program:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_bt_hci(r0, 0x400448cb, 0x0) (async)
syz_emit_vhci(&(0x7f0000000300)=ANY=[@ANYBLOB="040e0402030c02"], 0x7) (async)
syz_open_dev$ttys(0xc, 0x2, 0x0)
[ 85.972499][ T5301] Bluetooth: hci0: command tx timeout
[ 86.120712][ T5326] ------------[ cut here ]------------
[ 86.123253][ T5326] workqueue: cannot queue hci_rx_work on wq hci0
[ 86.126388][ T5326] WARNING: kernel/workqueue.c:2271 at __queue_work+0xd53/0x1020, CPU#0: syz.0.0/5326
[ 86.130772][ T5326] Modules linked in:
[ 86.132564][ T5326] CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 86.136754][ T5326] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 86.141417][ T5326] RIP: 0010:__queue_work+0xd7e/0x1020
[ 86.144023][ T5326] Code: 83 c5 18 4c 89 e8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ef e8 e3 f1 a3 00 49 8b 75 00 49 81 c7 78 01 00 00 4c 89 f7 4c 89 fa <67> 48 0f b9 3a 48 83 c4 58 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc
[ 86.152381][ T5326] RSP: 0018:ffffc9000e387b20 EFLAGS: 00010086
[ 86.155064][ T5326] RAX: 1ffff1100737c17b RBX: 0000000000000008 RCX: ffff88804084c900
[ 86.159963][ T5326] RDX: ffff88804321a978 RSI: ffffffff8aa03410 RDI: ffffffff9014a490
[ 86.163786][ T5326] RBP: 0000000000000000 R08: ffff888039be0bc7 R09: 1ffff1100737c178
[ 86.166972][ T5326] R10: dffffc0000000000 R11: ffffed100737c179 R12: dffffc0000000000
[ 86.169937][ T5326] R13: ffff888039be0bd8 R14: ffffffff9014a490 R15: ffff88804321a978
[ 86.173015][ T5326] FS: 00007f4a6307c6c0(0000) GS:ffff88808ca59000(0000) knlGS:0000000000000000
[ 86.176353][ T5326] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 86.179020][ T5326] CR2: 00007f4a6307bff0 CR3: 0000000011d91000 CR4: 0000000000352ef0
[ 86.182538][ T5326] Call Trace:
[ 86.184208][ T5326]
[ 86.185559][ T5326] ? rcu_is_watching+0x15/0xb0
[ 86.187845][ T5326] queue_work_on+0x106/0x1d0
[ 86.189908][ T5326] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 86.192555][ T5326] hci_recv_frame+0x625/0x7c0
[ 86.195227][ T5326] ? skb_pull+0xc1/0x1d0
[ 86.197100][ T5326] vhci_write+0x358/0x4a0
[ 86.199074][ T5326] vfs_write+0x61d/0xb90
[ 86.201057][ T5326] ? __pfx_vfs_write+0x10/0x10
[ 86.203245][ T5326] ? __fget_files+0x2a/0x420
[ 86.205356][ T5326] ksys_write+0x150/0x270
[ 86.207298][ T5326] ? __pfx_ksys_write+0x10/0x10
[ 86.209457][ T5326] do_syscall_64+0x14d/0xf80
[ 86.211590][ T5326] ? trace_irq_disable+0x3b/0x150
[ 86.213971][ T5326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.216627][ T5326] ? clear_bhb_loop+0x40/0x90
[ 86.218741][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.222021][ T5326] RIP: 0033:0x7f4a6215cfce
[ 86.224187][ T5326] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[ 86.233206][ T5326] RSP: 002b:00007f4a6307bfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 86.237170][ T5326] RAX: ffffffffffffffda RBX: 00007f4a6307c6c0 RCX: 00007f4a6215cfce
[ 86.240586][ T5326] RDX: 0000000000000007 RSI: 0000200000000300 RDI: 00000000000000ca
[ 86.243873][ T5326] RBP: 00007f4a62232bd9 R08: 0000000000000000 R09: 0000000000000000
[ 86.247178][ T5326] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 86.250572][ T5326] R13: 00007f4a62416128 R14: 00007f4a62416090 R15: 00007ffff40acb58
[ 86.253901][ T5326]
[ 86.255392][ T5326] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 86.258593][ T5326] CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 86.262332][ T5326] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 86.266611][ T5326] Call Trace:
