program:
syz_usb_connect$hid(0x3, 0x36, 0x0, 0x0) (async)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000180), r0)
sendmsg$NLBL_MGMT_C_ADD(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000ec0)={0x114, r1, 0xe701ac47a3d23ecd, 0x0, 0x0, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}, @NLBL_MGMT_A_DOMAIN={0xce, 0x1, 'C\xec\xf8\xa0w\x15|\xd8\xbcs\xe1\xb93\x14\xcd\xcb\xb6\xb9\xbb\x84\xe5\xbc\xdb\x7f\x9a\xf2\xea\xcc\x91:v@\xe83-\x1d\xaagQl\x7f\tKt\fc\x1f\x17]\xd5\xd0\xf0\xa8\xeb\xd2g\x92\x04\x00\x00\x00od\xe6,\xd3@I\x17\xf3\xbees0\xad\xc6\xbf/*\xb6(o\x91t\x12\x93U6\xf4@n\xdc\xdc\x8a7y\x81FY\xbe\xbbc\xd2\xc3\x01\xa5\xe2V\x8c\xb3im~\xd2V\xdaG\xbdbF\xc8n\x86\xac\x9c\xfb\xda\xe2&\"\xb4:\x13\xe9\tc\x85\xb4\xcb\x17\xbfm\x846\xe7\x7fp\x9eCdb\xad;\xa2\x8fs\xbf6\xe8\xe3Xg3&\xe2 \xd6\n\x9d=~<\x93/\xaf\x89\x06+\x96]\xb5+\xee\xff8^D*\xdb\xb8\xd8t\x80\xd4\x8fK=E0\xe8R\x83'}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @dev}, @NLBL_MGMT_A_IPV6MASK={0x11, 0x6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}]}, 0x114}}, 0x0)
syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e1f0a"], 0x22) (async)
syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904"], 0x0) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000e00)='./sys\x00', &(0x7f0000000f00)='sysfs\x00', 0x0, 0x0)
r2 = openat$autofs(0xffffffffffffff9c, &(0x7f00000000c0), 0x80000, 0x0) (async)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@ipv6_newroute={0x60, 0x18, 0x401, 0x0, 0x0, {0xa, 0x40, 0x0, 0x0, 0xfe, 0x2, 0x0, 0x1}, [@RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, '\x00', 0x2}}, @RTA_OIF={0x8, 0x4, 0x2}, @RTA_ENCAP_TYPE={0x6, 0x15, 0x8}, @RTA_ENCAP={0x20, 0x16, 0x0, 0x1, @RPL_IPTUNNEL_SRH={0x1c, 0x1, {0x0, 0x2, 0x1, 0x1, 0x0, [@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01']}}}]}, 0x60}}, 0x0) (async)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r2, 0xc0189375, &(0x7f0000000100)={{0x1, 0x1, 0x18, r3}, './sys/devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.0/modalias\x00'})
r4 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./sys/devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.0/modalias\x00', 0x0, 0x0)
read(r4, &(0x7f0000001100)=""/64, 0x40) (async)
syz_emit_vhci(&(0x7f0000000080)=ANY=[@ANYBLOB="0406"], 0x7)
[ 86.326073][ T4641] Bluetooth: hci0: unexpected event 0x06 length: 4 > 3
[ 86.438975][ T4641] Bluetooth: hci0: command tx timeout
[ 86.569227][ T804] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 86.699019][ T804] usb 5-1: device descriptor read/64, error -71
[ 86.939222][ T804] usb 5-1: new high-speed USB device number 3 using dummy_hcd
[ 87.069036][ T804] usb 5-1: device descriptor read/64, error -71
[ 87.180273][ T804] usb usb5-port1: attempt power cycle
[ 87.519034][ T804] usb 5-1: new high-speed USB device number 4 using dummy_hcd
