program: bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x15, 0x3, &(0x7f0000000580)=ANY=[@ANYBLOB="b70000000000000007000000000000009500e200000000001e5286574356940658273ad1326fc65be4b1037a74cfb5af100fc4e94d123d9b22a7561b8850821bc1f8b5b0a3e3b79b0d96ab7cc60e0e144f0f04bfffe68fe46421a161eedd1a5cee316f68f7617859f06c8efd5da6abe446649c322209b1af93c6c999058168ad0a70992124d19c7c9cc22ff9a6b1a058039ab938480e8697f8715bcb18e1fd0773909464a783148e0e7b604a6c47b33c43a3ffff92ec8bbde1af40f29cfcf0836a70a2f6b1192ab8f24ca363492393e1c2a3b190180caafbf8cfca720074bdcc7cbd978efd8404a1c700000000d97899514e64e36cad5eba82010b2d149ac02e5f07000000000000000000000000000000000000000000009d5df0e0dbb9821d9c5402474d5866ce5eb60188d83ac741b45aeacac594cf09de9b460f48b96ae8a0eead478e46c8ca3e4c5d2b3cb4ad48c830e8003c45f5b2dcbf36b7e8be59ca4b46266cf75bea8a22ab71895d954dc6d28864144c73391770690a9301cde97565d509effc252599b26555355d7955f551df82ea475a711ec56d00000000a89c7533c9955fd63cd00cb83d1228"], &(0x7f0000003ff6)='syzkaller\x00', 0x1, 0xc3, &(0x7f00000002c0)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_reuseport}, 0x94) r0 = socket$inet_sctp(0x2, 0x5, 0x84) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000480)={'team_slave_0\x00', 0x0}) sendmsg$ETHTOOL_MSG_PAUSE_SET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000940)=ANY=[@ANYBLOB="2800000014c4ab6914c31a0ea486063fe94fbdb940d7da395fa792f6230abd5e7f0ff5aa11ba41933d19ea333bec5945e9dbc2fa097bc55dc8f1f9b793d9c6334355dbbbcdaab22ad7a9cf83eabdd48a3d726a60c319e27c2fbea94d893186d0393c7f7dd34090db84109359f812295ef3507db3995e33502c7ed8c254288212389ebf675ef6906f0be399ef28d1341f00977ddac9e510547038c72d123c9bbecf9574a2ef11f78c5f49a627", @ANYRES16=r2, @ANYBLOB="010000000000000000001e0000000c00018008000100", @ANYRES32=r5, @ANYBLOB="0500030001000000"], 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x0) r6 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000240), 0x400, 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r6, 0xc018937a, &(0x7f0000000440)={{0x1, 0x1, 0x18, r0, {0xffff}}, './file0\x00'}) ioctl$sock_bt_hci(r1, 0x400448cb, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x30500, 0x0) syz_emit_vhci(&(0x7f0000000180)=ANY=[@ANYBLOB="040e0402030c", @ANYRESDEC], 0x7) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r8 = socket$nl_generic(0x10, 0x3, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000880), 0xe88403, 0x0) r9 = syz_open_dev$video4linux(&(0x7f0000000040), 0x5, 0x0) r10 = memfd_create(&(0x7f0000000100)='\vem1\xc1\xf8\xa6\x8dN\xc0\xa3w\xe2\xcb\xa2\xba\xe5\xf4\x97\xac#*\xff', 0x0) write(r10, &(0x7f0000000200)="06e7", 0x2) sendfile(r10, r10, &(0x7f0000001000), 0xffff) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x80000000004, 0x11, r10, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_MBUS_CODE(r9, 0xc0305602, &(0x7f0000000000)={0x0, 0xc}) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r12 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r12, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) ioctl$KVM_SET_CLOCK(r1, 0x4030ae7b, &(0x7f0000000400)={0x28000000000000, 0x2, 0x1, 0x2, 0x314}) r14 = add_key$keyring(&(0x7f00000008c0), &(0x7f0000000900)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) add_key$user(&(0x7f00000004c0), &(0x7f0000000500)={'syz', 0x2}, &(0x7f0000000880), 0x0, r14) sendmsg$NL80211_CMD_SET_INTERFACE(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYRES32=r7, @ANYRES16=r11, @ANYBLOB="0500000000f4ff2e76a6bfd2842c4900035a4fbd02c001f7a519ad3200", @ANYRES32=r13, @ANYBLOB="0800050003000000"], 