program:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_bt_hci(r0, 0x400448cb, 0x0)
syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e1f0a"], 0x22)
syz_emit_vhci(&(0x7f0000000300)=ANY=[@ANYBLOB="040b"], 0xe)
syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e0402030c"], 0x7)
syz_mount_image$hfsplus(&(0x7f00000000c0), &(0x7f0000000080)='./file2\x00', 0x4800, &(0x7f0000000100)=ANY=[], 0x1, 0x6bb, &(0x7f00000018c0)="$eJzs3c1vXFfdB/DvHY8dT9ombpq0eR5VqtVIgIhI7FgpmA0BIWSkCqGyYG0lTmNlkhbHRW6FqMPrtov+Ad1kg1ghsWITqbBgA7vukJeVkNh0g1kNujN3XjJ+m+bF45TPJ7pzzj3nnnN/93fvnbfImgD/s5bOp34/RZbOv75Rrm/dW2hu3Vu41a0nOZZkM6knqSUp/t1qtT5OriRFb5piqNzhw9XFNz75bOvTzlq9Wtrb1/YbN6TabnOoebPbNptkoiofwQPzXX3k+Ype5FeSnKtKGLvJJK3WZFo9P/nrs72esvNkp2zsNnr68AIFnpii87pZvhjXBttnkuPVjV6+D+i+8tbGEuQIjo243fA7CAAAAHjajPIZ+OR2trNRnDiEcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOALYbP/+/9FtdS69dkU3d//n6raUtWPllc+3+b3n1QcAAAAAAAAAHCIXtnOdjZyorveKtr/5/9qe+V0+/GZvJM7WclaLmQjy1nPetYyn2RmYKKpjeX19bX5EUZe2nXkpQMCPVaVjcdz3AAAAAAAAADwBfOLLPX//x8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAI6CIpnoFCnuDjTPpFZPMp1kqmzYTP7erT/N7o87AAAAADgEJ7eznY2c6K63ipxO8mL7O4DpvJPbWc9q1tPMSq61vxfofOqvbd1baG7dW7hVLjvn/fa/HlidPiCM9ozpfPew+57Ptrdo5HpW2y0XcjVvpZlrqbVHls5W8XRnHYrrbhlT8a3KiAm6VpXlkX9QlTu8P+Jk+xv+MqWx/xcsM+2MTPYyMlfFVmbj+e6Z2f0MDZ2dgwzvaT61XmCnh/Y0FPBD5fx4VZbH85u9cj4Ww5m4NHD1vbh/zpMv//H3P56r6kfnkEYzUZWt9mNjZyYWBjLx0iiZuNG8ffPG9Tvnn7ZM7DDXzsSZ3vpSvpcf5Xxm88OsZTU/zXLWs5LZfLddW65OfjFwe++RqSudYnK33S71E9fN+1R1hU5UrZ8nplfbY09kNT/IW7mWlbzW/ncp8/l6LudyFgfO8Jn9z3D7rq89cNf3XwFaz+2axnNfqSrl095vq3JXe3Y8KWVenx/I6+Bz7ky7b7Cln6VTB2epTMsDz41/2j+U+v9XlXIfvxw49+M3nIn5gUy8sF8muhfynebtm2s3lt8ebXenPhgY/usj9ZRaXi+nypOV7gnqXx1l3wvdvqF8lX2ne321HX1nen2dO3Vzzzt1qnoPt3OmS+2+l3btW2j3nR3o2+391sHv5gAYs+NfPT7V+Gfjb42PGr9q3Gi8Pv2dY9849vJUJv88+c363MSXai8Xf8hH+Xn/8z8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPDw7rz73s3lZnNlbajSarXe36Or2TqZ7NH1cJXanmGUlfoBoe6oZPYfz5QDui2t9Lq6P2f2GIM/qPJ/zyajj6p+gSedlvrjzfMYK/9ptVpVS7HHNr/7y85EPTdS6qZGvzYOqExXV3jlSKSuqtQPeadjekICDs3F9VtvX7zz7ntfW721/ObKmyu3Fy9fXpxbvPzawsXrq82Vuc7juKMEnoT+i/64IwEAAAAAAAAAAABGNdrfA+SR/pxg3McIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPN2Wzqd+P0Xm5y7Mletb9xaa5dKt97esJ6klKX6WFB8nV9JZMjMwXbHXfj5cXXzjk8+2Pu3PVS75/tUDxo1ms1oym2SiU959XPNdrcp9FfsdQtE7wjJh57qJg3H7bwAAAP//EOj9JQ==")
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file2\x00', 0x42, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, 0x0, 0x0)
pwrite64(r2, &(0x7f0000000140)='2', 0x1, 0x8000c65)
socket$inet6_tcp(0xa, 0x1, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5)
close(0x4)
syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00')
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000)
r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x20, 0x3, &(0x7f0000000580)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94)
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={r4, 0x0, 0x2d, 0x0, @val=@perf_event={0xa}}, 0x18)
dup2(r2, r1)
write$FUSE_WRITE(r1, &(0x7f00000000c0)={0x18}, 0xfffffdef)
[ 86.174249][ T5326] ------------[ cut here ]------------
[ 86.177334][ T5326] workqueue: cannot queue hci_rx_work on wq hci0
[ 86.181550][ T5326] WARNING: kernel/workqueue.c:2271 at __queue_work+0xd53/0x1020, CPU#0: syz.0.0/5326
