------------[ cut here ]------------
workqueue: cannot queue hci_cmd_timeout on wq hci4
WARNING: kernel/workqueue.c:2251 at __queue_work+0xc9d/0x10e0 kernel/workqueue.c:2250, CPU#2: syz-executor/5948
Modules linked in:
CPU: 2 UID: 0 PID: 5948 Comm: syz-executor Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:__queue_work+0xca1/0x10e0 kernel/workqueue.c:2250
Code: 78 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 f9 48 c1 e9 03 80 3c 01 00 0f 85 0c 04 00 00 48 8d 3d 03 8e 07 0f 48 8b 75 18 <67> 48 0f b9 3a e9 90 f7 ff ff e8 50 11 3a 00 90 0f 0b 90 e9 15 f6
RSP: 0018:ffffc90000538be8 EFLAGS: 00010046
RAX: dffffc0000000000 RBX: 0000000000000100 RCX: 1ffff11009e9c951
RDX: ffff88802470c178 RSI: ffffffff8a68c4a0 RDI: ffffffff908bd2d0
RBP: ffff88804f4e4a70 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000100 R11: ffff8880250c2ff0 R12: 1ffff920000a718f
R13: ffffffff81845610 R14: 0000000000000101 R15: ffff88802470c000
FS:  0000000000000000(0000) GS:ffff8880978fd000(0063) knlGS:0000000056892440
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 0000000080dc4000 CR3: 000000004d41b000 CR4: 0000000000352ef0
Call Trace:
 <IRQ>
 call_timer_fn+0x19a/0x5a0 kernel/time/timer.c:1748
 expire_timers kernel/time/timer.c:1794 [inline]
 __run_timers+0x569/0xae0 kernel/time/timer.c:2373
 __run_timer_base kernel/time/timer.c:2385 [inline]
 __run_timer_base kernel/time/timer.c:2377 [inline]
 run_timer_base+0x114/0x190 kernel/time/timer.c:2394
 run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2404
 handle_softirqs+0x219/0x950 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x109/0x170 kernel/softirq.c:723
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1056
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:202
Code: 90 f3 0f 1e fa 53 48 8b 74 24 08 48 89 fb 48 83 c7 18 e8 9a 45 21 f6 48 89 df e8 52 98 21 f6 e8 2d 41 4e f6 fb bf 01 00 00 00 <e8> 62 9b 11 f6 65 8b 05 9b f9 39 08 85 c0 74 06 5b e9 01 4d 00 00
RSP: 0018:ffffc90004b4fc88 EFLAGS: 00000202
RAX: 0000000000228a61 RBX: ffff888024eaca00 RCX: ffffffff81c676bf
RDX: 0000000000000000 RSI: ffffffff8daca141 RDI: 0000000000000001
RBP: ffff888024eacc00 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff9088e1d7 R11: ffff8880250c2ff0 R12: 0000000000000000
R13: 0000000000000011 R14: 0000000000000200 R15: ffff888024eaca00
 spin_unlock_irq include/linux/spinlock.h:401 [inline]
 get_signal+0x1e6a/0x26d0 kernel/signal.c:3037
 arch_do_signal_or_restart+0x8f/0x7a0 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:41 [inline]
 exit_to_user_mode_loop+0x8c/0x540 kernel/entry/common.c:75
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
 __do_fast_syscall_32+0x4a4/0x680 arch/x86/entry/syscall_32.c:310
 do_fast_syscall_32+0x32/0x80 arch/x86/entry/syscall_32.c:332
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf7f52579
Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
RSP: 002b:00000000ffbdbcf0 EFLAGS: 00000293 ORIG_RAX: 000000000000010b
RAX: fffffffffffffdfc RBX: 0000000000000000 RCX: 0000000000000000
RDX: 00000000ffbdbd24 RSI: 00000000ffbdbd1c RDI: 00000000ffbdbd24
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
----------------
Code disassembly (best guess):
   0:	78 01                	js     0x3
   2:	00 00                	add    %al,(%rax)
   4:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
   b:	fc ff df
   e:	48 89 f9             	mov    %rdi,%rcx
  11:	48 c1 e9 03          	shr    $0x3,%rcx
  15:	80 3c 01 00          	cmpb   $0x0,(%rcx,%rax,1)
  19:	0f 85 0c 04 00 00    	jne    0x42b
  1f:	48 8d 3d 03 8e 07 0f 	lea    0xf078e03(%rip),%rdi        # 0xf078e29
  26:	48 8b 75 18          	mov    0x18(%rbp),%rsi
* 2a:	67 48 0f b9 3a       	ud1    (%edx),%rdi <-- trapping instruction
  2f:	e9 90 f7 ff ff       	jmp    0xfffff7c4
  34:	e8 50 11 3a 00       	call   0x3a1189
  39:	90                   	nop
  3a:	0f 0b                	ud2
  3c:	90                   	nop
  3d:	e9                   	.byte 0xe9
  3e:	15                   	.byte 0x15
  3f:	f6                   	.byte 0xf6