0x24}}, 0x0) [ 102.785311][ T5306] Buffer I/O error on dev loop0, logical block 0, async page read [ 102.788756][ T5306] Buffer I/O error on dev loop0, logical block 0, async page read 25][ T4667] Bluetooth: hci0: command tx timeout [ 102.626424][ T5330] ------------[ cut here ]------------ [ 102.628790][ T5330] workqueue: cannot queue hci_rx_work on wq hci0 [ 102.631769][ T5330] WARNING: kernel/workqueue.c:2252 at __queue_work+0xd1f/0xf90, CPU#0: syz.0.0/5330 [ 102.635734][ T5330] Modules linked in: [ 102.637467][ T5330] CPU: 0 UID: 0 PID: 5330 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 102.641303][ T5330] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.645591][ T5330] RIP: 0010:__queue_work+0xd4a/0xf90 [ 102.648029][ T5330] Code: 83 c5 18 4c 89 e8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ef e8 d7 22 a2 00 49 8b 75 00 49 81 c7 78 01 00 00 4c 89 f7 4c 89 fa <67> 48 0f b9 3a 48 83 c4 58 5b 41 5c 41 5d 41 5e 41 5f 5d e9 8e b1 [ 102.656431][ T5330] RSP: 0018:ffffc9000aeefb20 EFLAGS: 00010086 [ 102.659134][ T5330] RAX: 1ffff1100253a97b RBX: 0000000000000008 RCX: 0000000000100000 [ 102.662633][ T5330] RDX: ffff88804121a178 RSI: ffffffff8a8d3a90 RDI: ffffffff8ff22ad0 [ 102.666181][ T5330] RBP: 0000000000000000 R08: ffff8880129d4bc7 R09: 1ffff1100253a978 [ 102.669646][ T5330] R10: dffffc0000000000 R11: ffffed100253a979 R12: dffffc0000000000 [ 102.672995][ T5330] R13: ffff8880129d4bd8 R14: ffffffff8ff22ad0 R15: ffff88804121a178 [ 102.676181][ T5330] FS: 00007f8cc4b176c0(0000) GS:ffff88808ccea000(0000) knlGS:0000000000000000 [ 102.679948][ T5330] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 102.682844][ T5330] CR2: 00007fa1fa22a3a0 CR3: 0000000044b59000 CR4: 0000000000352ef0 [ 102.686308][ T5330] Call Trace: [ 102.687789][ T5330] [ 102.689140][ T5330] ? rcu_is_watching+0x15/0xb0 [ 102.691317][ T5330] queue_work_on+0x106/0x1d0 [ 102.693311][ T5330] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 102.695773][ T5330] hci_recv_frame+0x625/0x7c0 [ 102.697890][ T5330] ? skb_pull+0xc1/0x1d0 [ 102.699745][ T5330] vhci_write+0x358/0x4a0 [ 102.701712][ T5330] vfs_write+0x61d/0xb90 [ 102.703573][ T5330] ? __pfx_vfs_write+0x10/0x10 [ 102.705595][ T5330] ? __fget_files+0x2a/0x420 [ 102.707568][ T5330] ksys_write+0x150/0x270 [ 102.709402][ T5330] ? __pfx_ksys_write+0x10/0x10 [ 102.711469][ T5330] do_syscall_64+0xe2/0xf80 [ 102.713436][ T5330] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.716018][ T5330] ? trace_irq_disable+0x37/0x100 [ 102.718321][ T5330] ? clear_bhb_loop+0x60/0xb0 [ 102.720434][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.723006][ T5330] RIP: 0033:0x7f8cc3b5b78e [ 102.725002][ T5330] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 102.733328][ T5330] RSP: 002b:00007f8cc4b16fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 102.736926][ T5330] RAX: ffffffffffffffda RBX: 00007f8cc4b176c0 RCX: 00007f8cc3b5b78e [ 102.740376][ T5330] RDX: 0000000000000007 RSI: 0000200000000180 RDI: 00000000000000ca [ 102.743844][ T5330] RBP: 00007f8cc3c08c1f R08: 0000000000000000 R09: 0000000000000000 [ 102.747290][ T5330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 102.750798][ T5330] R13: 00007f8cc3e16128 R14: 00007f8cc3e16090 R15: 00007ffd1c417028 [ 102.754203][ T5330] [ 102.755546][ T5330] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 102.758726][ T5330] CPU: 0 UID: 0 PID: 