program:
ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_bt_hci(r0, 0x400448cb, 0x0)
syz_emit_vhci(&(0x7f0000000300)=ANY=[@ANYBLOB="040e0402030c02"], 0x7)
syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000280)='./bus\x00', 0x202ac1b, 0x0, 0x1, 0x0, &(0x7f00000007c0))
rename(0x0, 0x0)
syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_link_key_req={{0x17, 0x6}}}, 0x9)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
syz_mount_image$msdos(&(0x7f0000000000), &(0x7f00000000c0)='./file0\x00', 0x2000c8, &(0x7f00000005c0)=ANY=[@ANYBLOB='codepage=874,nodots,dots,tz=UTC,dots,nodots,codepage=862,dots,dots,check=strict,allow_utime=000000000000000000001,sys_immutable,nodots,nfs,quiet,dots,nodots,nodots,debug,usefree,tz=UTC,flush,nodots,\x00'], 0xfd, 0x1bf, &(0x7f0000000940)="$eJzs3TGL02AYB/Cn9bzmnG4TRCHg4nSon+BEThADgtJBJ4XT5SqCt0SX9mP4Af0A0qmLRGrSxkaHWmxS6++39En/edvnHZp26ZNXN99dnL+/fPvl+udIkl70T+M0Zr04jn4sTAIA2CezooivRanrXgCAdqzx/f+t5ZYAgC17/uLlkwdZdvYsTZOI6SQf5sPyscwfPc7O7qY/HNerpnk+vLLM76XN3w7z/Gpcq/L75fp0NT+MO7fLfJ49fJo18kGcb3frAAAAAAAAAAAAAAAAAAAAAADQmVuRLvx2vs/JSTM/qvLy6Kf5QI35PQdx46A6rMcDFeM2NgUAAAAAAAAAAAAAAAAAAAD/mMuPny5ej0ZvPtTFICJWn/mTole98IbL2y76sRNtKP5qke5GG6MNPwWHEbGtxmZFUax1cn2NGHR1cQIAAAAAAAAAAAAAAAAAgP9M/affX7Oki4YAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoAP1/f83KMYRscbJyzc76nSrAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7LHvAQAA///DgjXa")
[ 112.627955][ T5288] Bluetooth: hci0: command tx timeout
[ 112.837609][ T5326] ------------[ cut here ]------------
[ 112.839593][ T5326] workqueue: cannot queue hci_rx_work on wq hci0
[ 112.843370][ T5326] WARNING: kernel/workqueue.c:2298 at __queue_work+0xd1f/0xfc0, CPU#0: syz.0.0/5326
[ 112.847694][ T5326] Modules linked in:
[ 112.849254][ T5326] CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 112.852660][ T5326] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 112.856470][ T5326] RIP: 0010:__queue_work+0xd4a/0xfc0
[ 112.858506][ T5326] Code: 83 c5 18 4c 89 e8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ef e8 d7 53 a5 00 49 8b 75 00 49 81 c7 70 01 00 00 4c 89 f7 4c 89 fa <67> 48 0f b9 3a 48 83 c4 58 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc
[ 112.865939][ T5326] RSP: 0018:ffffc9000e32fb20 EFLAGS: 00010082
[ 112.868386][ T5326] RAX: 1ffff110025c9178 RBX: 0000000000000008 RCX: 0000000000100000
[ 112.871295][ T5326] RDX: ffff888041653970 RSI: ffffffff8a9d5690 RDI: ffffffff9033bcb0
[ 112.874313][ T5326] RBP: 0000000000000000 R08: ffff888012e48baf R09: 1ffff110025c9175
[ 112.877391][ T5326] R10: dffffc0000000000 R11: ffffed10025c9176 R12: dffffc0000000000
[ 112.880315][ T5326] R13: ffff888012e48bc0 R14: ffffffff9033bcb0 R15: ffff888041653970
[ 112.883313][ T5326] FS: 00007fb6e17d46c0(0000) GS:ffff88808c887000(0000) knlGS:0000000000000000
