program:
r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000180), 0x40e02, 0x0)
r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_bt_hci(r1, 0x400448ca, 0x0)
write$rfkill(r0, &(0x7f0000000300)={0x0, 0x2, 0x3, 0x1, 0x1}, 0x8)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r2, &(0x7f0000000000)={0x1f, 0x0, 0x1}, 0x6)
[ 107.950471][ C0] ------------[ cut here ]------------
[ 107.950517][ C0] workqueue: cannot queue hci_cmd_timeout on wq hci0
[ 107.950640][ C0] WARNING: kernel/workqueue.c:2353 at __queue_work+0xd83/0x10d0, CPU#0: syz.0.0/5323
[ 107.959739][ C0] Modules linked in:
[ 107.961414][ C0] CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 107.965277][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 107.969495][ C0] RIP: 0010:__queue_work+0xd9f/0x10d0
[ 107.971786][ C0] Code: 49 81 c7 70 01 00 00 4c 8d 35 7d f9 ee 0e 48 89 f8 48 c1 e8 03 80 3c 18 00 74 05 e8 5b 6b ab 00 49 8b 75 18 4c 89 f7 4c 89 fa <67> 48 0f b9 3a 4c 89 e8 48 c1 e8 03 80 3c 18 00 74 08 4c 89 ef e8
[ 107.979748][ C0] RSP: 0018:ffffc90000007bc0 EFLAGS: 00010046
[ 107.982387][ C0] RAX: 1ffff110085d814e RBX: dffffc0000000000 RCX: ffff88803366a580
[ 107.985800][ C0] RDX: ffff8880444ef170 RSI: ffffffff8ad98fb0 RDI: ffffffff907d5fa0
[ 107.989203][ C0] RBP: 0000000000010000 R08: 0000000000000100 R09: 1ffffffff20f512f
[ 107.992636][ C0] R10: dffffc0000000000 R11: ffffffff818e6d40 R12: 0000000000000008
[ 107.995985][ C0] R13: ffff888042ec0a58 R14: ffffffff907d5fa0 R15: ffff8880444ef170
[ 107.999228][ C0] FS: 00007fa425b536c0(0000) GS:ffff88808c2bb000(0000) knlGS:0000000000000000
[ 108.003186][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 108.006130][ C0] CR2: 00007fa424df46b8 CR3: 000000001d0ef000 CR4: 0000000000352ef0
[ 108.009536][ C0] Call Trace:
[ 108.011017][ C0]
[ 108.012297][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 108.014810][ C0] call_timer_fn+0x18d/0x5f0
[ 108.016938][ C0] ? __pfx_delayed_work_timer_fn+0x10/0x10
[ 108.019469][ C0] ? call_timer_fn+0xd5/0x5f0
[ 108.021584][ C0] ? __pfx_call_timer_fn+0x10/0x10
[ 108.023788][ C0] ? do_raw_spin_unlock+0x4d/0x200
[ 108.026136][ C0] ? __pfx_delayed_work_timer_fn+0x10/0x10
[ 108.028687][ C0] __run_timer_base+0x67e/0x8b0
[ 108.030936][ C0] ? __pfx___run_timer_base+0x10/0x10
[ 108.033357][ C0] ? ktime_get+0x1f5/0x220
[ 108.035426][ C0] ? lapic_next_event+0x11/0x20
[ 108.037608][ C0] run_timer_softirq+0xb7/0x170
[ 108.039924][ C0] handle_softirqs+0x226/0x860
[ 108.043044][ C0] ? __irq_exit_rcu+0xcb/0x220
[ 108.045222][ C0] __irq_exit_rcu+0xcb/0x220
[ 108.047356][ C0] irq_exit_rcu+0x9/0x30
[ 108.049284][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0
[ 108.051827][ C0]
[ 108.053221][ C0]
[ 108.054632][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 108.057220][ C0] RIP: 0010:lock_acquire+0x232/0x350
[ 108.059613][ C0] Code: ff ff ff e8 30 ee 45 0a f7 44 24 10 00 02 00 00 0f 84 38 ff ff ff 65 48 8b 05 92 e8 f2 11 48 3b 44 24 50 75 33 fb 48 83 c4 58 <5b> 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 48 8d 3d 47 5c da
