GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
------------[ cut here ]------------
workqueue: cannot queue hci_cmd_timeout on wq hci4
WARNING: kernel/workqueue.c:2437 at __queue_work+0xdfc/0x1360 kernel/workqueue.c:2436, CPU#0: syz.7.23516/8429
Modules linked in:
CPU: 0 UID: 0 PID: 8429 Comm: syz.7.23516 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
RIP: 0010:__queue_work+0xe1a/0x1360 kernel/workqueue.c:2436
Code: 28 78 01 00 00 4c 8d 35 74 0f 11 10 48 89 f8 48 c1 e8 03 80 3c 18 00 74 05 e8 42 8c b0 00 49 8b 77 18 4c 89 f7 48 8b 54 24 28 <67> 48 0f b9 3a 4c 89 f8 48 c1 e8 03 80 3c 18 00 74 08 4c 89 ff e8
RSP: 0018:ffffc90000007be8 EFLAGS: 00010046
RAX: 1ffff110073ad94e RBX: dffffc0000000000 RCX: ffff8880390a5dc0
RDX: ffff888038346178 RSI: ffffffff8aee33b0 RDI: ffffffff919ffd90
RBP: 0000000000010000 R08: 0000000000000100 R09: 1ffffffff233a4f7
R10: dffffc0000000000 R11: ffffffff818ef750 R12: ffff8880383461c0
R13: 0000000000000008 R14: ffffffff919ffd90 R15: ffff888039d6ca58
FS: 0000000000000000(0000) GS:ffff88812362d000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8bfedf7ff8 CR3: 000000007c24c000 CR4: 00000000003526f0
Call Trace:
call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1749
expire_timers kernel/time/timer.c:1795 [inline]
__run_timers kernel/time/timer.c:2375 [inline]
__run_timer_base+0x67e/0x8b0 kernel/time/timer.c:2387
run_timer_base kernel/time/timer.c:2396 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2406
handle_softirqs+0x265/0x8d0 kernel/softirq.c:669
__do_softirq kernel/softirq.c:703 [inline]
invoke_softirq kernel/softirq.c:542 [inline]
__irq_exit_rcu+0xc6/0x220 kernel/softirq.c:786
irq_exit_rcu+0x9/0x30 kernel/softirq.c:809
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:rcu_do_enqueue+0x62e/0x870 kernel/rcu/tree.c:3204
Code: 05 67 bd 47 0e 49 03 07 49 39 c6 7f 47 e8 ca 1c 23 00 9c 58 a9 00 02 00 00 75 1f f7 44 24 20 00 02 00 00 74 01 fb 48 83 c4 50 <5b> 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 9d c6 51 0a f7
RSP: 0018:ffffc900043df688 EFLAGS: 00000286
RAX: 0000000000000006 RBX: ffff8880787fd140 RCX: 0000000000000046
RDX: 0000000000000006 RSI: ffffffff8e69c891 RDI: ffffffff8c8e7180
RBP: ffff8880b823d490 R08: ffffffff919d27bf R09: 1ffffffff233a4f7
R10: dffffc0000000000 R11: fffffbfff233a4f8 R12: 1ffff11017047a98
R13: 1ffff11017047a92 R14: 0000000000000024 R15: ffff8880b823d4c0
__call_rcu_common kernel/rcu/tree.c:3300 [inline]
call_rcu+0x20e/0x300 kernel/rcu/tree.c:3395
slab_free_hook mm/slub.c:2744 [inline]
slab_free mm/slub.c:6630 [inline]
kmem_cache_free+0x471/0x650 mm/slub.c:6757
tear_down_vmas+0x31f/0x530 mm/mmap.c:1277
exit_mmap+0x4ca/0x9f0 mm/mmap.c:1335
__mmput+0x118/0x420 kernel/fork.c:1191
exit_mm+0x18e/0x240 kernel/exit.c:586
do_exit+0x6a8/0x2360 kernel/exit.c:967
do_group_exit+0x22d/0x2f0 kernel/exit.c:1123
get_signal+0x1216/0x12c0 kernel/signal.c:3112
arch_do_signal_or_restart+0xbb/0x860 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:66 [inline]
exit_to_user_mode_loop+0x10e/0x770 kernel/entry/common.c:101
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:343 [inline]
do_syscall_64+0x328/0x520 arch/x86/entry/syscall_64.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe941d9f559
Code: Unable to access opcode bytes at 0x7fe941d9f52f.
RSP: 002b:00007fe942b850e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007fe942025fa8 RCX: 00007fe941d9f559
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fe942025fa8
RBP: 00007fe942025fa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fe942026038 R14: 00007fe94214f960 R15: 00007fe94214fa48
----------------
Code disassembly (best guess):
0: 28 78 01 sub %bh,0x1(%rax)
3: 00 00 add %al,(%rax)
5: 4c 8d 35 74 0f 11 10 lea 0x10110f74(%rip),%r14 # 0x10110f80
c: 48 89 f8 mov %rdi,%rax
f: 48 c1 e8 03 shr $0x3,%rax
13: 80 3c 18 00 cmpb $0x0,(%rax,%rbx,1)
17: 74 05 je 0x1e
19: e8 42 8c b0 00 call 0xb08c60
1e: 49 8b 77 18 mov 0x18(%r15),%rsi
22: 4c 89 f7 mov %r14,%rdi
25: 48 8b 54 24 28 mov 0x28(%rsp),%rdx
* 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2f: 4c 89 f8 mov %r15,%rax
32: 48 c1 e8 03 shr $0x3,%rax
36: 80 3c 18 00 cmpb $0x0,(%rax,%rbx,1)
3a: 74 08 je 0x44
3c: 4c 89 ff mov %r15,%rdi
3f: e8 .byte 0xe8