[ 112.886710][ T5326] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 112.889182][ T5326] CR2: 00007fff1b3ab910 CR3: 0000000012862000 CR4: 0000000000352ef0
[ 112.892260][ T5326] Call Trace:
[ 112.893510][ T5326]
[ 112.894701][ T5326] ? ktime_get_with_offset+0x93/0x2d0
[ 112.896805][ T5326] ? rcu_is_watching+0x15/0xb0
[ 112.898713][ T5326] queue_work_on+0x106/0x1d0
[ 112.900517][ T5326] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 112.902969][ T5326] hci_recv_frame+0x625/0x7c0
[ 112.904949][ T5326] ? skb_pull+0xc1/0x1d0
[ 112.906718][ T5326] vhci_write+0x358/0x4a0
[ 112.908395][ T5326] vfs_write+0x61d/0xb90
[ 112.910048][ T5326] ? __pfx_vfs_write+0x10/0x10
[ 112.911861][ T5326] ? __fget_files+0x2a/0x420
[ 112.913577][ T5326] ksys_write+0x150/0x270
[ 112.915246][ T5326] ? __pfx_ksys_write+0x10/0x10
[ 112.917119][ T5326] ? __pfx_kcov_ioctl+0x10/0x10
[ 112.919057][ T5326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 112.921395][ T5326] do_syscall_64+0x15f/0xf80
[ 112.923301][ T5326] ? trace_irq_disable+0x3b/0x140
[ 112.925394][ T5326] ? clear_bhb_loop+0x40/0x90
[ 112.927364][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 112.929923][ T5326] RIP: 0033:0x7fb6e535d60e
[ 112.931524][ T5326] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[ 112.937734][ T5326] RSP: 002b:00007fb6e17d3f78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 112.940940][ T5326] RAX: ffffffffffffffda RBX: 00007fb6e17d46c0 RCX: 00007fb6e535d60e
[ 112.944034][ T5326] RDX: 0000000000000007 RSI: 0000200000000300 RDI: 00000000000000ca
[ 112.947045][ T5326] RBP: 00007fb6e5432d69 R08: 0000000000000000 R09: 0000000000000000
[ 112.949898][ T5326] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 112.952798][ T5326] R13: 00007fb6e5616128 R14: 00007fb6e5616090 R15: 00007fff03f799f8
[ 112.955984][ T5326]
[ 112.957277][ T5326] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 112.960043][ T5326] CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 112.963494][ T5326] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 112.967385][ T5326] Call Trace:
[ 112.968692][ T5326]
[ 112.969812][ T5326] vpanic+0x56c/0xa60
[ 112.971320][ T5326] ? __pfx__printk+0x10/0x10
[ 112.973060][ T5326] ? __pfx_vpanic+0x10/0x10
[ 112.974770][ T5326] ? is_bpf_text_address+0x292/0x2b0
[ 112.976783][ T5326] ? is_bpf_text_address+0x26/0x2b0
[ 112.978851][ T5326] panic+0xc5/0xd0
[ 112.980306][ T5326] ? __pfx_panic+0x10/0x10
[ 112.982068][ T5326] __warn+0x315/0x4c0
[ 112.983635][ T5326] ? __queue_work+0xd1f/0xfc0
[ 112.985428][ T5326] ? __queue_work+0xd1f/0xfc0
[ 112.987151][ T5326] __report_bug+0x29a/0x540
[ 112.988851][ T5326] ? __queue_work+0xd1f/0xfc0
[ 112.990630][ T5326] ? __pfx___report_bug+0x10/0x10
[ 112.992491][ T5326] ? __pfx_hci_rx_work+0x10/0x10
[ 112.994372][ T5326] ? do_syscall_64+0x15f/0xf80
[ 112.996219][ T5326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 112.998491][ T5326] ? __lock_acquire+0x6b5/0x2cf0
