------------[ cut here ]------------
workqueue: cannot queue hci_cmd_timeout on wq hci3
WARNING: kernel/workqueue.c:2251 at __queue_work+0xc9d/0x10e0 kernel/workqueue.c:2250, CPU#0: syz.9.3604/18349
Modules linked in:
CPU: 0 UID: 0 PID: 18349 Comm: syz.9.3604 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:__queue_work+0xca1/0x10e0 kernel/workqueue.c:2250
Code: 78 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 f9 48 c1 e9 03 80 3c 01 00 0f 85 0c 04 00 00 48 8d 3d 53 f5 06 0f 48 8b 75 18 <67> 48 0f b9 3a e9 90 f7 ff ff e8 10 34 3a 00 90 0f 0b 90 e9 15 f6
RSP: 0018:ffffc90000007be8 EFLAGS: 00010046
RAX: dffffc0000000000 RBX: 0000000000000100 RCX: 1ffff110057ff151
RDX: ffff88802c5ac178 RSI: ffffffff8a6b8810 RDI: ffffffff908ba9e0
RBP: ffff88802bff8a70 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000100 R11: ffff888026fe2ff0 R12: 1ffff92000000f8f
R13: ffffffff8184c5d0 R14: 0000000000000101 R15: ffff88802c5ac000
FS: 0000555558a6c500(0000) GS:ffff8880d68f5000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c451ea0 CR3: 00000000642bb000 CR4: 0000000000352ef0
Call Trace:
call_timer_fn+0x19a/0x5a0 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1794 [inline]
__run_timers+0x569/0xae0 kernel/time/timer.c:2373
__run_timer_base kernel/time/timer.c:2385 [inline]
__run_timer_base kernel/time/timer.c:2377 [inline]
run_timer_base+0x114/0x190 kernel/time/timer.c:2394
run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2404
handle_softirqs+0x219/0x950 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1056
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:preempt_schedule_irq+0x4c/0x90 kernel/sched/core.c:7190
Code: df 55 65 48 8b 2d 0c 5a 39 08 53 48 89 eb 48 c1 eb 03 48 01 c3 bf 01 00 00 00 e8 df 62 11 f6 e8 fa b4 4d f6 fb bf 01 00 00 00 3f 96 ff ff 9c 58 fa f6 c4 02 75 1e bf 01 00 00 00 e8 8d f4 10
RSP: 0018:ffffc90005777968 EFLAGS: 00000206
RAX: 0000000000005c5f RBX: ffffed1004dfc498 RCX: 0000000000000006
RDX: 0000000000000000 RSI: ffffffff8dace031 RDI: 0000000000000001
RBP: ffff888026fe24c0 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff9088b8d7 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
irqentry_exit+0x1d8/0x8c0 kernel/entry/common.c:216
asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:lockdep_unregister_key+0xe9/0x140 kernel/locking/lockdep.c:6616
Code: 48 89 ef e8 89 ee ff ff 48 83 2d 89 02 39 14 01 89 c3 e8 0a ef ff ff 9c 58 f6 c4 02 75 52 41 f7 c4 00 02 00 00 74 01 fb 84 db <75> 1b 5b 5d 41 5c e9 3c ad 0a 00 8b 05 6a 61 ef 0e 31 db 85 c0 74
RSP: 0018:ffffc90005777a70 EFLAGS: 00000246
RAX: 0000000000000046 RBX: 0000000000000000 RCX: 0000000000000001
RDX: 0000000000000000 RSI: ffffffff8dbbe71d RDI: ffffffff8bf2b380
RBP: ffffffff97378b38 R08: 000000000003536b R09: ffffffff95d931b6
R10: 0000000000000002 R11: ffff888026fe2ff0 R12: 0000000000000246
R13: ffff88804d9d8000 R14: ffff88804d9d84c8 R15: 0000000000000100
__qdisc_destroy+0x11a/0x4a0 net/sched/sch_generic.c:1079
qdisc_put+0xab/0xe0 net/sched/sch_generic.c:1105
shutdown_scheduler_queue+0xa5/0x160 net/sched/sch_generic.c:1158
netdev_for_each_tx_queue include/linux/netdevice.h:2680 [inline]
dev_shutdown+0xb8/0x430 net/sched/sch_generic.c:1490
unregister_netdevice_many_notify+0xb37/0x2590 net/core/dev.c:12371
unregister_netdevice_many net/core/dev.c:12446 [inline]
unregister_netdevice_queue net/core/dev.c:12260 [inline]
unregister_netdevice_queue+0x305/0x3c0 net/core/dev.c:12250
unregister_netdevice include/linux/netdevice.h:3405 [inline]
__tun_detach+0x119c/0x1490 drivers/net/tun.c:621
tun_detach drivers/net/tun.c:637 [inline]
tun_chr_close+0xc2/0x230 drivers/net/tun.c:3436
__fput+0x402/0xb70 fs/file_table.c:468
task_work_run+0x150/0x240 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:44 [inline]
exit_to_user_mode_loop+0xfb/0x540 kernel/entry/common.c:75
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
do_syscall_64+0x4ee/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7a32b8f7c9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdf47c8128 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f7a32de7da0 RCX: 00007f7a32b8f7c9
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f7a32de7da0 R08: 00000000000001fc R09: 0000001df47c841f
R10: 00000000003ffbe0 R11: 0000000000000246 R12: 0000000000057c6d
R13: 00007f7a32de6450 R14: ffffffffffffffff R15: 00007ffdf47c8240
----------------
Code disassembly (best guess):
0: 78 01 js 0x3
2: 00 00 add %al,(%rax)
4: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
b: fc ff df
e: 48 89 f9 mov %rdi,%rcx
11: 48 c1 e9 03 shr $0x3,%rcx
15: 80 3c 01 00 cmpb $0x0,(%rcx,%rax,1)
19: 0f 85 0c 04 00 00 jne 0x42b
1f: 48 8d 3d 53 f5 06 0f lea 0xf06f553(%rip),%rdi # 0xf06f579
26: 48 8b 75 18 mov 0x18(%rbp),%rsi
* 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2f: e9 90 f7 ff ff jmp 0xfffff7c4
34: e8 10 34 3a 00 call 0x3a3449
39: 90 nop
3a: 0f 0b ud2
3c: 90 nop
3d: e9 .byte 0xe9
3e: 15 .byte 0x15
3f: f6 .byte 0xf6