------------[ cut here ]------------
WARNING: CPU: 1 PID: 7080 at kernel/workqueue.c:1441 __queue_work+0xddc/0xf90
Modules linked in:
CPU: 1 PID: 7080 Comm: syz-executor Not tainted 6.1.116-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:__queue_work+0xddc/0xf90 kernel/workqueue.c:1441
Code: 8b 3c 24 e8 76 7c 88 00 e9 d9 fc ff ff e8 0c f4 30 00 89 ee 48 c7 c7 c0 98 1d 8d e8 0e 8a 0b 03 e9 1e fc ff ff e8 f4 f3 30 00 <0f> 0b 48 83 c4 50 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 de f3 30 00
RSP: 0018:ffffc900001e0af8 EFLAGS: 00010046
RAX: ffffffff8159983c RBX: 00000000000b0012 RCX: ffff88802f835940
RDX: 0000000000000100 RSI: 0000000000000100 RDI: 0000000000000000
RBP: 0000000000010000 R08: ffffffff815a85e5 R09: fffffbfff1d34106
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: dffffc0000000000 R14: 0000000000000008 R15: ffff888078e9b800
FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f178c667d60 CR3: 0000000030aaa000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 000000000000000a DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
call_timer_fn+0x1ad/0x6b0 kernel/time/timer.c:1504
expire_timers kernel/time/timer.c:1544 [inline]
__run_timers+0x6a8/0x890 kernel/time/timer.c:1820
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1833
handle_softirqs+0x2ee/0xa40 kernel/softirq.c:571
__do_softirq kernel/softirq.c:605 [inline]
invoke_softirq kernel/softirq.c:445 [inline]
__irq_exit_rcu+0x157/0x240 kernel/softirq.c:654
irq_exit_rcu+0x5/0x20 kernel/softirq.c:666
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:preempt_schedule_irq+0xf2/0x1c0 kernel/sched/core.c:6870
Code: 89 f5 49 c1 ed 03 eb 0d 48 f7 03 08 00 00 00 0f 84 97 00 00 00 bf 01 00 00 00 e8 a9 73 ae f6 e8 14 42 e1 f6 fb bf 01 00 00 00 79 b4 ff ff 43 80 7c 3d 00 00 74 08 4c 89 f7 e8 69 0a 32 f7 48
RSP: 0018:ffffc90003b6f200 EFLAGS: 00000286
RAX: 4d37b6e851f9e900 RBX: 1ffff9200076de48 RCX: ffffffff816b028a
RDX: dffffc0000000000 RSI: ffffffff8b0c01c0 RDI: 0000000000000001
RBP: ffffc90003b6f2c0 R08: dffffc0000000000 R09: fffffbfff2246285
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff9200076de40
R13: 1ffff9200076de44 R14: ffffc90003b6f220 R15: dffffc0000000000
irqentry_exit+0x53/0x80 kernel/entry/common.c:439
asm_sysvec_reschedule_ipi+0x16/0x20 arch/x86/include/asm/idtentry.h:696
RIP: 0010:lock_acquire+0x26f/0x5a0 kernel/locking/lockdep.c:5666
Code: 2b 00 74 08 4c 89 f7 e8 ff 80 77 00 f6 44 24 61 02 0f 85 84 01 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 40 0e 36 e0 45 <4b> c7 44 25 00 00 00 00 00 43 c7 44 25 09 00 00 00 00 43 c7 44 25
RSP: 0018:ffffc90003b6f380 EFLAGS: 00000206
RAX: 0000000000000001 RBX: 1ffff9200076de7c RCX: ffffffff97338103
RDX: dffffc0000000000 RSI: ffffffff8b0c1340 RDI: ffffffff8b5d77c0
RBP: ffffc90003b6f4c8 R08: dffffc0000000000 R09: fffffbfff275a0d8
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff9200076de78
R13: dffffc0000000000 R14: ffffc90003b6f3e0 R15: 0000000000000246
__flush_workqueue+0x170/0x1610 kernel/workqueue.c:2812
drain_workqueue+0xc5/0x390 kernel/workqueue.c:2977
hci_dev_close_sync+0x47d/0x1020 net/bluetooth/hci_sync.c:5055
hci_dev_do_close net/bluetooth/hci_core.c:510 [inline]
hci_unregister_dev+0x207/0x500 net/bluetooth/hci_core.c:2707
vhci_release+0x7f/0xd0 drivers/bluetooth/hci_vhci.c:573
__fput+0x3f6/0x8d0 fs/file_table.c:320
task_work_run+0x246/0x300 kernel/task_work.c:203
exit_task_work include/linux/task_work.h:39 [inline]
do_exit+0xa73/0x26a0 kernel/exit.c:871
do_group_exit+0x202/0x2b0 kernel/exit.c:1021
get_signal+0x16f7/0x17d0 kernel/signal.c:2870
arch_do_signal_or_restart+0xb0/0x1a10 arch/x86/kernel/signal.c:871
exit_to_user_mode_loop+0x6a/0x100 kernel/entry/common.c:174
exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:210
__syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
syscall_exit_to_user_mode+0x60/0x270 kernel/entry/common.c:303
do_syscall_64+0x47/0xb0 arch/x86/entry/common.c:87
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f834d7805ac
Code: Unable to access opcode bytes at 0x7f834d780582.
RSP: 002b:00007fff9c817c30 EFLAGS: 00000293 ORIG_RAX: 000000000000002c
RAX: 000000000000003c RBX: 00007f834e464620 RCX: 00007f834d7805ac
RDX: 000000000000003c RSI: 00007f834e464670 RDI: 0000000000000003
RBP: 0000000000000000 R08: 00007fff9c817c84 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003
R13: 0000000000000000 R14: 00007f834e464670 R15: 0000000000000000
----------------
Code disassembly (best guess):
0: 89 f5 mov %esi,%ebp
2: 49 c1 ed 03 shr $0x3,%r13
6: eb 0d jmp 0x15
8: 48 f7 03 08 00 00 00 testq $0x8,(%rbx)
f: 0f 84 97 00 00 00 je 0xac
15: bf 01 00 00 00 mov $0x1,%edi
1a: e8 a9 73 ae f6 call 0xf6ae73c8
1f: e8 14 42 e1 f6 call 0xf6e14238
24: fb sti
25: bf 01 00 00 00 mov $0x1,%edi
* 2a: e8 79 b4 ff ff call 0xffffb4a8 <-- trapping instruction
2f: 43 80 7c 3d 00 00 cmpb $0x0,0x0(%r13,%r15,1)
35: 74 08 je 0x3f
37: 4c 89 f7 mov %r14,%rdi
3a: e8 69 0a 32 f7 call 0xf7320aa8
3f: 48 rex.W