program: r0 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x48, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r3, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0xff, 0x2, 0x0, 0x2}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40000}, 0x44080) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)=@newqdisc={0x34, 0x24, 0xd0f, 0x70bd29, 0x0, {0x60, 0x0, 0x0, r3, {}, {0xffe0, 0xa}, {0x1, 0x10}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x55}, 0x4000) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f0000000180)="a6bea8a120e5f8320c30ce5088a8", 0xe, 0x0, &(0x7f0000000140)={0x11, 0x86dd, r3, 0x1, 0x0, 0x6, @local}, 0x14) syz_mount_image$hfsplus(&(0x7f0000000040), &(0x7f0000000200)='./file0\x00', 0x3200014, &(0x7f0000000280)=ANY=[@ANYRES64=0x0, @ANYRES32, @ANYRES32], 0x1, 0x600, &(0x7f00000002c0)="$eJzs3U9oHNcdB/DvrFey5IKjJHZiSqAihrRU1NYflFa9xC2l6BBKSA89C1uOhddKkJSihFLU/9ceci2kB916KvRuaM/NLVcdA4VechL0oDKzs9LKWikr29Gu7M/HvH3v7Zt5781v/ml2MRvgubU4lebDFFmcenuzrO9sz7V2tucu1s2tJGW5kTTbWYrVpPmX5FbaKSNd3RXHjfPJysK7n3+580W71qxTtXzjcBePY6tOmUxyoc6POmGYvb1j+7t9bH/9KvYjUwbseplvPVGH8HTsHdE5Mv/Xz+rHnu/A+VG075tHTCSXkozVfwekvjo0znZ2T5/7LwAAAM+DF3azm81cHvQ8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4Dypf/+/qFOjU55M0fn9/9H6vdTlc6Y4VHs4sHkAAAAAAAAAwNPzrd3sZjOXO/W9ovrO//WqcqV6/UY+zHqWs5Yb2cxSNrKRtcwkmejqaHRzaWNjbaaPNWd7rjl7NtsLAAAAAAAAAM+o32bx4Pt/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBkVyoZ1V6UqnPJFGM8lYktFyua3ks075PHs46AkAAADAGXhhN7vZzOVOfa+onvlfqZ77x/JhVrORlWykleXcqT4LaD/1N3a251o723MPynS03x/991TTqHpM+7OH3iNfq5YYz92sVO/cyO28n1bupFGtWbrWmU/vef2mnFPxVlvR58zu1Hm5/J/rfDhMVBEZ2Y/IdD23MhovnhyJU+6dR0eaSWP/k58rp4j5W32Od6nOy+3541DHfLY++j4rz5mTI5F8+x9/+8W91ur9e3fXp4Znkx5THYmtZh2Jua7z8NXnKhLTVSSu7tcX89P8PFOZzDtZy0p+maVsZDmT+UlVWqqP5/J14uRI3TpUe+erZjJa75f2VfR0c3q9WvdyVvKzvJ87Wc6b1b/ZzOT7mc98Frr28NU+zvrG6c7669+pC+NJ/lTnw6GM64tdce2+5k5Ubd3vHETppeOjVDzmtbH5zbpQjvG7Oh8Oj0ZipisSL598vPx1r3xdb63eX7u39EGf471R52Uo/zBUd4nyeHmp3FlV7fDRUba93LNtpmq7st/WONJ2db+t55m61hl/oVr6lZ49zVZtr/Zsm6varnW19fp7C4Chd+m7l0bH/zP+7/FPx38/fm/87bEfX/zBxddGM/KvkR82py+80Xit+Hs+za8Pnv8BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDHt/7Rx/eXWq3ltQEXivqHfIZlPgpffyFjQzENhd57B3jG3dx48MHN9Y8+/t7Kg6X3lt9bXh2Zn1+YXph/c+7m3ZXW8nT7ddCzBL4OBzf9Qc8EAAAAAAAAAAAA6NdZ/HeCQW8jAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcL4tTqX5MEVmpm9Ml/Wd7blWmTrlgyWbSRpJil8lxT+TW2mnTHR1Vxw3zicrC+9+/uXOFwd9NTvLN05ar6eRR9/YqlMmk1yo8ydwqL/bT9xfsb+FZcCudwIHg/b/AAAA///SZQzG") bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000000340)=ANY=[@ANYBLOB="bf1600"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x4a, '\x00', 0x0, @fallback=0x2c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x13, 