program:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x803}, 0xe)
syz_emit_vhci(&(0x7f0000000340)=ANY=[@ANYBLOB="02c82028002400010007d3040007c4faff020c04000300d3"], 0x2d)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$HCIINQUIRY(r2, 0x400448ca, 0x0)
mmap$IORING_OFF_SQES(0x0, 0x1000, 0x2, 0x109031, 0xffffffffffffffff, 0x10000000)
r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
close_range(r3, 0xffffffffffffffff, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000640)='/sys/power/pm_test', 0x42, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000006000/0x2000)=nil, &(0x7f000000e000/0x1000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ff3000/0x3000)=nil, &(0x7f0000ff6000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0xfffffffc, 0xc000, 0x800, 0xb4}, 0x0, 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@newlink={0x58, 0x10, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1c1c1}, [@IFLA_LINKINFO={0x38, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x28, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_SNOOPING={0x5, 0x17, 0x10}, @IFLA_BR_MCAST_QUERIER={0x5}, @IFLA_BR_MCAST_HASH_ELASTICITY={0x8}, @IFLA_BR_MCAST_LAST_MEMBER_INTVL={0xc, 0x1e, 0x2}]}}}]}, 0x58}}, 0x0)
[ 93.645406][ T10] ------------[ cut here ]------------
[ 93.647983][ T10] workqueue: cannot queue hci_tx_work on wq hci0
[ 93.660657][ T10] WARNING: kernel/workqueue.c:2306 at __queue_work+0xd4a/0x10a0, CPU#0: kworker/0:1/10
[ 93.671551][ T10] Modules linked in:
[ 93.673393][ T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT(full)
[ 93.677407][ T10] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 93.691901][ T10] Workqueue: events l2cap_info_timeout
[ 93.694364][ T10] RIP: 0010:__queue_work+0xd66/0x10a0
[ 93.696825][ T10] Code: 49 81 c7 70 01 00 00 4c 8d 35 d6 00 cd 0e 48 89 f8 48 c1 e8 03 80 3c 18 00 74 05 e8 a4 6c a8 00 49 8b 75 18 4c 89 f7 4c 89 fa <67> 48 0f b9 3a 4c 89 e8 48 c1 e8 03 80 3c 18 00 74 08 4c 89 ef e8
[ 93.711361][ T10] RSP: 0018:ffffc9000023f830 EFLAGS: 00010046
[ 93.715125][ T10] RAX: 1ffff1100240098a RBX: dffffc0000000000 RCX: ffff88801bf0a540
[ 93.721301][ T10] RDX: ffff88803fe92970 RSI: ffffffff8ac51380 RDI: ffffffff905aeb30
[ 93.728071][ T10] RBP: 0000000000000020 R08: ffff888012004c3f R09: 1ffff11002400987
[ 93.735321][ T10] R10: dffffc0000000000 R11: ffffed1002400988 R12: 0000000000000008
[ 93.739647][ T10] R13: ffff888012004c38 R14: ffffffff905aeb30 R15: ffff88803fe92970
[ 93.743272][ T10] FS: 0000000000000000(0000) GS:ffff88808c53f000(0000) knlGS:0000000000000000
[ 93.747385][ T10] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 93.770259][ T10] CR2: 00007f7e31351fb3 CR3: 0000000043827000 CR4: 0000000000352ef0
[ 93.776029][ T10] Call Trace:
[ 93.779041][ T10]
[ 93.791552][ T10] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 93.795042][ T10] ? lockdep_hardirqs_on+0x7a/0x110
[ 93.798298][ T10] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 93.801699][ T10] ? rcu_is_watching+0x15/0xb0
[ 93.807022][ T10] queue_work_on+0x106/0x1d0
[ 93.808952][ T10] ? l2cap_chan_check_security+0x2ae/0x4f0
[ 93.819514][ T10] l2cap_conn_start+0x5e2/0xf70
[ 93.822194][ T10] ? __pfx_l2cap_conn_start+0x10/0x10
[ 93.825346][ T10] l2cap_info_timeout+0x68/0xa0
[ 93.828370][ T10] ? process_scheduled_works+0xa20/0x14e0
[ 93.831886][ T10] process_scheduled_works+0xa8e/0x14e0
[ 93.835438][ T10] ? __pfx_process_scheduled_works+0x10/0x10
[ 93.838970][ T10] ? assign_work+0x3cf/0x5d0
[ 93.841851][ T10] worker_thread+0xa47/0xfb0
[ 93.844135][ T10] kthread+0x388/0x470
[ 93.845854][ T10] ? __pfx_worker_thread+0x10/0x10
[ 93.847901][ T10] ? __pfx_kthread+0x10/0x10