[ 86.268124][ T5326]
[ 86.269254][ T5326] vpanic+0x56c/0xa60
[ 86.271073][ T5326] ? __pfx__printk+0x10/0x10
[ 86.273042][ T5326] ? __pfx_vpanic+0x10/0x10
[ 86.275081][ T5326] ? is_bpf_text_address+0x292/0x2b0
[ 86.277431][ T5326] ? is_bpf_text_address+0x26/0x2b0
[ 86.279468][ T5326] panic+0xc5/0xd0
[ 86.281161][ T5326] ? __pfx_panic+0x10/0x10
[ 86.283231][ T5326] __warn+0x315/0x4f0
[ 86.284989][ T5326] ? __queue_work+0xd53/0x1020
[ 86.287137][ T5326] ? __queue_work+0xd53/0x1020
[ 86.289209][ T5326] __report_bug+0x29a/0x540
[ 86.291470][ T5326] ? __queue_work+0xd53/0x1020
[ 86.293593][ T5326] ? __pfx___report_bug+0x10/0x10
[ 86.295857][ T5326] ? __pfx_hci_rx_work+0x10/0x10
[ 86.298056][ T5326] ? do_syscall_64+0x14d/0xf80
[ 86.300279][ T5326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.302925][ T5326] report_bug_entry+0x19a/0x290
[ 86.304870][ T5326] ? __queue_work+0xd7e/0x1020
[ 86.306735][ T5326] ? __queue_work+0xd83/0x1020
[ 86.308620][ T5326] handle_bug+0xca/0x200
[ 86.310599][ T5326] exc_invalid_op+0x1a/0x50
[ 86.312586][ T5326] asm_exc_invalid_op+0x1a/0x20
[ 86.314740][ T5326] RIP: 0010:__queue_work+0xd7e/0x1020
[ 86.317077][ T5326] Code: 83 c5 18 4c 89 e8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ef e8 e3 f1 a3 00 49 8b 75 00 49 81 c7 78 01 00 00 4c 89 f7 4c 89 fa <67> 48 0f b9 3a 48 83 c4 58 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc
[ 86.324316][ T5326] RSP: 0018:ffffc9000e387b20 EFLAGS: 00010086
[ 86.327153][ T5326] RAX: 1ffff1100737c17b RBX: 0000000000000008 RCX: ffff88804084c900
[ 86.330657][ T5326] RDX: ffff88804321a978 RSI: ffffffff8aa03410 RDI: ffffffff9014a490
[ 86.334105][ T5326] RBP: 0000000000000000 R08: ffff888039be0bc7 R09: 1ffff1100737c178
[ 86.337329][ T5326] R10: dffffc0000000000 R11: ffffed100737c179 R12: dffffc0000000000
[ 86.340614][ T5326] R13: ffff888039be0bd8 R14: ffffffff9014a490 R15: ffff88804321a978
[ 86.343906][ T5326] ? __pfx_hci_rx_work+0x10/0x10
[ 86.346090][ T5326] ? rcu_is_watching+0x15/0xb0
[ 86.348434][ T5326] queue_work_on+0x106/0x1d0
[ 86.350908][ T5326] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 86.353715][ T5326] hci_recv_frame+0x625/0x7c0
[ 86.355695][ T5326] ? skb_pull+0xc1/0x1d0
[ 86.357577][ T5326] vhci_write+0x358/0x4a0
[ 86.359884][ T5326] vfs_write+0x61d/0xb90
[ 86.361664][ T5326] ? __pfx_vfs_write+0x10/0x10
[ 86.363830][ T5326] ? __fget_files+0x2a/0x420
[ 86.365873][ T5326] ksys_write+0x150/0x270
[ 86.367810][ T5326] ? __pfx_ksys_write+0x10/0x10
[ 86.369893][ T5326] do_syscall_64+0x14d/0xf80
[ 86.371944][ T5326] ? trace_irq_disable+0x3b/0x150
[ 86.374205][ T5326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.376815][ T5326] ? clear_bhb_loop+0x40/0x90
[ 86.378910][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.381555][ T5326] RIP: 0033:0x7f4a6215cfce
[ 86.383478][ T5326] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[ 86.391854][ T5326] RSP: 002b:00007f4a6307bfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 86.395535][ T5326] RAX: ffffffffffffffda RBX: 00007f4a6307c6c0 RCX: 00007f4a6215cfce
[ 86.398895][ T5326] RDX: 0000000000000007 RSI: 0000200000000300 RDI: 00000000000000ca
[ 86.402335][ T5326] RBP: 00007f4a62232bd9 R08: 0000000000000000 R09: 0000000000000000
[ 86.405590][ T5326] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 86.409027][ T5326] R13: 00007f4a62416128 R14: 00007f4a62416090 R15: 00007ffff40acb58
[ 86.412383][ T5326]
[ 86.414108][ T5326] Kernel Offset: disabled
[ 86.416129][ T5326] Rebooting in 86400 seconds..