program:
socket(0x10, 0x3, 0x0)
setxattr$security_ima(0x0, 0x0, 0x0, 0x700, 0x0)
writev(0xffffffffffffffff, &(0x7f00000000c0), 0x0)
syz_usb_connect$hid(0x3, 0x36, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e1f0a"], 0x22)
syz_emit_vhci(&(0x7f0000000300)=ANY=[@ANYBLOB="040b"], 0xe)
syz_usb_connect(0x0, 0x0, 0x0, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf)
ioctl$TCFLSH(r0, 0x400455c8, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
r3 = dup(r2)
ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}})
writev(r1, &(0x7f0000000640)=[{&(0x7f0000000140)="2e1221b23bb601c493d3df163e75963d86dd606712e9000d2f8db0049d90491c3248040000dbb8a10000", 0x2a}, {&(0x7f0000000280)="8bcceb216f624c06f5ff84087509000020006558", 0x14}, {&(0x7f00000005c0)="c0b9a0089e7eec0b24e15ac3fdc765f2dc02ba", 0x13}], 0x3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='nsfs\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/dynamic_debug/control\x00', 0x2, 0x80)
write(r4, &(0x7f0000000100)='+p', 0x2)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000580)="d8000000140081044e81f782db44b9040afb07020a000000040000a118000200fe80ffff00000e1208000f01008104017f0016ea1f000b", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x0)
r5 = socket$kcm(0x10, 0x2, 0x0)
write$cgroup_subtree(r5, &(0x7f0000000580)=ANY=[], 0xfe33)
mount(0x0, 0x0, 0x0, 0x0, 0x0)
syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0)
ioctl$TIOCVHANGUP(r0, 0x5437, 0x0)
[ 94.165549][ T5284] Bluetooth: hci0: command tx timeout
[ 94.441503][ T138] Bluetooth: hci1: Frame reassembly failed (-84)
[ 94.499641][ T5322] netlink: 'syz.0.0': attribute type 11 has an invalid length.
[ 94.499761][ T5322] netlink: 132 bytes leftover after parsing attributes in process `syz.0.0'.
[ 94.751892][ T807] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 94.881827][ T807] usb 5-1: device descriptor read/64, error -71
[ 95.121752][ T807] usb 5-1: new high-speed USB device number 3 using dummy_hcd
[ 95.253749][ T807] usb 5-1: device descriptor read/64, error -71
[ 95.362097][ T807] usb usb5-port1: attempt power cycle
[ 95.701688][ T807] usb 5-1: new high-speed USB device number 4 using dummy_hcd
[ 95.722562][ T807] usb 5-1: device descriptor read/8, error -71
[ 95.961813][ T807] usb 5-1: new high-speed USB device number 5 using dummy_hcd
[ 95.982432][ T807] usb 5-1: device descriptor read/8, error -71
[ 96.093188][ T807] usb usb5-port1: unable to enumerate USB device
[ 96.212990][ T46] Bluetooth: hci0: command tx timeout
[ 96.453553][ T5284] Bluetooth: hci1: command 0x1003 tx timeout
[ 96.454751][ T5284] ------------[ cut here ]------------
[ 96.454757][ T5284] refcnt < 0
[ 96.454761][ T5284] WARNING: net/bluetooth/hci_conn.c:649 at hci_conn_timeout+0xff/0x2c0, CPU#0: kworker/u5:2/5284
[ 96.466825][ T5284] Modules linked in:
[ 96.468632][ T5284] CPU: 0 UID: 0 PID: 5284 Comm: kworker/u5:2 Not tainted syzkaller #0 PREEMPT(full)
[ 96.472742][ T5284] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 96.476297][ T5284] Workqueue: hci0 hci_conn_timeout
[ 96.478277][ T5284] RIP: 0010:hci_conn_timeout+0xff/0x2c0
[ 96.480737][ T5284] Code: 48 89 df e8 83 f7 09 00 eb 07 e8 1c e2 ec f6 b0 13 0f b6 f0 48 89 df 5b 41 5c 41 5e 41 5f 5d e9 e7 9e fe ff e8 02 e2 ec f6 90 <0f> 0b 90 eb 8c 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 31 ff ff ff
[ 96.488350][ T5284] RSP: 0018:ffffc9000f127ab0 EFLAGS: 00010293
[ 96.490878][ T5284] RAX: ffffffff8adb3d9e RBX: ffff888012e2c000 RCX: ffff8880003acb00
[ 96.494486][ T5284] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000
[ 96.498011][ T5284] RBP: 00000000ffffffff R08: ffff888012e2c013 R09: 1ffff110025c5802
[ 96.501260][ T5284] R10: dffffc0000000000 R11: ffffed10025c5803 R12: dffffc0000000000
[ 96.505044][ T5284] R13: ffffffff818fc66a R14: ffff888012e2ca50 R15: ffff888012e2c010
[ 96.508682][ T5284] FS: 0000000000000000(0000) GS:ffff88808c2bc000(0000) knlGS:0000000000000000
