------------[ cut here ]------------
workqueue: cannot queue hci_cmd_timeout on wq hci2
WARNING: CPU: 1 PID: 21226 at kernel/workqueue.c:2257 __queue_work+0xd03/0x1160 kernel/workqueue.c:2256
Modules linked in:
CPU: 1 UID: 0 PID: 21226 Comm: syz.5.4068 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:__queue_work+0xd03/0x1160 kernel/workqueue.c:2256
Code: 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 4b 04 00 00 48 8b 75 18 4c 89 fa 48 c7 c7 20 27 8c 8b e8 1e 15 f7 ff 90 <0f> 0b 90 90 e9 2f f7 ff ff e8 5f e5 38 00 90 0f 0b 90 e9 b4 f5 ff
RSP: 0018:ffffc90000a08be8 EFLAGS: 00010082
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817b3ee8
RDX: ffff8880287b0000 RSI: ffffffff817b3ef5 RDI: 0000000000000001
RBP: ffff88802a450978 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 1ffff9200014118f
R13: 0000000000000101 R14: ffffffff81843990 R15: ffff88807a5dc978
FS:  0000000000000000(0000) GS:ffff888124b08000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b31bf4ff8 CR3: 0000000062f24000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 call_timer_fn+0x19a/0x620 kernel/time/timer.c:1747
 expire_timers kernel/time/timer.c:1793 [inline]
 __run_timers+0x569/0x960 kernel/time/timer.c:2372
 __run_timer_base kernel/time/timer.c:2384 [inline]
 __run_timer_base kernel/time/timer.c:2376 [inline]
 run_timer_base+0x114/0x190 kernel/time/timer.c:2393
 run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2403
 handle_softirqs+0x219/0x8e0 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x109/0x170 kernel/softirq.c:723
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1052
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x70 kernel/kcov.c:210
Code: c6 6b 57 00 48 89 df 5b e9 2d 1a 5d 00 be 03 00 00 00 5b e9 82 b0 e7 02 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <f3> 0f 1e fa 48 8b 34 24 65 48 8b 15 68 72 e4 11 65 8b 05 79 72 e4
RSP: 0018:ffffc9000c9a7570 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 1ffff92001934eaf RCX: ffffffff816defb3
RDX: ffff8880287b0000 RSI: ffffffff816deff0 RDI: 0000000000000007
RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffff88807cdd6b40
R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000
 arch_check_zapped_pte+0x9d/0x140 arch/x86/mm/pgtable.c:833
 zap_present_folio_ptes mm/memory.c:1644 [inline]
 zap_present_ptes mm/memory.c:1709 [inline]
 do_zap_pte_range mm/memory.c:1810 [inline]
 zap_pte_range mm/memory.c:1854 [inline]
 zap_pmd_range mm/memory.c:1946 [inline]
 zap_pud_range mm/memory.c:1975 [inline]
 zap_p4d_range mm/memory.c:1996 [inline]
 unmap_page_range+0x151d/0x41b0 mm/memory.c:2017
 unmap_single_vma.constprop.0+0x153/0x240 mm/memory.c:2060
 unmap_vmas+0x218/0x470 mm/memory.c:2104
 exit_mmap+0x1b2/0xb90 mm/mmap.c:1280
 __mmput+0x12a/0x410 kernel/fork.c:1133
 mmput+0x62/0x70 kernel/fork.c:1156
 exit_mm kernel/exit.c:582 [inline]
 do_exit+0x7c7/0x2bf0 kernel/exit.c:954
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1107
 get_signal+0x2671/0x26d0 kernel/signal.c:3034
 arch_do_signal_or_restart+0x8f/0x7c0 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop+0x85/0x130 kernel/entry/common.c:40
 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
 do_syscall_64+0x426/0xfa0 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fdc6b18efc9
Code: Unable to access opcode bytes at 0x7fdc6b18ef9f.
RSP: 002b:00007fdc6bfaf038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: fffffffffffffe00 RBX: 00007fdc6b3e5fa0 RCX: 00007fdc6b18efc9
RDX: 000000000000003f RSI: 0000200000000040 RDI: 0000000000000003
RBP: 00007fdc6b211f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fdc6b3e6038 R14: 00007fdc6b3e5fa0 R15: 00007ffd2990ae58
 </TASK>
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	6b 57 00 48          	imul   $0x48,0x0(%rdi),%edx
   4:	89 df                	mov    %ebx,%edi
   6:	5b                   	pop    %rbx
   7:	e9 2d 1a 5d 00       	jmp    0x5d1a39
   c:	be 03 00 00 00       	mov    $0x3,%esi
  11:	5b                   	pop    %rbx
  12:	e9 82 b0 e7 02       	jmp    0x2e7b099
  17:	66 90                	xchg   %ax,%ax
  19:	90                   	nop
  1a:	90                   	nop
  1b:	90                   	nop
  1c:	90                   	nop
  1d:	90                   	nop
  1e:	90                   	nop
  1f:	90                   	nop
  20:	90                   	nop
  21:	90                   	nop
  22:	90                   	nop
  23:	90                   	nop
  24:	90                   	nop
  25:	90                   	nop
  26:	90                   	nop
  27:	90                   	nop
  28:	90                   	nop
* 29:	f3 0f 1e fa          	endbr64 <-- trapping instruction
  2d:	48 8b 34 24          	mov    (%rsp),%rsi
  31:	65 48 8b 15 68 72 e4 	mov    %gs:0x11e47268(%rip),%rdx        # 0x11e472a1
  38:	11
  39:	65                   	gs
  3a:	8b                   	.byte 0x8b
  3b:	05                   	.byte 0x5
  3c:	79 72                	jns    0xb0
  3e:	e4                   	.byte 0xe4