------------[ cut here ]------------
WARNING: CPU: 0 PID: 5082 at kernel/workqueue.c:2322 __queue_work+0xc6a/0xec0 kernel/workqueue.c:2321
Modules linked in:
CPU: 0 PID: 5082 Comm: syz-executor.0 Not tainted 6.8.0-syzkaller-05236-g443574b03387 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
RIP: 0010:__queue_work+0xc6a/0xec0 kernel/workqueue.c:2321
Code: ff e8 3a e0 35 00 eb 21 e8 33 e0 35 00 eb 1a e8 2c e0 35 00 eb 13 e8 25 e0 35 00 90 0f 0b 90 e9 74 fd ff ff e8 17 e0 35 00 90 <0f> 0b 90 48 83 c4 68 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc
RSP: 0018:ffffc90000007b20 EFLAGS: 00010046
RAX: ffffffff815f1036 RBX: 0000000000000100 RCX: ffff8880289a3c00
RDX: 0000000080000101 RSI: 0000000000000100 RDI: 0000000000000000
RBP: 0000000000010000 R08: ffffffff815f04d7 R09: 1ffffffff1f0d5cd
R10: dffffc0000000000 R11: ffffffff815f1740 R12: dffffc0000000000
R13: ffff888029c051c0 R14: ffff888029c05000 R15: 0000000000000008
FS:  0000000000000000(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f73ab2d5f80 CR3: 0000000067698000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 call_timer_fn+0x17e/0x600 kernel/time/timer.c:1792
 expire_timers kernel/time/timer.c:1838 [inline]
 __run_timers kernel/time/timer.c:2408 [inline]
 __run_timer_base+0x695/0x8e0 kernel/time/timer.c:2419
 run_timer_base kernel/time/timer.c:2428 [inline]
 run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2438
 __do_softirq+0x2bc/0x943 kernel/softirq.c:554
 invoke_softirq kernel/softirq.c:428 [inline]
 __irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:645
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:202
Code: 90 f3 0f 1e fa 53 48 89 fb 48 83 c7 18 48 8b 74 24 08 e8 fa 06 f7 f5 48 89 df e8 b2 46 f8 f5 e8 2d 67 21 f6 fb bf 01 00 00 00 <e8> 42 33 ea f5 65 8b 05 93 15 89 74 85 c0 74 06 5b c3 cc cc cc cc
RSP: 0018:ffffc90003cef850 EFLAGS: 00000282
RAX: 2de8a5874c909900 RBX: ffff888016722000 RCX: ffffffff81720c2a
RDX: dffffc0000000000 RSI: ffffffff8baac220 RDI: 0000000000000001
RBP: dffffc0000000000 R08: ffffffff92cc750f R09: 1ffffffff2598ea1
R10: dffffc0000000000 R11: fffffbfff2598ea2 R12: ffff888016722000
R13: ffff88802ea54c10 R14: ffff88802ea54c88 R15: ffff888029c05000
 flush_workqueue_prep_pwqs+0x2b0/0x4c0 kernel/workqueue.c:3886
 __flush_workqueue+0x5f1/0x1710 kernel/workqueue.c:3968
 drain_workqueue+0xc9/0x3a0 kernel/workqueue.c:4107
 hci_dev_close_sync+0x47b/0x1050 net/bluetooth/hci_sync.c:5138
 hci_dev_do_close net/bluetooth/hci_core.c:554 [inline]
 hci_unregister_dev+0x1e3/0x4e0 net/bluetooth/hci_core.c:2773
 vhci_release+0x83/0xd0 drivers/bluetooth/hci_vhci.c:674
 __fput+0x429/0x8a0 fs/file_table.c:423
 task_work_run+0x24f/0x310 kernel/task_work.c:180
 exit_task_work include/linux/task_work.h:38 [inline]
 do_exit+0xa1b/0x27e0 kernel/exit.c:878
 do_group_exit+0x207/0x2c0 kernel/exit.c:1027
 __do_sys_exit_group kernel/exit.c:1038 [inline]
 __se_sys_exit_group kernel/exit.c:1036 [inline]
 __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1036
 do_syscall_64+0xfb/0x240
 entry_SYSCALL_64_after_hwframe+0x6d/0x75
RIP: 0033:0x7f73aa67dea9
Code: Unable to access opcode bytes at 0x7f73aa67de7f.
RSP: 002b:00007ffd27f68e78 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f73aa67dea9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000043
RBP: 00007f73aa6db388 R08: 00007ffd27f66c17 R09: 000000000000ee78
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 000000000000ee78 R14: 0000000000000000 R15: 0000000000000012
 </TASK>
----------------
Code disassembly (best guess):
   0:	90                   	nop
   1:	f3 0f 1e fa          	endbr64
   5:	53                   	push   %rbx
   6:	48 89 fb             	mov    %rdi,%rbx
   9:	48 83 c7 18          	add    $0x18,%rdi
   d:	48 8b 74 24 08       	mov    0x8(%rsp),%rsi
  12:	e8 fa 06 f7 f5       	call   0xf5f70711
  17:	48 89 df             	mov    %rbx,%rdi
  1a:	e8 b2 46 f8 f5       	call   0xf5f846d1
  1f:	e8 2d 67 21 f6       	call   0xf6216751
  24:	fb                   	sti
  25:	bf 01 00 00 00       	mov    $0x1,%edi
* 2a:	e8 42 33 ea f5       	call   0xf5ea3371 <-- trapping instruction
  2f:	65 8b 05 93 15 89 74 	mov    %gs:0x74891593(%rip),%eax        # 0x748915c9
  36:	85 c0                	test   %eax,%eax
  38:	74 06                	je     0x40
  3a:	5b                   	pop    %rbx
  3b:	c3                   	ret
  3c:	cc                   	int3
  3d:	cc                   	int3
  3e:	cc                   	int3
  3f:	cc                   	int3