------------[ cut here ]------------
workqueue: cannot queue hci_cmd_timeout on wq hci0
WARNING: CPU: 1 PID: 7246 at kernel/workqueue.c:2255 __queue_work+0xd03/0x1160 kernel/workqueue.c:2254
Modules linked in:
CPU: 1 UID: 0 PID: 7246 Comm: syz.2.304 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:__queue_work+0xd03/0x1160 kernel/workqueue.c:2254
Code: 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 4b 04 00 00 48 8b 75 18 4c 89 fa 48 c7 c7 20 01 ac 8b e8 be 1e f7 ff 90 <0f> 0b 90 90 e9 2f f7 ff ff e8 8f 7b 38 00 90 0f 0b 90 e9 b4 f5 ff
RSP: 0018:ffffc900006a0be8 EFLAGS: 00010082
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817a3388
RDX: ffff8880246c0000 RSI: ffffffff817a3395 RDI: 0000000000000001
RBP: ffff8880247d4970 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 1ffff920000d418f
R13: 0000000000000100 R14: ffffffff81832490 R15: ffff88802b354178
FS: 00007f0074aff6c0(0000) GS:ffff8880d67b5000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0073b72960 CR3: 000000002533f000 CR4: 0000000000352ef0
Call Trace:
call_timer_fn+0x197/0x620 kernel/time/timer.c:1747
expire_timers kernel/time/timer.c:1793 [inline]
__run_timers+0x569/0x960 kernel/time/timer.c:2372
__run_timer_base kernel/time/timer.c:2384 [inline]
__run_timer_base kernel/time/timer.c:2376 [inline]
run_timer_base+0x114/0x190 kernel/time/timer.c:2393
run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2403
handle_softirqs+0x219/0x8e0 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1050
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:lock_acquire+0x62/0x350 kernel/locking/lockdep.c:5872
Code: e6 3e 12 83 f8 07 0f 87 bc 02 00 00 89 c0 48 0f a3 05 22 a2 13 0f 0f 82 74 02 00 00 8b 35 da d3 13 0f 85 f6 0f 85 8d 00 00 00 <48> 8b 44 24 30 65 48 2b 05 79 e6 3e 12 0f 85 c7 02 00 00 48 83 c4
RSP: 0018:ffffc9000461eee8 EFLAGS: 00000206
RAX: 0000000000000046 RBX: ffffffff8e5c1260 RCX: 00000000d18a2251
RDX: 0000000000000000 RSI: ffffffff8de2cdb8 RDI: ffffffff8c162d00
RBP: 0000000000000002 R08: 7e1ee3192f898faa R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
rcu_read_lock include/linux/rcupdate.h:841 [inline]
class_rcu_constructor include/linux/rcupdate.h:1155 [inline]
unwind_next_frame+0xd1/0x20a0 arch/x86/kernel/unwind_orc.c:479
arch_stack_walk+0x94/0x100 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
save_stack+0x160/0x1f0 mm/page_owner.c:156
__set_page_owner+0x91/0x550 mm/page_owner.c:329
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1c0/0x230 mm/page_alloc.c:1851
prep_new_page mm/page_alloc.c:1859 [inline]
get_page_from_freelist+0x132b/0x38e0 mm/page_alloc.c:3858
__alloc_frozen_pages_noprof+0x261/0x23f0 mm/page_alloc.c:5148
alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2416
alloc_frozen_pages_noprof mm/mempolicy.c:2487 [inline]
alloc_pages_noprof+0x131/0x390 mm/mempolicy.c:2507
vm_area_alloc_pages mm/vmalloc.c:3642 [inline]
__vmalloc_area_node mm/vmalloc.c:3720 [inline]
__vmalloc_node_range_noprof+0x72f/0x14b0 mm/vmalloc.c:3893
vmalloc_user_noprof+0x9e/0xe0 mm/vmalloc.c:4046
vb2_vmalloc_alloc+0x135/0x3f0 drivers/media/common/videobuf2/videobuf2-vmalloc.c:47
__vb2_buf_mem_alloc drivers/media/common/videobuf2/videobuf2-core.c:242 [inline]
__vb2_queue_alloc+0x8c6/0x1280 drivers/media/common/videobuf2/videobuf2-core.c:523
vb2_core_reqbufs+0xa90/0xfe0 drivers/media/common/videobuf2/videobuf2-core.c:964
vb2_reqbufs+0x1a3/0x1f0 drivers/media/common/videobuf2/videobuf2-v4l2.c:715
v4l2_m2m_reqbufs drivers/media/v4l2-core/v4l2-mem2mem.c:582 [inline]
v4l2_m2m_ioctl_reqbufs+0xdc/0x1e0 drivers/media/v4l2-core/v4l2-mem2mem.c:1376
v4l_reqbufs+0x14f/0x1e0 drivers/media/v4l2-core/v4l2-ioctl.c:2170
__video_do_ioctl+0xb3d/0xfc0 drivers/media/v4l2-core/v4l2-ioctl.c:3137
video_usercopy+0x4cd/0x1720 drivers/media/v4l2-core/v4l2-ioctl.c:3479
v4l2_ioctl+0x1ba/0x250 drivers/media/v4l2-core/v4l2-dev.c:366
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:598 [inline]
__se_sys_ioctl fs/ioctl.c:584 [inline]
__x64_sys_ioctl+0x18b/0x210 fs/ioctl.c:584
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f0073b8eba9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f0074aff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f0073dd5fa0 RCX: 00007f0073b8eba9
RDX: 00002000000000c0 RSI: 00000000c0145608 RDI: 0000000000000015
RBP: 00007f0073c11e19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f0073dd6038 R14: 00007f0073dd5fa0 R15: 00007ffff615c7e8
----------------
Code disassembly (best guess):
0: e6 3e out %al,$0x3e
2: 12 83 f8 07 0f 87 adc -0x78f0f808(%rbx),%al
8: bc 02 00 00 89 mov $0x89000002,%esp
d: c0 48 0f a3 rorb $0xa3,0xf(%rax)
11: 05 22 a2 13 0f add $0xf13a222,%eax
16: 0f 82 74 02 00 00 jb 0x290
1c: 8b 35 da d3 13 0f mov 0xf13d3da(%rip),%esi # 0xf13d3fc
22: 85 f6 test %esi,%esi
24: 0f 85 8d 00 00 00 jne 0xb7
* 2a: 48 8b 44 24 30 mov 0x30(%rsp),%rax <-- trapping instruction
2f: 65 48 2b 05 79 e6 3e sub %gs:0x123ee679(%rip),%rax # 0x123ee6b0
36: 12
37: 0f 85 c7 02 00 00 jne 0x304
3d: 48 rex.W
3e: 83 .byte 0x83
3f: c4 .byte 0xc4