program:
sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, 0x0, 0x0) (async)
r0 = userfaultfd(0x80001) (async)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0)
write$binfmt_script(r1, &(0x7f0000000500)={'#! ', './file0'}, 0xb) (async, rerun: 32)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x28011, r1, 0x0) (async, rerun: 32)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000540)={0xaa, 0x310}) (async, rerun: 64)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000000000/0x400000)=nil, 0x400000}, 0x1}) (async, rerun: 64)
ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000000)={{&(0x7f0000001000/0x1000)=nil, 0x1000}}) (async)
syz_emit_vhci(0x0, 0xe)
syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000300)=ANY=[@ANYBLOB="1201010200000040"], 0x0) (async)
syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e1f0a"], 0x22) (async)
syz_emit_vhci(&(0x7f0000000300)=ANY=[@ANYBLOB="040b"], 0xe) (async)
syz_emit_vhci(&(0x7f0000000080)=ANY=[@ANYBLOB="0406"], 0x7)
[ 95.096131][ T5281] Bluetooth: hci0: command tx timeout
[ 95.351396][ T5281] Bluetooth: hci0: unexpected event 0x06 length: 4 > 3
[ 95.606391][ T5305] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 95.736216][ T5305] usb 5-1: device descriptor read/64, error -71
[ 95.975939][ T5305] usb 5-1: new high-speed USB device number 3 using dummy_hcd
[ 96.106178][ T5305] usb 5-1: device descriptor read/64, error -71
[ 96.216240][ T5305] usb usb5-port1: attempt power cycle
[ 96.556005][ T5305] usb 5-1: new high-speed USB device number 4 using dummy_hcd
[ 96.576725][ T5305] usb 5-1: device descriptor read/8, error -71
[ 96.815934][ T5305] usb 5-1: new high-speed USB device number 5 using dummy_hcd
[ 96.836506][ T5305] usb 5-1: device descriptor read/8, error -71
[ 96.947115][ T5305] usb usb5-port1: unable to enumerate USB device
[ 97.126333][ T5281] Bluetooth: hci0: command tx timeout
[ 97.368141][ T4645] ------------[ cut here ]------------
[ 97.368154][ T4645] refcnt < 0
[ 97.368176][ T4645] WARNING: net/bluetooth/hci_conn.c:641 at hci_conn_timeout+0xff/0x2c0, CPU#0: kworker/u5:1/4645
[ 97.376962][ T4645] Modules linked in:
[ 97.378611][ T4645] CPU: 0 UID: 0 PID: 4645 Comm: kworker/u5:1 Not tainted syzkaller #0 PREEMPT(full)
[ 97.382361][ T4645] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 97.386513][ T4645] Workqueue: hci0 hci_conn_timeout
[ 97.393007][ T4645] RIP: 0010:hci_conn_timeout+0xff/0x2c0
[ 97.395425][ T4645] Code: 48 89 df e8 a3 f7 09 00 eb 07 e8 9c e3 ec f6 b0 13 0f b6 f0 48 89 df 5b 41 5c 41 5e 41 5f 5d e9 d7 9e fe ff e8 82 e3 ec f6 90 <0f> 0b 90 eb 8c 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 31 ff ff ff
[ 97.403515][ T4645] RSP: 0018:ffffc9000f537ab0 EFLAGS: 00010293
[ 97.407045][ T4645] RAX: ffffffff8adb18be RBX: ffff888034584000 RCX: ffff88801fb84b00
[ 97.410294][ T4645] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000
[ 97.413532][ T4645] RBP: 00000000ffffffff R08: ffff888034584013 R09: 1ffff110068b0802
[ 97.417074][ T4645] R10: dffffc0000000000 R11: ffffed10068b0803 R12: dffffc0000000000
[ 97.420385][ T4645] R13: ffffffff818fa5fa R14: ffff888034584a50 R15: ffff888034584010
[ 97.423505][ T4645] FS: 0000000000000000(0000) GS:ffff88808c2bc000(0000) knlGS:0000000000000000
[ 97.427005][ T4645] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 97.429620][ T4645] CR2: 00007f665ee49fe8 CR3: 000000001fc4b000 CR4: 0000000000352ef0
[ 97.432765][ T4645] Call Trace:
[ 97.434056][ T4645]
[ 97.435205][ T4645] process_scheduled_works+0xc3d/0x1630
[ 97.437579][ T4645] ? __pfx_process_scheduled_works+0x10/0x10
[ 97.439952][ T4645] ? assign_work+0x3cf/0x5d0