[ 96.513099][ T5284] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 96.515909][ T5284] CR2: 00007f7c8ba6f07f CR3: 00000000505a3000 CR4: 0000000000352ef0
[ 96.519287][ T5284] Call Trace:
[ 96.520805][ T5284]
[ 96.522090][ T5284] process_scheduled_works+0xc3d/0x1630
[ 96.524197][ T5284] ? __pfx_process_scheduled_works+0x10/0x10
[ 96.526813][ T5284] ? assign_work+0x3cf/0x5d0
[ 96.528701][ T5284] worker_thread+0xa47/0xfb0
[ 96.531071][ T5284] ? __kthread_parkme+0x71/0x1f0
[ 96.533940][ T5284] kthread+0x38b/0x480
[ 96.535798][ T5284] ? __pfx_worker_thread+0x10/0x10
[ 96.538045][ T5284] ? __pfx_kthread+0x10/0x10
[ 96.540422][ T5284] ret_from_fork+0x514/0xb70
[ 96.542555][ T5284] ? __pfx_ret_from_fork+0x10/0x10
[ 96.544831][ T5284] ? __switch_to+0xc89/0x1420
[ 96.546921][ T5284] ? __pfx_kthread+0x10/0x10
[ 96.549032][ T5284] ret_from_fork_asm+0x1a/0x30
[ 96.551066][ T5284]
[ 96.552626][ T5284] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 96.555913][ T5284] CPU: 0 UID: 0 PID: 5284 Comm: kworker/u5:2 Not tainted syzkaller #0 PREEMPT(full)
[ 96.560185][ T5284] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 96.564837][ T5284] Workqueue: hci0 hci_conn_timeout
[ 96.567044][ T5284] Call Trace:
[ 96.568532][ T5284]
[ 96.569856][ T5284] vpanic+0x56d/0xa60
[ 96.571561][ T5284] ? __pfx__printk+0x10/0x10
[ 96.573639][ T5284] ? __pfx_vpanic+0x10/0x10
[ 96.575643][ T5284] ? is_bpf_text_address+0x292/0x2b0
[ 96.577945][ T5284] ? is_bpf_text_address+0x26/0x2b0
[ 96.580244][ T5284] panic+0xc5/0xd0
[ 96.581941][ T5284] ? __pfx_panic+0x10/0x10
[ 96.583917][ T5284] ? ret_from_fork_asm+0x1a/0x30
[ 96.586117][ T5284] __warn+0x315/0x4c0
[ 96.587852][ T5284] ? hci_conn_timeout+0xff/0x2c0
[ 96.589960][ T5284] ? hci_conn_timeout+0xff/0x2c0
[ 96.592039][ T5284] __report_bug+0x276/0x570
[ 96.593971][ T5284] ? hci_conn_timeout+0xff/0x2c0
[ 96.596373][ T5284] ? __pfx___report_bug+0x10/0x10
[ 96.598948][ T5284] ? add_lock_to_list+0xc7/0x100
[ 96.601232][ T5284] ? lockdep_unlock+0x5c/0xd0
[ 96.603226][ T5284] ? __lock_acquire+0x1511/0x2de0
[ 96.605359][ T5284] ? hci_conn_timeout+0xff/0x2c0
[ 96.607395][ T5284] report_bug+0x16b/0x220
[ 96.609249][ T5284] ? hci_conn_timeout+0xff/0x2c0
[ 96.611486][ T5284] ? hci_conn_timeout+0x101/0x2c0
[ 96.613744][ T5284] handle_bug+0x9c/0x200
[ 96.615606][ T5284] exc_invalid_op+0x1a/0x50
[ 96.617617][ T5284] asm_exc_invalid_op+0x1a/0x20
[ 96.619804][ T5284] RIP: 0010:hci_conn_timeout+0xff/0x2c0
[ 96.622231][ T5284] Code: 48 89 df e8 83 f7 09 00 eb 07 e8 1c e2 ec f6 b0 13 0f b6 f0 48 89 df 5b 41 5c 41 5e 41 5f 5d e9 e7 9e fe ff e8 02 e2 ec f6 90 <0f> 0b 90 eb 8c 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 31 ff ff ff
[ 96.629782][ T5284] RSP: 0018:ffffc9000f127ab0 EFLAGS: 00010293
[ 96.632539][ T5284] RAX: ffffffff8adb3d9e RBX: ffff888012e2c000 RCX: ffff8880003acb00
[ 96.636044][ T5284] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000
[ 96.639660][ T5284] RBP: 00000000ffffffff R08: ffff888012e2c013 R09: 1ffff110025c5802
[ 96.643103][ T5284] R10: dffffc0000000000 R11: ffffed10025c5803 R12: dffffc0000000000
[ 96.646631][ T5284] R13: ffffffff818fc66a R14: ffff888012e2ca50 R15: ffff888012e2c010
[ 96.650217][ T5284] ? process_scheduled_works+0x97a/0x1630
[ 96.652821][ T5284] ? hci_conn_timeout+0xfe/0x2c0
[ 96.654819][ T5284] process_scheduled_works+0xc3d/0x1630
[ 96.656989][ T5284] ? __pfx_process_scheduled_works+0x10/0x10
[ 96.659551][ T5284] ? assign_work+0x3cf/0x5d0
[ 96.661642][ T5284] worker_thread+0xa47/0xfb0
[ 96.663706][ T5284] ? __kthread_parkme+0x71/0x1f0
[ 96.665856][ T5284] kthread+0x38b/0x480
[ 96.667640][ T5284] ? __pfx_worker_thread+0x10/0x10
[ 96.669956][ T5284] ? __pfx_kthread+0x10/0x10
[ 96.672005][ T5284] ret_from_fork+0x514/0xb70
[ 96.674137][ T5284] ? __pfx_ret_from_fork+0x10/0x10
[ 96.676546][ T5284] ? __switch_to+0xc89/0x1420
[ 96.678977][ T5284] ? __pfx_kthread+0x10/0x10
[ 96.681144][ T5284] ret_from_fork_asm+0x1a/0x30
[ 96.683173][ T5284]
[ 96.685036][ T5284] Kernel Offset: disabled
[ 96.687047][ T5284] Rebooting in 86400 seconds..