program:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_bt_hci(r0, 0x400448cb, 0x0) (async)
r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000002c0), 0x40040, 0x0) (async, rerun: 32)
syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e0402030c"], 0x7) (rerun: 32)
ioctl$BTRFS_IOC_QUOTA_CTL(0xffffffffffffffff, 0xc0109428, 0x0) (async)
ioctl$SNAPSHOT_CREATE_IMAGE(r1, 0x40043311, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) (async)
r2 = socket$nl_route(0x10, 0x3, 0x0) (async)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) (async)
r3 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) (async)
ioctl(r2, 0x8b2b, &(0x7f0000000040)) (async)
mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000380)='.\x00', &(0x7f0000000100)='virtiofs\x00', 0x1200810, 0x0)
[ 74.244012][ T5299] Bluetooth: hci0: command tx timeout
[ 74.314122][ T5315] ------------[ cut here ]------------
[ 74.316559][ T5315] workqueue: cannot queue hci_rx_work on wq hci0
[ 74.319542][ T5315] WARNING: CPU: 0 PID: 5315 at kernel/workqueue.c:2258 __queue_work+0xd62/0xfe0
[ 74.323152][ T5315] Modules linked in:
[ 74.324824][ T5315] CPU: 0 UID: 0 PID: 5315 Comm: syz.0.0 Not tainted 6.15.0-rc7-syzkaller-00144-gb1427432d3b6 #0 PREEMPT(full)
[ 74.329562][ T5315] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 74.333961][ T5315] RIP: 0010:__queue_work+0xd62/0xfe0
[ 74.336137][ T5315] Code: 42 80 3c 20 00 74 08 4c 89 ef e8 49 df 96 00 49 8b 75 00 49 81 c7 78 01 00 00 48 c7 c7 e0 cc 69 8b 4c 89 fa e8 9f 40 f9 ff 90 <0f> 0b 90 90 e9 f1 f4 ff ff e8 00 e4 34 00 90 0f 0b 90 e9 dd fc ff
[ 74.343816][ T5315] RSP: 0018:ffffc9000f6b7a88 EFLAGS: 00010046
[ 74.346438][ T5315] RAX: 40e4c423a75ac400 RBX: 0000000000000000 RCX: ffff88801e242440
[ 74.349750][ T5315] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002
[ 74.352966][ T5315] RBP: 1ffff11008755f38 R08: ffff88801fe23e93 R09: 1ffff11003fc47d2
[ 74.356217][ T5315] R10: dffffc0000000000 R11: ffffed1003fc47d3 R12: dffffc0000000000
[ 74.359429][ T5315] R13: ffff888045a38a98 R14: ffff88801e242440 R15: ffff888043aaf978
[ 74.362624][ T5315] FS: 00007f11b47816c0(0000) GS:ffff88808d6c2000(0000) knlGS:0000000000000000
[ 74.366170][ T5315] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 74.368919][ T5315] CR2: 00007f11b4780fc8 CR3: 000000003ad78000 CR4: 0000000000352ef0
[ 74.372180][ T5315] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 74.375431][ T5315] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 74.378661][ T5315] Call Trace:
[ 74.380091][ T5315]
[ 74.381299][ T5315] ? rcu_is_watching+0x15/0xb0
[ 74.383267][ T5315] queue_work_on+0x181/0x270
[ 74.385316][ T5315] ? lockdep_hardirqs_on+0x9c/0x150
[ 74.387463][ T5315] ? __pfx_queue_work_on+0x10/0x10
[ 74.389630][ T5315] ? _raw_spin_unlock_irqrestore+0xad/0x110
[ 74.392186][ T5315] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 74.394865][ T5315] ? skb_queue_tail+0x30/0xf0
[ 74.396981][ T5315] hci_recv_frame+0x5ad/0x700
[ 74.398953][ T5315] ? skb_pull+0xc1/0x1d0
[ 74.400713][ T5315] vhci_write+0x358/0x4a0
[ 74.402512][ T5315] vfs_write+0x548/0xa90
[ 74.404361][ T5315] ? __pfx_vhci_write+0x10/0x10
[ 74.406379][ T5315] ? __pfx_vfs_write+0x10/0x10
[ 74.408303][ T5315] ? __fget_files+0x2a/0x420
[ 74.410278][ T5315] ksys_write+0x145/0x250
[ 74.412172][ T5315] ? rcu_is_watching+0x15/0xb0
[ 74.414356][ T5315] ? __pfx_ksys_write+0x10/0x10
[ 74.416510][ T5315] ? do_syscall_64+0xba/0x210
[ 74.418488][ T5315] do_syscall_64+0xf6/0x210
[ 74.420523][ T5315] ? clear_bhb_loop+0x60/0xb0
[ 74.422622][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 74.425102][ T5315] RIP: 0033:0x7f11b398d41f
[ 74.426969][ T5315] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
[ 74.435217][ T5315] RSP: 002b:00007f11b4781000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
[ 74.438785][ T5315] RAX: ffffffffffffffda RBX: 00007f11b3bb6160 RCX: 00007f11b398d41f
[ 74.442175][ T5315] RDX: 0000000000000007 RSI: 0000200000000040 RDI: 00000000000000ca
