program:
r0 = socket$inet6(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f0000001240)={0xa, 0x4e20, 0xfffffffe, @loopback}, 0x1c)
sendto$inet6(r0, 0x0, 0x0, 0xfffffefffffbffaf, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r1 = syz_genetlink_get_family_id$SEG6(&(0x7f00000000c0), 0xffffffffffffffff)
sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x40, r1, 0x200, 0x70bd2b, 0x25dfdbfc, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0x8}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x5}, @SEG6_ATTR_DST={0x14, 0x1, @private0={0xfc, 0x0, '\x00', 0x74}}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0xfffffffb}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x40)
sendto$inet6(r0, &(0x7f0000000000)='\b', 0xfffffffffffffd68, 0x4004895, 0x0, 0xffffffffffffff5a)
sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, 0x0, 0x0)
syz_emit_vhci(0x0, 0xe)
syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000300)=ANY=[@ANYBLOB="1201010200000040"], 0x0)
syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e1f0a"], 0x22)
syz_emit_vhci(&(0x7f0000000300)=ANY=[@ANYBLOB="040b"], 0xe)
syz_emit_vhci(&(0x7f0000000080)=ANY=[@ANYBLOB="0406"], 0x7)
getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f00000002c0)={&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f0000001640)=""/102400, 0x19000, 0x0, 0x0, 0x64}, &(0x7f00000008c0)=0x40)
[ 93.610350][ T4637] Bluetooth: hci0: command tx timeout
[ 93.988530][ T805] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 94.149348][ T5271] Bluetooth: hci0: unexpected event 0x06 length: 4 > 3
[ 95.649661][ T5271] Bluetooth: hci0: command tx timeout
[ 96.211834][ T4637] ------------[ cut here ]------------
[ 96.214276][ T4637] refcnt < 0
[ 96.214289][ T4637] WARNING: net/bluetooth/hci_conn.c:631 at hci_conn_timeout+0xff/0x2c0, CPU#0: kworker/u5:1/4637
[ 96.221635][ T4637] Modules linked in:
[ 96.223496][ T4637] CPU: 0 UID: 0 PID: 4637 Comm: kworker/u5:1 Not tainted syzkaller #0 PREEMPT(full)
[ 96.227947][ T4637] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 96.232280][ T4637] Workqueue: hci0 hci_conn_timeout
[ 96.234560][ T4637] RIP: 0010:hci_conn_timeout+0xff/0x2c0
[ 96.237064][ T4637] Code: 48 89 df e8 c3 cc 09 00 eb 07 e8 3c 2d ff f6 b0 13 0f b6 f0 48 89 df 5b 41 5c 41 5e 41 5f 5d e9 b7 a0 fe ff e8 22 2d ff f6 90 <0f> 0b 90 eb 8c 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 31 ff ff ff
[ 96.245021][ T4637] RSP: 0018:ffffc9000f6ffad0 EFLAGS: 00010293
[ 96.247716][ T4637] RAX: ffffffff8ac7e4be RBX: ffff888012b74000 RCX: ffff888037674a80
[ 96.251211][ T4637] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000
[ 96.254648][ T4637] RBP: 00000000ffffffff R08: ffff888012b74013 R09: 1ffff1100256e802
[ 96.257964][ T4637] R10: dffffc0000000000 R11: ffffed100256e803 R12: dffffc0000000000
[ 96.261410][ T4637] R13: dffffc0000000000 R14: ffff888012b74a40 R15: ffff888012b74010
[ 96.264749][ T4637] FS: 0000000000000000(0000) GS:ffff88808c53e000(0000) knlGS:0000000000000000
[ 96.268500][ T4637] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 96.271280][ T4637] CR2: 000055945a3d71f8 CR3: 00000000124f9000 CR4: 0000000000352ef0
[ 96.274577][ T4637] Call Trace:
[ 96.276155][ T4637]
[ 96.277404][ T4637] ? process_scheduled_works+0xa20/0x14e0
[ 96.279681][ T4637] process_scheduled_works+0xa8e/0x14e0
[ 96.282114][ T4637] ? __pfx_process_scheduled_works+0x10/0x10
[ 96.284658][ T4637] ? assign_work+0x3cf/0x5d0
[ 96.286652][ T4637] worker_thread+0xa47/0xfb0
[ 96.288504][ T4637] ? __kthread_parkme+0x71/0x1f0
