program:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_bt_hci(r0, 0x400448cb, 0x0)
syz_emit_vhci(&(0x7f0000000180)=ANY=[@ANYBLOB="043e110b07"], 0xec)
syz_mount_image$udf(&(0x7f0000000180), &(0x7f0000000080)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0, &(0x7f0000000540)=ANY=[], 0xfe, 0xc24, &(0x7f0000002280)="$eJzs3UFsHNd9B+D/Gy5Fym4rJk5Uu42LTVukMmO5sqSYilW4q5pmG0CWiVDMLQBX5EpdmFoSJNXIRtrQvfTQQ4Ci6CEnAq1RIEUDoymCHtnWBZKLD0VOPREtbARFD2wRIKeAxcy+lZY0ZcmmSFH299nUbznz3ux7b5YzkqA3LwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAiN976cKpZ9ODbgUAcJAuTX311Gn3fwD4RLnsz/8AAAAAAAAAAAAAAHDYpSjisUixeGkzzVTfdw1fbHdu3Jwen9i92tFU1Ryoypdfw8+ePnP2S8+NnevlB9e/356IV6YuX6i/uHB9cam1vNyaq0932rMLc617PsJe6+80Wg1A/fqrN+auXl2un37mzLbdN0feG3r0+Mj5sadOPtkrOz0+MTHVV6Y2+JHf/X3uNMPjSBRxMlI8/b2fpGZEFLH3sbjLZ2e/Ha06MVp1Ynp8ourIfLvZWSl3TvYGooio91Vq9MboAM7FnjQiVsvmlw0eLbs3tdhcal6Zb9Unm0sr7ZX2QmcydVtb9qceRZxLEWsRsTH0/sMNRhG1SPGdY5vpSkQM9Mbhi9XE4Du3o9jHPt6Dsp31wYi14iE4Z4fYUBTxcqT46dtFzJZjlr/iCxEvl/mDiDfLfCEilR+MsxHv7vI54uFUiyL+vDz/5zfTXHU96F1XLn6t/pXO1YW+sr3rykN/fzhIh/zaNBxFNKsr/mb66L/ZAQAAAAAAAAAAAAAAAOB+OxpFPBEpXvr3P6rmFUc1L/3Y+bHfH/nF/jnjj9/lOGXZZyJitbi3OblH8hTiyTSZ0gOeS/xJNhxF/HGe//fGg24MAAAAAAAAAAAAAAAAAADAJ9yPI8Xz75xIa9G/pni7c61+uXllvrsqbG/t396a6VtbW1v11M1GzpmcqznXcq7n3MgZRa6fs5FzJudqzrWc6zk3csZArp+zkXMm52rOtZzrOTdyRi3Xz9nIOZNzNedazvWcGznjkKzdCwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwcVJEET+PFN/+xmaKFBGNiJno5vpQrwwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8CANpSK+Hynqf9C4ta0WEan6v+tE+cvZaBwp89PRGCvzhWhcyNmsstZ44wG0n70ZTEX8KFIMDb9164Tn8z/Y/e7WxyDe/Obt736l1s2B3s6R94YePX7s/NjErz1+p9dptwaMXmx3btysT49PTEz1ba7ld/9037aR/L7F/ek6EbH82uuvNufnW0ufmBdFHIpmPKgXte6LWhyS9hzUi3y9il12FYfhp6BxWAaq9+IBX5g4EOX9/91I8dvv/Efvht+7//9C97tbd/j42Z/cvv8/v/NA+3T/f6xv2/P5dyODtYjhleuLg8cjhpdfe/1k+3rzWutaq3P21Kkvj419+cypwSMRw1fb862+V3seKgAAAAAAAAAAAAAAAICDlYr43UjR/NFmqkfEzWq+1sj5sadOPjkQA9V8q23ztl6Zunyh/uLC9cWl1vJya64+3WnPLsy17vXthqvpXtPjE/vSmbs6us/tPzr84sLia0vta3+4suv+R4YvXFleWWrO7r47jkYR0ejfMlo1eHp8omr0fLvZqapO7jqZ7sMbTEX8Z6SYPVs/0tuW5//tnOG/bf7/6s4D7dP8v0/1bSvfM6UifhYpfusvHo/PV+18JN43Zrnc30SK0XOfy+XiSFmu14bucwW6MwPLsv8bKf7h59vL9uZDPna77LP3Oq4Pi/L8H4sU3/+z78av523bn/+w+/l/ZOeB9un8f6Zv2yPbnlew566Tz//JSPHCY2/Fb+RtH/T8jyK2tra+FXEiF771fI59Ov+f7ds2Et33/c37130AAAAAAAAAAICH1mAq4m8jxZMTtfRc3nYv//5vbueB9unff/1y37a5A1qvaM+DCgAAAACHxGAq4seR4trKW7fmUG+f/903//N3bq+9Pp527K3+nu+XqucG3M+//+s3kt93Zu/dBgAAAAAAAAAAAAAAAAAAgEMlpSKey+upz9xlPfX1SPHSfz+dy6XjZbneOvAj1a/DlxY6Jy/Mzy/MNleaV+Zb9anF5myrrPuZSLH515/LdYtqffXP57rdNd6Ht3prsS9Fiom/65XtrsXeW5u8ux54dy32suynIsV//f32sr11rD97u+zpsuxfRYqv/9PuZY/fLnumLPvdSPHDr9d7ZR8py/aej9p9JulwLeZbz8wuzL/vUagAAAAAAAAAAAAAAAAAAADwYQ2mIv40UvzP9bVYrab9v3FrV85ab8Ob3+xb73+Hm9U6/yPV+v93ev1R1v8fuS+9BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAh0uKIl6PFIuXNtP6UPl91/DFdufGzenxid2rHU1VzYGqfPk1/OzpM2e/9NzYuV5+cP377Yl4ZeryhfqLC9cXl1rLy625+nSnPbsw17rnI+y1/u2h6xqtBqB+/dUbc1evLtdPP3Nm2+6bI+8NPXp85PzYUyef7JWdHp+YmOorUxv8EO/+oRp325Eo4i8jxdPf+0n656GIIvY+Fnf57Oy3o1UnRqtOTI9PVB2Zbzc7K+XOyd5AFBH1vkqN3hgdwLnYk0bEatn8ssGjZfemFptLzSvzrfpkc2mlvdJe6EymbmvL/tSjiHMpYi0iNob6D3QkZxGvRorvHNtM/zIUMdAbhy9emvrqqdN3bkexr728i29V7awPRqwVD8E5O8SGooh/jBQ/fftE/OtQRC26X/GFiJfL/EHEm2W+EJHKD8bZiHeHHnSruV9qUcT/lef//GZ6eyii+pGprisXv1b/SufqQl/Z3nVl5/1hKyIeqvvDQTrk16bhKOKH1RV/M/2bn2sAAAAAAAAAAAAAAACAQ6SIX40Uz79zIlXzg2/NKW53rtUvN6/Md6f19eb+9eZMb21tbdVTNxs5Z3Ku5lzLuZ5zI2cUuX7ORs6ZnKs513Ku59zIGQO5fs5GzpmcqznXcq7n3MgZtVw/ZyPnTM7VnGs513Nu5IxDMncPAAAAAAAAAAAAAAAAAAD4eCmq/1J8+xubaWuou770THRz3XqgH3v/HwAA//9wn/vk")
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700)
mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000)
write$cgroup_int(r1, &(0x7f0000000200)=0x7, 0x12)

[   84.774612][ T5324] ------------[ cut here ]------------
[   84.777060][ T5324] workqueue: cannot queue hci_rx_work on wq hci0
[   84.779985][ T5324] WARNING: kernel/workqueue.c:2298 at __queue_work+0xd3f/0x1040, CPU#0: syz.0.0/5324
[   84.784140][ T5324] Modules linked in:
[   84.785928][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
[   84.790059][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   84.794309][ T5324] RIP: 0010:__queue_work+0xd67/0x1040
[   84.796565][ T5324] Code: a6 0e 49 8d 7d 18 48 89 f8 48 c1 e8 03 42 80 3c 20 00 74 05 e8 ba 61 a5 00 49 8b 75 18 49 81 c7 70 01 00 00 4c 89 f7 4c 89 fa <67> 48 0f b9 3a 4c 89 e8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ef
[   84.805049][ T5324] RSP: 0018:ffffc9000df2fb08 EFLAGS: 00010082
[   84.808257][ T5324] RAX: 1ffff110023a9178 RBX: 0000000000000008 RCX: 0000000000100000
[   84.811993][ T5324] RDX: ffff8880405cb170 RSI: ffffffff8a9e48c0 RDI: ffffffff9033f950
