program:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc) (async)
r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_bt_hci(r1, 0x400448cb, 0x0) (async)
r2 = syz_open_dev$sg(&(0x7f00000000c0), 0xb, 0x101100)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f0000000100))
syz_emit_vhci(&(0x7f00000007c0)=ANY=[@ANYBLOB="040e06006220"], 0x9) (async)
sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x209, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8}, @NFTA_HOOK_PRIORITY={0x8}]}]}], {0x14}}, 0x88}}, 0x0)
syz_mount_image$erofs(&(0x7f0000000180), &(0x7f00000001c0)='./file3\x00', 0x8, &(0x7f0000000200)=ANY=[@ANYRES16=0x0, @ANYRES64, @ANYBLOB="5333c923ead7d62a1aa7e1ad6926618430329b0ea6e6e24d7310d2249d89707d2a2ee55d187812e2a0109f36ed3b24151208962f1353f76d5dc207c8b61a67695d2e4632e520"], 0x1, 0x192, &(0x7f0000000280)="$eJzslb1O8lAYx//nlM837xW8yztIIg6WtqhxIZHFycHED+JgIpFK0CIGOgiJg1dgXF2Mg/ehqxdh0EUXnHSuac+hHBXUmCgkPr+Ep7/S08PTp8kfEATxa7m9eWp7j7m7BIC/SCEuv7/Xemu4sv468XBwuTBfOFo/v4q39WS/PT3v878fAXCR1+CG9768OyWPy+Chr4BjQnoBDLr0DXCsSrfBsCZ9W/Gav17XtyqOrW/WnJIvhl9Mv1h+yb7ur3PIUAIQlf0x5Xqj2dopOo5d/0b5aH6dPEdOmZ/6vrqzMZT5meAwpWfBsCR9FvHubMRIlOf/F+ntr/3w85OMhJwei1c+Kv2QjLT08sk7YxhX8klEyUnwV5Nxq3uZRrM1WakWy3bZ3rWs7IwxZRjTViYIIlHfyb9kkE9/lP2jA9bGWAz7Rdetm6KG55ao/RKXB/nHkR4T5372x95uHUYikx8eHH1LawObJwiCGCL/wYLMDHK5K3PyohdiLQ65T4IgCIIgCIIgCIIgvs5zAAAA//+G5W2x")
r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
open_by_handle_at(r3, &(0x7f0000000180)=@raw={0x4, 0x71, {'F&'}}, 0x440200)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)={{0x14}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @reject={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_REJECT_TYPE={0x8}, @NFTA_REJECT_ICMP_CODE={0x5}]}}}]}]}], {0x14}}, 0x7c}}, 0x0)
[ 86.009055][ T5286] Bluetooth: hci0: command tx timeout
[ 86.185793][ T5326] ------------[ cut here ]------------
[ 86.188195][ T5326] workqueue: cannot queue hci_rx_work on wq hci0
[ 86.190929][ T5326] WARNING: kernel/workqueue.c:2298 at __queue_work+0xd1f/0xfc0, CPU#0: syz.0.0/5326
[ 86.194851][ T5326] Modules linked in:
[ 86.196532][ T5326] CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 86.200280][ T5326] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 86.204466][ T5326] RIP: 0010:__queue_work+0xd4a/0xfc0
[ 86.206828][ T5326] Code: 83 c5 18 4c 89 e8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ef e8 57 5c a5 00 49 8b 75 00 49 81 c7 70 01 00 00 4c 89 f7 4c 89 fa <67> 48 0f b9 3a 48 83 c4 58 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc
[ 86.214770][ T5326] RSP: 0018:ffffc9000f797b20 EFLAGS: 00010082
[ 86.217431][ T5326] RAX: 1ffff11008197178 RBX: 0000000000000008 RCX: ffff88801f85ca00
[ 86.220862][ T5326] RDX: ffff8880362eb970 RSI: ffffffff8a9ddad0 RDI: ffffffff9033d930
[ 86.224190][ T5326] RBP: 0000000000000000 R08: ffff888040cb8baf R09: 1ffff11008197175
