------------[ cut here ]------------
workqueue: cannot queue hci_cmd_timeout on wq hci2
WARNING: CPU: 1 PID: 6151 at kernel/workqueue.c:2258 __queue_work+0xd62/0xfe0 kernel/workqueue.c:2256
Modules linked in:
CPU: 1 UID: 0 PID: 6151 Comm: syz.1.47 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:__queue_work+0xd62/0xfe0 kernel/workqueue.c:2256
Code: 42 80 3c 20 00 74 08 4c 89 ef e8 09 2c 95 00 49 8b 75 00 49 81 c7 78 01 00 00 48 c7 c7 e0 e8 89 8b 4c 89 fa e8 4f 34 f9 ff 90 <0f> 0b 90 90 e9 f1 f4 ff ff e8 a0 44 35 00 90 0f 0b 90 e9 dd fc ff
RSP: 0018:ffffc90000a08b08 EFLAGS: 00010046
RAX: b42234c7e4d23f00 RBX: 0000000000000100 RCX: ffff8880269c1e00
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000002
RBP: 1ffff1100506ea38 R08: ffff8880b8724293 R09: 1ffff110170e4852
R10: dffffc0000000000 R11: ffffed10170e4853 R12: dffffc0000000000
R13: ffff88807bec4988 R14: 0000000000000008 R15: ffff888028375178
FS:  00007fae4e5326c0(0000) GS:ffff888125d57000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000025000 CR3: 00000000313e0000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 call_timer_fn+0x17b/0x5f0 kernel/time/timer.c:1747
 expire_timers kernel/time/timer.c:1793 [inline]
 __run_timers kernel/time/timer.c:2372 [inline]
 __run_timer_base+0x646/0x860 kernel/time/timer.c:2384
 run_timer_base kernel/time/timer.c:2393 [inline]
 run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403
 handle_softirqs+0x283/0x870 kernel/softirq.c:579
 __do_softirq kernel/softirq.c:613 [inline]
 invoke_softirq kernel/softirq.c:453 [inline]
 __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1050
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:kasan_byte_accessible+0x16/0x30 mm/kasan/generic.c:201
Code: 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df 0f b6 04 07 <3c> 08 0f 92 c0 e9 c0 6b 49 09 cc 66 66 66 66 66 66 2e 0f 1f 84 00
RSP: 0018:ffffc9000ba573b8 EFLAGS: 00000a02
RAX: 0000000000000000 RBX: ffffffff8212c262 RCX: b42234c7e4d23f00
RDX: 0000000000000000 RSI: ffffffff8212c262 RDI: 1ffffffff1c487b0
RBP: ffffffff8212ceb3 R08: 0000000000000001 R09: 0000000000000000
R10: ffffc9000ba57540 R11: fffff5200174aead R12: 0000000000000000
R13: ffffffff8e243d80 R14: ffffffff8e243d80 R15: 0000000000000001
 __kasan_check_byte+0x12/0x40 mm/kasan/common.c:556
 kasan_check_byte include/linux/kasan.h:399 [inline]
 lock_acquire+0x8d/0x360 kernel/locking/lockdep.c:5845
 __fs_reclaim_acquire mm/page_alloc.c:4045 [inline]
 fs_reclaim_acquire+0x72/0x100 mm/page_alloc.c:4059
 might_alloc include/linux/sched/mm.h:318 [inline]
 prepare_alloc_pages+0x153/0x610 mm/page_alloc.c:4727
 __alloc_frozen_pages_noprof+0x123/0x370 mm/page_alloc.c:4948
 alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2419
 folio_alloc_mpol_noprof mm/mempolicy.c:2438 [inline]
 vma_alloc_folio_noprof+0xe4/0x200 mm/mempolicy.c:2473
 folio_prealloc+0x30/0x180 mm/memory.c:-1
 alloc_anon_folio mm/memory.c:5014 [inline]
 do_anonymous_page mm/memory.c:5071 [inline]
 do_pte_missing mm/memory.c:4249 [inline]
 handle_pte_fault mm/memory.c:6069 [inline]
 __handle_mm_fault+0x2c88/0x5620 mm/memory.c:6212
 handle_mm_fault+0x2d5/0x7f0 mm/memory.c:6381
 do_user_addr_fault+0x764/0x1390 arch/x86/mm/fault.c:1387
 handle_page_fault arch/x86/mm/fault.c:1476 [inline]
 exc_page_fault+0x76/0xf0 arch/x86/mm/fault.c:1532
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0010:rep_movs_alternative+0x33/0x90 arch/x86/lib/copy_user_64.S:61
Code: 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 c3 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 <48> 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb
RSP: 0018:ffffc9000ba57b88 EFLAGS: 00050246
RAX: 0000000000000000 RBX: 0000000000000008 RCX: 0000000000000008
RDX: 0000000000000000 RSI: ffffc9000ba57c20 RDI: 0000200000025000
RBP: ffffc9000ba57c90 R08: ffffc9000ba57c27 R09: 1ffff9200174af84
R10: dffffc0000000000 R11: fffff5200174af85 R12: 0000200000025008
R13: 00007ffffffff000 R14: ffffc9000ba57c20 R15: 0000200000025000
 copy_user_generic arch/x86/include/asm/uaccess_64.h:126 [inline]
 raw_copy_to_user arch/x86/include/asm/uaccess_64.h:147 [inline]
 _inline_copy_to_user include/linux/uaccess.h:197 [inline]
 _copy_to_user+0x8a/0xb0 lib/usercopy.c:26
 copy_to_user include/linux/uaccess.h:225 [inline]
 msr_read+0x177/0x250 arch/x86/kernel/msr.c:69
 vfs_read+0x200/0x980 fs/read_write.c:570
 ksys_read+0x145/0x250 fs/read_write.c:715
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fae4d78ebe9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fae4e532038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fae4d9b6090 RCX: 00007fae4d78ebe9
RDX: 0000000000018ff8 RSI: 0000200000019680 RDI: 0000000000000004
RBP: 00007fae4d811e19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fae4d9b6128 R14: 00007fae4d9b6090 R15: 00007ffca7abbc68
 </TASK>
----------------
Code disassembly (best guess):
   0:	00 00                	add    %al,(%rax)
   2:	00 00                	add    %al,(%rax)
   4:	90                   	nop
   5:	90                   	nop
   6:	90                   	nop
   7:	90                   	nop
   8:	90                   	nop
   9:	90                   	nop
   a:	90                   	nop
   b:	90                   	nop
   c:	90                   	nop
   d:	90                   	nop
   e:	90                   	nop
   f:	90                   	nop
  10:	90                   	nop
  11:	90                   	nop
  12:	90                   	nop
  13:	90                   	nop
  14:	66 0f 1f 00          	nopw   (%rax)
  18:	48 c1 ef 03          	shr    $0x3,%rdi
  1c:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  23:	fc ff df
  26:	0f b6 04 07          	movzbl (%rdi,%rax,1),%eax
* 2a:	3c 08                	cmp    $0x8,%al <-- trapping instruction
  2c:	0f 92 c0             	setb   %al
  2f:	e9 c0 6b 49 09       	jmp    0x9496bf4
  34:	cc                   	int3
  35:	66                   	data16
  36:	66                   	data16
  37:	66                   	data16
  38:	66                   	data16
  39:	66                   	data16
  3a:	66                   	data16
  3b:	2e                   	cs
  3c:	0f                   	.byte 0xf
  3d:	1f                   	(bad)
  3e:	84 00                	test   %al,(%rax)