[ 97.441855][ T4645] worker_thread+0xa47/0xfb0
[ 97.443977][ T4645] ? __kthread_parkme+0x71/0x1f0
[ 97.448625][ T4645] kthread+0x38b/0x480
[ 97.450366][ T4645] ? __pfx_worker_thread+0x10/0x10
[ 97.452495][ T4645] ? __pfx_kthread+0x10/0x10
[ 97.454562][ T4645] ret_from_fork+0x514/0xb70
[ 97.465016][ T4645] ? __pfx_ret_from_fork+0x10/0x10
[ 97.467044][ T4645] ? __switch_to+0xc89/0x1420
[ 97.469011][ T4645] ? __pfx_kthread+0x10/0x10
[ 97.471112][ T4645] ret_from_fork_asm+0x1a/0x30
[ 97.474256][ T4645]
[ 97.475568][ T4645] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 97.481314][ T4645] CPU: 0 UID: 0 PID: 4645 Comm: kworker/u5:1 Not tainted syzkaller #0 PREEMPT(full)
[ 97.485285][ T4645] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 97.489145][ T4645] Workqueue: hci0 hci_conn_timeout
[ 97.491035][ T4645] Call Trace:
[ 97.492318][ T4645]
[ 97.493536][ T4645] vpanic+0x56d/0xa60
[ 97.495141][ T4645] ? __pfx__printk+0x10/0x10
[ 97.496924][ T4645] ? __pfx_vpanic+0x10/0x10
[ 97.498684][ T4645] ? is_bpf_text_address+0x292/0x2b0
[ 97.500761][ T4645] ? is_bpf_text_address+0x26/0x2b0
[ 97.502665][ T4645] panic+0xc5/0xd0
[ 97.504070][ T4645] ? __pfx_panic+0x10/0x10
[ 97.505792][ T4645] ? ret_from_fork_asm+0x1a/0x30
[ 97.507663][ T4645] __warn+0x315/0x4c0
[ 97.509224][ T4645] ? hci_conn_timeout+0xff/0x2c0
[ 97.511249][ T4645] ? hci_conn_timeout+0xff/0x2c0
[ 97.513233][ T4645] __report_bug+0x276/0x570
[ 97.515141][ T4645] ? hci_conn_timeout+0xff/0x2c0
[ 97.517190][ T4645] ? __pfx___report_bug+0x10/0x10
[ 97.519264][ T4645] ? add_lock_to_list+0xc7/0x100
[ 97.521449][ T4645] ? lockdep_unlock+0x5c/0xd0
[ 97.523464][ T4645] ? __lock_acquire+0x1511/0x2de0
[ 97.525638][ T4645] ? hci_conn_timeout+0xff/0x2c0
[ 97.527841][ T4645] report_bug+0x16b/0x220
[ 97.529822][ T4645] ? hci_conn_timeout+0xff/0x2c0
[ 97.531954][ T4645] ? hci_conn_timeout+0x101/0x2c0
[ 97.533916][ T4645] handle_bug+0x9c/0x200
[ 97.535708][ T4645] exc_invalid_op+0x1a/0x50
[ 97.537790][ T4645] asm_exc_invalid_op+0x1a/0x20
[ 97.539854][ T4645] RIP: 0010:hci_conn_timeout+0xff/0x2c0
[ 97.542152][ T4645] Code: 48 89 df e8 a3 f7 09 00 eb 07 e8 9c e3 ec f6 b0 13 0f b6 f0 48 89 df 5b 41 5c 41 5e 41 5f 5d e9 d7 9e fe ff e8 82 e3 ec f6 90 <0f> 0b 90 eb 8c 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 31 ff ff ff
[ 97.550242][ T4645] RSP: 0018:ffffc9000f537ab0 EFLAGS: 00010293
[ 97.552759][ T4645] RAX: ffffffff8adb18be RBX: ffff888034584000 RCX: ffff88801fb84b00
[ 97.556043][ T4645] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000
[ 97.559399][ T4645] RBP: 00000000ffffffff R08: ffff888034584013 R09: 1ffff110068b0802
[ 97.562771][ T4645] R10: dffffc0000000000 R11: ffffed10068b0803 R12: dffffc0000000000
[ 97.565841][ T4645] R13: ffffffff818fa5fa R14: ffff888034584a50 R15: ffff888034584010
[ 97.569213][ T4645] ? process_scheduled_works+0x97a/0x1630
[ 97.571512][ T4645] ? hci_conn_timeout+0xfe/0x2c0
[ 97.573524][ T4645] process_scheduled_works+0xc3d/0x1630
[ 97.575854][ T4645] ? __pfx_process_scheduled_works+0x10/0x10
[ 97.578458][ T4645] ? assign_work+0x3cf/0x5d0
[ 97.580261][ T4645] worker_thread+0xa47/0xfb0
[ 97.582061][ T4645] ? __kthread_parkme+0x71/0x1f0
[ 97.583968][ T4645] kthread+0x38b/0x480
[ 97.585633][ T4645] ? __pfx_worker_thread+0x10/0x10
[ 97.587769][ T4645] ? __pfx_kthread+0x10/0x10
[ 97.589744][ T4645] ret_from_fork+0x514/0xb70
[ 97.591624][ T4645] ? __pfx_ret_from_fork+0x10/0x10
[ 97.593838][ T4645] ? __switch_to+0xc89/0x1420
[ 97.595696][ T4645] ? __pfx_kthread+0x10/0x10
[ 97.597739][ T4645] ret_from_fork_asm+0x1a/0x30
[ 97.599787][ T4645]
[ 97.601575][ T4645] Kernel Offset: disabled
[ 97.603505][ T4645] Rebooting in 86400 seconds..