[ 86.227550][ T5326] R10: dffffc0000000000 R11: ffffed1008197176 R12: dffffc0000000000
[ 86.230974][ T5326] R13: ffff888040cb8bc0 R14: ffffffff9033d930 R15: ffff8880362eb970
[ 86.234424][ T5326] FS: 00007f6bce8b16c0(0000) GS:ffff88808c881000(0000) knlGS:0000000000000000
[ 86.238352][ T5326] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 86.241364][ T5326] CR2: 00007f6bce890d58 CR3: 000000003daf5000 CR4: 0000000000352ef0
[ 86.244829][ T5326] Call Trace:
[ 86.246312][ T5326]
[ 86.247656][ T5326] ? ktime_get_with_offset+0x93/0x2d0
[ 86.250040][ T5326] ? rcu_is_watching+0x15/0xb0
[ 86.252077][ T5326] queue_work_on+0x106/0x1d0
[ 86.254168][ T5326] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 86.256791][ T5326] hci_recv_frame+0x625/0x7c0
[ 86.258830][ T5326] ? skb_pull+0xc1/0x1d0
[ 86.260695][ T5326] vhci_write+0x358/0x4a0
[ 86.262595][ T5326] vfs_write+0x61d/0xb90
[ 86.264498][ T5326] ? __pfx_vfs_write+0x10/0x10
[ 86.266515][ T5326] ? __fget_files+0x2a/0x420
[ 86.268492][ T5326] ksys_write+0x150/0x270
[ 86.270309][ T5326] ? __pfx_ksys_write+0x10/0x10
[ 86.272343][ T5326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.274921][ T5326] do_syscall_64+0x15f/0xf80
[ 86.276932][ T5326] ? trace_irq_disable+0x3b/0x140
[ 86.279116][ T5326] ? clear_bhb_loop+0x40/0x90
[ 86.281145][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.283615][ T5326] RIP: 0033:0x7f6bcd95d68e
[ 86.285530][ T5326] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[ 86.293718][ T5326] RSP: 002b:00007f6bce8b0f78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 86.297362][ T5326] RAX: ffffffffffffffda RBX: 00007f6bce8b16c0 RCX: 00007f6bcd95d68e
[ 86.300725][ T5326] RDX: 0000000000000009 RSI: 00002000000007c0 RDI: 00000000000000ca
[ 86.304109][ T5326] RBP: 00007f6bcda32d6f R08: 0000000000000000 R09: 0000000000000000
[ 86.307616][ T5326] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 86.311167][ T5326] R13: 00007f6bcdc16128 R14: 00007f6bcdc16090 R15: 00007fff1c4a4568
[ 86.314613][ T5326]
[ 86.315940][ T5326] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 86.319096][ T5326] CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 86.322886][ T5326] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 86.327083][ T5326] Call Trace:
[ 86.328579][ T5326]
[ 86.329858][ T5326] vpanic+0x56c/0xa60
[ 86.331551][ T5326] ? __pfx__printk+0x10/0x10
[ 86.333538][ T5326] ? __pfx_vpanic+0x10/0x10
[ 86.335547][ T5326] ? is_bpf_text_address+0x292/0x2b0
[ 86.337749][ T5326] ? is_bpf_text_address+0x26/0x2b0
[ 86.340143][ T5326] panic+0xc5/0xd0
[ 86.341773][ T5326] ? __pfx_panic+0x10/0x10
[ 86.343693][ T5326] __warn+0x315/0x4c0
[ 86.345425][ T5326] ? __queue_work+0xd1f/0xfc0
[ 86.347394][ T5326] ? __queue_work+0xd1f/0xfc0
[ 86.349508][ T5326] __report_bug+0x29a/0x540
[ 86.351453][ T5326] ? __queue_work+0xd1f/0xfc0
[ 86.353399][ T5326] ? __pfx___report_bug+0x10/0x10
[ 86.355484][ T5326] ? __pfx_hci_rx_work+0x10/0x10