[ 108.068227][ C0] RSP: 0018:ffffc9000c307908 EFLAGS: 00000282
[ 108.071032][ C0] RAX: 45a43ef6f7e3c900 RBX: 0000000000000001 RCX: 0000000000000046
[ 108.074652][ C0] RDX: ffff88803366b158 RSI: ffffffff8e6a3f12 RDI: ffffffff8c6dcd80
[ 108.078126][ C0] RBP: ffff88803366a580 R08: 0000000000000008 R09: ffffffff96bb4b78
[ 108.081513][ C0] R10: 00000000c8a2d8b5 R11: 0000000019fc19cb R12: ffff8880444ef140
[ 108.084974][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000246
[ 108.088324][ C0] ? touch_wq_lockdep_map+0xb5/0x180
[ 108.090617][ C0] touch_wq_lockdep_map+0xcb/0x180
[ 108.092842][ C0] ? touch_wq_lockdep_map+0xb5/0x180
[ 108.095076][ C0] __flush_workqueue+0x148/0x1470
[ 108.097337][ C0] ? drain_workqueue+0xb1/0x380
[ 108.099429][ C0] ? __pfx___flush_workqueue+0x10/0x10
[ 108.101770][ C0] ? __mutex_unlock_slowpath+0x731/0x900
[ 108.104200][ C0] drain_workqueue+0xce/0x380
[ 108.106257][ C0] hci_dev_close_sync+0x606/0x10c0
[ 108.108451][ C0] ? __pfx___mutex_lock+0x10/0x10
[ 108.110581][ C0] ? __pfx_hci_dev_close_sync+0x10/0x10
[ 108.112987][ C0] ? lockdep_hardirqs_on+0x7b/0x110
[ 108.115209][ C0] ? enable_work+0x1fd/0x230
[ 108.117225][ C0] hci_dev_close+0x108/0x260
[ 108.119353][ C0] sock_do_ioctl+0x101/0x320
[ 108.121476][ C0] ? __pfx_sock_do_ioctl+0x10/0x10
[ 108.123854][ C0] ? hook_file_ioctl+0x1f2/0x600
[ 108.127270][ C0] sock_ioctl+0x57a/0x7e0
[ 108.129227][ C0] ? __pfx_sock_ioctl+0x10/0x10
[ 108.131322][ C0] ? __fget_files+0x2a/0x420
[ 108.133357][ C0] ? __fget_files+0x3a2/0x420
[ 108.135402][ C0] ? __fget_files+0x2a/0x420
[ 108.137455][ C0] ? bpf_lsm_file_ioctl+0x9/0x20
[ 108.139705][ C0] ? __pfx_sock_ioctl+0x10/0x10
[ 108.141799][ C0] __se_sys_ioctl+0xfc/0x170
[ 108.143737][ C0] do_syscall_64+0x166/0x520
[ 108.145801][ C0] ? trace_irq_disable+0x3b/0x140
[ 108.148749][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 108.151428][ C0] ? clear_bhb_loop+0x70/0xc0
[ 108.153470][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 108.156017][ C0] RIP: 0033:0x7fa424b9e199
[ 108.157968][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 108.165912][ C0] RSP: 002b:00007fa425b52fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 108.169561][ C0] RAX: ffffffffffffffda RBX: 00007fa424e25fa0 RCX: 00007fa424b9e199
[ 108.173104][ C0] RDX: 0000000000000000 RSI: 00000000400448ca RDI: 0000000000000005
[ 108.176490][ C0] RBP: 00007fa424c350b8 R08: 0000000000000000 R09: 0000000000000000
[ 108.179928][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 108.183358][ C0] R13: 00007fa424e26038 R14: 00007fa424e25fa0 R15: 00007ffdef743438
[ 108.186771][ C0]
[ 108.188181][ C0] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 108.191284][ C0] CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 108.194946][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 108.199152][ C0] Call Trace:
