program:
mkdir(&(0x7f0000000000)='./config\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000300)='./config\x00', &(0x7f0000000400)='configfs\x00', 0x0, 0x0) (async)
mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) (async)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f00000020c0)={0x0, 0x0, "3874ce", 0x7d})
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0x1ff) (async)
symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/configs/c.1/midi.usb0\x00')
mkdir(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/ncm.usb0\x00', 0x1ff)
symlink(&(0x7f0000000f00)='./config/usb_gadget/g1/functions/ncm.usb0\x00', &(0x7f0000001000)='./config/usb_gadget/g1/configs/c.1/ncm.usb0\x00') (async)
r1 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r1, &(0x7f0000001400)='dummy_udc.0', 0xb)
r2 = socket$netlink(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$ETHTOOL_MSG_COALESCE_SET(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x34, r3, 0x1, 0x70bd2e, 0x25dfdbfb, {}, [@ETHTOOL_A_COALESCE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}, @ETHTOOL_A_COALESCE_RX_MAX_FRAMES_IRQ={0x8, 0x5, 0xfffffff9}]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x20005880)
[ 131.370615][ T5325] ------------[ cut here ]------------
[ 131.373331][ T5325] !work->func
[ 131.373343][ T5325] WARNING: kernel/workqueue.c:4335 at __flush_work+0xb8f/0xca0, CPU#0: syz.0.0/5325
[ 131.379265][ T5325] Modules linked in:
[ 131.381777][ T5325] CPU: 0 UID: 0 PID: 5325 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 131.385380][ T5325] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 131.389822][ T5325] RIP: 0010:__flush_work+0xb8f/0xca0
[ 131.392191][ T5325] Code: 75 5e 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 f0 dd 38 00 90 0f 0b 90 e9 7c ff ff ff e8 e2 dd 38 00 90 <0f> 0b 90 31 c0 48 bb f8 f8 f8 f8 f8 f8 f8 f8 e9 64 ff ff ff e8 c8
[ 131.400416][ T5325] RSP: 0018:ffffc9000e1afa20 EFLAGS: 00010293
[ 131.403156][ T5325] RAX: ffffffff818e353e RBX: ffff888011d261b0 RCX: ffff888012df2580
[ 131.406311][ T5325] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff888011d26198
[ 131.409642][ T5325] RBP: ffffc9000e1afbd0 R08: ffffffff9057ad37 R09: 1ffffffff20af5a6
[ 131.412858][ T5325] R10: dffffc0000000000 R11: fffffbfff20af5a7 R12: dffffc0000000000
[ 131.416256][ T5325] R13: 1ffff110023a4c36 R14: 1ffff92001c35f4c R15: ffff888011d26198
[ 131.419768][ T5325] FS: 00007f787a8406c0(0000) GS:ffff88808c539000(0000) knlGS:0000000000000000
[ 131.423683][ T5325] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 131.426420][ T5325] CR2: 00002000000020c0 CR3: 0000000011cbc000 CR4: 0000000000352ef0
[ 131.429858][ T5325] Call Trace:
[ 131.431272][ T5325]
[ 131.432572][ T5325] ? trace_contention_end+0x3d/0x140
[ 131.434866][ T5325] ? __mutex_lock+0x30d/0x1550
[ 131.437423][ T5325] ? __pfx___flush_work+0x10/0x10
[ 131.439978][ T5325] ? __mutex_lock+0x30d/0x1550
[ 131.442146][ T5325] ? rcu_is_watching+0x15/0xb0
[ 131.444287][ T5325] ? work_grab_pending+0x3d1/0x930
[ 131.446517][ T5325] ? __cancel_work_sync+0x5c/0x110
[ 131.448836][ T5325] __cancel_work_sync+0xbe/0x110