[ 87.539547][ T804] usb 5-1: device descriptor read/8, error -71
[ 87.779018][ T804] usb 5-1: new high-speed USB device number 5 using dummy_hcd
[ 87.799577][ T804] usb 5-1: device descriptor read/8, error -71
[ 87.909343][ T804] usb usb5-port1: unable to enumerate USB device
[ 88.362036][ T5276] ------------[ cut here ]------------
[ 88.364347][ T5276] refcnt < 0
[ 88.364359][ T5276] WARNING: net/bluetooth/hci_conn.c:631 at hci_conn_timeout+0xff/0x2c0, CPU#0: kworker/u5:2/5276
[ 88.370316][ T5276] Modules linked in:
[ 88.372352][ T5276] CPU: 0 UID: 0 PID: 5276 Comm: kworker/u5:2 Not tainted syzkaller #0 PREEMPT(full)
[ 88.376017][ T5276] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 88.380203][ T5276] Workqueue: hci0 hci_conn_timeout
[ 88.382296][ T5276] RIP: 0010:hci_conn_timeout+0xff/0x2c0
[ 88.384505][ T5276] Code: 48 89 df e8 c3 cc 09 00 eb 07 e8 3c 2d ff f6 b0 13 0f b6 f0 48 89 df 5b 41 5c 41 5e 41 5f 5d e9 b7 a0 fe ff e8 22 2d ff f6 90 <0f> 0b 90 eb 8c 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 31 ff ff ff
[ 88.392769][ T5276] RSP: 0018:ffffc9000df97ad0 EFLAGS: 00010293
[ 88.395279][ T5276] RAX: ffffffff8ac7e4be RBX: ffff888012ecc000 RCX: ffff888012bc8000
[ 88.398373][ T5276] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000
[ 88.401626][ T5276] RBP: 00000000ffffffff R08: ffff888012ecc013 R09: 1ffff110025d9802
[ 88.404838][ T5276] R10: dffffc0000000000 R11: ffffed10025d9803 R12: dffffc0000000000
[ 88.408058][ T5276] R13: dffffc0000000000 R14: ffff888012ecca40 R15: ffff888012ecc010
[ 88.411351][ T5276] FS: 0000000000000000(0000) GS:ffff88808c53e000(0000) knlGS:0000000000000000
[ 88.415129][ T5276] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 88.417728][ T5276] CR2: 00007fc626f8dd80 CR3: 000000001d367000 CR4: 0000000000352ef0
[ 88.420944][ T5276] Call Trace:
[ 88.422395][ T5276]
[ 88.423599][ T5276] ? process_scheduled_works+0xa20/0x14e0
[ 88.426047][ T5276] process_scheduled_works+0xa8e/0x14e0
[ 88.428661][ T5276] ? __pfx_process_scheduled_works+0x10/0x10
[ 88.431286][ T5276] ? assign_work+0x3cf/0x5d0
[ 88.433119][ T5276] worker_thread+0xa47/0xfb0
[ 88.434985][ T5276] ? __kthread_parkme+0x71/0x1f0
[ 88.436928][ T5276] kthread+0x388/0x470
[ 88.438521][ T5276] ? __pfx_worker_thread+0x10/0x10
[ 88.441012][ T5276] ? __pfx_kthread+0x10/0x10
[ 88.442778][ T5276] ret_from_fork+0x514/0xb70
[ 88.444994][ T5276] ? __pfx_ret_from_fork+0x10/0x10
[ 88.447668][ T5276] ? __switch_to+0xc89/0x1420
[ 88.450784][ T5276] ? __pfx_kthread+0x10/0x10
[ 88.453099][ T5276] ret_from_fork_asm+0x1a/0x30
[ 88.455485][ T5276]
[ 88.457151][ T5276] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 88.460828][ T5276] CPU: 0 UID: 0 PID: 5276 Comm: kworker/u5:2 Not tainted syzkaller #0 PREEMPT(full)
[ 88.465003][ T5276] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 88.469287][ T5276] Workqueue: hci0 hci_conn_timeout