[ 96.290626][ T4637] kthread+0x388/0x470
[ 96.292330][ T4637] ? __pfx_worker_thread+0x10/0x10
[ 96.294231][ T4637] ? __pfx_kthread+0x10/0x10
[ 96.296125][ T4637] ret_from_fork+0x514/0xb70
[ 96.298037][ T4637] ? __pfx_ret_from_fork+0x10/0x10
[ 96.300212][ T4637] ? __switch_to+0xc89/0x1420
[ 96.302225][ T4637] ? __pfx_kthread+0x10/0x10
[ 96.304161][ T4637] ret_from_fork_asm+0x1a/0x30
[ 96.306263][ T4637]
[ 96.307640][ T4637] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 96.310645][ T4637] CPU: 0 UID: 0 PID: 4637 Comm: kworker/u5:1 Not tainted syzkaller #0 PREEMPT(full)
[ 96.314503][ T4637] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 96.318586][ T4637] Workqueue: hci0 hci_conn_timeout
[ 96.320635][ T4637] Call Trace:
[ 96.322033][ T4637]
[ 96.323260][ T4637] vpanic+0x56c/0xa60
[ 96.324950][ T4637] ? __pfx__printk+0x10/0x10
[ 96.326951][ T4637] ? __pfx_vpanic+0x10/0x10
[ 96.329044][ T4637] ? is_bpf_text_address+0x292/0x2b0
[ 96.331368][ T4637] ? is_bpf_text_address+0x26/0x2b0
[ 96.333544][ T4637] panic+0xc5/0xd0
[ 96.335139][ T4637] ? __pfx_panic+0x10/0x10
[ 96.337119][ T4637] ? ret_from_fork_asm+0x1a/0x30
[ 96.339248][ T4637] __warn+0x315/0x4c0
[ 96.341034][ T4637] ? hci_conn_timeout+0xff/0x2c0
[ 96.343108][ T4637] ? hci_conn_timeout+0xff/0x2c0
[ 96.345228][ T4637] __report_bug+0x276/0x570
[ 96.347139][ T4637] ? hci_conn_timeout+0xff/0x2c0
[ 96.349245][ T4637] ? __pfx___report_bug+0x10/0x10
[ 96.351344][ T4637] ? add_lock_to_list+0xc7/0x100
[ 96.353433][ T4637] ? lockdep_unlock+0x5d/0xd0
[ 96.355470][ T4637] ? __lock_acquire+0x13e8/0x2cf0
[ 96.357619][ T4637] ? hci_conn_timeout+0xff/0x2c0
[ 96.359797][ T4637] report_bug+0x16a/0x220
[ 96.361689][ T4637] ? hci_conn_timeout+0xff/0x2c0
[ 96.363727][ T4637] ? hci_conn_timeout+0x101/0x2c0
[ 96.365854][ T4637] handle_bug+0x9c/0x200
[ 96.367672][ T4637] exc_invalid_op+0x1a/0x50
[ 96.369590][ T4637] asm_exc_invalid_op+0x1a/0x20
[ 96.371660][ T4637] RIP: 0010:hci_conn_timeout+0xff/0x2c0
[ 96.373933][ T4637] Code: 48 89 df e8 c3 cc 09 00 eb 07 e8 3c 2d ff f6 b0 13 0f b6 f0 48 89 df 5b 41 5c 41 5e 41 5f 5d e9 b7 a0 fe ff e8 22 2d ff f6 90 <0f> 0b 90 eb 8c 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 31 ff ff ff
[ 96.381778][ T4637] RSP: 0018:ffffc9000f6ffad0 EFLAGS: 00010293
[ 96.384190][ T4637] RAX: ffffffff8ac7e4be RBX: ffff888012b74000 RCX: ffff888037674a80
[ 96.387497][ T4637] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000
[ 96.390643][ T4637] RBP: 00000000ffffffff R08: ffff888012b74013 R09: 1ffff1100256e802
[ 96.393982][ T4637] R10: dffffc0000000000 R11: ffffed100256e803 R12: dffffc0000000000
[ 96.397061][ T4637] R13: dffffc0000000000 R14: ffff888012b74a40 R15: ffff888012b74010
[ 96.400158][ T4637] ? hci_conn_timeout+0xfe/0x2c0
[ 96.402048][ T4637] ? process_scheduled_works+0xa20/0x14e0
[ 96.404240][ T4637] process_scheduled_works+0xa8e/0x14e0
[ 96.406657][ T4637] ? __pfx_process_scheduled_works+0x10/0x10
[ 96.409230][ T4637] ? assign_work+0x3cf/0x5d0
[ 96.411244][ T4637] worker_thread+0xa47/0xfb0
[ 96.413290][ T4637] ? __kthread_parkme+0x71/0x1f0
[ 96.415417][ T4637] kthread+0x388/0x470
[ 96.417216][ T4637] ? __pfx_worker_thread+0x10/0x10
[ 96.419276][ T4637] ? __pfx_kthread+0x10/0x10
[ 96.421244][ T4637] ret_from_fork+0x514/0xb70
[ 96.423178][ T4637] ? __pfx_ret_from_fork+0x10/0x10
[ 96.425311][ T4637] ? __switch_to+0xc89/0x1420
[ 96.427239][ T4637] ? __pfx_kthread+0x10/0x10
[ 96.429087][ T4637] ret_from_fork_asm+0x1a/0x30
[ 96.431041][ T4637]
[ 96.432706][ T4637] Kernel Offset: disabled
[ 96.434557][ T4637] Rebooting in 86400 seconds..