IPVS: dh: UDP 224.0.0.2:0 - no destination available
------------[ cut here ]------------
workqueue: cannot queue hci_cmd_timeout on wq hci4
WARNING: CPU: 0 PID: 14069 at kernel/workqueue.c:2257 __queue_work+0xc9c/0x10f0 kernel/workqueue.c:2256
Modules linked in:
CPU: 0 UID: 0 PID: 14069 Comm: syz.8.2297 Not tainted 6.16.0-syzkaller-04405-g4b290aae788e #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:__queue_work+0xc9c/0x10f0 kernel/workqueue.c:2256
Code: 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 28 04 00 00 48 8b 75 18 4c 89 f2 48 c7 c7 e0 09 ac 8b e8 a5 19 f7 ff 90 <0f> 0b 90 90 e9 96 f7 ff ff e8 c6 8c 38 00 90 0f 0b 90 e9 1b f6 ff
RSP: 0018:ffffc90000007be8 EFLAGS: 00010082
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817a36a8
RDX: ffff88807950da00 RSI: ffffffff817a36b5 RDI: 0000000000000001
RBP: ffff88805ecd8970 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 1ffff92000000f8f
R13: 0000000000000101 R14: ffff88807be8e178 R15: 0000000000000001
FS:  00007f90019776c0(0000) GS:ffff88812472b000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b30a09ff8 CR3: 000000005a596000 CR4: 0000000000350ef0
Call Trace:
 <IRQ>
 call_timer_fn+0x19a/0x620 kernel/time/timer.c:1747
 expire_timers kernel/time/timer.c:1793 [inline]
 __run_timers+0x569/0x960 kernel/time/timer.c:2372
 __run_timer_base kernel/time/timer.c:2384 [inline]
 __run_timer_base kernel/time/timer.c:2376 [inline]
 run_timer_base+0x114/0x190 kernel/time/timer.c:2393
 run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2403
 handle_softirqs+0x219/0x8e0 kernel/softirq.c:579
 __do_softirq kernel/softirq.c:613 [inline]
 invoke_softirq kernel/softirq.c:453 [inline]
 __irq_exit_rcu+0x109/0x170 kernel/softirq.c:680
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1050
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:console_flush_all+0x9a2/0xc60 kernel/printk/printk.c:3227
Code: 00 e8 62 ba 28 00 9c 5b 81 e3 00 02 00 00 31 ff 48 89 de e8 90 e4 20 00 48 85 db 0f 85 55 01 00 00 e8 12 e9 20 00 fb 4c 89 e0 <48> c1 e8 03 42 80 3c 38 00 0f 84 11 ff ff ff 4c 89 e7 e8 37 35 85
RSP: 0018:ffffc9000c28f350 EFLAGS: 00000287
RAX: ffffffff8f2ea658 RBX: 0000000000000000 RCX: ffffc90012ae3000
RDX: 0000000000080000 RSI: ffffffff819abf2e RDI: 0000000000000007
RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffffffff8f2ea658
R13: ffffffff8f2ea600 R14: ffffc9000c28f3e0 R15: dffffc0000000000
 __console_flush_and_unlock kernel/printk/printk.c:3285 [inline]
 console_unlock+0xd8/0x210 kernel/printk/printk.c:3325
 vprintk_emit+0x418/0x6d0 kernel/printk/printk.c:2450
 _printk+0xc7/0x100 kernel/printk/printk.c:2475
 __ext4_warning+0x19c/0x210 fs/ext4/super.c:1006
 ext4_enable_quotas+0x7d3/0xc60 fs/ext4/super.c:7164
 ext4_orphan_cleanup+0xe52/0x11e0 fs/ext4/orphan.c:432
 __ext4_fill_super fs/ext4/super.c:5605 [inline]
 ext4_fill_super+0x8ff7/0xb020 fs/ext4/super.c:5724
 get_tree_bdev_flags+0x38c/0x620 fs/super.c:1692
 vfs_get_tree+0x8e/0x340 fs/super.c:1815
 do_new_mount fs/namespace.c:3805 [inline]
 path_mount+0x1482/0x1fd0 fs/namespace.c:4120
 do_mount fs/namespace.c:4133 [inline]
 __do_sys_mount fs/namespace.c:4344 [inline]
 __se_sys_mount fs/namespace.c:4321 [inline]
 __x64_sys_mount+0x28d/0x310 fs/namespace.c:4321
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f9000b9014a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f9001976e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f9001976ef0 RCX: 00007f9000b9014a
RDX: 0000200000000000 RSI: 00002000000000c0 RDI: 00007f9001976eb0
RBP: 0000200000000000 R08: 00007f9001976ef0 R09: 000000000280880f
R10: 000000000280880f R11: 0000000000000246 R12: 00002000000000c0
R13: 00007f9001976eb0 R14: 0000000000000527 R15: 0000200000000040
 </TASK>
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	e8 62 ba 28 00       	call   0x28ba67
   5:	9c                   	pushf
   6:	5b                   	pop    %rbx
   7:	81 e3 00 02 00 00    	and    $0x200,%ebx
   d:	31 ff                	xor    %edi,%edi
   f:	48 89 de             	mov    %rbx,%rsi
  12:	e8 90 e4 20 00       	call   0x20e4a7
  17:	48 85 db             	test   %rbx,%rbx
  1a:	0f 85 55 01 00 00    	jne    0x175
  20:	e8 12 e9 20 00       	call   0x20e937
  25:	fb                   	sti
  26:	4c 89 e0             	mov    %r12,%rax
* 29:	48 c1 e8 03          	shr    $0x3,%rax <-- trapping instruction
  2d:	42 80 3c 38 00       	cmpb   $0x0,(%rax,%r15,1)
  32:	0f 84 11 ff ff ff    	je     0xffffff49
  38:	4c 89 e7             	mov    %r12,%rdi
  3b:	e8                   	.byte 0xe8
  3c:	37                   	(bad)
  3d:	35                   	.byte 0x35
  3e:	85                   	.byte 0x85