program:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_bt_hci(r0, 0x400448cb, 0x0)
syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043e1f1b"], 0x22)
syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e0402030c"], 0x7)
syz_emit_vhci(&(0x7f0000000240)=ANY=[@ANYBLOB="043e0b1a"], 0xe)
[ 85.560500][ T4681] Bluetooth: hci0: command tx timeout
[ 85.611299][ T5340] ------------[ cut here ]------------
[ 85.614605][ T5340] workqueue: cannot queue hci_rx_work on wq hci0
[ 85.617642][ T5340] WARNING: kernel/workqueue.c:2252 at 0x0, CPU#0: syz.0.0/5340
[ 85.621034][ T5340] Modules linked in:
[ 85.623020][ T5340] CPU: 0 UID: 0 PID: 5340 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 85.627419][ T5340] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 85.632320][ T5340] RIP: 0010:__queue_work+0xd4b/0xf90
[ 85.634880][ T5340] Code: 83 c5 18 4c 89 e8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ef e8 f6 ed 9e 00 49 8b 75 00 49 81 c7 78 01 00 00 4c 89 f7 4c 89 fa <67> 48 0f b9 3a 48 83 c4 58 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc
[ 85.643406][ T5340] RSP: 0018:ffffc9000a697a70 EFLAGS: 00010086
[ 85.646010][ T5340] RAX: 1ffff110023bb97b RBX: 0000000000000008 RCX: 0000000000100000
[ 85.649634][ T5340] RDX: ffff888036a42978 RSI: ffffffff8a569090 RDI: ffffffff8fa50110
[ 85.653311][ T5340] RBP: 0000000000000000 R08: ffff888011ddcbc7 R09: 1ffff110023bb978
[ 85.656933][ T5340] R10: dffffc0000000000 R11: ffffed10023bb979 R12: dffffc0000000000
[ 85.660550][ T5340] R13: ffff888011ddcbd8 R14: ffffffff8fa50110 R15: ffff888036a42978
[ 85.664818][ T5340] FS: 00007fab825d46c0(0000) GS:ffff88808d22f000(0000) knlGS:0000000000000000
[ 85.668973][ T5340] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 85.672656][ T5340] CR2: 00007fe34393e6c8 CR3: 0000000011844000 CR4: 0000000000352ef0
[ 85.676534][ T5340] Call Trace:
[ 85.678107][ T5340]
[ 85.679435][ T5340] ? rcu_is_watching+0x15/0xb0
[ 85.681662][ T5340] queue_work_on+0x181/0x270
[ 85.683641][ T5340] ? lockdep_hardirqs_on+0x98/0x140
[ 85.686042][ T5340] ? __pfx_queue_work_on+0x10/0x10
[ 85.688417][ T5340] ? _raw_spin_unlock_irqrestore+0xad/0x110
[ 85.691112][ T5340] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 85.693887][ T5340] ? skb_queue_tail+0x30/0xf0
[ 85.695862][ T5340] hci_recv_frame+0x625/0x7c0
[ 85.698122][ T5340] ? skb_pull+0xc1/0x1d0
[ 85.700226][ T5340] vhci_write+0x358/0x4a0
[ 85.702278][ T5340] vfs_write+0x5c9/0xb30
[ 85.704238][ T5340] ? __pfx_vhci_write+0x10/0x10
[ 85.706461][ T5340] ? __pfx_vfs_write+0x10/0x10
[ 85.708641][ T5340] ? __fget_files+0x2a/0x420
[ 85.710719][ T5340] ksys_write+0x145/0x250
[ 85.712639][ T5340] ? __pfx_ksys_write+0x10/0x10
[ 85.714933][ T5340] ? do_syscall_64+0xbe/0xf80
[ 85.717151][ T5340] do_syscall_64+0xfa/0xf80
[ 85.719227][ T5340] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.721984][ T5340] ? clear_bhb_loop+0x60/0xb0
[ 85.724104][ T5340] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.726760][ T5340] RIP: 0033:0x7fab8618e27f
[ 85.728884][ T5340] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
[ 85.737470][ T5340] RSP: 002b:00007fab825d4000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
[ 85.741205][ T5340] RAX: ffffffffffffffda RBX: 00007fab863e6090 RCX: 00007fab8618e27f
[ 85.744588][ T5340] RDX: 0000000000000007 RSI: 0000200000000040 RDI: 00000000000000ca
[ 85.748004][ T5340] RBP: 00007fab86213f91 R08: 0000000000000000 R09: 0000000000000000
[ 85.751584][ T5340] R10: 0000200000000040 R11: 0000000000000293 R12: 0000000000000000
[ 85.755037][ T5340] R13: 00007fab863e6128 R14: 00007fab863e6090 R15: 00007ffc8678c238
[ 85.758459][ T5340]
[ 85.759906][ T5340] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 85.763248][ T5340] CPU: 0 UID: 0 PID: 5340 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 85.767088][ T5340] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 85.771933][ T5340] Call Trace:
[ 85.773325][ T5340]
[ 85.774758][ T5340] dump_stack_lvl+0x99/0x250
[ 85.776765][ T5340] ? __asan_memcpy+0x40/0x70
[ 85.778896][ T5340] ? __pfx_dump_stack_lvl+0x10/0x10
[ 85.781242][ T5340] ? __pfx__printk+0x10/0x10
[ 85.783469][ T5340] vpanic+0x237/0x6d0
[ 85.785273][ T5340] ? __pfx_vpanic+0x10/0x10
[ 85.787355][ T5340] ? is_bpf_text_address+0x292/0x2b0
[ 85.789692][ T5340] ? is_bpf_text_address+0x26/0x2b0
[ 85.792002][ T5340] panic+0xb9/0xc0
[ 85.793951][ T5340] ? __pfx_panic+0x10/0x10
[ 85.796208][ T5340] __warn+0x317/0x4b0
[ 85.798142][ T5340] __report_bug+0x288/0x500
[ 85.800336][ T5340] ? stack_depot_save_flags+0x40/0x850
[ 85.802856][ T5340] ? __pfx___report_bug+0x10/0x10
[ 85.805189][ T5340] ? kasan_save_track+0x4f/0x80
[ 85.807473][ T5340] ? __pfx_hci_rx_work+0x10/0x10
[ 85.809634][ T5340] ? __lock_acquire+0x6b6/0x2cf0
[ 85.811919][ T5340] report_bug_entry+0x16a/0x220
[ 85.814144][ T5340] ? __queue_work+0xd4b/0xf90
[ 85.816274][ T5340] ? __queue_work+0xd50/0xf90
[ 85.818344][ T5340] handle_bug+0xca/0x200
[ 85.820302][ T5340] exc_invalid_op+0x1a/0x50
[ 85.822442][ T5340] asm_exc_invalid_op+0x1a/0x20
[ 85.824622][ T5340] RIP: 0010:__queue_work+0xd4b/0xf90
[ 85.826994][ T5340] Code: 83 c5 18 4c 89 e8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ef e8 f6 ed 9e 00 49 8b 75 00 49 81 c7 78 01 00 00 4c 89 f7 4c 89 fa <67> 48 0f b9 3a 48 83 c4 58 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc
[ 85.834661][ T5340] RSP: 0018:ffffc9000a697a70 EFLAGS: 00010086
[ 85.837155][ T5340] RAX: 1ffff110023bb97b RBX: 0000000000000008 RCX: 0000000000100000
[ 85.840592][ T5340] RDX: ffff888036a42978 RSI: ffffffff8a569090 RDI: ffffffff8fa50110
[ 85.844231][ T5340] RBP: 0000000000000000 R08: ffff888011ddcbc7 R09: 1ffff110023bb978
[ 85.847826][ T5340] R10: dffffc0000000000 R11: ffffed10023bb979 R12: dffffc0000000000
[ 85.851432][ T5340] R13: ffff888011ddcbd8 R14: ffffffff8fa50110 R15: ffff888036a42978
[ 85.855050][ T5340] ? __pfx_hci_rx_work+0x10/0x10
[ 85.857324][ T5340] ? rcu_is_watching+0x15/0xb0
[ 85.859445][ T5340] queue_work_on+0x181/0x270
[ 85.861793][ T5340] ? lockdep_hardirqs_on+0x98/0x140
[ 85.864896][ T5340] ? __pfx_queue_work_on+0x10/0x10
[ 85.867790][ T5340] ? _raw_spin_unlock_irqrestore+0xad/0x110
[ 85.870665][ T5340] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 85.873669][ T5340] ? skb_queue_tail+0x30/0xf0
[ 85.875799][ T5340] hci_recv_frame+0x625/0x7c0
[ 85.877961][ T5340] ? skb_pull+0xc1/0x1d0
[ 85.879934][ T5340] vhci_write+0x358/0x4a0
[ 85.881936][ T5340] vfs_write+0x5c9/0xb30
[ 85.883898][ T5340] ? __pfx_vhci_write+0x10/0x10
[ 85.886144][ T5340] ? __pfx_vfs_write+0x10/0x10
[ 85.888353][ T5340] ? __fget_files+0x2a/0x420
[ 85.890460][ T5340] ksys_write+0x145/0x250
[ 85.892503][ T5340] ? __pfx_ksys_write+0x10/0x10
[ 85.894939][ T5340] ? do_syscall_64+0xbe/0xf80
[ 85.897508][ T5340] do_syscall_64+0xfa/0xf80
[ 85.899802][ T5340] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.902543][ T5340] ? clear_bhb_loop+0x60/0xb0
[ 85.904704][ T5340] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.907690][ T5340] RIP: 0033:0x7fab8618e27f
[ 85.909874][ T5340] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
[ 85.918631][ T5340] RSP: 002b:00007fab825d4000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
[ 85.922283][ T5340] RAX: ffffffffffffffda RBX: 00007fab863e6090 RCX: 00007fab8618e27f
[ 85.925884][ T5340] RDX: 0000000000000007 RSI: 0000200000000040 RDI: 00000000000000ca
[ 85.929188][ T5340] RBP: 00007fab86213f91 R08: 0000000000000000 R09: 0000000000000000
[ 85.932748][ T5340] R10: 0000200000000040 R11: 0000000000000293 R12: 0000000000000000
[ 85.936579][ T5340] R13: 00007fab863e6128 R14: 00007fab863e6090 R15: 00007ffc8678c238
[ 85.940183][ T5340]
[ 85.941947][ T5340] Kernel Offset: disabled
[ 85.943877][ T5340] Rebooting in 86400 seconds..