0x4, &(0x7f0000000080)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x0, 0x1, 0xbe}]}, &(0x7f0000000240)='GPL\x00'}, 0x90) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r5, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x803}, 0xe) syz_emit_vhci(&(0x7f0000000340)=ANY=[@ANYBLOB="02c82028002400010007d3040007c4faff020c04000300d3"], 0x2d) ioctl$NILFS_IOCTL_GET_CPINFO(r1, 0x80186e82, &(0x7f0000000b40)={&(0x7f0000000900)=[{0x3, 0x0, 0x7fff, 0x100000000, 0x18d, 0x8, 0xb166, 0x3}, {0x2, 0x0, 0x5, 0x10, 0x10001, 0xb, 0xfffffffffffffffd, 0x8}, {0x3, 0x0, 0x447f, 0x200, 0x0, 0x0, 0x1000, 0x8}, {0x2, 0x0, 0x8, 0x8, 0x200, 0x4, 0xffffffffffffffff, 0x81}, {0x0, 0x0, 0x3, 0x3ff, 0x0, 0x5, 0x1ff, 0x6}, {0x3, 0x0, 0x6, 0x1000, 0x10, 0xff, 0x7, 0x2}, {0x1, 0x0, 0x8, 0x3, 0x7, 0xc, 0x7, 0x1ca}, {0x0, 0x0, 0x2, 0xde8, 0x7ad3, 0x8, 0x5, 0xf}, {0x1, 0x0, 0x4, 0x4, 0x7, 0x8000, 0x7, 0xf8}, {0x1, 0x0, 0x8, 0xa, 0xe46, 0x2, 0x7, 0x4}], 0xa, 0x38, 0x1, 0x2}) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) open$dir(&(0x7f00000002c0)='./control/file0\x00', 0xc4540, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(0xffffffffffffffff, 0x28, 0x2, &(0x7f00000008c0)=0x1, 0x8) syz_read_part_table(0x618, &(0x7f0000000000)="$eJzs281rHHUYB/Bn9mV2NyrBv8DipbGXFha9lBYkhEWEpiDaHqTai/Sypxw8ra66Ij2k9aAWeomHghgDvXiSIhRKSYpQiBdF8JSIBAXBgxjRkXnZJBtEVNZD4fM5zDy/PM/M95fd2eMED7RafPx21PMqax3uFX9oFGWWH5KyGFYXRsTzq+cWXnjz7NNlr7D767sR0czq5XJ8187EKaJ7q9FfXm3FkxHx6ZHffnyoCEpjWNw30rh3/UK0I2rp326/ii22VP+rgace+eefBf/e3NKx28lwc7w8OdM/fymNJ2pr93fz9R/l1984fNmReG46+TdP3Z1tV/VXvcFW7/vazz/1zlxbOZ5ejUh2ThSdiUdjZvzUJFPI7/9+Lv3kxp350Xanuz7eyGChWVWXL+5mpQO/roenkAsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwP9jbunY7ceSzUc/68SHG6c3Ts70z19aOzr/+tr9s82I+Cip5o63ynOyf+kb08i/eeru7FujLIvZfDXY6v0Qi43emWsrp9OrnTi6c6Kae7k4Ln/9yqvlOttoRzqF/H4nIm7cmR9td7rrzy4uvteM92MQn49ea0REevlidMrBJI+rpfHlBy9lEa0pRAMAAAAAAAAAAAAAAAAAAMCehVY0xvWLaUSsPPNNXmetuLI3lEY8XpXftvJmRPdWo7+82nvnylzVqN6IH9YihhHx3b3rFw7ErLfLc571xX4Zv2RZNrmh4bhYqk82Jt72T/LB9n/+rxn7MwAA//8VUHbI") [ 85.760624][ T44] Bluetooth: hci0: command tx timeout [ 85.947890][ T5327] loop0: detected capacity change from 0 to 1024 [ 86.057773][ T5313] ------------[ cut here ]------------ [ 86.060264][ T5313] workqueue: cannot queue hci_tx_work on wq hci0 [ 86.063203][ T5313] WARNING: kernel/workqueue.c:2298 at __queue_work+0xd3f/0x1040, CPU#0: kworker/0:5/5313 [ 86.067500][ T5313] Modules linked in: [ 86.069368][ T5313] CPU: 0 UID: 0 PID: 5313 Comm: kworker/0:5 Not tainted syzkaller #0 PREEMPT(full) [ 86.073423][ T5313] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 86.077839][ T5313] Workqueue: events l2cap_info_timeout [ 