program:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
connect$bt_sco(r0, &(0x7f0000000100), 0x8) (async)
syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="0418"], 0x1a) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
socket$phonet_pipe(0x23, 0x5, 0x2) (async)
r1 = socket$inet(0x2, 0x80001, 0x84)
getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) (async)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) (async)
r2 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0x0, 0x20002f7})
ioctl$VIDIOC_TRY_FMT(0xffffffffffffffff, 0xc0d05640, &(0x7f0000000000)={0xd, @vbi={0x0, 0x0, 0x0, 0x4745504d, [], [0xfffffffe]}}) (async)
io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0)
[ 76.639496][ T4671] Bluetooth: hci0: command tx timeout
[ 76.642931][ T1314] ieee802154 phy0 wpan0: encryption failed: -22
[ 76.645675][ T1314] ieee802154 phy1 wpan1: encryption failed: -22
[ 76.708410][ T5301] ------------[ cut here ]------------
[ 76.711502][ T5301] WARNING: CPU: 0 PID: 5301 at net/bluetooth/hci_conn.c:567 hci_conn_timeout+0xff/0x290
[ 76.715665][ T5301] Modules linked in:
[ 76.717536][ T5301] CPU: 0 UID: 0 PID: 5301 Comm: kworker/u5:2 Not tainted syzkaller #0 PREEMPT(full)
[ 76.721962][ T5301] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 76.726979][ T5301] Workqueue: hci0 hci_conn_timeout
[ 76.729780][ T5301] RIP: 0010:hci_conn_timeout+0xff/0x290
[ 76.732339][ T5301] Code: 48 89 df e8 53 1d 09 00 eb 07 e8 1c bd 74 f7 b0 13 0f b6 f0 48 89 df 5b 41 5c 41 5e 41 5f 5d e9 e7 c4 fe ff e8 02 bd 74 f7 90 <0f> 0b 90 eb 8c 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 31 ff ff ff
[ 76.740898][ T5301] RSP: 0018:ffffc9000d35fa30 EFLAGS: 00010293
[ 76.743230][ T5301] RAX: ffffffff8a4ae69e RBX: ffff888011cf4000 RCX: ffff88801f6d8000
[ 76.746412][ T5301] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000
[ 76.749852][ T5301] RBP: 00000000ffffffff R08: ffff888011cf4013 R09: 1ffff1100239e802
[ 76.753115][ T5301] R10: dffffc0000000000 R11: ffffed100239e803 R12: dffffc0000000000
[ 76.756318][ T5301] R13: ffff8880116b7018 R14: ffff888011cf4948 R15: ffff888011cf4010
[ 76.759677][ T5301] FS: 0000000000000000(0000) GS:ffff88808d304000(0000) knlGS:0000000000000000
[ 76.763515][ T5301] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 76.766351][ T5301] CR2: 00007ff50f78ab48 CR3: 0000000011722000 CR4: 0000000000352ef0
[ 76.769899][ T5301] Call Trace:
[ 76.771318][ T5301]
[ 76.772545][ T5301] ? process_scheduled_works+0x9ef/0x17b0
[ 76.774622][ T5301] process_scheduled_works+0xae1/0x17b0
[ 76.776725][ T5301] ? __pfx_process_scheduled_works+0x10/0x10
[ 76.779084][ T5301] worker_thread+0x8a0/0xda0
[ 76.781057][ T5301] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 76.783898][ T5301] ? __kthread_parkme+0x7b/0x200
[ 76.786139][ T5301] kthread+0x711/0x8a0
[ 76.788008][ T5301] ? __pfx_worker_thread+0x10/0x10
[ 76.790393][ T5301] ? __pfx_kthread+0x10/0x10
[ 76.792471][ T5301] ? _raw_spin_unlock_irq+0x23/0x50
[ 76.794483][ T5301] ? lockdep_hardirqs_on+0x9c/0x150
[ 76.796490][ T5301] ? __pfx_kthread+0x10/0x10
[ 76.798516][ T5301] ret_from_fork+0x4bc/0x870
