program:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_bt_hci(r0, 0x400448cb, 0x0)
openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x100, 0x0)
syz_emit_vhci(&(0x7f0000000400)=ANY=[@ANYBLOB="040e0402030c", @ANYRES64], 0x7) (async, rerun: 64)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) (rerun: 64)
connect$bt_l2cap(r1, &(0x7f0000000000)={0x1f, 0x8ef, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe)
io_uring_register$IORING_REGISTER_RING_FDS(0xffffffffffffffff, 0x14, &(0x7f0000000540)=[{0x6, 0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000040)=""/127, 0x7f}, {&(0x7f00000000c0)=""/234, 0xea}, {&(0x7f00000001c0)=""/63, 0x3f}, {&(0x7f0000000200)=""/59, 0x3b}, {&(0x7f0000000240)=""/192, 0xc0}, {&(0x7f0000000300)=""/230, 0xe6}], &(0x7f0000000500)=[0x1ff, 0x3, 0x4]}], 0x1)
[ 86.531217][ T5332] ------------[ cut here ]------------
[ 86.533635][ T5332] workqueue: cannot queue hci_rx_work on wq hci0
[ 86.536400][ T5332] WARNING: kernel/workqueue.c:2298 at __queue_work+0xd1f/0xfc0, CPU#0: syz.0.0/5332
[ 86.540246][ T5332] Modules linked in:
[ 86.542275][ T5332] CPU: 0 UID: 0 PID: 5332 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 86.546037][ T5332] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 86.550304][ T5332] RIP: 0010:__queue_work+0xd4a/0xfc0
[ 86.552529][ T5332] Code: 83 c5 18 4c 89 e8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ef e8 57 5c a5 00 49 8b 75 00 49 81 c7 70 01 00 00 4c 89 f7 4c 89 fa <67> 48 0f b9 3a 48 83 c4 58 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc
[ 86.560614][ T5332] RSP: 0018:ffffc9000dd57b20 EFLAGS: 00010082
[ 86.563301][ T5332] RAX: 1ffff110024b3178 RBX: 0000000000000008 RCX: ffff88804168a500
[ 86.566702][ T5332] RDX: ffff888041778170 RSI: ffffffff8a9ddad0 RDI: ffffffff9033d930
[ 86.570192][ T5332] RBP: 0000000000000000 R08: ffff888012598baf R09: 1ffff110024b3175
[ 86.573975][ T5332] R10: dffffc0000000000 R11: ffffed10024b3176 R12: dffffc0000000000
[ 86.577394][ T5332] R13: ffff888012598bc0 R14: ffffffff9033d930 R15: ffff888041778170
[ 86.580955][ T5332] FS: 00007f37b5df56c0(0000) GS:ffff88808c881000(0000) knlGS:0000000000000000
[ 86.584874][ T5332] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 86.587730][ T5332] CR2: 00007f37b5df4fe8 CR3: 00000000415f6000 CR4: 0000000000352ef0
[ 86.591163][ T5332] Call Trace:
[ 86.592666][ T5332]
[ 86.594139][ T5332] ? ktime_get_with_offset+0x93/0x2d0
[ 86.596354][ T5332] ? rcu_is_watching+0x15/0xb0
[ 86.598400][ T5332] queue_work_on+0x106/0x1d0
[ 86.600419][ T5332] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 86.602947][ T5332] hci_recv_frame+0x625/0x7c0
[ 86.605043][ T5332] ? skb_pull+0xc1/0x1d0
[ 86.606793][ T5332] vhci_write+0x358/0x4a0
[ 86.608655][ T5332] vfs_write+0x61d/0xb90
[ 86.610551][ T5332] ? __pfx_vfs_write+0x10/0x10
[ 86.612808][ T5332] ? __fget_files+0x2a/0x420
[ 86.614886][ T5332] ksys_write+0x150/0x270
[ 86.616765][ T5332] ? __pfx_ksys_write+0x10/0x10
[ 86.618980][ T5332] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.621584][ T5332] do_syscall_64+0x15f/0xf80
[ 86.623650][ T5332] ? trace_irq_disable+0x3b/0x140
[ 86.625786][ T5332] ? clear_bhb_loop+0x40/0x90
[ 86.627766][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.630334][ T5332] RIP: 0033:0x7f37b995d60e
[ 86.632190][ T5332] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[ 86.640273][ T5332] RSP: 002b:00007f37b5df4f78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 86.643882][ T5332] RAX: ffffffffffffffda RBX: 00007f37b5df56c0 RCX: 00007f37b995d60e
[ 86.647249][ T5332] RDX: 0000000000000007 RSI: 0000200000000400 RDI: 00000000000000ca
[ 86.650631][ T5332] RBP: 00007f37b9a32d69 R08: 0000000000000000 R09: 0000000000000000
[ 86.654050][ T5332] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 86.657548][ T5332] R13: 00007f37b9c16218 R14: 00007f37b9c16180 R15: 00007fff2a78c898
[ 86.660956][ T5332]