[ 108.200724][ C0]
[ 108.202002][ C0] vpanic+0x56d/0xa60
[ 108.203925][ C0] ? __pfx__printk+0x10/0x10
[ 108.205971][ C0] ? __pfx_vpanic+0x10/0x10
[ 108.208022][ C0] ? is_bpf_text_address+0x292/0x2b0
[ 108.210397][ C0] ? is_bpf_text_address+0x26/0x2b0
[ 108.212700][ C0] panic+0xc5/0xd0
[ 108.214435][ C0] ? __pfx_panic+0x10/0x10
[ 108.216467][ C0] __warn+0x315/0x4c0
[ 108.218314][ C0] ? __queue_work+0xd83/0x10d0
[ 108.220415][ C0] ? __queue_work+0xd83/0x10d0
[ 108.222522][ C0] __report_bug+0x276/0x570
[ 108.224804][ C0] ? __queue_work+0xd83/0x10d0
[ 108.227465][ C0] ? __pfx___report_bug+0x10/0x10
[ 108.229856][ C0] ? do_raw_spin_lock+0x12b/0x2f0
[ 108.232136][ C0] ? __pfx_hci_cmd_timeout+0x10/0x10
[ 108.234521][ C0] ? look_up_lock_class+0x57/0x110
[ 108.236773][ C0] ? register_lock_class+0x31/0x2e0
[ 108.239101][ C0] report_bug_entry+0x19b/0x290
[ 108.241431][ C0] ? __queue_work+0xd9f/0x10d0
[ 108.243809][ C0] ? __queue_work+0xda4/0x10d0
[ 108.245909][ C0] handle_bug+0xce/0x200
[ 108.247802][ C0] exc_invalid_op+0x1a/0x50
[ 108.249821][ C0] asm_exc_invalid_op+0x1a/0x20
[ 108.251978][ C0] RIP: 0010:__queue_work+0xd9f/0x10d0
[ 108.254410][ C0] Code: 49 81 c7 70 01 00 00 4c 8d 35 7d f9 ee 0e 48 89 f8 48 c1 e8 03 80 3c 18 00 74 05 e8 5b 6b ab 00 49 8b 75 18 4c 89 f7 4c 89 fa <67> 48 0f b9 3a 4c 89 e8 48 c1 e8 03 80 3c 18 00 74 08 4c 89 ef e8
[ 108.262711][ C0] RSP: 0018:ffffc90000007bc0 EFLAGS: 00010046
[ 108.265593][ C0] RAX: 1ffff110085d814e RBX: dffffc0000000000 RCX: ffff88803366a580
[ 108.269121][ C0] RDX: ffff8880444ef170 RSI: ffffffff8ad98fb0 RDI: ffffffff907d5fa0
[ 108.272663][ C0] RBP: 0000000000010000 R08: 0000000000000100 R09: 1ffffffff20f512f
[ 108.276106][ C0] R10: dffffc0000000000 R11: ffffffff818e6d40 R12: 0000000000000008
[ 108.279608][ C0] R13: ffff888042ec0a58 R14: ffffffff907d5fa0 R15: ffff8880444ef170
[ 108.283147][ C0] ? __pfx_delayed_work_timer_fn+0x10/0x10
[ 108.285732][ C0] ? __pfx_hci_cmd_timeout+0x10/0x10
[ 108.288073][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 108.290414][ C0] call_timer_fn+0x18d/0x5f0
[ 108.292475][ C0] ? __pfx_delayed_work_timer_fn+0x10/0x10
[ 108.295156][ C0] ? call_timer_fn+0xd5/0x5f0
[ 108.297288][ C0] ? __pfx_call_timer_fn+0x10/0x10
[ 108.299659][ C0] ? do_raw_spin_unlock+0x4d/0x200
[ 108.302518][ C0] ? __pfx_delayed_work_timer_fn+0x10/0x10
[ 108.305322][ C0] __run_timer_base+0x67e/0x8b0
[ 108.307556][ C0] ? __pfx___run_timer_base+0x10/0x10
[ 108.309984][ C0] ? ktime_get+0x1f5/0x220
[ 108.312042][ C0] ? lapic_next_event+0x11/0x20
[ 108.314300][ C0] run_timer_softirq+0xb7/0x170
[ 108.316490][ C0] handle_softirqs+0x226/0x860
[ 108.318639][ C0] ? __irq_exit_rcu+0xcb/0x220
[ 108.320736][ C0] __irq_exit_rcu+0xcb/0x220
[ 108.322857][ C0] irq_exit_rcu+0x9/0x30
[ 108.324739][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0
[ 108.327260][ C0]
[ 108.328597][ C0]
[ 108.329911][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 108.332599][ C0] RIP: 0010:lock_acquire+0x232/0x350
