program:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
prctl$PR_GET_TID_ADDRESS(0x28, &(0x7f00000000c0))
bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e22, @empty}, 0x67)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001c40)={0x0, 0x3, &(0x7f0000001300)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000001200)='syzkaller\x00'}, 0x94)
r2 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
socket(0x10, 0x3, 0x0)
socket(0x22, 0x2, 0x4)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045)
r4 = io_uring_setup(0x1b78, &(0x7f0000000040)={0x0, 0xca72, 0x8000, 0x0, 0x20002fb})
write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x2, 0x9}}, 0x20)
r5 = socket$inet(0x2, 0x80001, 0x84)
getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8)
fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffffb)
io_uring_enter(r4, 0x2219, 0x7721, 0x16, 0x0, 0x0)
ioctl$sock_bt_hci(r3, 0x400448cb, 0x0)
syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043e1f1b"], 0x22)
syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e0402030c"], 0x7)
r6 = socket$isdn_base(0x22, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000001c0)={'macvtap0\x00'})
openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x900, 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0)
r7 = fsmount(r2, 0x0, 0x0)
r8 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt(r8, 0x84, 0x7f, &(0x7f0000000040)="0100000009800000", 0x8)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000200)={r1, r7, 0x1, 0x0, @void}, 0x10)
setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10)
chdir(&(0x7f0000000180)='./file0\x00')
syz_emit_ethernet(0xba, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000088ca0dccbee7f9997e015c8dd9ab4334bed61bc668c29cf7cfc5b4dde74f94301753753a6d075db7c4437d6fbd6dd46daaa88ac7d60d1ec9b9d1f8bdb35b9a77957c77b5d4f72c544ae724c22f9ad007051425bd672facbb5e58c3bf38f088595800d5901e8de88696466796e2ea1c7cba35487bd21f9b1a124de3150dc3a53defb0e94bfaae932e2d86bdbe4108624920ecbee8890e5fedf627f6fd680fdaf50352fb3e800f738ba8eedb5f013c"], 0x0)
[ 101.622901][ T5307] Bluetooth: hci0: command tx timeout
[ 101.638133][ T5328] ------------[ cut here ]------------
[ 101.641390][ T5328] workqueue: cannot queue hci_rx_work on wq hci0
[ 101.644746][ T5328] WARNING: kernel/workqueue.c:2271 at __queue_work+0xd53/0x1020, CPU#0: syz.0.0/5328
[ 101.648708][ T5328] Modules linked in:
[ 101.650352][ T5328] CPU: 0 UID: 0 PID: 5328 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 101.654300][ T5328] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 101.658876][ T5328] RIP: 0010:__queue_work+0xd7e/0x1020
[ 101.661707][ T5328] Code: 83 c5 18 4c 89 e8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ef e8 b3 1e a4 00 49 8b 75 00 49 81 c7 78 01 00 00 4c 89 f7 4c 89 fa <67> 48 0f b9 3a 48 83 c4 58 5b 41 5c 41 5d 41 5e 41 5f 5d e9 5a 36
[ 101.670403][ T5328] RSP: 0018:ffffc9000efffb20 EFLAGS: 00010086
[ 101.673244][ T5328] RAX: 1ffff1100240017b RBX: 0000000000000008 RCX: 0000000000100000
[ 101.677595][ T5328] RDX: ffff888040d33178 RSI: ffffffff8aa17b60 RDI: ffffffff9014c300
[ 101.681559][ T5328] RBP: 0000000000000000 R08: ffff888012000bc7 R09: 1ffff11002400178
[ 101.685163][ T5328] R10: dffffc0000000000 R11: ffffed1002400179 R12: dffffc0000000000
[ 101.688852][ T5328] R13: ffff888012000bd8 R14: ffffffff9014c300 R15: ffff888040d33178
[ 101.692445][ T5328] FS: 00007f3e118fb6c0(0000) GS:ffff88808ca51000(0000) knlGS:0000000000000000
[ 101.697735][ T5328] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 101.700783][ T5328] CR2: 00007f3e11925140 CR3: 0000000043b6a000 CR4: 0000000000352ef0
[ 101.704179][ T5328] Call Trace:
[ 101.705708][ T5328]
[ 101.707048][ T5328] ? rcu_is_watching+0x15/0xb0
[ 101.709359][ T5328] queue_work_on+0x106/0x1d0
[ 101.711544][ T5328] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 101.714405][ T5328] hci_recv_frame+0x625/0x7c0
[ 101.716713][ T5328] ? skb_pull+0xc1/0x1d0
[ 101.718654][ T5328] vhci_write+0x358/0x4a0
[ 101.720573][ T5328] vfs_write+0x61d/0xb90
[ 101.722489][ T5328] ? __pfx_vfs_write+0x10/0x10
[ 101.724685][ T5328] ? __fget_files+0x2a/0x420
[ 101.727372][ T5328] ksys_write+0x150/0x270
[ 101.730318][ T5328] ? __pfx_ksys_write+0x10/0x10
[ 101.732966][ T5328] ? __pfx_kcov_ioctl+0x10/0x10
[ 101.735039][ T5328] do_syscall_64+0x14d/0xf80
[ 101.737057][ T5328] ? trace_irq_disable+0x3b/0x150
[ 101.739300][ T5328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 101.741973][ T5328] ? clear_bhb_loop+0x40/0x90
