program: setuid(0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x5, 0x10, 0x2, 0x9, 0x0, 0xffffffffffffffff, 0x10000}, 0x48) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, &(0x7f0000000000), 0x10) r3 = socket$can_j1939(0x1d, 0x2, 0x7) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r5, 0x400448cb, 0x0) syz_emit_vhci(&(0x7f00000006c0)=ANY=[@ANYBLOB="040e0402030c"], 0x7) syz_emit_vhci(&(0x7f0000000200)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_status={{0xf, 0x4}, {0x9, 0x1, 0x200d}}}, 0x7) r6 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), r4) sendmsg$IEEE802154_START_REQ(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="34000000e14ed4821a509d44cabcc42e6783b311a4b0f42aaf9620217287c32c3b245c5ae8125f79ba93b518db14961fd677be47d4c26df93fbe7fe07b8cd2ad8af02189dd4249feb8b9245e63d08d550143d058413e0689d0705478b8cd61f64096b7f1c953311ee3fd5cc9603488a20155619ca98d95", @ANYRES16=r6, @ANYBLOB="010028bd7000fedbdf250d00000005001700f900000006000a0000000000050007000900000006000800a3aa0000"], 0x34}, 0x1, 0x0, 0x0, 0x810}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000080)={'vxcan0\x00', 0x0}) sendmsg$can_bcm(r2, &(0x7f00000002c0)={&(0x7f0000000040)={0x1d, r7}, 0x10, &(0x7f00000000c0)={&(0x7f0000000140)={0x1, 0x0, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "bd80e88c9c43feb0"}}, 0x48}}, 0x0) sendmsg$can_bcm(r2, &(0x7f0000000280)={&(0x7f0000000100)={0x1d, r7}, 0x10, &(0x7f0000000240)={&(0x7f00000001c0)={0x1, 0x3, 0x0, {0x0, 0xea60}, {0x0, 0x2710}, {}, 0x2}, 0x48}}, 0x0) syz_open_dev$vbi(&(0x7f0000000300), 0x0, 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xf, &(0x7f0000000080)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x2}, {0x85, 0x0, 0x0, 0xd3}}}, &(0x7f0000000040)='syzkaller\x00'}, 0x90) sendmmsg$unix(r0, &(0x7f00000bd000), 0x0, 0x805) ioctl$TUNSETGROUP(0xffffffffffffffff, 0x400454ce, 0x0) timer_create(0x7, 0x0, 0x0) r8 = syz_open_dev$vivid(&(0x7f0000000400), 0x2, 0x2) sendfile(r3, r8, 0x0, 0x9) clock_gettime(0x0, 0x0) timer_settime(0x0, 0x1, 0x0, 0x0) landlock_restrict_self(0xffffffffffffffff, 0xc) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000001700)=ANY=[@ANYBLOB="b7020000267d957bbfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff1d6405000000000065040400210000000404000001e37c60b7040000000000006a0a00fe000000008500000032000000b70000000000000095000000000000000ce0de7621e5e832249c04112cf7af2b75d0d1f034b1b3fb6bd3ce8fa62c7941272ff49142d860010ab162aa2264ab67e55a00000000000000edfe0969a9ddc125b686a1e83c8790c893d713b3295dad0ea697181d1e85b64126b5d72f204754d1d4a93f24215dee354e93cfc3f50ff23f8432c72012f021c84c59a9d4c142f439d3040cfee621589fb3a2f1407c7cbed48e7026f8d52d4bca2608c79aa4a73732028f88ce07ed1075da4a2ef44e3d8b88873f0b1de87dfb6d15936ec0a27cb554def9e27396df6b7851ffa26237ea6730880f06371beb3b290b7d8629a6f0373fefa0acb60888fc14ad2b83ca03ac2aee792482ce5f53cc7e04bc77b2fef26e00c5b2200a91cb80c6065a697d6fc8aa8b65aee0783b04cff0218ce82c9687b4474da89c474c23727555fc5e5f8ad0f2f7a261140440fce1f12cc6df312accd011d888384283092d987c40bbb46f68c2431b97906f00000000349834fa147bd5923bbd4e606708034931a8f1a89bdf77093a0000427aab8e21e1a33d3fe093547532fce6549dd648ad233e05a7b3ea178007c1c32e871ac81f287c4aabbd153390b16d1d41ee433e3a54ea9ee82cf14f3a4cc523ee000000000009e106d6b5289f0000000000000000000000f7bc9f46cb71f6b889d37807