86.080233][ T5313] RIP: 0010:__queue_work+0xd67/0x1040 [ 86.082531][ T5313] Code: a6 0e 49 8d 7d 18 48 89 f8 48 c1 e8 03 42 80 3c 20 00 74 05 e8 ba 5d a5 00 49 8b 75 18 49 81 c7 70 01 00 00 4c 89 f7 4c 89 fa <67> 48 0f b9 3a 4c 89 e8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ef [ 86.091419][ T5313] RSP: 0018:ffffc9000f02f820 EFLAGS: 00010082 [ 86.094136][ T5313] RAX: 1ffff1100257f18a RBX: 0000000000000008 RCX: ffff88801f5f8000 [ 86.097500][ T5313] RDX: ffff888043287170 RSI: ffffffff8a9e2d90 RDI: ffffffff9033e950 [ 86.101131][ T5313] RBP: 0000000000000020 R08: ffff888012bf8c3f R09: 1ffff1100257f187 [ 86.104273][ T5313] R10: dffffc0000000000 R11: ffffed100257f188 R12: dffffc0000000000 [ 86.107612][ T5313] R13: ffff888012bf8c38 R14: ffffffff9033e950 R15: ffff888043287170 [ 86.111425][ T5313] FS: 0000000000000000(0000) GS:ffff88808c87f000(0000) knlGS:0000000000000000 [ 86.115976][ T5313] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 86.118883][ T5313] CR2: 00007f4a445909c0 CR3: 0000000012e1c000 CR4: 0000000000352ef0 [ 86.122234][ T5313] Call Trace: [ 86.123756][ T5313] [ 86.125142][ T5313] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 86.127698][ T5313] ? rcu_is_watching+0x15/0xb0 [ 86.129684][ T5313] queue_work_on+0x106/0x1d0 [ 86.131752][ T5313] l2cap_conn_start+0x5c9/0xf20 [ 86.133940][ T5313] ? __pfx_l2cap_conn_start+0x10/0x10 [ 86.136134][ T5313] l2cap_info_timeout+0x68/0xa0 [ 86.138215][ T5313] ? process_scheduled_works+0xa70/0x1860 [ 86.140719][ T5313] process_scheduled_works+0xb5d/0x1860 [ 86.143159][ T5313] ? __pfx_process_scheduled_works+0x10/0x10 [ 86.145695][ T5313] ? assign_work+0x3d5/0x5e0 [ 86.147650][ T5313] worker_thread+0xa53/0xfc0 [ 86.149578][ T5313] kthread+0x389/0x470 [ 86.151215][ T5313] ? __pfx_worker_thread+0x10/0x10 [ 86.153163][ T5313] ? __pfx_kthread+0x10/0x10 [ 86.155027][ T5313] ret_from_fork+0x514/0xb70 [ 86.156726][ T5313] ? __pfx_ret_from_fork+0x10/0x10 [ 86.158723][ T5313] ? __switch_to+0xc79/0x1410 [ 86.160713][ T5313] ? __pfx_kthread+0x10/0x10 [ 86.162694][ T5313] ret_from_fork_asm+0x1a/0x30 [ 86.164834][ T5313] [ 86.166219][ T5313] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 86.169372][ T5313] CPU: 0 UID: 0 PID: 5313 Comm: kworker/0:5 Not tainted syzkaller #0 PREEMPT(full) [ 86.173357][ T5313] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 86.177589][ T5313] Workqueue: events l2cap_info_timeout [ 86.179947][ T5313] Call Trace: [ 86.181400][ T5313] [ 86.182686][ T5313] vpanic+0x56c/0xa60 [ 86.184581][ T5313] ? __pfx__printk+0x10/0x10 [ 86.186559][ T5313] ? __pfx_vpanic+0x10/0x10 [ 86.188636][ T5313] ? is_bpf_text_address+0x292/0x2b0 [ 86.191377][ T5313] ? is_bpf_text_address+0x26/0x2b0 [ 86.193599][ T5313] panic+0xc5/0xd0 [ 86.195286][ T5313] ? __pfx_panic+0x10/0x10 [ 86.197242][ T5313] ? ret_from_fork_asm+0x1a/0x30 [ 86.199280][ T5313] __warn+0x315/0x4c0 [ 86.201035][ T5313] ? __queue_work+0xd3f/0x1040 [ 86.203037][ T5313] ? __queue_work+0xd3f/0x1040 [ 86.205148][ T5313] __report_bug+0x29a/0x540 [ 86.207151][ T5313] ? __queue_work+0xd3f/0x1040 [ 86.209272][ T5313] ? __pfx___report_bug+0x10/0x10 [ 86.211528][ T5313] ? __pfx_hci_tx_work+0x10/0x10 [ 86.213802][ T5313] report_bug_entry+0x19a/0x290 [ 86.215987][ T5313] ? __queue_work+0xd67/0x1040 [ 86.218092][ T5313] ? __queue_work+0xd6c/0x1040 [ 86.220194][ T5313] handle_bug+0xce/0x200 [ 86.222044][ T5313] exc_invalid_op+0x1a/0x50 [ 86.224071][ T5313] asm_exc_invalid_op+0x1a/0x20 [ 86.226168][ T5313] RIP: 0010:__queue_work+0xd67/0x1040 [ 86.228520][ T5313] Code: a6 0e 49 8d 7d 18 48 89 f8 48 c1 e8 03 42 80 3c 20 00 74 05 e8 ba 5d a5 00 49 8b 75 18 49 81 c7 70 01 00 00 4c 89 f7 4c 89 fa <67> 48 0f b9 3a 4c 89 e8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ef [ 86.236538][ T5313] RSP: 0018:ffffc9000f02f820 EFLAGS: 00010082 [ 86.239046][ T5313] RAX: 1ffff1100257f18a RBX: 0000000000000008 RCX: ffff88801f5f8000 [ 86.242449][ T5313] RDX: ffff888043287170 RSI: ffffffff8a9e2d90 RDI: ffffffff9033e950 [ 86.245770][ T5313] RBP: 0000000000000020 R08: ffff888012bf8c3f R09: 1ffff1100257f187 [ 86.249122][ T5313] R10: dffffc0000000000 R11: ffffed100257f188 R12: dffffc0000000000 [ 86.252591][ T5313] R13: ffff888012bf8c38 R14: ffffffff9033e950 R15: ffff888043287170 [ 86.255955][ T5313] ? __pfx_hci_tx_work+0x10/0x10 [ 86.258080][ T5313] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 86.260610][ T5313] ? rcu_is_watching+0x15/0xb0 [ 86.262701][ T5313] queue_work_on+0x106/0x1d0 [ 86.264741][ T5313] l2cap_conn_start+0x5c9/0xf20 [ 86.266837][ T5313] ? __pfx_l2cap_conn_start+0x10/0x10 [ 86.268993][ T5313] l2cap_info_timeout+0x68/0xa0 [ 86.271034][ T5313] ? process_scheduled_works+0xa70/0x1860 [ 86.273368][ T5313] process_scheduled_works+0xb5d/0x1860 [ 86.275663][ T5313] ? __pfx_process_scheduled_works+0x10/0x10 [ 86.278040][ T5313] ? assign_work+0x3d5/0x5e0 [ 86.279937][ T5313] worker_thread+0xa53/0xfc0 [ 86.281918][ T5313] kthread+0x389/0x470 [ 86.283636][ T5313] ? __pfx_worker_thread+0x10/0x10 [ 86.285780][ T5313] ? __pfx_kthread+0x10/0x10 [ 86.287842][ T5313] ret_from_fork+0x514/0xb70 [ 86.289889][ T5313] ? __pfx_ret_from_fork+0x10/0x10 [ 86.292098][ T5313] ? __switch_to+0xc79/0x1410 [ 86.294215][ T5313] ? __pfx_kthread+0x10/0x10 [ 86.296273][ T5313] ret_from_fork_asm+0x1a/0x30 [ 86.298302][ T5313] [ 86.300011][ T5313] Kernel Offset: disabled [ 86.301923][ T5313] Rebooting in 86400 seconds..