program: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0x3, 0x2) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, 0x0, 0x0) syz_emit_vhci(0x0, 0xe) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000300)=ANY=[@ANYBLOB="1201010200000040"], 0x0) syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e1f0a"], 0x22) syz_emit_vhci(&(0x7f0000000300)=ANY=[@ANYBLOB="040b"], 0xe) syz_emit_vhci(&(0x7f0000000080)=ANY=[@ANYBLOB="0406"], 0x7) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r0, &(0x7f0000002ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0xfffd, 0x14}, @ipv4=@generic={{0x5, 0x4, 0x1, 0x22, 0x1016, 0x69, 0x0, 0x60, 0x2, 0x0, @empty=0x600, @broadcast}, "14f3305280f125e6"}}, 0xfdef) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000240)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2, &(0x7f0000000180)={[{@jqfmt_vfsold}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x4000000}}, {@orlov}, {@noload}, {@delalloc}, {@mblk_io_submit}, {@commit}, {@user_xattr}, {@nogrpid}, {@init_itable_val={'init_itable', 0x3d, 0x400fff}}]}, 0xfa, 0x47a, &(0x7f0000000340)="$eJzs3M9vFFUcAPDvTLflt62IP0CQKhqJP1pafsjBi0YTDpqY6AHjqbaFVAo1tCZCiFYPeDQk3o3/hfGkF6NeNPGqd0NCDBdQL2tmZ6aUZbfd0m2Xsp9PMu17M6/z3ndm3u6bed0NoGsNZj+SiO0R8UdE9OfZ2wsM5r9uXr80/s/1S+NJVKtv/53Uyt24fmm8LFr+3bY8Uy3zmxrUe/m9iLHp6cnzRX547uyHw7MXLr44dXbs9OTpyXOjx48fObyv79jo0bbEmcV1Y88nM3t3n3j3ypvjJ6+8/3OSRh531MXRLoP50W3omXZX1mE7FqWTyuIt+3+9lW50JdBJPRGRna7eWv/vj57YsrCtP17/vKONA9ZUtVqtLvGqPF8F7mNJdLoFQGeUb/TZ/W+5rNPQ455w7ZX8BiiL+2ax5FsqkeaJ/b1197fb21j/YEScnP/362yJNXoOAQCw2PfZ+OeFRuO/NB7JE33ZjweKOZSBiHgwInZGxEMRsSsiHo6olX00Ih5bYf31MyR3jn/Sq3cdXAuy8d/LxdzW7eO/tCwy0FPkdtTi701OTU1PHiqOycHo3XRqKpkcWaKOH177/cuGGyq3j/+yJau/HAsW7bhaqXtANzE2N7bKsBdc+yxiT6VR/EmU0zhJROyOiD13WcfUc5Wm25aPfwnNd9uy6jcRz+bnfz7q4i8lTecnR146Nnp0eHNMTx4aLq+KO/3y2+W3mtW/qvjbIDv/Wxte/wvxDySbI2YvXDxTm6+dXdHus64Tl//8ouk9TRF/1r1auf5P7Ciu/77kndqKvmLDx2Nzc+dHIvqSN+5cP3prb2W+LJ/Ff/BA4/6/M24diccjYm9E7IuIJ7KbwqLtT0bEUxFxYImD8NOrT3+wTPwNzv/6zJVm8U8sd/5j8flfeaLnzI/fLR//5ohodv6P1FIHizWtvP612sDVHDsAAADYKPL/gU/SoYV0mg4N5f/Dvyu2ptMzs3PPn5r56NxEPu89EL1p+aSrf9Hz0JHi2XCZH63LHy6eG3/Vs6WWHxqfmZ7odPDQ5bY16f+Zv3o63TpgzbVhHg3YoPR/6F76P3SnRP+Hrqb/Q/dq1P8/bVp66Ns1bQywrrz/Q/dqof/P57+ajwqAjcn7P3Qv/R+6UtPPxqer+sh/y4ktbdrPf8X3Ga5HmyWyRKT3RDPu/0Sl5S+zWEGi2p/3/2zNpoZlOv3KBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0B7/BwAA///wDOHx") r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r3, 0x84, 0x72, &(0x7f00000001c0)={0x0, 0x1, 0x10}, 0xc) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c) sendmsg$inet6(r2, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) write(r3, &(0x7f0000000100)="88", 0x1) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r3, 0x84, 0x22, &(0x7f0000002700)={0x7, 0x2, 0x2, 0xfffffff8}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x111, 0x5}}, 0x20) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e24, @empty}}, 0x5, 0x3, 0xf06, 0x1, 0x94, 0xfffffffd, 0x5}, 