program:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_bt_hci(r0, 0x400448cb, 0x0)
syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e1f0a"], 0x22)
r1 = socket$inet6_sctp(0xa, 0x1, 0x84)
bind$inet6(r1, 0x0, 0x0)
syz_emit_ethernet(0x31e, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
syz_usb_connect$cdc_ecm(0x0, 0x51, 0x0, 0x0)
ioctl$USBDEVFS_IOCTL(0xffffffffffffffff, 0xc0105512, &(0x7f0000000200)=@usbdevfs_connect)
syz_emit_vhci(&(0x7f0000000300)=ANY=[@ANYBLOB="040b"], 0xe)
syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e0402030c"], 0x7)
[ 84.766029][ T5320] Bluetooth: hci0: command tx timeout
[ 84.841418][ T5340] ------------[ cut here ]------------
[ 84.844641][ T5340] workqueue: cannot queue hci_rx_work on wq hci0
[ 84.847715][ T5340] WARNING: kernel/workqueue.c:2298 at __queue_work+0xd1f/0xfc0, CPU#0: syz.0.0/5340
[ 84.851628][ T5340] Modules linked in:
[ 84.853298][ T5340] CPU: 0 UID: 0 PID: 5340 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 84.857583][ T5340] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 84.863479][ T5340] RIP: 0010:__queue_work+0xd4a/0xfc0
[ 84.865925][ T5340] Code: 83 c5 18 4c 89 e8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ef e8 77 47 a5 00 49 8b 75 00 49 81 c7 70 01 00 00 4c 89 f7 4c 89 fa <67> 48 0f b9 3a 48 83 c4 58 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc
[ 84.874355][ T5340] RSP: 0018:ffffc9000600fb20 EFLAGS: 00010082
[ 84.877223][ T5340] RAX: 1ffff1100242c178 RBX: 0000000000000008 RCX: 0000000000100000
[ 84.881430][ T5340] RDX: ffff888012840170 RSI: ffffffff8aa8c4b0 RDI: ffffffff90366f70
[ 84.885744][ T5340] RBP: 0000000000000000 R08: ffff888012160baf R09: 1ffff1100242c175
[ 84.889622][ T5340] R10: dffffc0000000000 R11: ffffed100242c176 R12: dffffc0000000000
[ 84.893877][ T5340] R13: ffff888012160bc0 R14: ffffffff90366f70 R15: ffff888012840170
[ 84.898685][ T5340] FS: 00007fdcc83f56c0(0000) GS:ffff88808c812000(0000) knlGS:0000000000000000
[ 84.902795][ T5340] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 84.905254][ T5340] CR2: 00007f2107cac9d0 CR3: 000000001f273000 CR4: 0000000000352ef0
[ 84.908694][ T5340] Call Trace:
[ 84.910310][ T5340]
[ 84.911907][ T5340] ? ktime_get_with_offset+0x93/0x2d0
[ 84.914931][ T5340] ? rcu_is_watching+0x15/0xb0
[ 84.917355][ T5340] queue_work_on+0x106/0x1d0
[ 84.919820][ T5340] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 84.922582][ T5340] hci_recv_frame+0x625/0x7c0
[ 84.924794][ T5340] ? skb_pull+0xc1/0x1d0
[ 84.926823][ T5340] vhci_write+0x358/0x4a0
[ 84.929109][ T5340] vfs_write+0x61d/0xb90
[ 84.931568][ T5340] ? __pfx_vfs_write+0x10/0x10
[ 84.934420][ T5340] ? __fget_files+0x2a/0x420
[ 84.936604][ T5340] ksys_write+0x150/0x270
[ 84.938605][ T5340] ? __pfx_ksys_write+0x10/0x10
[ 84.940804][ T5340] ? __pfx_kcov_ioctl+0x10/0x10
[ 84.943060][ T5340] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 84.946487][ T5340] do_syscall_64+0x15f/0xf80
[ 84.949889][ T5340] ? trace_irq_disable+0x3b/0x140
[ 84.953018][ T5340] ? clear_bhb_loop+0x40/0x90
[ 84.955176][ T5340] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 84.957978][ T5340] RIP: 0033:0x7fdccbf5d04e
[ 84.960009][ T5340] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[ 84.968807][ T5340] RSP: 002b:00007fdcc83f4f78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 84.974023][ T5340] RAX: ffffffffffffffda RBX: 00007fdcc83f56c0 RCX: 00007fdccbf5d04e
[ 84.978549][ T5340] RDX: 0000000000000022 RSI: 0000200000000540 RDI: 00000000000000ca
[ 84.982059][ T5340] RBP: 00007fdccc032c91 R08: 0000000000000000 R09: 0000000000000000
[ 84.985647][ T5340] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 84.990010][ T5340] R13: 00007fdccc216128 R14: 00007fdccc216090 R15: 00007fff725b7428
[ 84.995597][ T5340]