[ 86.186862][ T5326] Modules linked in:
[ 86.188707][ T5326] CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 86.192682][ T5326] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 86.197199][ T5326] RIP: 0010:__queue_work+0xd7e/0x1020
[ 86.199772][ T5326] Code: 83 c5 18 4c 89 e8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ef e8 63 18 a4 00 49 8b 75 00 49 81 c7 78 01 00 00 4c 89 f7 4c 89 fa <67> 48 0f b9 3a 48 83 c4 58 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc
[ 86.208677][ T5326] RSP: 0018:ffffc9000df4fb20 EFLAGS: 00010086
[ 86.211484][ T5326] RAX: 1ffff110023ca97b RBX: 0000000000000008 RCX: 0000000000100000
[ 86.215101][ T5326] RDX: ffff888032fb2178 RSI: ffffffff8aa06c00 RDI: ffffffff9014aa90
[ 86.219490][ T5326] RBP: 0000000000000000 R08: ffff888011e54bc7 R09: 1ffff110023ca978
[ 86.223331][ T5326] R10: dffffc0000000000 R11: ffffed10023ca979 R12: dffffc0000000000
[ 86.227347][ T5326] R13: ffff888011e54bd8 R14: ffffffff9014aa90 R15: ffff888032fb2178
[ 86.230820][ T5326] FS: 00007f91eeb926c0(0000) GS:ffff88808ca58000(0000) knlGS:0000000000000000
[ 86.234794][ T5326] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 86.238086][ T5326] CR2: 00007f91eeb456a0 CR3: 0000000044f05000 CR4: 0000000000352ef0
[ 86.241286][ T5326] Call Trace:
[ 86.242740][ T5326]
[ 86.244065][ T5326] ? rcu_is_watching+0x15/0xb0
[ 86.246182][ T5326] queue_work_on+0x106/0x1d0
[ 86.248006][ T5326] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 86.250459][ T5326] hci_recv_frame+0x625/0x7c0
[ 86.252634][ T5326] ? skb_pull+0xc1/0x1d0
[ 86.254447][ T5326] vhci_write+0x358/0x4a0
[ 86.256527][ T5326] vfs_write+0x61d/0xb90
[ 86.259730][ T5326] ? __pfx_vfs_write+0x10/0x10
[ 86.262170][ T5326] ? __fget_files+0x2a/0x420
[ 86.264309][ T5326] ksys_write+0x150/0x270
[ 86.266264][ T5326] ? __pfx_ksys_write+0x10/0x10
[ 86.268556][ T5326] do_syscall_64+0x14d/0xf80
[ 86.270728][ T5326] ? trace_irq_disable+0x3b/0x150
[ 86.273016][ T5326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.275802][ T5326] ? clear_bhb_loop+0x40/0x90
[ 86.277902][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.280831][ T5326] RIP: 0033:0x7f91edd5cfce
[ 86.282844][ T5326] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[ 86.290644][ T5326] RSP: 002b:00007f91eeb91f78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 86.293975][ T5326] RAX: ffffffffffffffda RBX: 00007f91eeb926c0 RCX: 00007f91edd5cfce
[ 86.298756][ T5326] RDX: 000000000000000e RSI: 0000200000000300 RDI: 00000000000000ca
[ 86.303245][ T5326] RBP: 00007f91ede32bd9 R08: 0000000000000000 R09: 0000000000000000
[ 86.306949][ T5326] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 86.310246][ T5326] R13: 00007f91ee016128 R14: 00007f91ee016090 R15: 00007ffc65660618
[ 86.313442][ T5326]
[ 86.314774][ T5326] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 86.318069][ T5326] CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 86.321866][ T5326] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 86.327225][ T5326] Call Trace:
[ 86.328620][ T5326]
[ 86.329765][ T5326] vpanic+0x56c/0xa60
[ 86.331651][ T5326] ? __pfx__printk+0x10/0x10
[ 86.333780][ T5326] ? __pfx_vpanic+0x10/0x10
[ 86.335792][ T5326] ? is_bpf_text_address+0x292/0x2b0
[ 86.338375][ T5326] ? is_bpf_text_address+0x26/0x2b0
