program:
r0 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0) (async)
r1 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) (async)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
unshare(0xe020600) (async)
ioctl$FICLONE(r2, 0x40049409, r2) (async)
fcntl$notify(r1, 0x402, 0x8000003d)
fcntl$setsig(r0, 0xa, 0xf) (async)
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0)
write$dsp(r3, &(0x7f0000000040)='\x00', 0x1) (async)
prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0)
renameat2(r0, &(0x7f00000001c0)='./cgroup\x00', 0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x1) (async)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000580)=ANY=[@ANYBLOB="a00000001800020002000000010000001c200010fe02c80100260000840013000000000000000b000000000000000000000002000000010000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000f00000000000000000000000000000000000000000000000000000f0f00"/160], 0xa0}, 0x1, 0x0, 0x0, 0x44040}, 0x6080) (async)
r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94)
r5 = socket$packet(0x11, 0x2, 0x300)
r6 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1, 0xc, &(0x7f0000000300)=ANY=[@ANYRES8=r0], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
setsockopt$sock_attach_bpf(r5, 0x1, 0x32, &(0x7f0000000180)=r6, 0x4) (async)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[@ANYRES32=r0], 0x14}, 0x1, 0x0, 0x0, 0x4880}, 0x8010) (async)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) (async)
pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe)
syz_usb_connect$hid(0x3, 0x36, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e1f0a"], 0x22)
syz_emit_vhci(&(0x7f0000000080)=ANY=[@ANYBLOB="0406"], 0x7)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c0000000400000000001312000000006000d4d202f5f2b13cdcc6c70cd1e5a2858158e1847ece9fb5a681eca7d049b3bd30127934209268fb4e4e24"], 0x0, 0x28}, 0x20) (async)
r7 = openat$sw_sync_info(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0)
close(r7) (async)
r8 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x8000)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(r8, 0xc04064a0, &(0x7f0000000200)={0x0, &(0x7f0000000240)=[0x0], 0x0, 0x0, 0x0, 0x1})
ioctl$DRM_IOCTL_MODE_SETCRTC(r7, 0xc06864a2, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x6, 0x40000, 0x1, 0x0, {0x0, 0x0, 0x0, 0x2, 0x3, 0x0, 0x4, 0xc9b, 0x7f, 0x0, 0x0, 0xfffefffe, 0x4, 0xfffffffe, "65366a50432b7ee2c7feddd90df868e7f3ddbded72f3bf0a71b5d0a49323a260"}})
[ 145.086848][ T4642] Bluetooth: hci0: command tx timeout
[ 145.148846][ T25] audit: type=1326 audit(1790856161.273:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5324 comm="syz.0.0" exe="/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f3363f9e159 code=0x0
[ 145.209940][ T5289] Bluetooth: hci0: unexpected event 0x06 length: 4 > 3
[ 147.165962][ T5289] Bluetooth: hci0: command tx timeout
[ 147.256635][ T4642] ------------[ cut here ]------------
[ 147.256651][ T4642] refcnt < 0
[ 147.256668][ T4642] WARNING: net/bluetooth/hci_conn.c:641 at hci_conn_timeout+0xff/0x2c0, CPU#0: kworker/u5:1/4642
[ 147.283676][ T4642] Modules linked in:
[ 147.290676][ T4642] CPU: 0 UID: 0 PID: 4642 Comm: kworker/u5:1 Not tainted syzkaller #0 PREEMPT(full)
[ 147.301461][ T4642] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 147.306772][ T4642] Workqueue: hci0 hci_conn_timeout
[ 147.314554][ T4642] RIP: 0010:hci_conn_timeout+0xff/0x2c0
[ 147.322670][ T4642] Code: 48 89 df e8 a3 f7 09 00 eb 07 e8 9c e3 ec f6 b0 13 0f b6 f0 48 89 df 5b 41 5c 41 5e 41 5f 5d e9 d7 9e fe ff e8 82 e3 ec f6 90 <0f> 0b 90 eb 8c 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 31 ff ff ff
[ 147.345717][ T4642] RSP: 0018:ffffc9000e407ab0 EFLAGS: 00010293
[ 147.349633][ T4642] RAX: ffffffff8adb18be RBX: ffff888012c9c000 RCX: ffff88801bb78000
[ 147.368708][ T4642] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000
[ 147.372338][ T4642] RBP: 00000000ffffffff R08: ffff888012c9c013 R09: 1ffff11002593802
[ 147.388804][ T4642] R10: dffffc0000000000 R11: ffffed1002593803 R12: dffffc0000000000
[ 147.394413][ T4642] R13: ffffffff818fa5fa R14: ffff888012c9ca50 R15: ffff888012c9c010