[ 76.800679][ T5301] ? __pfx_ret_from_fork+0x10/0x10
[ 76.802936][ T5301] ? __pfx_kthread+0x10/0x10
[ 76.804840][ T5301] ret_from_fork_asm+0x1a/0x30
[ 76.806820][ T5301]
[ 76.808160][ T5301] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 76.811274][ T5301] CPU: 0 UID: 0 PID: 5301 Comm: kworker/u5:2 Not tainted syzkaller #0 PREEMPT(full)
[ 76.815180][ T5301] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 76.819989][ T5301] Workqueue: hci0 hci_conn_timeout
[ 76.822311][ T5301] Call Trace:
[ 76.823814][ T5301]
[ 76.825098][ T5301] dump_stack_lvl+0x99/0x250
[ 76.826927][ T5301] ? __asan_memcpy+0x40/0x70
[ 76.828982][ T5301] ? __pfx_dump_stack_lvl+0x10/0x10
[ 76.831096][ T5301] ? __pfx__printk+0x10/0x10
[ 76.833084][ T5301] vpanic+0x237/0x6d0
[ 76.834774][ T5301] ? __pfx_vpanic+0x10/0x10
[ 76.836785][ T5301] panic+0xb9/0xc0
[ 76.838374][ T5301] ? __pfx_panic+0x10/0x10
[ 76.840261][ T5301] __warn+0x31b/0x4b0
[ 76.841953][ T5301] ? hci_conn_timeout+0xff/0x290
[ 76.844169][ T5301] ? hci_conn_timeout+0xff/0x290
[ 76.846356][ T5301] report_bug+0x2be/0x4f0
[ 76.848204][ T5301] ? hci_conn_timeout+0xff/0x290
[ 76.850344][ T5301] ? hci_conn_timeout+0xff/0x290
[ 76.852641][ T5301] ? hci_conn_timeout+0x101/0x290
[ 76.854765][ T5301] handle_bug+0x84/0x160
[ 76.856507][ T5301] exc_invalid_op+0x1a/0x50
[ 76.858376][ T5301] asm_exc_invalid_op+0x1a/0x20
[ 76.860403][ T5301] RIP: 0010:hci_conn_timeout+0xff/0x290
[ 76.862828][ T5301] Code: 48 89 df e8 53 1d 09 00 eb 07 e8 1c bd 74 f7 b0 13 0f b6 f0 48 89 df 5b 41 5c 41 5e 41 5f 5d e9 e7 c4 fe ff e8 02 bd 74 f7 90 <0f> 0b 90 eb 8c 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 31 ff ff ff
[ 76.870691][ T5301] RSP: 0018:ffffc9000d35fa30 EFLAGS: 00010293
[ 76.873354][ T5301] RAX: ffffffff8a4ae69e RBX: ffff888011cf4000 RCX: ffff88801f6d8000
[ 76.876614][ T5301] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000
[ 76.880113][ T5301] RBP: 00000000ffffffff R08: ffff888011cf4013 R09: 1ffff1100239e802
[ 76.883558][ T5301] R10: dffffc0000000000 R11: ffffed100239e803 R12: dffffc0000000000
[ 76.887122][ T5301] R13: ffff8880116b7018 R14: ffff888011cf4948 R15: ffff888011cf4010
[ 76.890591][ T5301] ? hci_conn_timeout+0xfe/0x290
[ 76.892710][ T5301] ? process_scheduled_works+0x9ef/0x17b0
[ 76.895248][ T5301] process_scheduled_works+0xae1/0x17b0
[ 76.897704][ T5301] ? __pfx_process_scheduled_works+0x10/0x10
[ 76.900246][ T5301] worker_thread+0x8a0/0xda0
[ 76.902341][ T5301] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 76.905199][ T5301] ? __kthread_parkme+0x7b/0x200
[ 76.907392][ T5301] kthread+0x711/0x8a0
[ 76.909112][ T5301] ? __pfx_worker_thread+0x10/0x10
[ 76.911330][ T5301] ? __pfx_kthread+0x10/0x10
[ 76.913250][ T5301] ? _raw_spin_unlock_irq+0x23/0x50
[ 76.915353][ T5301] ? lockdep_hardirqs_on+0x9c/0x150
[ 76.917525][ T5301] ? __pfx_kthread+0x10/0x10
[ 76.919468][ T5301] ret_from_fork+0x4bc/0x870
[ 76.921383][ T5301] ? __pfx_ret_from_fork+0x10/0x10
[ 76.923518][ T5301] ? __pfx_kthread+0x10/0x10
[ 76.925632][ T5301] ret_from_fork_asm+0x1a/0x30
[ 76.927739][ T5301]
[ 76.929420][ T5301] Kernel Offset: disabled
[ 76.931512][ T5301] Rebooting in 86400 seconds..