[ 108.334827][ C0] Code: ff ff ff e8 30 ee 45 0a f7 44 24 10 00 02 00 00 0f 84 38 ff ff ff 65 48 8b 05 92 e8 f2 11 48 3b 44 24 50 75 33 fb 48 83 c4 58 <5b> 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 48 8d 3d 47 5c da
[ 108.342457][ C0] RSP: 0018:ffffc9000c307908 EFLAGS: 00000282
[ 108.344954][ C0] RAX: 45a43ef6f7e3c900 RBX: 0000000000000001 RCX: 0000000000000046
[ 108.348416][ C0] RDX: ffff88803366b158 RSI: ffffffff8e6a3f12 RDI: ffffffff8c6dcd80
[ 108.351910][ C0] RBP: ffff88803366a580 R08: 0000000000000008 R09: ffffffff96bb4b78
[ 108.355412][ C0] R10: 00000000c8a2d8b5 R11: 0000000019fc19cb R12: ffff8880444ef140
[ 108.358885][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000246
[ 108.362411][ C0] ? touch_wq_lockdep_map+0xb5/0x180
[ 108.364716][ C0] touch_wq_lockdep_map+0xcb/0x180
[ 108.366970][ C0] ? touch_wq_lockdep_map+0xb5/0x180
[ 108.369249][ C0] __flush_workqueue+0x148/0x1470
[ 108.371599][ C0] ? drain_workqueue+0xb1/0x380
[ 108.373859][ C0] ? __pfx___flush_workqueue+0x10/0x10
[ 108.376261][ C0] ? __mutex_unlock_slowpath+0x731/0x900
[ 108.378834][ C0] drain_workqueue+0xce/0x380
[ 108.380982][ C0] hci_dev_close_sync+0x606/0x10c0
[ 108.383321][ C0] ? __pfx___mutex_lock+0x10/0x10
[ 108.385643][ C0] ? __pfx_hci_dev_close_sync+0x10/0x10
[ 108.388125][ C0] ? lockdep_hardirqs_on+0x7b/0x110
[ 108.390508][ C0] ? enable_work+0x1fd/0x230
[ 108.392520][ C0] hci_dev_close+0x108/0x260
[ 108.394597][ C0] sock_do_ioctl+0x101/0x320
[ 108.396610][ C0] ? __pfx_sock_do_ioctl+0x10/0x10
[ 108.398926][ C0] ? hook_file_ioctl+0x1f2/0x600
[ 108.401237][ C0] sock_ioctl+0x57a/0x7e0
[ 108.403190][ C0] ? __pfx_sock_ioctl+0x10/0x10
[ 108.405365][ C0] ? __fget_files+0x2a/0x420
[ 108.407397][ C0] ? __fget_files+0x3a2/0x420
[ 108.409465][ C0] ? __fget_files+0x2a/0x420
[ 108.411544][ C0] ? bpf_lsm_file_ioctl+0x9/0x20
[ 108.413775][ C0] ? __pfx_sock_ioctl+0x10/0x10
[ 108.415951][ C0] __se_sys_ioctl+0xfc/0x170
[ 108.418021][ C0] do_syscall_64+0x166/0x520
[ 108.420128][ C0] ? trace_irq_disable+0x3b/0x140
[ 108.422348][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 108.425011][ C0] ? clear_bhb_loop+0x70/0xc0
[ 108.427124][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 108.429770][ C0] RIP: 0033:0x7fa424b9e199
[ 108.431809][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 108.440351][ C0] RSP: 002b:00007fa425b52fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 108.443896][ C0] RAX: ffffffffffffffda RBX: 00007fa424e25fa0 RCX: 00007fa424b9e199
[ 108.447020][ C0] RDX: 0000000000000000 RSI: 00000000400448ca RDI: 0000000000000005
[ 108.450116][ C0] RBP: 00007fa424c350b8 R08: 0000000000000000 R09: 0000000000000000
[ 108.453285][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 108.456575][ C0] R13: 00007fa424e26038 R14: 00007fa424e25fa0 R15: 00007ffdef743438
[ 108.460465][ C0]
[ 108.462331][ C0] Kernel Offset: disabled
[ 108.464426][ C0] Rebooting in 86400 seconds..