[ 86.340686][ T5326] panic+0xc5/0xd0
[ 86.342625][ T5326] ? __pfx_panic+0x10/0x10
[ 86.345094][ T5326] __warn+0x315/0x4f0
[ 86.346913][ T5326] ? __queue_work+0xd53/0x1020
[ 86.348714][ T5326] ? __queue_work+0xd53/0x1020
[ 86.350761][ T5326] __report_bug+0x29a/0x540
[ 86.352760][ T5326] ? __queue_work+0xd53/0x1020
[ 86.354790][ T5326] ? __pfx___report_bug+0x10/0x10
[ 86.356980][ T5326] ? __pfx_hci_rx_work+0x10/0x10
[ 86.359249][ T5326] ? do_syscall_64+0x14d/0xf80
[ 86.361621][ T5326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.364747][ T5326] report_bug_entry+0x19a/0x290
[ 86.367912][ T5326] ? __queue_work+0xd7e/0x1020
[ 86.370856][ T5326] ? __queue_work+0xd83/0x1020
[ 86.373113][ T5326] handle_bug+0xce/0x200
[ 86.374955][ T5326] exc_invalid_op+0x1a/0x50
[ 86.377257][ T5326] asm_exc_invalid_op+0x1a/0x20
[ 86.379401][ T5326] RIP: 0010:__queue_work+0xd7e/0x1020
[ 86.381503][ T5326] Code: 83 c5 18 4c 89 e8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ef e8 63 18 a4 00 49 8b 75 00 49 81 c7 78 01 00 00 4c 89 f7 4c 89 fa <67> 48 0f b9 3a 48 83 c4 58 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc
[ 86.389626][ T5326] RSP: 0018:ffffc9000df4fb20 EFLAGS: 00010086
[ 86.392467][ T5326] RAX: 1ffff110023ca97b RBX: 0000000000000008 RCX: 0000000000100000
[ 86.395496][ T5326] RDX: ffff888032fb2178 RSI: ffffffff8aa06c00 RDI: ffffffff9014aa90
[ 86.398533][ T5326] RBP: 0000000000000000 R08: ffff888011e54bc7 R09: 1ffff110023ca978
[ 86.402016][ T5326] R10: dffffc0000000000 R11: ffffed10023ca979 R12: dffffc0000000000
[ 86.405336][ T5326] R13: ffff888011e54bd8 R14: ffffffff9014aa90 R15: ffff888032fb2178
[ 86.408268][ T5326] ? __pfx_hci_rx_work+0x10/0x10
[ 86.410091][ T5326] ? rcu_is_watching+0x15/0xb0
[ 86.411905][ T5326] queue_work_on+0x106/0x1d0
[ 86.414314][ T5326] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 86.418014][ T5326] hci_recv_frame+0x625/0x7c0
[ 86.420454][ T5326] ? skb_pull+0xc1/0x1d0
[ 86.422150][ T5326] vhci_write+0x358/0x4a0
[ 86.423908][ T5326] vfs_write+0x61d/0xb90
[ 86.425600][ T5326] ? __pfx_vfs_write+0x10/0x10
[ 86.427821][ T5326] ? __fget_files+0x2a/0x420
[ 86.429673][ T5326] ksys_write+0x150/0x270
[ 86.431492][ T5326] ? __pfx_ksys_write+0x10/0x10
[ 86.433521][ T5326] do_syscall_64+0x14d/0xf80
[ 86.435898][ T5326] ? trace_irq_disable+0x3b/0x150
[ 86.438921][ T5326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.441976][ T5326] ? clear_bhb_loop+0x40/0x90
[ 86.444077][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.446428][ T5326] RIP: 0033:0x7f91edd5cfce
[ 86.448433][ T5326] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[ 86.457276][ T5326] RSP: 002b:00007f91eeb91f78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 86.460769][ T5326] RAX: ffffffffffffffda RBX: 00007f91eeb926c0 RCX: 00007f91edd5cfce
[ 86.463790][ T5326] RDX: 000000000000000e RSI: 0000200000000300 RDI: 00000000000000ca
[ 86.466962][ T5326] RBP: 00007f91ede32bd9 R08: 0000000000000000 R09: 0000000000000000
[ 86.470603][ T5326] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 86.475885][ T5326] R13: 00007f91ee016128 R14: 00007f91ee016090 R15: 00007ffc65660618
[ 86.479436][ T5326]
[ 86.481055][ T5326] Kernel Offset: disabled
[ 86.483068][ T5326] Rebooting in 86400 seconds..