[ 86.357574][ T5326] ? do_syscall_64+0x15f/0xf80
[ 86.359625][ T5326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.362237][ T5326] ? __lock_acquire+0x6b5/0x2cf0
[ 86.364312][ T5326] report_bug_entry+0x19a/0x290
[ 86.366305][ T5326] ? __queue_work+0xd4a/0xfc0
[ 86.368333][ T5326] ? __queue_work+0xd4f/0xfc0
[ 86.370406][ T5326] handle_bug+0xce/0x200
[ 86.372316][ T5326] exc_invalid_op+0x1a/0x50
[ 86.374708][ T5326] asm_exc_invalid_op+0x1a/0x20
[ 86.377006][ T5326] RIP: 0010:__queue_work+0xd4a/0xfc0
[ 86.379424][ T5326] Code: 83 c5 18 4c 89 e8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ef e8 57 5c a5 00 49 8b 75 00 49 81 c7 70 01 00 00 4c 89 f7 4c 89 fa <67> 48 0f b9 3a 48 83 c4 58 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc
[ 86.387231][ T5326] RSP: 0018:ffffc9000f797b20 EFLAGS: 00010082
[ 86.389686][ T5326] RAX: 1ffff11008197178 RBX: 0000000000000008 RCX: ffff88801f85ca00
[ 86.392791][ T5326] RDX: ffff8880362eb970 RSI: ffffffff8a9ddad0 RDI: ffffffff9033d930
[ 86.396021][ T5326] RBP: 0000000000000000 R08: ffff888040cb8baf R09: 1ffff11008197175
[ 86.399356][ T5326] R10: dffffc0000000000 R11: ffffed1008197176 R12: dffffc0000000000
[ 86.402596][ T5326] R13: ffff888040cb8bc0 R14: ffffffff9033d930 R15: ffff8880362eb970
[ 86.405363][ T5326] ? __pfx_hci_rx_work+0x10/0x10
[ 86.407324][ T5326] ? ktime_get_with_offset+0x93/0x2d0
[ 86.409609][ T5326] ? rcu_is_watching+0x15/0xb0
[ 86.411347][ T5326] queue_work_on+0x106/0x1d0
[ 86.413020][ T5326] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 86.415084][ T5326] hci_recv_frame+0x625/0x7c0
[ 86.417092][ T5326] ? skb_pull+0xc1/0x1d0
[ 86.418881][ T5326] vhci_write+0x358/0x4a0
[ 86.420713][ T5326] vfs_write+0x61d/0xb90
[ 86.422190][ T5326] ? __pfx_vfs_write+0x10/0x10
[ 86.424068][ T5326] ? __fget_files+0x2a/0x420
[ 86.425995][ T5326] ksys_write+0x150/0x270
[ 86.427836][ T5326] ? __pfx_ksys_write+0x10/0x10
[ 86.429885][ T5326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.432353][ T5326] do_syscall_64+0x15f/0xf80
[ 86.434331][ T5326] ? trace_irq_disable+0x3b/0x140
[ 86.436507][ T5326] ? clear_bhb_loop+0x40/0x90
[ 86.438452][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.440976][ T5326] RIP: 0033:0x7f6bcd95d68e
[ 86.442873][ T5326] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[ 86.450507][ T5326] RSP: 002b:00007f6bce8b0f78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 86.454004][ T5326] RAX: ffffffffffffffda RBX: 00007f6bce8b16c0 RCX: 00007f6bcd95d68e
[ 86.457246][ T5326] RDX: 0000000000000009 RSI: 00002000000007c0 RDI: 00000000000000ca
[ 86.460647][ T5326] RBP: 00007f6bcda32d6f R08: 0000000000000000 R09: 0000000000000000
[ 86.464021][ T5326] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 86.467425][ T5326] R13: 00007f6bcdc16128 R14: 00007f6bcdc16090 R15: 00007fff1c4a4568
[ 86.470839][ T5326]
[ 86.472581][ T5326] Kernel Offset: disabled
[ 86.474284][ T5326] Rebooting in 86400 seconds..