865e3b4e9916dd0f72c9d58ea333b90f8886dcbf5ddda0e42ca08e3303632401f2f5212b40c0e88c957fd767dbfc80b07ad668b4f6f92fb209d7c2dbac597843c8eb7bf92fe6d0bb0b72549795c2ed19e441eb69869844152ba9da0588e42cdbc5fcd245ce5e3ef0dca64931276702a312db7956f0a75eb9caa17d47a6331c7c963cbf86a845ce27c26b7136d3e7207318b1df7a6320c64f18ccd926eaeddcde8d5006d6c38db117fb1115221a66169172720ccca770bff37e59511b2606138377eda44b2f288b491ab8aae0e11a98303b0e407e0f9d21f4a3ebbd3fabf6da9a1a1f869a339fab465d8322b7280b0734fd115a19b33c8644fff71b3c62f2e1b827e2663e06a751182e968c8ab05fb1d0115d4b11d944f2c06acc023a02b7416a9a10218d21503cda13bb5df6c992e52e1c01793b728eac000058ab3b3900d279297dadc127e2f38fc60c23af2e1fefa5a83456647191ba1953d335f59aa261fe79613df6bf43884e9649691e32680d75a541c27ffe74f9d13340f2cf1c7dc2b7db01213216cd4ecfd30efe137641471987289b7e23482e026b26eacd1b97443e2ea2d1d6e31a01ee0ae7fa195a2152b2338b086423a3883f2ce3e2f84e04f4d52c985eac4b46336908599564b47db0e6aa97ee51a360f4382fd99745725d44c77d097f69d19fe86f71c38a0226d44ebe0ecbd959f14b540745cd03b8c9f02b825ba45ca85706c73115f70871db9d2a1bc2a517b39f9648123917a5db07ba4e27f961373767e1ea8f7cc558e483abef1a9923c5cfa2081e430680950b7d7c377726b557ad31fdee17ba7057741f39d29d8ab295222f96297a777bb235416e72c84afef2bdb08fb375147b028b89f15af45bc8976b91158c13c9876daa71e7db0f5a17376be39ea79ce1246c547c740e31c64e5d293e0e5a544dd166010061d6ccae46c173b8e11721e4bce22c96af00000021f80ac6c3971006db853e3c40a5417d6eac09eb0e01ac6bd4c6dacdcb1d6d2ef9c8bdea91c984022821e961236d08f8b9072ec6cb5d5a68833fd5b4e80a5ac2bc6ff323f5ce612b59ce8177956c1affcc8baf4c8b59ab959aff9a7bd81f7c7c1f1bb92ddbeed6bce8041c7f0c1c584e6ae027678ce3cfbfea938aecc3c5119c5875b7fb35dc20f5c7aaae1e276104f607a73fe501c1045873a2b1eb80e95c87f099d98028dc82bdc7ef08c871fb3061c3c5ebd613e6e5e8cf099bb6e8c0441a133c85138b36a02c47fbedf7ed1d3ce74c9ec2c676c0b2d4b5eca61dbf5769b483c2a9f6bec666dae4e81960e9bad7f17cfc3d5bcc7b7f437110ca8ffa908c12086b2227eb202a8d56e0925ba994b05c98c39de44d25932449ddf08e5377814a40877eab4440ca01b3f50d2014a61a7d32105254b424238122386424efa3a7041254f686a5faac120942287f75e8e3db569ce47b120059d774a37e11d013be50cd2cbb00f6d2a23af61ec7d30bb7dc33a92f900b6ff1d29dc61cc40b846040dbafd00c6bcfbcf7af8ea5b4bd9593f73c6c95dd6d59083763debf02ea36803976b6cc145338e1"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffffe}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r9, 0x702, 0xe, 0x0, &(0x7f0000000100)="e4604f89ecdb33440008d480eb00", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) futex(&(0x7f0000000000)=0x2, 0x0, 0x0, &(0x7f0000000180)={0x77359400}, &(0x7f00000001c0)=0x2, 0x1) [ 103.699220][ T4656] Bluetooth: hci0: command tx timeout [ 103.892093][ T5328] ------------[ cut here ]------------ [ 103.894345][ T5328] workqueue: cannot queue hci_rx_work on wq hci0 [ 103.896914][ T5328] WARNING: kernel/workqueue.c:2298 at __queue_work+0xd3f/0x1040, CPU#0: syz.0.0/5328 [ 103.900043][ T5328] Modules linked in: [ 103.901522][ T5328] CPU: 0 UID: 0 PID: 5328 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.904933][ T5328] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.909629][ T5328] RIP: 0010:__queue_work+0xd67/0x1040 [ 103.912247][ T5328] Code: a6 0e 49 8d 7d 18 48 89 f8 48 c1 e8 03 42 80 3c 20 00 74 05 e8 6a 60 a5 00 49 8b 75 18 49 81 c7 70 01 00 00 4c 89 f7 4c 89 fa <67> 48 0f b9 3a 4c 89 