[ 84.997047][ T5340] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 85.000462][ T5340] CPU: 0 UID: 0 PID: 5340 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 85.004660][ T5340] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 85.009245][ T5340] Call Trace:
[ 85.010880][ T5340]
[ 85.012466][ T5340] vpanic+0x56c/0xa60
[ 85.014916][ T5340] ? __pfx__printk+0x10/0x10
[ 85.017580][ T5340] ? __pfx_vpanic+0x10/0x10
[ 85.019647][ T5340] ? is_bpf_text_address+0x292/0x2b0
[ 85.022072][ T5340] ? is_bpf_text_address+0x26/0x2b0
[ 85.024597][ T5340] panic+0xc5/0xd0
[ 85.026705][ T5340] ? __pfx_panic+0x10/0x10
[ 85.029472][ T5340] __warn+0x315/0x4c0
[ 85.031920][ T5340] ? __queue_work+0xd1f/0xfc0
[ 85.034593][ T5340] ? __queue_work+0xd1f/0xfc0
[ 85.036589][ T5340] __report_bug+0x29a/0x540
[ 85.038627][ T5340] ? __queue_work+0xd1f/0xfc0
[ 85.040694][ T5340] ? __pfx___report_bug+0x10/0x10
[ 85.043046][ T5340] ? __pfx_hci_rx_work+0x10/0x10
[ 85.045301][ T5340] ? do_syscall_64+0x15f/0xf80
[ 85.047599][ T5340] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.050418][ T5340] ? __lock_acquire+0x6b5/0x2cf0
[ 85.052737][ T5340] report_bug_entry+0x19a/0x290
[ 85.055091][ T5340] ? __queue_work+0xd4a/0xfc0
[ 85.057973][ T5340] ? __queue_work+0xd4f/0xfc0
[ 85.060904][ T5340] handle_bug+0xce/0x200
[ 85.063512][ T5340] exc_invalid_op+0x1a/0x50
[ 85.066120][ T5340] asm_exc_invalid_op+0x1a/0x20
[ 85.068504][ T5340] RIP: 0010:__queue_work+0xd4a/0xfc0
[ 85.070938][ T5340] Code: 83 c5 18 4c 89 e8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ef e8 77 47 a5 00 49 8b 75 00 49 81 c7 70 01 00 00 4c 89 f7 4c 89 fa <67> 48 0f b9 3a 48 83 c4 58 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc
[ 85.079553][ T5340] RSP: 0018:ffffc9000600fb20 EFLAGS: 00010082
[ 85.082548][ T5340] RAX: 1ffff1100242c178 RBX: 0000000000000008 RCX: 0000000000100000
[ 85.087171][ T5340] RDX: ffff888012840170 RSI: ffffffff8aa8c4b0 RDI: ffffffff90366f70
[ 85.091026][ T5340] RBP: 0000000000000000 R08: ffff888012160baf R09: 1ffff1100242c175
[ 85.094902][ T5340] R10: dffffc0000000000 R11: ffffed100242c176 R12: dffffc0000000000
[ 85.099459][ T5340] R13: ffff888012160bc0 R14: ffffffff90366f70 R15: ffff888012840170
[ 85.103802][ T5340] ? __pfx_hci_rx_work+0x10/0x10
[ 85.106496][ T5340] ? ktime_get_with_offset+0x93/0x2d0
[ 85.109472][ T5340] ? rcu_is_watching+0x15/0xb0
[ 85.111714][ T5340] queue_work_on+0x106/0x1d0
[ 85.113777][ T5340] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 85.116287][ T5340] hci_recv_frame+0x625/0x7c0
[ 85.118492][ T5340] ? skb_pull+0xc1/0x1d0
[ 85.120575][ T5340] vhci_write+0x358/0x4a0
[ 85.122765][ T5340] vfs_write+0x61d/0xb90
[ 85.125616][ T5340] ? __pfx_vfs_write+0x10/0x10
[ 85.129205][ T5340] ? __fget_files+0x2a/0x420
[ 85.131535][ T5340] ksys_write+0x150/0x270
[ 85.133532][ T5340] ? __pfx_ksys_write+0x10/0x10
[ 85.135896][ T5340] ? __pfx_kcov_ioctl+0x10/0x10
[ 85.138143][ T5340] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.140915][ T5340] do_syscall_64+0x15f/0xf80
[ 85.143511][ T5340] ? trace_irq_disable+0x3b/0x140
[ 85.146496][ T5340] ? clear_bhb_loop+0x40/0x90
[ 85.149163][ T5340] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.152011][ T5340] RIP: 0033:0x7fdccbf5d04e
[ 85.154095][ T5340] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[ 85.163842][ T5340] RSP: 002b:00007fdcc83f4f78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 85.168051][ T5340] RAX: ffffffffffffffda RBX: 00007fdcc83f56c0 RCX: 00007fdccbf5d04e
[ 85.171554][ T5340] RDX: 0000000000000022 RSI: 0000200000000540 RDI: 00000000000000ca
[ 85.175072][ T5340] RBP: 00007fdccc032c91 R08: 0000000000000000 R09: 0000000000000000
[ 85.178799][ T5340] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 85.183245][ T5340] R13: 00007fdccc216128 R14: 00007fdccc216090 R15: 00007fff725b7428
[ 85.186851][ T5340]
[ 85.188526][ T5340] Kernel Offset: disabled
[ 85.190486][ T5340] Rebooting in 86400 seconds..