5330 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 102.762638][ T5330] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.767048][ T5330] Call Trace: [ 102.768601][ T5330] [ 102.769958][ T5330] vpanic+0x1e0/0x670 [ 102.771740][ T5330] panic+0xc5/0xd0 [ 102.773445][ T5330] ? __pfx_panic+0x10/0x10 [ 102.775459][ T5330] __warn+0x315/0x4a0 [ 102.777292][ T5330] ? __queue_work+0xd1f/0xf90 [ 102.779353][ T5330] ? __queue_work+0xd1f/0xf90 [ 102.781475][ T5330] __report_bug+0x29a/0x540 [ 102.783421][ T5330] ? __queue_work+0xd1f/0xf90 [ 102.785493][ T5330] ? __pfx___report_bug+0x10/0x10 [ 102.787738][ T5330] ? vhci_write+0xbe/0x4a0 [ 102.789805][ T5330] ? __pfx_hci_rx_work+0x10/0x10 [ 102.792024][ T5330] ? __lock_acquire+0x6b5/0x2cf0 [ 102.794253][ T5330] report_bug_entry+0x19a/0x290 [ 102.796466][ T5330] ? __queue_work+0xd4a/0xf90 [ 102.798620][ T5330] ? __queue_work+0xd4f/0xf90 [ 102.800712][ T5330] handle_bug+0xca/0x200 [ 102.802609][ T5330] exc_invalid_op+0x1a/0x50 [ 102.804678][ T5330] asm_exc_invalid_op+0x1a/0x20 [ 102.806847][ T5330] RIP: 0010:__queue_work+0xd4a/0xf90 [ 102.809129][ T5330] Code: 83 c5 18 4c 89 e8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ef e8 d7 22 a2 00 49 8b 75 00 49 81 c7 78 01 00 00 4c 89 f7 4c 89 fa <67> 48 0f b9 3a 48 83 c4 58 5b 41 5c 41 5d 41 5e 41 5f 5d e9 8e b1 [ 102.817304][ T5330] RSP: 0018:ffffc9000aeefb20 EFLAGS: 00010086 [ 102.819929][ T5330] RAX: 1ffff1100253a97b RBX: 0000000000000008 RCX: 0000000000100000 [ 102.823445][ T5330] RDX: ffff88804121a178 RSI: ffffffff8a8d3a90 RDI: ffffffff8ff22ad0 [ 102.826903][ T5330] RBP: 0000000000000000 R08: ffff8880129d4bc7 R09: 1ffff1100253a978 [ 102.830457][ T5330] R10: dffffc0000000000 R11: ffffed100253a979 R12: dffffc0000000000 [ 102.833882][ T5330] R13: ffff8880129d4bd8 R14: ffffffff8ff22ad0 R15: ffff88804121a178 [ 102.837285][ T5330] ? __pfx_hci_rx_work+0x10/0x10 [ 102.839490][ T5330] ? rcu_is_watching+0x15/0xb0 [ 102.841640][ T5330] queue_work_on+0x106/0x1d0 [ 102.843625][ T5330] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 102.846260][ T5330] hci_recv_frame+0x625/0x7c0 [ 102.848389][ T5330] ? skb_pull+0xc1/0x1d0 [ 102.850222][ T5330] vhci_write+0x358/0x4a0 [ 102.852067][ T5330] vfs_write+0x61d/0xb90 [ 102.853926][ T5330] ? __pfx_vfs_write+0x10/0x10 [ 102.856027][ T5330] ? __fget_files+0x2a/0x420 [ 102.858143][ T5330] ksys_write+0x150/0x270 [ 102.859995][ T5330] ? __pfx_ksys_write+0x10/0x10 [ 102.862117][ T5330] do_syscall_64+0xe2/0xf80 [ 102.864101][ T5330] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.866740][ T5330] ? trace_irq_disable+0x37/0x100 [ 102.868937][ T5330] ? clear_bhb_loop+0x60/0xb0 [ 102.871034][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.873603][ T5330] RIP: 0033:0x7f8cc3b5b78e [ 102.875567][ T5330] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 102.883844][ T5330] RSP: 002b:00007f8cc4b16fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 102.887441][ T5330] RAX: ffffffffffffffda RBX: 00007f8cc4b176c0 RCX: 00007f8cc3b5b78e [ 102.890897][ T5330] RDX: 0000000000000007 RSI: 0000200000000180 RDI: 00000000000000ca [ 102.894286][ T5330] RBP: 00007f8cc3c08c1f R08: 0000000000000000 R09: 0000000000000000 [ 102.897800][ T5330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 102.901311][ T5330] R13: 00007f8cc3e16128 R14: 00007f8cc3e16090 R15: 00007ffd1c417028 [ 102.904812][ T5330] [ 102.906469][ T5330] Kernel Offset: disabled [ 102.908433][ T5330] Rebooting in 86400 seconds..