e8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ef [ 103.919448][ T5328] RSP: 0018:ffffc90006d47b08 EFLAGS: 00010082 [ 103.922154][ T5328] RAX: 1ffff110081ba978 RBX: 0000000000000008 RCX: 0000000000100000 [ 103.925181][ T5328] RDX: ffff888040dd0970 RSI: ffffffff8a9e3150 RDI: ffffffff9033f750 [ 103.928371][ T5328] RBP: 0000000000000000 R08: ffff888040dd4baf R09: 1ffff110081ba975 [ 103.931432][ T5328] R10: dffffc0000000000 R11: ffffed10081ba976 R12: dffffc0000000000 [ 103.934472][ T5328] R13: ffff888040dd4ba8 R14: ffffffff9033f750 R15: ffff888040dd0970 [ 103.937446][ T5328] FS: 00007f800c4fd6c0(0000) GS:ffff88808c87c000(0000) knlGS:0000000000000000 [ 103.940831][ T5328] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 103.943525][ T5328] CR2: 00007f800c4fcff8 CR3: 0000000011ced000 CR4: 0000000000352ef0 [ 103.946400][ T5328] Call Trace: [ 103.947855][ T5328] [ 103.949096][ T5328] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 103.951145][ T5328] ? rcu_is_watching+0x15/0xb0 [ 103.952848][ T5328] queue_work_on+0x106/0x1d0 [ 103.954568][ T5328] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 103.956666][ T5328] hci_recv_frame+0x625/0x7c0 [ 103.958460][ T5328] ? skb_pull+0xc1/0x1d0 [ 103.960145][ T5328] vhci_write+0x358/0x4a0 [ 103.961902][ T5328] vfs_write+0x61d/0xb90 [ 103.963583][ T5328] ? __pfx_vfs_write+0x10/0x10 [ 103.965543][ T5328] ? __fget_files+0x2a/0x420 [ 103.967350][ T5328] ksys_write+0x150/0x270 [ 103.969148][ T5328] ? __pfx_ksys_write+0x10/0x10 [ 103.971180][ T5328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.973430][ T5328] do_syscall_64+0x15f/0xf80 [ 103.975103][ T5328] ? trace_irq_disable+0x3b/0x140 [ 103.976981][ T5328] ? clear_bhb_loop+0x40/0x90 [ 103.978749][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.981007][ T5328] RIP: 0033:0x7f800b55d68e [ 103.982769][ T5328] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 103.990392][ T5328] RSP: 002b:00007f800c4fcf78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 103.993834][ T5328] RAX: ffffffffffffffda RBX: 00007f800c4fd6c0 RCX: 00007f800b55d68e [ 103.997213][ T5328] RDX: 0000000000000007 RSI: 00002000000006c0 RDI: 00000000000000ca [ 104.000870][ T5328] RBP: 00007f800b632d6f R08: 0000000000000000 R09: 0000000000000000 [ 104.004289][ T5328] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 104.007692][ T5328] R13: 00007f800b816128 R14: 00007f800b816090 R15: 00007ffc53ca59c8 [ 104.011234][ T5328] [ 104.012634][ T5328] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 104.015666][ T5328] CPU: 0 UID: 0 PID: 5328 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 104.019308][ T5328] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 104.023408][ T5328] Call Trace: [ 104.024712][ T5328] [ 104.026013][ T5328] vpanic+0x56c/0xa60 [ 104.027864][ T5328] ? __pfx__printk+0x10/0x10 [ 104.029554][ T5328] ? __pfx_vpanic+0x10/0x10 [ 104.031619][ T5328] ? is_bpf_text_address+0x292/0x2b0 [ 104.033977][ T5328] ? is_bpf_text_address+0x26/0x2b0 [ 104.036155][ T5328] panic+0xc5/0xd0 [ 104.037718][ T5328] ? __pfx_panic+0x10/0x10 [ 104.039570][ T5328] __warn+0x315/0x4c0 [ 104.041327][ T5328] ? __queue_work+0xd3f/0x1040 [ 104.043088][ T5328] ? __queue_work+0xd3f/0x1040 [ 104.045160][ T5328] __report_bug+0x29a/0x540 [ 104.047178][ T5328] ? __pfx_stack_trace_save+0x10/0x10 [ 