[ 101.744095][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 101.746748][ T5328] RIP: 0033:0x7f3e1095cfce
[ 101.748859][ T5328] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[ 101.758195][ T5328] RSP: 002b:00007f3e118faf78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 101.761842][ T5328] RAX: ffffffffffffffda RBX: 00007f3e118fb6c0 RCX: 00007f3e1095cfce
[ 101.765803][ T5328] RDX: 0000000000000022 RSI: 0000200000000040 RDI: 00000000000000ca
[ 101.769555][ T5328] RBP: 00007f3e10a32c99 R08: 0000000000000000 R09: 0000000000000000
[ 101.773003][ T5328] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 101.776486][ T5328] R13: 00007f3e10c16128 R14: 00007f3e10c16090 R15: 00007ffc27a1aeb8
[ 101.780507][ T5328]
[ 101.782148][ T5328] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 101.785459][ T5328] CPU: 0 UID: 0 PID: 5328 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 101.789507][ T5328] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 101.794089][ T5328] Call Trace:
[ 101.795642][ T5328]
[ 101.797089][ T5328] vpanic+0x56c/0xa60
[ 101.799256][ T5328] ? __pfx__printk+0x10/0x10
[ 101.801681][ T5328] ? __pfx_vpanic+0x10/0x10
[ 101.803907][ T5328] ? is_bpf_text_address+0x292/0x2b0
[ 101.806251][ T5328] ? is_bpf_text_address+0x26/0x2b0
[ 101.808612][ T5328] panic+0xc5/0xd0
[ 101.810435][ T5328] ? __pfx_panic+0x10/0x10
[ 101.813247][ T5328] __warn+0x315/0x4f0
[ 101.815458][ T5328] ? __queue_work+0xd53/0x1020
[ 101.817770][ T5328] ? __queue_work+0xd53/0x1020
[ 101.819866][ T5328] __report_bug+0x29a/0x540
[ 101.821877][ T5328] ? __queue_work+0xd53/0x1020
[ 101.824110][ T5328] ? __pfx___report_bug+0x10/0x10
[ 101.826696][ T5328] ? __pfx_hci_rx_work+0x10/0x10
[ 101.829374][ T5328] ? do_syscall_64+0x14d/0xf80
[ 101.831743][ T5328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 101.834527][ T5328] report_bug_entry+0x19a/0x290
[ 101.836852][ T5328] ? __queue_work+0xd7e/0x1020
[ 101.838985][ T5328] ? __queue_work+0xd83/0x1020
[ 101.841477][ T5328] handle_bug+0xce/0x200
[ 101.843918][ T5328] exc_invalid_op+0x1a/0x50
[ 101.846093][ T5328] asm_exc_invalid_op+0x1a/0x20
[ 101.848172][ T5328] RIP: 0010:__queue_work+0xd7e/0x1020
[ 101.850687][ T5328] Code: 83 c5 18 4c 89 e8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ef e8 b3 1e a4 00 49 8b 75 00 49 81 c7 78 01 00 00 4c 89 f7 4c 89 fa <67> 48 0f b9 3a 48 83 c4 58 5b 41 5c 41 5d 41 5e 41 5f 5d e9 5a 36
[ 101.859493][ T5328] RSP: 0018:ffffc9000efffb20 EFLAGS: 00010086
[ 101.862042][ T5328] RAX: 1ffff1100240017b RBX: 0000000000000008 RCX: 0000000000100000
[ 101.865325][ T5328] RDX: ffff888040d33178 RSI: ffffffff8aa17b60 RDI: ffffffff9014c300
[ 101.868818][ T5328] RBP: 0000000000000000 R08: ffff888012000bc7 R09: 1ffff11002400178
[ 101.872679][ T5328] R10: dffffc0000000000 R11: ffffed1002400179 R12: dffffc0000000000
[ 101.877576][ T5328] R13: ffff888012000bd8 R14: ffffffff9014c300 R15: ffff888040d33178
[ 101.881066][ T5328] ? __pfx_hci_rx_work+0x10/0x10
[ 101.883269][ T5328] ? rcu_is_watching+0x15/0xb0
[ 101.885315][ T5328] queue_work_on+0x106/0x1d0
[ 101.887626][ T5328] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 101.891073][ T5328] hci_recv_frame+0x625/0x7c0
[ 101.893470][ T5328] ? skb_pull+0xc1/0x1d0
[ 101.895488][ T5328] vhci_write+0x358/0x4a0
[ 101.897375][ T5328] vfs_write+0x61d/0xb90
[ 101.899338][ T5328] ? __pfx_vfs_write+0x10/0x10
[ 101.901511][ T5328] ? __fget_files+0x2a/0x420
[ 101.903914][ T5328] ksys_write+0x150/0x270
[ 101.906334][ T5328] ? __pfx_ksys_write+0x10/0x10
[ 101.909133][ T5328] ? __pfx_kcov_ioctl+0x10/0x10
[ 101.911211][ T5328] do_syscall_64+0x14d/0xf80
[ 101.913129][ T5328] ? trace_irq_disable+0x3b/0x150
[ 101.915372][ T5328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 101.917949][ T5328] ? clear_bhb_loop+0x40/0x90
[ 101.919882][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 101.922830][ T5328] RIP: 0033:0x7f3e1095cfce
[ 101.925299][ T5328] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[ 101.934452][ T5328] RSP: 002b:00007f3e118faf78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 101.938084][ T5328] RAX: ffffffffffffffda RBX: 00007f3e118fb6c0 RCX: 00007f3e1095cfce
[ 101.942663][ T5328] RDX: 0000000000000022 RSI: 0000200000000040 RDI: 00000000000000ca
[ 101.947283][ T5328] RBP: 00007f3e10a32c99 R08: 0000000000000000 R09: 0000000000000000
[ 101.950580][ T5328] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 101.953874][ T5328] R13: 00007f3e10c16128 R14: 00007f3e10c16090 R15: 00007ffc27a1aeb8
[ 101.957475][ T5328]
[ 101.959263][ T5328] Kernel Offset: disabled
[ 101.961333][ T5328] Rebooting in 86400 seconds..