[ 93.849854][ T10] ret_from_fork+0x514/0xb70
[ 93.851845][ T10] ? __pfx_ret_from_fork+0x10/0x10
[ 93.855219][ T10] ? __switch_to+0xc89/0x1420
[ 93.858375][ T10] ? __pfx_kthread+0x10/0x10
[ 93.866594][ T10] ret_from_fork_asm+0x1a/0x30
[ 93.874744][ T10]
[ 93.886192][ T10] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 93.892686][ T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT(full)
[ 93.899059][ T10] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 93.905904][ T10] Workqueue: events l2cap_info_timeout
[ 93.909826][ T10] Call Trace:
[ 93.912434][ T10]
[ 93.913952][ T10] vpanic+0x56c/0xa60
[ 93.915956][ T10] ? __pfx__printk+0x10/0x10
[ 93.918270][ T10] ? __pfx_vpanic+0x10/0x10
[ 93.920676][ T10] ? is_bpf_text_address+0x292/0x2b0
[ 93.923328][ T10] ? is_bpf_text_address+0x26/0x2b0
[ 93.925923][ T10] panic+0xc5/0xd0
[ 93.927827][ T10] ? __pfx_panic+0x10/0x10
[ 93.930073][ T10] ? ret_from_fork_asm+0x1a/0x30
[ 93.942489][ T10] __warn+0x315/0x4c0
[ 93.944312][ T10] ? __queue_work+0xd4a/0x10a0
[ 93.946493][ T10] ? __queue_work+0xd4a/0x10a0
[ 93.948713][ T10] __report_bug+0x276/0x570
[ 93.961069][ T10] ? check_noncircular+0xda/0x150
[ 93.964214][ T10] ? __queue_work+0xd4a/0x10a0
[ 93.971632][ T10] ? __pfx___report_bug+0x10/0x10
[ 93.973938][ T10] ? __lock_acquire+0x13e8/0x2cf0
[ 93.976291][ T10] ? __pfx_hci_tx_work+0x10/0x10
[ 93.978640][ T10] report_bug_entry+0x19a/0x290
[ 93.997955][ T10] ? __queue_work+0xd66/0x10a0
[ 94.000648][ T10] ? __queue_work+0xd6b/0x10a0
[ 94.003051][ T10] handle_bug+0xce/0x200
[ 94.005209][ T10] exc_invalid_op+0x1a/0x50
[ 94.007477][ T10] asm_exc_invalid_op+0x1a/0x20
[ 94.010917][ T10] RIP: 0010:__queue_work+0xd66/0x10a0
[ 94.023864][ T10] Code: 49 81 c7 70 01 00 00 4c 8d 35 d6 00 cd 0e 48 89 f8 48 c1 e8 03 80 3c 18 00 74 05 e8 a4 6c a8 00 49 8b 75 18 4c 89 f7 4c 89 fa <67> 48 0f b9 3a 4c 89 e8 48 c1 e8 03 80 3c 18 00 74 08 4c 89 ef e8
[ 94.044095][ T10] RSP: 0018:ffffc9000023f830 EFLAGS: 00010046
[ 94.048061][ T10] RAX: 1ffff1100240098a RBX: dffffc0000000000 RCX: ffff88801bf0a540
[ 94.061516][ T10] RDX: ffff88803fe92970 RSI: ffffffff8ac51380 RDI: ffffffff905aeb30
[ 94.066727][ T10] RBP: 0000000000000020 R08: ffff888012004c3f R09: 1ffff11002400987
[ 94.081456][ T10] R10: dffffc0000000000 R11: ffffed1002400988 R12: 0000000000000008
[ 94.086922][ T10] R13: ffff888012004c38 R14: ffffffff905aeb30 R15: ffff88803fe92970
[ 94.092638][ T10] ? __pfx_hci_tx_work+0x10/0x10
[ 94.103617][ T10] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 94.107712][ T10] ? lockdep_hardirqs_on+0x7a/0x110
[ 94.113106][ T10] ? _raw_spin_unlock_irqrestore+0x4c/0x80
[ 94.124486][ T10] ? rcu_is_watching+0x15/0xb0
[ 94.126857][ T10] queue_work_on+0x106/0x1d0
[ 94.128993][ T10] ? l2cap_chan_check_security+0x2ae/0x4f0
[ 94.142471][ T10] l2cap_conn_start+0x5e2/0xf70
[ 94.146345][ T10] ? __pfx_l2cap_conn_start+0x10/0x10
[ 94.152736][ T10] l2cap_info_timeout+0x68/0xa0
[ 94.156536][ T10] ? process_scheduled_works+0xa20/0x14e0
[ 94.162504][ T10] process_scheduled_works+0xa8e/0x14e0
[ 94.167050][ T10] ? __pfx_process_scheduled_works+0x10/0x10
[ 94.170790][ T10] ? assign_work+0x3cf/0x5d0
[ 94.173059][ T10] worker_thread+0xa47/0xfb0
[ 94.175249][ T10] kthread+0x388/0x470
[ 94.177184][ T10] ? __pfx_worker_thread+0x10/0x10
[ 94.179545][ T10] ? __pfx_kthread+0x10/0x10
[ 94.182836][ T10] ret_from_fork+0x514/0xb70
[ 94.185711][ T10] ? __pfx_ret_from_fork+0x10/0x10
[ 94.189016][ T10] ? __switch_to+0xc89/0x1420
[ 94.195544][ T10] ? __pfx_kthread+0x10/0x10
[ 94.203023][ T10] ret_from_fork_asm+0x1a/0x30
[ 94.208290][ T10]
[ 94.211777][ T10] Kernel Offset: disabled
[ 94.223053][ T10] Rebooting in 86400 seconds..