[ 74.445459][ T5315] RBP: 00007f11b3a10ab1 R08: 0000000000000000 R09: 0000000000000000
[ 74.448848][ T5315] R10: 0000200000000040 R11: 0000000000000293 R12: 0000000000000000
[ 74.452114][ T5315] R13: 0000000000000001 R14: 00007f11b3bb6160 R15: 00007ffcaa265d78
[ 74.455540][ T5315]
[ 74.456913][ T5315] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 74.460029][ T5315] CPU: 0 UID: 0 PID: 5315 Comm: syz.0.0 Not tainted 6.15.0-rc7-syzkaller-00144-gb1427432d3b6 #0 PREEMPT(full)
[ 74.465054][ T5315] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 74.469560][ T5315] Call Trace:
[ 74.471012][ T5315]
[ 74.472320][ T5315] dump_stack_lvl+0x99/0x250
[ 74.474309][ T5315] ? __asan_memcpy+0x40/0x70
[ 74.476295][ T5315] ? __pfx_dump_stack_lvl+0x10/0x10
[ 74.478465][ T5315] ? __pfx__printk+0x10/0x10
[ 74.480472][ T5315] panic+0x2db/0x790
[ 74.482151][ T5315] ? __pfx_panic+0x10/0x10
[ 74.484069][ T5315] ? show_trace_log_lvl+0x4fb/0x550
[ 74.486304][ T5315] __warn+0x31b/0x4b0
[ 74.488032][ T5315] ? __queue_work+0xd62/0xfe0
[ 74.490005][ T5315] ? __queue_work+0xd62/0xfe0
[ 74.491979][ T5315] report_bug+0x2be/0x4f0
[ 74.493913][ T5315] ? __queue_work+0xd62/0xfe0
[ 74.495909][ T5315] ? __queue_work+0xd62/0xfe0
[ 74.497910][ T5315] ? __queue_work+0xd64/0xfe0
[ 74.499882][ T5315] handle_bug+0x84/0x160
[ 74.501763][ T5315] exc_invalid_op+0x1a/0x50
[ 74.503721][ T5315] asm_exc_invalid_op+0x1a/0x20
[ 74.505796][ T5315] RIP: 0010:__queue_work+0xd62/0xfe0
[ 74.507835][ T5315] Code: 42 80 3c 20 00 74 08 4c 89 ef e8 49 df 96 00 49 8b 75 00 49 81 c7 78 01 00 00 48 c7 c7 e0 cc 69 8b 4c 89 fa e8 9f 40 f9 ff 90 <0f> 0b 90 90 e9 f1 f4 ff ff e8 00 e4 34 00 90 0f 0b 90 e9 dd fc ff
[ 74.515884][ T5315] RSP: 0018:ffffc9000f6b7a88 EFLAGS: 00010046
[ 74.518411][ T5315] RAX: 40e4c423a75ac400 RBX: 0000000000000000 RCX: ffff88801e242440
[ 74.521707][ T5315] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002
[ 74.525011][ T5315] RBP: 1ffff11008755f38 R08: ffff88801fe23e93 R09: 1ffff11003fc47d2
[ 74.528284][ T5315] R10: dffffc0000000000 R11: ffffed1003fc47d3 R12: dffffc0000000000
[ 74.531651][ T5315] R13: ffff888045a38a98 R14: ffff88801e242440 R15: ffff888043aaf978
[ 74.534904][ T5315] ? __queue_work+0xd61/0xfe0
[ 74.536957][ T5315] ? rcu_is_watching+0x15/0xb0
[ 74.539086][ T5315] queue_work_on+0x181/0x270
[ 74.541087][ T5315] ? lockdep_hardirqs_on+0x9c/0x150
[ 74.543257][ T5315] ? __pfx_queue_work_on+0x10/0x10
[ 74.545456][ T5315] ? _raw_spin_unlock_irqrestore+0xad/0x110
[ 74.547915][ T5315] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 74.550534][ T5315] ? skb_queue_tail+0x30/0xf0
[ 74.552569][ T5315] hci_recv_frame+0x5ad/0x700
[ 74.554587][ T5315] ? skb_pull+0xc1/0x1d0
[ 74.556341][ T5315] vhci_write+0x358/0x4a0
[ 74.558203][ T5315] vfs_write+0x548/0xa90
[ 74.560163][ T5315] ? __pfx_vhci_write+0x10/0x10
[ 74.562151][ T5315] ? __pfx_vfs_write+0x10/0x10
[ 74.564488][ T5315] ? __fget_files+0x2a/0x420
[ 74.566599][ T5315] ksys_write+0x145/0x250
[ 74.568616][ T5315] ? rcu_is_watching+0x15/0xb0
[ 74.570713][ T5315] ? __pfx_ksys_write+0x10/0x10
[ 74.573227][ T5315] ? do_syscall_64+0xba/0x210
[ 74.575725][ T5315] do_syscall_64+0xf6/0x210
[ 74.578063][ T5315] ? clear_bhb_loop+0x60/0xb0
[ 74.580111][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 74.582649][ T5315] RIP: 0033:0x7f11b398d41f
[ 74.584708][ T5315] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
[ 74.592573][ T5315] RSP: 002b:00007f11b4781000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
[ 74.595970][ T5315] RAX: ffffffffffffffda RBX: 00007f11b3bb6160 RCX: 00007f11b398d41f
[ 74.599305][ T5315] RDX: 0000000000000007 RSI: 0000200000000040 RDI: 00000000000000ca
[ 74.602578][ T5315] RBP: 00007f11b3a10ab1 R08: 0000000000000000 R09: 0000000000000000
[ 74.605944][ T5315] R10: 0000200000000040 R11: 0000000000000293 R12: 0000000000000000
[ 74.609308][ T5315] R13: 0000000000000001 R14: 00007f11b3bb6160 R15: 00007ffcaa265d78
[ 74.612584][ T5315]
[ 74.614206][ T5315] Kernel Offset: disabled
[ 74.616068][ T5315] Rebooting in 86400 seconds..