[ 131.451041][ T5325] f_midi_free+0xac/0x1f0
[ 131.453044][ T5325] config_usb_cfg_unlink+0x236/0x260
[ 131.455251][ T5325] configfs_symlink+0xde9/0x1030
[ 131.457423][ T5325] ? lookup_one_qstr_excl+0x1d4/0x360
[ 131.460223][ T5325] ? make_vfsuid+0x49/0xa0
[ 131.462233][ T5325] ? __pfx_configfs_symlink+0x10/0x10
[ 131.464465][ T5325] ? bpf_lsm_inode_symlink+0x9/0x20
[ 131.466639][ T5325] vfs_symlink+0x18b/0x330
[ 131.468620][ T5325] ? security_path_symlink+0xfd/0x360
[ 131.470985][ T5325] filename_symlinkat+0x1cd/0x410
[ 131.473119][ T5325] ? __pfx_filename_symlinkat+0x10/0x10
[ 131.475505][ T5325] ? do_getname+0x151/0x250
[ 131.477409][ T5325] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 131.480071][ T5325] __se_sys_symlinkat+0x4e/0x2b0
[ 131.482276][ T5325] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 131.484855][ T5325] do_syscall_64+0x174/0x580
[ 131.486860][ T5325] ? trace_irq_disable+0x3b/0x140
[ 131.489097][ T5325] ? clear_bhb_loop+0x70/0xc0
[ 131.491058][ T5325] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 131.493651][ T5325] RIP: 0033:0x7f787999e0d9
[ 131.495655][ T5325] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 131.504401][ T5325] RSP: 002b:00007f787a83ffe8 EFLAGS: 00000246 ORIG_RAX: 000000000000010a
[ 131.507802][ T5325] RAX: ffffffffffffffda RBX: 00007f7879c26090 RCX: 00007f787999e0d9
[ 131.511289][ T5325] RDX: 00002000000005c0 RSI: ffffffffffffff9c RDI: 0000200000000580
[ 131.514555][ T5325] RBP: 00007f7879a35024 R08: 0000000000000000 R09: 0000000000000000
[ 131.517918][ T5325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 131.521229][ T5325] R13: 00007f7879c26128 R14: 00007f7879c26090 R15: 00007fff6b47aa58
[ 131.524709][ T5325]
[ 131.526097][ T5325] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 131.529068][ T5325] CPU: 0 UID: 0 PID: 5325 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 131.532553][ T5325] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 131.536474][ T5325] Call Trace:
[ 131.537912][ T5325]
[ 131.539242][ T5325] vpanic+0x56c/0xa60
[ 131.540960][ T5325] ? __pfx__printk+0x10/0x10
[ 131.542904][ T5325] ? __pfx_vpanic+0x10/0x10
[ 131.544775][ T5325] ? is_bpf_text_address+0x292/0x2b0
[ 131.546912][ T5325] ? is_bpf_text_address+0x26/0x2b0
[ 131.549064][ T5325] panic+0xc5/0xd0
[ 131.550642][ T5325] ? __pfx_panic+0x10/0x10
[ 131.552661][ T5325] __warn+0x315/0x4c0
[ 131.554448][ T5325] ? __flush_work+0xb8f/0xca0
[ 131.556471][ T5325] ? __flush_work+0xb8f/0xca0
[ 131.558470][ T5325] __report_bug+0x276/0x570
[ 131.560457][ T5325] ? __flush_work+0xb8f/0xca0
[ 131.562440][ T5325] ? __pfx___report_bug+0x10/0x10
[ 131.564516][ T5325] ? __flush_work+0xb91/0xca0
[ 131.566446][ T5325] ? __flush_work+0xb8f/0xca0
[ 131.568400][ T5325] ? report_bug+0x19/0x220
[ 131.570232][ T5325] ? __flush_work+0xb8f/0xca0
[ 131.572147][ T5325] ? __flush_work+0xb8f/0xca0
[ 131.574124][ T5325] report_bug+0x16a/0x220
[ 131.575904][ T5325] ? __flush_work+0xb8f/0xca0
[ 131.577831][ T5325] ? __flush_work+0xb91/0xca0
[ 131.579812][ T5325] handle_bug+0x9c/0x200
[ 131.581552][ T5325] exc_invalid_op+0x1a/0x50