[ 113.000292][ T5326] report_bug_entry+0x19a/0x290
[ 113.002193][ T5326] ? __queue_work+0xd4a/0xfc0
[ 113.003992][ T5326] ? __queue_work+0xd4f/0xfc0
[ 113.005918][ T5326] handle_bug+0xce/0x200
[ 113.007490][ T5326] exc_invalid_op+0x1a/0x50
[ 113.009196][ T5326] asm_exc_invalid_op+0x1a/0x20
[ 113.011067][ T5326] RIP: 0010:__queue_work+0xd4a/0xfc0
[ 113.013052][ T5326] Code: 83 c5 18 4c 89 e8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ef e8 d7 53 a5 00 49 8b 75 00 49 81 c7 70 01 00 00 4c 89 f7 4c 89 fa <67> 48 0f b9 3a 48 83 c4 58 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc
[ 113.020062][ T5326] RSP: 0018:ffffc9000e32fb20 EFLAGS: 00010082
[ 113.022410][ T5326] RAX: 1ffff110025c9178 RBX: 0000000000000008 RCX: 0000000000100000
[ 113.025525][ T5326] RDX: ffff888041653970 RSI: ffffffff8a9d5690 RDI: ffffffff9033bcb0
[ 113.028612][ T5326] RBP: 0000000000000000 R08: ffff888012e48baf R09: 1ffff110025c9175
[ 113.031596][ T5326] R10: dffffc0000000000 R11: ffffed10025c9176 R12: dffffc0000000000
[ 113.034520][ T5326] R13: ffff888012e48bc0 R14: ffffffff9033bcb0 R15: ffff888041653970
[ 113.037489][ T5326] ? __pfx_hci_rx_work+0x10/0x10
[ 113.039422][ T5326] ? ktime_get_with_offset+0x93/0x2d0
[ 113.041488][ T5326] ? rcu_is_watching+0x15/0xb0
[ 113.043351][ T5326] queue_work_on+0x106/0x1d0
[ 113.045116][ T5326] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 113.047309][ T5326] hci_recv_frame+0x625/0x7c0
[ 113.049018][ T5326] ? skb_pull+0xc1/0x1d0
[ 113.050624][ T5326] vhci_write+0x358/0x4a0
[ 113.052221][ T5326] vfs_write+0x61d/0xb90
[ 113.053867][ T5326] ? __pfx_vfs_write+0x10/0x10
[ 113.055755][ T5326] ? __fget_files+0x2a/0x420
[ 113.057542][ T5326] ksys_write+0x150/0x270
[ 113.059265][ T5326] ? __pfx_ksys_write+0x10/0x10
[ 113.061084][ T5326] ? __pfx_kcov_ioctl+0x10/0x10
[ 113.062927][ T5326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 113.065192][ T5326] do_syscall_64+0x15f/0xf80
[ 113.067117][ T5326] ? trace_irq_disable+0x3b/0x140
[ 113.069080][ T5326] ? clear_bhb_loop+0x40/0x90
[ 113.070927][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 113.073149][ T5326] RIP: 0033:0x7fb6e535d60e
[ 113.074905][ T5326] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[ 113.082427][ T5326] RSP: 002b:00007fb6e17d3f78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 113.085825][ T5326] RAX: ffffffffffffffda RBX: 00007fb6e17d46c0 RCX: 00007fb6e535d60e
[ 113.088780][ T5326] RDX: 0000000000000007 RSI: 0000200000000300 RDI: 00000000000000ca
[ 113.091906][ T5326] RBP: 00007fb6e5432d69 R08: 0000000000000000 R09: 0000000000000000
[ 113.094894][ T5326] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 113.097925][ T5326] R13: 00007fb6e5616128 R14: 00007fb6e5616090 R15: 00007fff03f799f8
[ 113.101031][ T5326]
[ 113.102738][ T5326] Kernel Offset: disabled
[ 113.104404][ T5326] Rebooting in 86400 seconds..