program: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_mount_image$hfs(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x808808, &(0x7f0000000100)=ANY=[@ANYRESOCT=r0], 0x1, 0x2ed, &(0x7f0000000400)="$eJzs3U1u00wcx/HfOEmbvqhPnrYIiQ2oUAk2FQUWiE0klC17VghoU6kiKqItErChQiwRB0CIHVfgEGxAXIAdbDhAVxjNeJw4qe0kEDd9+X6kWs54Xv6Dx/GMUWsBOLVuN75/vP7D/hippJKkW1IgqSqVJZ3R2erTrd3N3VZzPa+ikithf4yikiY6MNXJs7bVTCtqy7kSXs1+Kms2mYZihL/DMJRCt8Wp5a7+FIE06a9Dd7x6yHEVZU86P+4YRupn/yzJE2z2ta9nmisyJADA0efv/4G/Tcy6JKMgkJb9bf9E3f/3xx3AaN1oHUjKn88n7v9udhcae37/c4c66z23hLPHg3iVOEgwlZ7PE4pGVtcE0/RbVbpYgqmNzbJWPvi0upfItui269HQjfWJdilemw4mu7aK7kxHvXEzyl5xSBubreZkRvwLw7X478xn89XcMzW903p7/lcOjSb0Ps7TdaaCio3/anaNM3ZTs7nkl/31ej3oyvK/a+ScHwten15W01ckyTrjBwR77Qjy4nRtz6v7sULUu9U+pRbSStXanzJKLXaVKvmRsLL2uJX7KKUYcRfNW3PXLOmXPqmRmP8HNr5lJa7MvK9643L6kRH1ZyI9Z/vfpqe6zuVyoTfn5FD9gjfc07I3eqibmtt5/uJRqdVqbtudByk7T2a3jU+pvJZS8xS/U1JOHu11UkLrZRgOWnNYZPBXRlqh/f5op9jLJy2zvcraKcFhnya/E4+x8bQ+yp2MXjS+KG9AHp+dMJQyDhXwDYUjZ8fEJ90nTI05IBw2O+8y0frPzeT9rM4tkeymljNP7/ufRokaVwO9ilZA3VPBebedHmoFN5O9gku0eK3dYsqa6+Jl6VIi0Si3xZqP84QwDX3TfZ7/AwAAAAAAAAAAAAAAAAAAHDcj/HWC+DcZDxwacxcBAAAAAAAAAAAAAAAAAAAAADj2/ur9v2l/I969/7eW8v7fhNG9/zf/zUAABvInAAD//5y3dTY=") syz_mount_image$exfat(0x0, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0, 0x0, 0xff, 0x0, &(0x7f0000000080)) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="3c0000001300010500"/20, @ANYRES32=0x0, @ANYBLOB="01000000000000001400350076657468305f766c616e0000000000000500100005"], 0x3c}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'vlan0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000680)=@newlink={0x44, 0x10, 0x403, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6}]}}}, @IFLA_LINK={0x8, 0x5, r4}]}, 0x44}, 0x1, 0xba01, 0x0, 0x4004001}, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) rename(&(0x7f0000025a80)='./bus\x00', &(0x7f0000025e00)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00') ioctl$sock_bt_hci(r0, 0x400448cb, 0x0) syz_emit_vhci(&(0x7f0000000300)=ANY=[@ANYBLOB="040e0402030c02"], 0x7) [ 84.554276][ T5329] loop0: detected capacity change from 0 to 64 [ 84.559150][ T5329] hfs: Unknown parameter '00000000000000000000004' [ 84.671221][ T5330] ------------[ cut here ]------------ [ 84.673661][ T5330] workqueue: cannot queue hci_rx_work on wq hci0 [ 84.676258][ T5330] WARNING: kernel/workqueue.c:2298 at __queue_work+0xd3f/0x1040, CPU#0: syz.0.0/5330 [ 84.680198][ T5330] Modules linked in: [ 84.681936][ T5330] CPU: 0 UID: 0 PID: 5330 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 84.685597][ T5330] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 84.689888][ T5330] RIP: 0010:__queue_work+0xd67/0x1040 [ 84.692016][ T5330] Code: a6 0e 49 8d 7d 18 48 89 f8 48 c1 e8 03 42 80 3c 20 00 74 05 e8 ba 5d a5 00 49 8b 75 18 49 81 c7 70 01 00 00 4c 89 f7 4c 89 fa <67> 48 0f b9 3a 4c 89 e8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ef [ 84.699874][ T5330] RSP: 0018:ffffc9000e6cfb08 EFLAGS: 00010082 [ 84.702384][ T5330] RAX: 1ffff11008513978 RBX: 0000000000000008 RCX: 0000000000100000 [ 84.705693][ T5330] RDX: ffff88804281a170 RSI: ffffffff8a9df000 RDI: ffffffff9033e550 [ 