0x9c) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000600)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x111, 0x8}}, 0x20) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x4e60, 0x6, @empty, 0xf}}, 0xffffec47, 0x9, 0xffff1896, 0x100, 0x25, 0x7fff}, 0x9c) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x13, 0x4, &(0x7f00000000c0)=@framed={{0xffffffb4, 0x2, 0x0, 0x0, 0x500, 0x61, 0x11, 0x4c}, [@call={0x85, 0x0, 0x0, 0x1c}]}, &(0x7f0000000380)='GPL\x00', 0x3, 0xc3, &(0x7f00000003c0)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000100), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) pipe2$9p(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) write$P9_RSYMLINK(r5, &(0x7f00000007c0)={0x14, 0x11, 0x2, {0x20, 0x1}}, 0x14) ioctl$FS_IOC_FSSETXATTR(r4, 0x401c5820, &(0x7f0000000080)={0x18}) [ 92.646170][ T5273] Bluetooth: hci0: command tx timeout [ 92.664644][ T1248] cfg80211: failed to load regulatory.db [ 92.949566][ T10] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 93.114330][ T4638] Bluetooth: hci0: unexpected event 0x06 length: 4 > 3 [ 93.115306][ T5316] syzkaller1: entered promiscuous mode [ 93.122045][ T5316] syzkaller1: entered allmulticast mode [ 93.134274][ T5316] loop0: detected capacity change from 0 to 512 [ 93.164150][ T5316] EXT4-fs: Ignoring removed orlov option [ 93.174042][ T5316] EXT4-fs: Ignoring removed mblk_io_submit option [ 93.198610][ T5316] EXT4-fs error (device loop0): ext4_iget_extra_inode:5180: inode #15: comm syz.0.0: corrupted in-inode xattr: e_value size too large [ 93.204763][ T5316] loop0: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 93.205685][ T5316] EXT4-fs error (device loop0): ext4_orphan_get:1404: comm syz.0.0: couldn't read orphan inode 15 (err -117) [ 93.209891][ C0] EXT4-fs (loop0): error count since last fsck: 1 [ 93.209944][ C0] EXT4-fs (loop0): initial error at time 1786883968: ext4_iget_extra_inode:5180: inode 15 [ 93.209962][ C0] EXT4-fs (loop0): last error at time 1786883968: ext4_iget_extra_inode:5180: inode 15 [ 93.226674][ T5316] loop0: lost filesystem error report for type 5 error -117 [ 93.229955][ T5316] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0xb7000) [ 93.501420][ T1020] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1 [ 93.504337][ T1020] ata1: failed to read log page 10h (errno=-5) [ 93.507701][ T1020] ata1.00: exception Emask 0x1 SAct 0xc000 SErr 0x0 action 0x0 [ 93.541150][ T1020] ata1.00: irq_stat 0x40000000 [ 93.551229][ T1020] ata1.00: failed command: WRITE FPDMA QUEUED [ 93.559134][ T1020] ata1.00: cmd 61/b8:70:36:01:08/05:00:00:00:00/40 tag 14 ncq dma 749568 out [ 93.559134][ T1020] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error) [ 93.583951][ T1020] ata1.00: status: { DRDY } [ 93.589622][ T1020] ata1.00: failed command: WRITE FPDMA QUEUED [ 93.599771][ T1020] ata1.00: cmd 61/c0:78:ee:06:08/02:00:00:00:00/40 tag 15 ncq dma 360448 out [ 93.599771][ T1020] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error) [ 