[   84.815435][ T5324] RBP: 0000000000000000 R08: ffff888011d48baf R09: 1ffff110023a9175
[   84.818971][ T5324] R10: dffffc0000000000 R11: ffffed10023a9176 R12: dffffc0000000000
[   84.822448][ T5324] R13: ffff888011d48ba8 R14: ffffffff9033f950 R15: ffff8880405cb170
[   84.825942][ T5324] FS:  00007f38dbbeb6c0(0000) GS:ffff88808c87c000(0000) knlGS:0000000000000000
[   84.829891][ T5324] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   84.832720][ T5324] CR2: 00007fcc8526b708 CR3: 00000000336fb000 CR4: 0000000000352ef0
[   84.836235][ T5324] Call Trace:
[   84.837801][ T5324]  <TASK>
[   84.839157][ T5324]  ? __pfx_do_raw_spin_lock+0x10/0x10
[   84.841596][ T5324]  ? rcu_is_watching+0x15/0xb0
[   84.843699][ T5324]  queue_work_on+0x106/0x1d0
[   84.845638][ T5324]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[   84.848158][ T5324]  hci_recv_frame+0x625/0x7c0
[   84.850210][ T5324]  vhci_write+0x358/0x4a0
[   84.852188][ T5324]  vfs_write+0x61d/0xb90
[   84.854040][ T5324]  ? __pfx_vfs_write+0x10/0x10
[   84.856182][ T5324]  ? __fget_files+0x2a/0x420
[   84.858318][ T5324]  ksys_write+0x150/0x270
[   84.860138][ T5324]  ? __pfx_ksys_write+0x10/0x10
[   84.862325][ T5324]  ? __pfx_kcov_ioctl+0x10/0x10
[   84.864605][ T5324]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   84.867262][ T5324]  do_syscall_64+0x15f/0xf80
[   84.869337][ T5324]  ? trace_irq_disable+0x3b/0x140
[   84.871732][ T5324]  ? clear_bhb_loop+0x40/0x90
[   84.873781][ T5324]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   84.876336][ T5324] RIP: 0033:0x7f38dad5d68e
[   84.878316][ T5324] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[   84.886557][ T5324] RSP: 002b:00007f38dbbeaf78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[   84.890439][ T5324] RAX: ffffffffffffffda RBX: 00007f38dbbeb6c0 RCX: 00007f38dad5d68e
[   84.894046][ T5324] RDX: 00000000000000ec RSI: 0000200000000180 RDI: 00000000000000ca
[   84.897562][ T5324] RBP: 00007f38dae32d6f R08: 0000000000000000 R09: 0000000000000000
[   84.901169][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   84.904834][ T5324] R13: 00007f38db016128 R14: 00007f38db016090 R15: 00007ffc0b1406f8
[   84.908380][ T5324]  </TASK>
[   84.909805][ T5324] Kernel panic - not syncing: kernel: panic_on_warn set ...