[ 88.471595][ T5276] Call Trace:
[ 88.473166][ T5276]
[ 88.474471][ T5276] vpanic+0x56c/0xa60
[ 88.476269][ T5276] ? __pfx__printk+0x10/0x10
[ 88.478138][ T5276] ? __pfx_vpanic+0x10/0x10
[ 88.479996][ T5276] ? is_bpf_text_address+0x292/0x2b0
[ 88.482135][ T5276] ? is_bpf_text_address+0x26/0x2b0
[ 88.484298][ T5276] panic+0xc5/0xd0
[ 88.485949][ T5276] ? __pfx_panic+0x10/0x10
[ 88.487825][ T5276] ? ret_from_fork_asm+0x1a/0x30
[ 88.489900][ T5276] __warn+0x315/0x4c0
[ 88.491455][ T5276] ? hci_conn_timeout+0xff/0x2c0
[ 88.493622][ T5276] ? hci_conn_timeout+0xff/0x2c0
[ 88.495777][ T5276] __report_bug+0x276/0x570
[ 88.497776][ T5276] ? hci_conn_timeout+0xff/0x2c0
[ 88.499895][ T5276] ? __pfx___report_bug+0x10/0x10
[ 88.502085][ T5276] ? add_lock_to_list+0xc7/0x100
[ 88.504128][ T5276] ? lockdep_unlock+0x5d/0xd0
[ 88.506027][ T5276] ? __lock_acquire+0x13e8/0x2cf0
[ 88.508087][ T5276] ? hci_conn_timeout+0xff/0x2c0
[ 88.510109][ T5276] report_bug+0x16a/0x220
[ 88.511864][ T5276] ? hci_conn_timeout+0xff/0x2c0
[ 88.513887][ T5276] ? hci_conn_timeout+0x101/0x2c0
[ 88.516089][ T5276] handle_bug+0x9c/0x200
[ 88.518099][ T5276] exc_invalid_op+0x1a/0x50
[ 88.520172][ T5276] asm_exc_invalid_op+0x1a/0x20
[ 88.522476][ T5276] RIP: 0010:hci_conn_timeout+0xff/0x2c0
[ 88.525080][ T5276] Code: 48 89 df e8 c3 cc 09 00 eb 07 e8 3c 2d ff f6 b0 13 0f b6 f0 48 89 df 5b 41 5c 41 5e 41 5f 5d e9 b7 a0 fe ff e8 22 2d ff f6 90 <0f> 0b 90 eb 8c 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 31 ff ff ff
[ 88.533470][ T5276] RSP: 0018:ffffc9000df97ad0 EFLAGS: 00010293
[ 88.536123][ T5276] RAX: ffffffff8ac7e4be RBX: ffff888012ecc000 RCX: ffff888012bc8000
[ 88.539436][ T5276] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000
[ 88.542761][ T5276] RBP: 00000000ffffffff R08: ffff888012ecc013 R09: 1ffff110025d9802
[ 88.545895][ T5276] R10: dffffc0000000000 R11: ffffed10025d9803 R12: dffffc0000000000
[ 88.549133][ T5276] R13: dffffc0000000000 R14: ffff888012ecca40 R15: ffff888012ecc010
[ 88.552279][ T5276] ? hci_conn_timeout+0xfe/0x2c0
[ 88.554349][ T5276] ? process_scheduled_works+0xa20/0x14e0
[ 88.556492][ T5276] process_scheduled_works+0xa8e/0x14e0
[ 88.558561][ T5276] ? __pfx_process_scheduled_works+0x10/0x10
[ 88.560975][ T5276] ? assign_work+0x3cf/0x5d0
[ 88.562732][ T5276] worker_thread+0xa47/0xfb0
[ 88.564621][ T5276] ? __kthread_parkme+0x71/0x1f0
[ 88.566400][ T5276] kthread+0x388/0x470
[ 88.567752][ T5276] ? __pfx_worker_thread+0x10/0x10
[ 88.569713][ T5276] ? __pfx_kthread+0x10/0x10
[ 88.571720][ T5276] ret_from_fork+0x514/0xb70
[ 88.574561][ T5276] ? __pfx_ret_from_fork+0x10/0x10
[ 88.576830][ T5276] ? __switch_to+0xc89/0x1420
[ 88.578797][ T5276] ? __pfx_kthread+0x10/0x10
[ 88.580744][ T5276] ret_from_fork_asm+0x1a/0x30
[ 88.582831][ T5276]
[ 88.584601][ T5276] Kernel Offset: disabled
[ 88.586521][ T5276] Rebooting in 86400 seconds..