84.709013][ T5330] RBP: 0000000000000000 R08: ffff88804289cbaf R09: 1ffff11008513975 [ 84.712462][ T5330] R10: dffffc0000000000 R11: ffffed1008513976 R12: dffffc0000000000 [ 84.716003][ T5330] R13: ffff88804289cba8 R14: ffffffff9033e550 R15: ffff88804281a170 [ 84.719303][ T5330] FS: 00007f78f87c46c0(0000) GS:ffff88808c87f000(0000) knlGS:0000000000000000 [ 84.723183][ T5330] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 84.725961][ T5330] CR2: 00007fc6f19909c0 CR3: 00000000370ad000 CR4: 0000000000352ef0 [ 84.729347][ T5330] Call Trace: [ 84.730800][ T5330] [ 84.732100][ T5330] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 84.734295][ T5330] ? rcu_is_watching+0x15/0xb0 [ 84.736312][ T5330] queue_work_on+0x106/0x1d0 [ 84.738328][ T5330] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 84.740748][ T5330] hci_recv_frame+0x625/0x7c0 [ 84.742842][ T5330] ? skb_pull+0xc1/0x1d0 [ 84.744653][ T5330] vhci_write+0x358/0x4a0 [ 84.746602][ T5330] vfs_write+0x61d/0xb90 [ 84.748393][ T5330] ? __pfx_vfs_write+0x10/0x10 [ 84.750668][ T5330] ? __fget_files+0x2a/0x420 [ 84.752689][ T5330] ksys_write+0x150/0x270 [ 84.754467][ T5330] ? __pfx_ksys_write+0x10/0x10 [ 84.756531][ T5330] ? __pfx_kcov_ioctl+0x10/0x10 [ 84.758771][ T5330] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.761345][ T5330] do_syscall_64+0x15f/0xf80 [ 84.763354][ T5330] ? trace_irq_disable+0x3b/0x140 [ 84.765603][ T5330] ? clear_bhb_loop+0x40/0x90 [ 84.767493][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.770491][ T5330] RIP: 0033:0x7f78f795d68e [ 84.772592][ T5330] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 84.780774][ T5330] RSP: 002b:00007f78f87c3f78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 84.784154][ T5330] RAX: ffffffffffffffda RBX: 00007f78f87c46c0 RCX: 00007f78f795d68e [ 84.787529][ T5330] RDX: 0000000000000007 RSI: 0000200000000300 RDI: 00000000000000ca [ 84.790824][ T5330] RBP: 00007f78f7a32d6f R08: 0000000000000000 R09: 0000000000000000 [ 84.794247][ T5330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 84.798723][ T5330] R13: 00007f78f7c16128 R14: 00007f78f7c16090 R15: 00007ffde1c45b28 [ 84.802247][ T5330] [ 84.803632][ T5330] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 84.806584][ T5330] CPU: 0 UID: 0 PID: 5330 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 84.810437][ T5330] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 84.814686][ T5330] Call Trace: [ 84.816113][ T5330] [ 84.817360][ T5330] vpanic+0x56c/0xa60 [ 84.819035][ T5330] ? __pfx__printk+0x10/0x10 [ 84.820966][ T5330] ? __pfx_vpanic+0x10/0x10 [ 84.822995][ T5330] ? is_bpf_text_address+0x292/0x2b0 [ 84.825273][ T5330] ? is_bpf_text_address+0x26/0x2b0 [ 84.827461][ T5330] panic+0xc5/0xd0 [ 84.829033][ T5330] ? __pfx_panic+0x10/0x10 [ 84.830890][ T5330] __warn+0x315/0x4c0 [ 84.832522][ T5330] ? __queue_work+0xd3f/0x1040 [ 84.834541][ T5330] ? __queue_work+0xd3f/0x1040 [ 84.836577][ T5330] __report_bug+0x29a/0x540 [ 84.838545][ T5330] ? __pfx_stack_trace_save+0x10/0x10 [ 84.840798][ T5330] ? __queue_work+0xd3f/0x1040 [ 84.842831][ T5330] ? __pfx___report_bug+0x10/0x10 [ 84.844975][ T5330] ? __pfx_hci_rx_work+0x10/0x10 [ 84.847226][ T5330] ? __alloc_skb+0x27d/0x7d0 [ 84.849230][ T5330] ? vhci_write+0xbe/0x4a0 [ 84.851118][ T5330] ? vfs_write+0x61d/0xb90 [ 84.853085][ T5330] ? ksys_write+0x150/0x270 [ 84.855116][ T5330] ? do_syscall_64+0x15f/0xf80 [ 84.857186][ T5330] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.859780][ T5330] report_bug_entry+0x19a/0x290 [ 84.861857][ T5330] ? __queue_work+0xd67/0x1040 [ 84.863823][ T5330] ? __queue_work+0xd6c/0x1040 [ 84.865926][ T5330] handle_bug+0xce/0x200 [ 84.867822][ T5330] exc_invalid_op+0x1a/0x50 [ 84.869785][ T5330] asm_exc_invalid_op+0x1a/0x20 [ 84.871828][ T5330] RIP: 0010:__queue_work+0xd67/0x1040 [ 84.874104][ T5330] Code: a6 0e 49 8d 7d 18 48 89 f8 48 c1 e8 03 42 80 3c 20 00 74 05 e8 ba 5d a5 00 49 8b 75 18 49 81 c7 70 01 00 00 4c 89 f7 4c 89 fa <67> 48 0f b9 3a 4c 89 e8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ef [ 84.882122][ T5330] RSP: 0018:ffffc9000e6cfb08 EFLAGS: 00010082 [ 84.884746][ T5330] RAX: 1ffff11008513978 RBX: 0000000000000008 RCX: 0000000000100000 [ 84.888211][ T5330] RDX: ffff88804281a170 RSI: ffffffff8a9df000 RDI: ffffffff9033e550 [ 84.891402][ T5330] RBP: 0000000000000000 R08: ffff88804289cbaf R09: 1ffff11008513975 [ 84.894977][ T5330] R10: dffffc0000000000 R11: ffffed1008513976 R12: dffffc0000000000 [ 84.898792][ T5330] R13: ffff88804289cba8 R14: ffffffff9033e550 R15: ffff88804281a170 [ 84.901960][ T5330] ? __pfx_hci_rx_work+0x10/0x10 [ 84.903925][ T5330] ? __queue_work+0xd2c/0x1040 [ 84.905833][ T5330] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 84.907905][ T5330] ? rcu_is_watching+0x15/0xb0 [ 84.909903][ T5330] queue_work_on+0x106/0x1d0 [ 84.911800][ T5330] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 84.914221][ T5330] hci_recv_frame+0x625/0x7c0 [ 84.916431][ T5330] ? skb_pull+0xc1/0x1d0 [ 84.918367][ T5330] vhci_write+0x358/0x4a0 [ 84.920272][ T5330] vfs_write+0x61d/0xb90 [ 84.922064][ T5330] ? __pfx_vfs_write+0x10/0x10 [ 84.924093][ T5330] ? __fget_files+0x2a/0x420 [ 84.926101][ T5330] ksys_write+0x150/0x270 [ 84.928086][ T5330] ? __pfx_ksys_write+0x10/0x10 [ 84.930269][ T5330] ? __pfx_kcov_ioctl+0x10/0x10 [ 84.932205][ T5330] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.934871][ T5330] do_syscall_64+0x15f/0xf80 [ 84.936871][ T5330] ? trace_irq_disable+0x3b/0x140 [ 84.938972][ T5330] ? clear_bhb_loop+0x40/0x90 [ 84.940871][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.943191][ T5330] RIP: 0033:0x7f78f795d68e [ 84.944879][ T5330] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 84.953036][ T5330] RSP: 002b:00007f78f87c3f78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 84.956392][ T5330] RAX: ffffffffffffffda RBX: 00007f78f87c46c0 RCX: 00007f78f795d68e [ 84.959723][ T5330] RDX: 0000000000000007 RSI: 0000200000000300 RDI: 00000000000000ca [ 84.962952][ T5330] RBP: 00007f78f7a32d6f R08: 0000000000000000 R09: 0000000000000000 [ 84.966091][ T5330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 84.969152][ T5330] R13: 00007f78f7c16128 R14: 00007f78f7c16090 R15: 00007ffde1c45b28 [ 84.972463][ T5330] [ 84.974211][ T5330] Kernel Offset: disabled [ 84.976000][ T5330] Rebooting in 86400 seconds..