[ 86.662331][ T5332] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 86.665427][ T5332] CPU: 0 UID: 0 PID: 5332 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 86.669247][ T5332] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 86.673639][ T5332] Call Trace:
[ 86.675133][ T5332]
[ 86.676506][ T5332] vpanic+0x56c/0xa60
[ 86.678331][ T5332] ? __pfx__printk+0x10/0x10
[ 86.680404][ T5332] ? __pfx_vpanic+0x10/0x10
[ 86.682517][ T5332] ? is_bpf_text_address+0x292/0x2b0
[ 86.684890][ T5332] ? is_bpf_text_address+0x26/0x2b0
[ 86.687189][ T5332] panic+0xc5/0xd0
[ 86.688865][ T5332] ? __pfx_panic+0x10/0x10
[ 86.690895][ T5332] __warn+0x315/0x4c0
[ 86.692721][ T5332] ? __queue_work+0xd1f/0xfc0
[ 86.694827][ T5332] ? __queue_work+0xd1f/0xfc0
[ 86.696986][ T5332] __report_bug+0x29a/0x540
[ 86.699046][ T5332] ? __queue_work+0xd1f/0xfc0
[ 86.701045][ T5332] ? __pfx___report_bug+0x10/0x10
[ 86.703322][ T5332] ? __pfx_hci_rx_work+0x10/0x10
[ 86.705590][ T5332] ? do_syscall_64+0x15f/0xf80
[ 86.707757][ T5332] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.710429][ T5332] ? __lock_acquire+0x6b5/0x2cf0
[ 86.712514][ T5332] report_bug_entry+0x19a/0x290
[ 86.714678][ T5332] ? __queue_work+0xd4a/0xfc0
[ 86.716632][ T5332] ? __queue_work+0xd4f/0xfc0
[ 86.718720][ T5332] handle_bug+0xce/0x200
[ 86.720589][ T5332] exc_invalid_op+0x1a/0x50
[ 86.722665][ T5332] asm_exc_invalid_op+0x1a/0x20
[ 86.724934][ T5332] RIP: 0010:__queue_work+0xd4a/0xfc0
[ 86.727594][ T5332] Code: 83 c5 18 4c 89 e8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ef e8 57 5c a5 00 49 8b 75 00 49 81 c7 70 01 00 00 4c 89 f7 4c 89 fa <67> 48 0f b9 3a 48 83 c4 58 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc
[ 86.735958][ T5332] RSP: 0018:ffffc9000dd57b20 EFLAGS: 00010082
[ 86.738587][ T5332] RAX: 1ffff110024b3178 RBX: 0000000000000008 RCX: ffff88804168a500
[ 86.741893][ T5332] RDX: ffff888041778170 RSI: ffffffff8a9ddad0 RDI: ffffffff9033d930
[ 86.745354][ T5332] RBP: 0000000000000000 R08: ffff888012598baf R09: 1ffff110024b3175
[ 86.748770][ T5332] R10: dffffc0000000000 R11: ffffed10024b3176 R12: dffffc0000000000
[ 86.752287][ T5332] R13: ffff888012598bc0 R14: ffffffff9033d930 R15: ffff888041778170
[ 86.755763][ T5332] ? __pfx_hci_rx_work+0x10/0x10
[ 86.757912][ T5332] ? ktime_get_with_offset+0x93/0x2d0
[ 86.760096][ T5332] ? rcu_is_watching+0x15/0xb0
[ 86.762109][ T5332] queue_work_on+0x106/0x1d0
[ 86.764066][ T5332] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 86.766655][ T5332] hci_recv_frame+0x625/0x7c0
[ 86.768553][ T5332] ? skb_pull+0xc1/0x1d0
[ 86.770500][ T5332] vhci_write+0x358/0x4a0
[ 86.772492][ T5332] vfs_write+0x61d/0xb90
[ 86.774362][ T5332] ? __pfx_vfs_write+0x10/0x10
[ 86.776468][ T5332] ? __fget_files+0x2a/0x420
[ 86.778499][ T5332] ksys_write+0x150/0x270
[ 86.780406][ T5332] ? __pfx_ksys_write+0x10/0x10
[ 86.782539][ T5332] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.785205][ T5332] do_syscall_64+0x15f/0xf80
[ 86.787254][ T5332] ? trace_irq_disable+0x3b/0x140
[ 86.789363][ T5332] ? clear_bhb_loop+0x40/0x90
[ 86.791349][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.793953][ T5332] RIP: 0033:0x7f37b995d60e
[ 86.795904][ T5332] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[ 86.804147][ T5332] RSP: 002b:00007f37b5df4f78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 86.807659][ T5332] RAX: ffffffffffffffda RBX: 00007f37b5df56c0 RCX: 00007f37b995d60e
[ 86.811081][ T5332] RDX: 0000000000000007 RSI: 0000200000000400 RDI: 00000000000000ca
[ 86.814563][ T5332] RBP: 00007f37b9a32d69 R08: 0000000000000000 R09: 0000000000000000
[ 86.817983][ T5332] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 86.821417][ T5332] R13: 00007f37b9c16218 R14: 00007f37b9c16180 R15: 00007fff2a78c898
[ 86.824844][ T5332]
[ 86.826612][ T5332] Kernel Offset: disabled
[ 86.828513][ T5332] Rebooting in 86400 seconds..