------------[ cut here ]------------
workqueue: cannot queue hci_cmd_timeout on wq hci1
WARNING: kernel/workqueue.c:2352 at __queue_work+0xdb7/0x1370 kernel/workqueue.c:2351, CPU#3: syz.2.52/6098
Modules linked in:
CPU: 3 UID: 0 PID: 6098 Comm: syz.2.52 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:__queue_work+0xdbb/0x1370 kernel/workqueue.c:2351
Code: 00 00 00 fc ff df 49 8d 94 24 70 01 00 00 48 89 f9 48 c1 e9 03 80 3c 01 00 0f 85 84 05 00 00 48 8d 3d 09 2a 78 0f 48 8b 75 18 <67> 48 0f b9 3a 48 b8 00 00 00 00 00 fc ff df 48 89 ea 48 c1 ea 03
RSP: 0000:ffffc900005f8b68 EFLAGS: 00010046
RAX: dffffc0000000000 RBX: 0000000000000100 RCX: 1ffff11009dbd94e
RDX: ffff88804de8e970 RSI: ffffffff8ac09060 RDI: ffffffff91483ce0
RBP: ffff88804edeca58 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000100 R11: 0000000000000001 R12: ffff88804de8e800
R13: 1ffff920000bf177 R14: 0000000000000000 R15: ffffffff81d018a0
FS:  0000000000000000(0000) GS:ffff888096c60000(0063) knlGS:00000000570ba480
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 000000008000c000 CR3: 000000005dcb6000 CR4: 0000000000352ef0
Call Trace:
 <IRQ>
 call_timer_fn+0x198/0x5f0 kernel/time/timer.c:1748
 expire_timers kernel/time/timer.c:1794 [inline]
 __run_timers+0x570/0xb00 kernel/time/timer.c:2374
 __run_timer_base kernel/time/timer.c:2386 [inline]
 __run_timer_base kernel/time/timer.c:2378 [inline]
 run_timer_base+0x114/0x190 kernel/time/timer.c:2395
 run_timer_softirq+0x1a/0x50 kernel/time/timer.c:2405
 handle_softirqs+0x1e6/0x9d0 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0x16a/0x210 kernel/softirq.c:758
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:211 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 kernel/locking/spinlock.c:221
Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 f6 5a 15 f6 48 89 df e8 7e b1 15 f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 <bf> 01 00 00 00 e8 05 a7 04 f6 65 48 83 3d 74 a4 ba 08 00 74 16 5b
RSP: 0000:ffffc9000620f9f0 EFLAGS: 00000246
RAX: 0000000000000006 RBX: ffff88807ffd6f00 RCX: 0000000000000040
RDX: 0000000000000003 RSI: ffffffff8e3f18bd RDI: ffffffff8c622c80
RBP: 0000000000000283 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: dffffc0000000000 R12: dffffc0000000000
R13: ffff88802b541e00 R14: 000000000000003f R15: 000000000000003f
 free_frozen_page_commit+0x79e/0x1050 mm/page_alloc.c:2900
 __free_frozen_pages+0x73b/0x10f0 mm/page_alloc.c:2988
 free_devinfo+0x8b/0xb0 sound/core/seq/oss/seq_oss_init.c:390
 port_delete.isra.0+0x11e/0x210 sound/core/seq/seq_ports.c:269
 snd_seq_delete_port+0x228/0x2c0 sound/core/seq/seq_ports.c:296
 snd_seq_ioctl_delete_port+0xb6/0x200 sound/core/seq/seq_clientmgr.c:1380
 call_seq_client_ctl+0xa3/0x130 sound/core/seq/seq_clientmgr.c:2467
 snd_seq_kernel_client_ctl+0x35/0x50 sound/core/seq/seq_clientmgr.c:2495
 snd_seq_event_port_detach+0xbb/0x100 sound/core/seq/seq_ports.c:717
 delete_port sound/core/seq/oss/seq_oss_init.c:335 [inline]
 snd_seq_oss_release+0x139/0x180 sound/core/seq/oss/seq_oss_init.c:415
 odev_release+0x4c/0x70 sound/core/seq/oss/seq_oss.c:141
 __fput+0x3ff/0xb50 fs/file_table.c:512
 task_work_run+0x150/0x240 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:70 [inline]
 exit_to_user_mode_loop+0x1d8/0x700 kernel/entry/common.c:101
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:336 [inline]
 __do_fast_syscall_32+0x59f/0x8b0 arch/x86/entry/syscall_32.c:294
 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf705efec
Code: Unable to access opcode bytes at 0xf705efc2.
RSP: 002b:00000000ffe467fc EFLAGS: 00000202 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 000000000000001e
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
----------------
Code disassembly (best guess):
   0:	00 00                	add    %al,(%rax)
   2:	00 fc                	add    %bh,%ah
   4:	ff                   	lcall  (bad)
   5:	df 49 8d             	fisttps -0x73(%rcx)
   8:	94                   	xchg   %eax,%esp
   9:	24 70                	and    $0x70,%al
   b:	01 00                	add    %eax,(%rax)
   d:	00 48 89             	add    %cl,-0x77(%rax)
  10:	f9                   	stc
  11:	48 c1 e9 03          	shr    $0x3,%rcx
  15:	80 3c 01 00          	cmpb   $0x0,(%rcx,%rax,1)
  19:	0f 85 84 05 00 00    	jne    0x5a3
  1f:	48 8d 3d 09 2a 78 0f 	lea    0xf782a09(%rip),%rdi        # 0xf782a2f
  26:	48 8b 75 18          	mov    0x18(%rbp),%rsi
* 2a:	67 48 0f b9 3a       	ud1    (%edx),%rdi <-- trapping instruction
  2f:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  36:	fc ff df
  39:	48 89 ea             	mov    %rbp,%rdx
  3c:	48 c1 ea 03          	shr    $0x3,%rdx