[ 147.407754][ T4642] FS: 0000000000000000(0000) GS:ffff88808c2bc000(0000) knlGS:0000000000000000
[ 147.413406][ T4642] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 147.425931][ T4642] CR2: 00007f33640ea2f0 CR3: 000000004c667000 CR4: 0000000000352ef0
[ 147.429963][ T4642] Call Trace:
[ 147.431514][ T4642]
[ 147.433009][ T4642] process_scheduled_works+0xc3d/0x1630
[ 147.451965][ T4642] ? __pfx_process_scheduled_works+0x10/0x10
[ 147.455583][ T4642] ? assign_work+0x3cf/0x5d0
[ 147.458734][ T4642] worker_thread+0xa47/0xfb0
[ 147.461866][ T4642] ? __kthread_parkme+0x71/0x1f0
[ 147.465933][ T4642] kthread+0x38b/0x480
[ 147.483287][ T4642] ? __pfx_worker_thread+0x10/0x10
[ 147.503452][ T4642] ? __pfx_kthread+0x10/0x10
[ 147.517160][ T4642] ret_from_fork+0x514/0xb70
[ 147.520018][ T4642] ? __pfx_ret_from_fork+0x10/0x10
[ 147.541629][ T4642] ? __switch_to+0xc89/0x1420
[ 147.544132][ T4642] ? __pfx_kthread+0x10/0x10
[ 147.553877][ T4642] ret_from_fork_asm+0x1a/0x30
[ 147.556960][ T4642]
[ 147.560929][ T4642] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 147.567741][ T4642] CPU: 0 UID: 0 PID: 4642 Comm: kworker/u5:1 Not tainted syzkaller #0 PREEMPT(full)
[ 147.578377][ T4642] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 147.592064][ T4642] Workqueue: hci0 hci_conn_timeout
[ 147.595243][ T4642] Call Trace:
[ 147.598158][ T4642]
[ 147.599432][ T4642] vpanic+0x56d/0xa60
[ 147.601108][ T4642] ? __pfx__printk+0x10/0x10
[ 147.610014][ T4642] ? __pfx_vpanic+0x10/0x10
[ 147.613174][ T4642] ? is_bpf_text_address+0x292/0x2b0
[ 147.620629][ T4642] ? is_bpf_text_address+0x26/0x2b0
[ 147.623099][ T4642] panic+0xc5/0xd0
[ 147.630262][ T4642] ? __pfx_panic+0x10/0x10
[ 147.632929][ T4642] ? ret_from_fork_asm+0x1a/0x30
[ 147.636253][ T4642] __warn+0x315/0x4c0
[ 147.637926][ T4642] ? hci_conn_timeout+0xff/0x2c0
[ 147.645379][ T4642] ? hci_conn_timeout+0xff/0x2c0
[ 147.647692][ T4642] __report_bug+0x276/0x570
[ 147.656046][ T4642] ? hci_conn_timeout+0xff/0x2c0
[ 147.658211][ T4642] ? __pfx___report_bug+0x10/0x10
[ 147.665557][ T4642] ? add_lock_to_list+0xc7/0x100
[ 147.667624][ T4642] ? lockdep_unlock+0x5c/0xd0
[ 147.669705][ T4642] ? __lock_acquire+0x1511/0x2de0
[ 147.671785][ T4642] ? hci_conn_timeout+0xff/0x2c0
[ 147.673993][ T4642] report_bug+0x16b/0x220
[ 147.676541][ T4642] ? hci_conn_timeout+0xff/0x2c0
[ 147.679490][ T4642] ? hci_conn_timeout+0x101/0x2c0
[ 147.681905][ T4642] handle_bug+0x9c/0x200
[ 147.683890][ T4642] exc_invalid_op+0x1a/0x50
[ 147.691400][ T4642] asm_exc_invalid_op+0x1a/0x20
[ 147.694297][ T4642] RIP: 0010:hci_conn_timeout+0xff/0x2c0
[ 147.696827][ T4642] Code: 48 89 df e8 a3 f7 09 00 eb 07 e8 9c e3 ec f6 b0 13 0f b6 f0 48 89 df 5b 41 5c 41 5e 41 5f 5d e9 d7 9e fe ff e8 82 e3 ec f6 90 <0f> 0b 90 eb 8c 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 31 ff ff ff
[ 147.717467][ T4642] RSP: 0018:ffffc9000e407ab0 EFLAGS: 00010293
[ 147.725740][ T4642] RAX: ffffffff8adb18be RBX: ffff888012c9c000 RCX: ffff88801bb78000
[ 147.729613][ T4642] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000
[ 147.738091][ T4642] RBP: 00000000ffffffff R08: ffff888012c9c013 R09: 1ffff11002593802
[ 147.746543][ T4642] R10: dffffc0000000000 R11: ffffed1002593803 R12: dffffc0000000000
[ 147.755093][ T4642] R13: ffffffff818fa5fa R14: ffff888012c9ca50 R15: ffff888012c9c010
[ 147.758754][ T4642] ? process_scheduled_works+0x97a/0x1630
[ 147.766704][ T4642] ? hci_conn_timeout+0xfe/0x2c0
[ 147.768831][ T4642] process_scheduled_works+0xc3d/0x1630
[ 147.771247][ T4642] ? __pfx_process_scheduled_works+0x10/0x10
[ 147.773765][ T4642] ? assign_work+0x3cf/0x5d0
[ 147.785661][ T4642] worker_thread+0xa47/0xfb0
[ 147.788687][ T4642] ? __kthread_parkme+0x71/0x1f0
[ 147.793451][ T4642] kthread+0x38b/0x480
[ 147.796754][ T4642] ? __pfx_worker_thread+0x10/0x10
[ 147.800571][ T4642] ? __pfx_kthread+0x10/0x10
[ 147.802549][ T4642] ret_from_fork+0x514/0xb70
[ 147.804571][ T4642] ? __pfx_ret_from_fork+0x10/0x10
[ 147.806702][ T4642] ? __switch_to+0xc89/0x1420
[ 147.808724][ T4642] ? __pfx_kthread+0x10/0x10
[ 147.812674][ T4642] ret_from_fork_asm+0x1a/0x30
[ 147.817913][ T4642]
[ 147.821643][ T4642] Kernel Offset: disabled
[ 147.826362][ T4642] Rebooting in 86400 seconds..