------------[ cut here ]------------
workqueue: cannot queue hci_cmd_timeout on wq hci2
WARNING: CPU: 1 PID: 6041 at kernel/workqueue.c:2256 __queue_work+0xd38/0xfb0
Modules linked in:
CPU: 1 UID: 0 PID: 6041 Comm: kworker/1:4 Not tainted 6.16.0-syzkaller-11895-gcca7a0aae895-dirty #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Workqueue: usb_hub_wq hub_event
RIP: 0010:__queue_work+0xd38/0xfb0
Code: 42 80 3c 20 00 74 08 4c 89 ef e8 83 06 99 00 49 8b 75 00 49 81 c7 78 01 00 00 48 c7 c7 20 df 89 8b 4c 89 fa e8 49 3a f9 ff 90 <0f> 0b 90 90 e9 1a f5 ff ff e8 ba 9b 35 00 90 0f 0b 90 e9 dd fc ff
RSP: 0018:ffffc900001e0b10 EFLAGS: 00010046
RAX: 06418d0689747100 RBX: 0000000000000100 RCX: ffff888107b18000
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000002
RBP: 1ffff11023316838 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff1bfa1ec R12: dffffc0000000000
R13: ffff888119f64988 R14: 0000000000000008 R15: ffff8881198b4178
FS:  0000000000000000(0000) GS:ffff8881a3c24000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005555725ab5c8 CR3: 00000000292f6000 CR4: 00000000000006f0
Call Trace:
 <IRQ>
 call_timer_fn+0x17e/0x5f0
 __run_timer_base+0x646/0x860
 run_timer_softirq+0xb7/0x180
 handle_softirqs+0x286/0x870
 __irq_exit_rcu+0xca/0x1f0
 irq_exit_rcu+0x9/0x30
 sysvec_apic_timer_interrupt+0xa6/0xc0
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:kfree+0x84/0x440
Code: ac 02 00 00 48 83 fb 11 0f 82 67 01 00 00 4c 8b 3d 39 1e a5 0b 48 89 df e8 39 6f 5c ff 48 c1 e8 06 48 83 e0 c0 49 8b 4c 07 08 <f6> c1 01 0f 85 72 01 00 00 49 01 c7 0f 1f 44 00 00 41 0f b6 47 33
RSP: 0018:ffffc90004c2e9f0 EFLAGS: 00000202
RAX: 00000000007f7f80 RBX: ffff88801fdfe300 RCX: ffff88801a4413c0
RDX: ffffc90029d5f000 RSI: 00000000000111a2 RDI: 00000000000111a3
RBP: ffffc90004c2eb80 R08: ffff88801fdfe303 R09: 1ffff11003fbfc60
R10: dffffc0000000000 R11: ffffed1003fbfc61 R12: 0000000000000000
R13: dffffc0000000000 R14: ffffffff872b279e R15: ffffea0000000000
 usb_start_wait_urb+0x21e/0x4c0
 usb_control_msg+0x232/0x3e0
 reg_r+0xed/0x2e0
 sd_init+0x2ff/0x4f20
 gspca_dev_probe2+0x855/0x1440
 usb_probe_interface+0x668/0xc30
 really_probe+0x26d/0x9e0
 __driver_probe_device+0x18c/0x2f0
 driver_probe_device+0x4f/0x430
 __device_attach_driver+0x2ce/0x530
 bus_for_each_drv+0x251/0x2e0
 __device_attach+0x2b8/0x400
 bus_probe_device+0x185/0x260
 device_add+0x7b6/0xb50
 usb_set_configuration+0x1a87/0x20e0
 usb_generic_driver_probe+0x8d/0x150
 usb_probe_device+0x1c4/0x390
 really_probe+0x26d/0x9e0
 __driver_probe_device+0x18c/0x2f0
 driver_probe_device+0x4f/0x430
 __device_attach_driver+0x2ce/0x530
 bus_for_each_drv+0x251/0x2e0
 __device_attach+0x2b8/0x400
 bus_probe_device+0x185/0x260
 device_add+0x7b6/0xb50
 usb_new_device+0xa39/0x16f0
 hub_event+0x2958/0x4a20
 process_scheduled_works+0xae1/0x17b0
 worker_thread+0x8a0/0xda0
 kthread+0x711/0x8a0
 ret_from_fork+0x3fc/0x770
 ret_from_fork_asm+0x1a/0x30
 </TASK>
