %gs:0x121b42c8(%rip),%rdx # 0x121b4302
39: 12
3a: 65 gs
3b: 8b .byte 0x8b
3c: 05 .byte 0x5
3d: d9 42 1b flds 0x1b(%rdx)