------------[ cut here ]------------
workqueue: cannot queue hci_cmd_timeout on wq hci0
WARNING: kernel/workqueue.c:2270 at __queue_work+0xd08/0x1150 kernel/workqueue.c:2269, CPU#0: syz-executor/5930
Modules linked in:
CPU: 0 UID: 0 PID: 5930 Comm: syz-executor Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:__queue_work+0xd0c/0x1150 kernel/workqueue.c:2269
Code: 00 00 00 fc ff df 49 8d 94 24 78 01 00 00 48 89 f9 48 c1 e9 03 80 3c 01 00 0f 85 04 04 00 00 48 8d 3d e8 08 0d 0f 48 8b 75 18 <67> 48 0f b9 3a e9 2a f7 ff ff e8 a5 ad 38 00 90 0f 0b 90 e9 b2 f5
RSP: 0018:ffffc90000007be8 EFLAGS: 00010046
RAX: dffffc0000000000 RBX: 0000000000000100 RCX: 1ffff1100966c951
RDX: ffff888029f71178 RSI: ffffffff8a7f6610 RDI: ffffffff90dc5310
RBP: ffff88804b364a70 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000100 R11: 0000000000000000 R12: ffff888029f71000
R13: 1ffff92000000f8f R14: ffffffff81cf5b40 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff88809715a000(0063) knlGS:0000000057965480
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f7446288 CR3: 000000004d242000 CR4: 0000000000352ef0
Call Trace:
call_timer_fn+0x19a/0x670 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1794 [inline]
__run_timers+0x570/0xb30 kernel/time/timer.c:2373
__run_timer_base kernel/time/timer.c:2385 [inline]
__run_timer_base kernel/time/timer.c:2377 [inline]
run_timer_base+0x114/0x190 kernel/time/timer.c:2394
run_timer_softirq+0x1a/0x50 kernel/time/timer.c:2404
handle_softirqs+0x1eb/0x9e0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0xef/0x150 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1056
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:finish_task_switch.isra.0+0x20e/0xb80 kernel/sched/core.c:5152
Code: ed 03 0f 48 85 d2 0f 85 84 06 00 00 85 c0 0f 85 a7 01 00 00 48 89 df e8 20 e5 ff ff e8 2b 5c 3a 00 fb 49 8d bc 24 30 16 00 00 <48> b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 04 02 84
RSP: 0018:ffffc900040cfa78 EFLAGS: 00000202
RAX: 0000000000061379 RBX: ffff88802b23b280 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8de751f8 RDI: ffff8880293c5f30
RBP: ffffc900040cfac0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffff8880293c4900
R13: ffff888029d2a480 R14: ffff8880251e2480 R15: ffff88802b23c0c0
context_switch kernel/sched/core.c:5298 [inline]
__schedule+0xff6/0x60e0 kernel/sched/core.c:6907
__schedule_loop kernel/sched/core.c:6989 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:7004
do_nanosleep+0x206/0x560 kernel/time/hrtimer.c:2124
hrtimer_nanosleep+0x156/0x360 kernel/time/hrtimer.c:2171
common_nsleep+0xa1/0xd0 kernel/time/posix-timers.c:1345
__do_sys_clock_nanosleep_time32 kernel/time/posix-timers.c:1419 [inline]
__se_sys_clock_nanosleep_time32 kernel/time/posix-timers.c:1396 [inline]
__ia32_sys_clock_nanosleep_time32+0x352/0x480 kernel/time/posix-timers.c:1396
do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
do_int80_emulation+0x141/0x6b0 arch/x86/entry/syscall_32.c:172
asm_int80_emulation+0x1a/0x20 arch/x86/include/asm/idtentry.h:621
RIP: 0023:0xf71f572b
Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53
RSP: 002b:00000000ffeb365c EFLAGS: 00000246
ORIG_RAX: 000000000000010b
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000000000
RDX: 00000000ffeb36f4 RSI: 00000000ffeb36ec RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: 00 fc add %bh,%ah
4: ff lcall (bad)
5: df 49 8d fisttps -0x73(%rcx)
8: 94 xchg %eax,%esp
9: 24 78 and $0x78,%al
b: 01 00 add %eax,(%rax)
d: 00 48 89 add %cl,-0x77(%rax)
10: f9 stc
11: 48 c1 e9 03 shr $0x3,%rcx
15: 80 3c 01 00 cmpb $0x0,(%rcx,%rax,1)
19: 0f 85 04 04 00 00 jne 0x423
1f: 48 8d 3d e8 08 0d 0f lea 0xf0d08e8(%rip),%rdi # 0xf0d090e
26: 48 8b 75 18 mov 0x18(%rbp),%rsi
* 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2f: e9 2a f7 ff ff jmp 0xfffff75e
34: e8 a5 ad 38 00 call 0x38adde
39: 90 nop
3a: 0f 0b ud2
3c: 90 nop
3d: e9 .byte 0xe9
3e: b2 f5 mov $0xf5,%dl