104.049493][ T5328] ? __queue_work+0xd3f/0x1040 [ 104.051706][ T5328] ? __pfx___report_bug+0x10/0x10 [ 104.053949][ T5328] ? __pfx_hci_rx_work+0x10/0x10 [ 104.056125][ T5328] ? __alloc_skb+0x27d/0x7d0 [ 104.065620][ T5328] ? vhci_write+0xbe/0x4a0 [ 104.067724][ T5328] ? vfs_write+0x61d/0xb90 [ 104.069671][ T5328] ? ksys_write+0x150/0x270 [ 104.071627][ T5328] ? do_syscall_64+0x15f/0xf80 [ 104.073652][ T5328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.075990][ T5328] report_bug_entry+0x19a/0x290 [ 104.077928][ T5328] ? __queue_work+0xd67/0x1040 [ 104.079505][ T5328] ? __queue_work+0xd6c/0x1040 [ 104.081393][ T5328] handle_bug+0xce/0x200 [ 104.083275][ T5328] exc_invalid_op+0x1a/0x50 [ 104.085361][ T5328] asm_exc_invalid_op+0x1a/0x20 [ 104.087598][ T5328] RIP: 0010:__queue_work+0xd67/0x1040 [ 104.090669][ T5328] Code: a6 0e 49 8d 7d 18 48 89 f8 48 c1 e8 03 42 80 3c 20 00 74 05 e8 6a 60 a5 00 49 8b 75 18 49 81 c7 70 01 00 00 4c 89 f7 4c 89 fa <67> 48 0f b9 3a 4c 89 e8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ef [ 104.098934][ T5328] RSP: 0018:ffffc90006d47b08 EFLAGS: 00010082 [ 104.101645][ T5328] RAX: 1ffff110081ba978 RBX: 0000000000000008 RCX: 0000000000100000 [ 104.105099][ T5328] RDX: ffff888040dd0970 RSI: ffffffff8a9e3150 RDI: ffffffff9033f750 [ 104.108549][ T5328] RBP: 0000000000000000 R08: ffff888040dd4baf R09: 1ffff110081ba975 [ 104.112007][ T5328] R10: dffffc0000000000 R11: ffffed10081ba976 R12: dffffc0000000000 [ 104.115406][ T5328] R13: ffff888040dd4ba8 R14: ffffffff9033f750 R15: ffff888040dd0970 [ 104.118997][ T5328] ? __pfx_hci_rx_work+0x10/0x10 [ 104.122157][ T5328] ? __queue_work+0xd2c/0x1040 [ 104.125045][ T5328] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 104.128169][ T5328] ? rcu_is_watching+0x15/0xb0 [ 104.130455][ T5328] queue_work_on+0x106/0x1d0 [ 104.132507][ T5328] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 104.135215][ T5328] hci_recv_frame+0x625/0x7c0 [ 104.137390][ T5328] ? skb_pull+0xc1/0x1d0 [ 104.139271][ T5328] vhci_write+0x358/0x4a0 [ 104.141303][ T5328] vfs_write+0x61d/0xb90 [ 104.143116][ T5328] ? __pfx_vfs_write+0x10/0x10 [ 104.145415][ T5328] ? __fget_files+0x2a/0x420 [ 104.147379][ T5328] ksys_write+0x150/0x270 [ 104.149196][ T5328] ? __pfx_ksys_write+0x10/0x10 [ 104.151347][ T5328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.154140][ T5328] do_syscall_64+0x15f/0xf80 [ 104.156237][ T5328] ? trace_irq_disable+0x3b/0x140 [ 104.158556][ T5328] ? clear_bhb_loop+0x40/0x90 [ 104.160662][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.163229][ T5328] RIP: 0033:0x7f800b55d68e [ 104.165266][ T5328] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 104.173517][ T5328] RSP: 002b:00007f800c4fcf78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 104.177246][ T5328] RAX: ffffffffffffffda RBX: 00007f800c4fd6c0 RCX: 00007f800b55d68e [ 104.180821][ T5328] RDX: 0000000000000007 RSI: 00002000000006c0 RDI: 00000000000000ca [ 104.184422][ T5328] RBP: 00007f800b632d6f R08: 0000000000000000 R09: 0000000000000000 [ 104.188042][ T5328] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 104.191558][ T5328] R13: 00007f800b816128 R14: 00007f800b816090 R15: 00007ffc53ca59c8 [ 104.194865][ T5328] [ 104.196717][ T5328] Kernel Offset: disabled [ 104.199571][ T5328] Rebooting in 86400 seconds..