93.619767][ T1020] ata1.00: status: { DRDY } [ 93.626821][ T1020] ata1.00: configured for UDMA/100 [ 93.633893][ T1020] ata1: EH complete [ 94.144198][ T10] usb 5-1: unable to get BOS descriptor or descriptor too short [ 94.158843][ T10] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 0.00 [ 94.176370][ T10] usb 5-1: no configurations [ 94.178918][ T10] usb 5-1: can't read configurations, error -22 [ 94.700171][ T4638] Bluetooth: hci0: command tx timeout [ 95.182730][ T5273] ------------[ cut here ]------------ [ 95.185143][ T5273] refcnt < 0 [ 95.185153][ T5273] WARNING: net/bluetooth/hci_conn.c:631 at hci_conn_timeout+0xff/0x2c0, CPU#0: kworker/u5:2/5273 [ 95.192501][ T5273] Modules linked in: [ 95.194780][ T5273] CPU: 0 UID: 0 PID: 5273 Comm: kworker/u5:2 Not tainted syzkaller #0 PREEMPT(full) [ 95.198835][ T5273] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.203701][ T5273] Workqueue: hci0 hci_conn_timeout [ 95.205867][ T5273] RIP: 0010:hci_conn_timeout+0xff/0x2c0 [ 95.208144][ T5273] Code: 48 89 df e8 c3 cc 09 00 eb 07 e8 3c 2d ff f6 b0 13 0f b6 f0 48 89 df 5b 41 5c 41 5e 41 5f 5d e9 b7 a0 fe ff e8 22 2d ff f6 90 <0f> 0b 90 eb 8c 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 31 ff ff ff [ 95.215847][ T5273] RSP: 0018:ffffc9000dc87ad0 EFLAGS: 00010293 [ 95.218306][ T5273] RAX: ffffffff8ac7e4be RBX: ffff8880369a4000 RCX: ffff888012a98000 [ 95.221403][ T5273] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000 [ 95.224500][ T5273] RBP: 00000000ffffffff R08: ffff8880369a4013 R09: 1ffff11006d34802 [ 95.227736][ T5273] R10: dffffc0000000000 R11: ffffed1006d34803 R12: dffffc0000000000 [ 95.231062][ T5273] R13: dffffc0000000000 R14: ffff8880369a4a40 R15: ffff8880369a4010 [ 95.234403][ T5273] FS: 0000000000000000(0000) GS:ffff88808c53e000(0000) knlGS:0000000000000000 [ 95.238062][ T5273] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.240945][ T5273] CR2: 000055bc67458574 CR3: 0000000051025000 CR4: 0000000000352ef0 [ 95.244516][ T5273] Call Trace: [ 95.246052][ T5273] [ 95.247126][ T5273] ? process_scheduled_works+0xa20/0x14e0 [ 95.249369][ T5273] process_scheduled_works+0xa8e/0x14e0 [ 95.251551][ T5273] ? __pfx_process_scheduled_works+0x10/0x10 [ 95.255114][ T5273] ? assign_work+0x3cf/0x5d0 [ 95.257130][ T5273] worker_thread+0xa47/0xfb0 [ 95.259685][ T5273] ? __kthread_parkme+0x71/0x1f0 [ 95.261753][ T5273] kthread+0x388/0x470 [ 95.263443][ T5273] ? __pfx_worker_thread+0x10/0x10 [ 95.265538][ T5273] ? __pfx_kthread+0x10/0x10 [ 95.267220][ T5273] ret_from_fork+0x514/0xb70 [ 95.269271][ T5273] ? __pfx_ret_from_fork+0x10/0x10 [ 95.271381][ T5273] ? __switch_to+0xc89/0x1420 [ 95.273270][ T5273] ? __pfx_kthread+0x10/0x10 [ 95.275062][ T5273] ret_from_fork_asm+0x1a/0x30 [ 95.276891][ T5273] [ 95.278121][ T5273] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 95.281058][ T5273] CPU: 0 UID: 0 PID: 5273 Comm: kworker/u5:2 Not tainted syzkaller #0 PREEMPT(full) [ 95.284430][ T5273] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.288416][ T5273] Workqueue: hci0 hci_conn_timeout [ 95.290538][ T5273] Call Trace: [ 95.291971][ T5273] [ 95.293185][ T5273] vpanic+0x56c/0xa60 [ 95.294629][ T5273] ? __pfx__printk+0x10/0x10 [ 95.296292][ T5273] ? __pfx_vpanic+0x10/0x10 [ 95.297871][ T5273] ? is_bpf_text_address+0x292/0x2b0 [ 95.300029][ T5273] ? is_bpf_text_address+0x26/0x2b0 [ 95.302318][ T5273] panic+0xc5/0xd0 [ 95.303959][ T5273] ? __pfx_panic+0x10/0x10 [ 95.305843][ T5273] ? ret_from_fork_asm+0x1a/0x30 [ 95.308061][ T5273] __warn+0x315/0x4c0 [ 95.309989][ T5273] ? hci_conn_timeout+0xff/0x2c0 [ 95.312149][ T5273] ? hci_conn_timeout+0xff/0x2c0 [ 95.314309][ T5273] __report_bug+0x276/0x570 [ 95.316439][ T5273] ? hci_conn_timeout+0xff/0x2c0 [ 95.318687][ T5273] ? __pfx___report_bug+0x10/0x10 [ 95.320933][ T5273] ? add_lock_to_list+0xc7/0x100 [ 95.323017][ T5273] ? lockdep_unlock+0x5d/0xd0 [ 95.325056][ T5273] ? __lock_acquire+0x13e8/0x2cf0 [ 95.327436][ T5273] ? hci_conn_timeout+0xff/0x2c0 [ 95.330175][ T5273] report_bug+0x16a/0x220 [ 95.332474][ T5273] ? hci_conn_timeout+0xff/0x2c0 [ 95.334673][ T5273] ? hci_conn_timeout+0x101/0x2c0 [ 95.337020][ T5273] handle_bug+0x9c/0x200 [ 95.338968][ T5273] exc_invalid_op+0x1a/0x50 [ 95.340966][ T5273] asm_exc_invalid_op+0x1a/0x20 [ 95.343061][ T5273] RIP: 0010:hci_conn_timeout+0xff/0x2c0 [ 95.345462][ T5273] Code: 48 89 df e8 c3 cc 09 00 eb 07 e8 3c 2d ff f6 b0 13 0f b6 f0 48 89 df 5b 41 5c 41 5e 41 5f 5d e9 b7 a0 fe ff e8 22 2d ff f6 90 <0f> 0b 90 eb 8c 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 31 ff ff ff [ 95.353218][ T5273] RSP: 0018:ffffc9000dc87ad0 EFLAGS: 00010293 [ 95.355754][ T5273] RAX: ffffffff8ac7e4be RBX: ffff8880369a4000 RCX: ffff888012a98000 [ 95.359050][ T5273] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000 [ 95.362321][ T5273] RBP: 00000000ffffffff R08: ffff8880369a4013 R09: 1ffff11006d34802 [ 95.365515][ T5273] R10: dffffc0000000000 R11: ffffed1006d34803 R12: dffffc0000000000 [ 95.368690][ T5273] R13: dffffc0000000000 R14: ffff8880369a4a40 R15: ffff8880369a4010 [ 95.371850][ T5273] ? hci_conn_timeout+0xfe/0x2c0 [ 95.373940][ T5273] ? process_scheduled_works+0xa20/0x14e0 [ 95.376416][ T5273] process_scheduled_works+0xa8e/0x14e0 [ 95.378679][ T5273] ? __pfx_process_scheduled_works+0x10/0x10 [ 95.381078][ T5273] ? assign_work+0x3cf/0x5d0 [ 95.382960][ T5273] worker_thread+0xa47/0xfb0 [ 95.384810][ T5273] ? __kthread_parkme+0x71/0x1f0 [ 95.386853][ T5273] kthread+0x388/0x470 [ 95.388450][ T5273] ? __pfx_worker_thread+0x10/0x10 [ 95.390489][ T5273] ? __pfx_kthread+0x10/0x10 [ 95.392349][ T5273] ret_from_fork+0x514/0xb70 [ 95.394253][ T5273] ? __pfx_ret_from_fork+0x10/0x10 [ 95.396329][ T5273] ? __switch_to+0xc89/0x1420 [ 95.398298][ T5273] ? __pfx_kthread+0x10/0x10 [ 95.400109][ T5273] ret_from_fork_asm+0x1a/0x30 [ 95.401719][ T5273] [ 95.403199][ T5273] Kernel Offset: disabled [ 95.404655][ T5273] Rebooting in 86400 seconds..