[ 131.583457][ T5325] asm_exc_invalid_op+0x1a/0x20
[ 131.585479][ T5325] RIP: 0010:__flush_work+0xb8f/0xca0
[ 131.587608][ T5325] Code: 75 5e 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 f0 dd 38 00 90 0f 0b 90 e9 7c ff ff ff e8 e2 dd 38 00 90 <0f> 0b 90 31 c0 48 bb f8 f8 f8 f8 f8 f8 f8 f8 e9 64 ff ff ff e8 c8
[ 131.595249][ T5325] RSP: 0018:ffffc9000e1afa20 EFLAGS: 00010293
[ 131.597658][ T5325] RAX: ffffffff818e353e RBX: ffff888011d261b0 RCX: ffff888012df2580
[ 131.600839][ T5325] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff888011d26198
[ 131.604159][ T5325] RBP: ffffc9000e1afbd0 R08: ffffffff9057ad37 R09: 1ffffffff20af5a6
[ 131.607436][ T5325] R10: dffffc0000000000 R11: fffffbfff20af5a7 R12: dffffc0000000000
[ 131.610706][ T5325] R13: 1ffff110023a4c36 R14: 1ffff92001c35f4c R15: ffff888011d26198
[ 131.613955][ T5325] ? __flush_work+0xb8e/0xca0
[ 131.615940][ T5325] ? trace_contention_end+0x3d/0x140
[ 131.618159][ T5325] ? __mutex_lock+0x30d/0x1550
[ 131.620086][ T5325] ? __pfx___flush_work+0x10/0x10
[ 131.622164][ T5325] ? __mutex_lock+0x30d/0x1550
[ 131.624215][ T5325] ? rcu_is_watching+0x15/0xb0
[ 131.626295][ T5325] ? work_grab_pending+0x3d1/0x930
[ 131.628503][ T5325] ? __cancel_work_sync+0x5c/0x110
[ 131.630715][ T5325] __cancel_work_sync+0xbe/0x110
[ 131.632921][ T5325] f_midi_free+0xac/0x1f0
[ 131.634895][ T5325] config_usb_cfg_unlink+0x236/0x260
[ 131.637189][ T5325] configfs_symlink+0xde9/0x1030
[ 131.639362][ T5325] ? lookup_one_qstr_excl+0x1d4/0x360
[ 131.641593][ T5325] ? make_vfsuid+0x49/0xa0
[ 131.643424][ T5325] ? __pfx_configfs_symlink+0x10/0x10
[ 131.645488][ T5325] ? bpf_lsm_inode_symlink+0x9/0x20
[ 131.647931][ T5325] vfs_symlink+0x18b/0x330
[ 131.650261][ T5325] ? security_path_symlink+0xfd/0x360
[ 131.652520][ T5325] filename_symlinkat+0x1cd/0x410
[ 131.654578][ T5325] ? __pfx_filename_symlinkat+0x10/0x10
[ 131.656917][ T5325] ? do_getname+0x151/0x250
[ 131.658787][ T5325] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 131.661266][ T5325] __se_sys_symlinkat+0x4e/0x2b0
[ 131.663348][ T5325] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 131.665783][ T5325] do_syscall_64+0x174/0x580
[ 131.667727][ T5325] ? trace_irq_disable+0x3b/0x140
[ 131.669770][ T5325] ? clear_bhb_loop+0x70/0xc0
[ 131.671709][ T5325] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 131.674235][ T5325] RIP: 0033:0x7f787999e0d9
[ 131.676089][ T5325] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 131.683803][ T5325] RSP: 002b:00007f787a83ffe8 EFLAGS: 00000246 ORIG_RAX: 000000000000010a
[ 131.687073][ T5325] RAX: ffffffffffffffda RBX: 00007f7879c26090 RCX: 00007f787999e0d9
[ 131.690167][ T5325] RDX: 00002000000005c0 RSI: ffffffffffffff9c RDI: 0000200000000580
[ 131.693366][ T5325] RBP: 00007f7879a35024 R08: 0000000000000000 R09: 0000000000000000
[ 131.696575][ T5325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 131.699713][ T5325] R13: 00007f7879c26128 R14: 00007f7879c26090 R15: 00007fff6b47aa58
[ 131.702899][ T5325]
[ 131.704580][ T5325] Kernel Offset: disabled
[ 131.706465][ T5325] Rebooting in 86400 seconds..