[   84.912769][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
[   84.916775][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   84.921131][ T5324] Call Trace:
[   84.922526][ T5324]  <TASK>
[   84.923872][ T5324]  vpanic+0x56c/0xa60
[   84.925650][ T5324]  ? __pfx__printk+0x10/0x10
[   84.927722][ T5324]  ? __pfx_vpanic+0x10/0x10
[   84.929743][ T5324]  ? is_bpf_text_address+0x292/0x2b0
[   84.931828][ T5324]  ? is_bpf_text_address+0x26/0x2b0
[   84.934132][ T5324]  panic+0xc5/0xd0
[   84.935803][ T5324]  ? __pfx_panic+0x10/0x10
[   84.937896][ T5324]  __warn+0x315/0x4c0
[   84.939611][ T5324]  ? __queue_work+0xd3f/0x1040
[   84.941747][ T5324]  ? __queue_work+0xd3f/0x1040
[   84.943961][ T5324]  __report_bug+0x29a/0x540
[   84.945919][ T5324]  ? finish_task_switch+0x41f/0xbe0
[   84.948080][ T5324]  ? __queue_work+0xd3f/0x1040
[   84.950085][ T5324]  ? __pfx___report_bug+0x10/0x10
[   84.952086][ T5324]  ? __schedule+0x1837/0x5740
[   84.954211][ T5324]  ? __pfx_hci_rx_work+0x10/0x10
[   84.956353][ T5324]  ? do_syscall_64+0x15f/0xf80
[   84.958318][ T5324]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   84.960712][ T5324]  report_bug_entry+0x19a/0x290
[   84.962779][ T5324]  ? __queue_work+0xd67/0x1040
[   84.964919][ T5324]  ? __queue_work+0xd6c/0x1040
[   84.967095][ T5324]  handle_bug+0xce/0x200
[   84.968885][ T5324]  exc_invalid_op+0x1a/0x50
[   84.970940][ T5324]  asm_exc_invalid_op+0x1a/0x20
[   84.973221][ T5324] RIP: 0010:__queue_work+0xd67/0x1040
[   84.975678][ T5324] Code: a6 0e 49 8d 7d 18 48 89 f8 48 c1 e8 03 42 80 3c 20 00 74 05 e8 ba 61 a5 00 49 8b 75 18 49 81 c7 70 01 00 00 4c 89 f7 4c 89 fa <67> 48 0f b9 3a 4c 89 e8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ef
[   84.983589][ T5324] RSP: 0018:ffffc9000df2fb08 EFLAGS: 00010082
[   84.986281][ T5324] RAX: 1ffff110023a9178 RBX: 0000000000000008 RCX: 0000000000100000
[   84.989976][ T5324] RDX: ffff8880405cb170 RSI: ffffffff8a9e48c0 RDI: ffffffff9033f950
[   84.993556][ T5324] RBP: 0000000000000000 R08: ffff888011d48baf R09: 1ffff110023a9175
[   84.996795][ T5324] R10: dffffc0000000000 R11: ffffed10023a9176 R12: dffffc0000000000
[   85.000175][ T5324] R13: ffff888011d48ba8 R14: ffffffff9033f950 R15: ffff8880405cb170
[   85.003511][ T5324]  ? __pfx_hci_rx_work+0x10/0x10
[   85.005620][ T5324]  ? __queue_work+0xd2c/0x1040
[   85.007701][ T5324]  ? __pfx_do_raw_spin_lock+0x10/0x10
[   85.010033][ T5324]  ? rcu_is_watching+0x15/0xb0
[   85.011956][ T5324]  queue_work_on+0x106/0x1d0
[   85.014079][ T5324]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[   85.016648][ T5324]  hci_recv_frame+0x625/0x7c0
[   85.018612][ T5324]  vhci_write+0x358/0x4a0
[   85.020414][ T5324]  vfs_write+0x61d/0xb90
[   85.022268][ T5324]  ? __pfx_vfs_write+0x10/0x10
[   85.024507][ T5324]  ? __fget_files+0x2a/0x420
[   85.026692][ T5324]  ksys_write+0x150/0x270
[   85.028929][ T5324]  ? __pfx_ksys_write+0x10/0x10
[   85.031829][ T5324]  ? __pfx_kcov_ioctl+0x10/0x10
[   85.034116][ T5324]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   85.036846][ T5324]  do_syscall_64+0x15f/0xf80
[   85.038877][ T5324]  ? trace_irq_disable+0x3b/0x140
[   85.041146][ T5324]  ? clear_bhb_loop+0x40/0x90
[   85.043308][ T5324]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   85.045886][ T5324] RIP: 0033:0x7f38dad5d68e
[   85.047844][ T5324] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[   85.055360][ T5324] RSP: 002b:00007f38dbbeaf78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[   85.058640][ T5324] RAX: ffffffffffffffda RBX: 00007f38dbbeb6c0 RCX: 00007f38dad5d68e
[   85.062166][ T5324] RDX: 00000000000000ec RSI: 0000200000000180 RDI: 00000000000000ca
[   85.065518][ T5324] RBP: 00007f38dae32d6f R08: 0000000000000000 R09: 0000000000000000
[   85.069026][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   85.072291][ T5324] R13: 00007f38db016128 R14: 00007f38db016090 R15: 00007ffc0b1406f8
[   85.075498][ T5324]  </TASK>
[   85.077086][ T5324] Kernel Offset: disabled
[   85.079071][ T5324] Rebooting in 86400 seconds..