program:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x400200, 0x0) (async)
r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_bt_hci(r1, 0x400448cb, 0x0) (async, rerun: 32)
gettid() (async, rerun: 32)
openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0xa2500, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
r3 = dup(r2)
sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)={0x54, 0x2, 0x6, 0x5, 0x0, 0xf0ffff, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8}]}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}]}, 0x54}}, 0x20044014) (async)
r4 = socket$inet6_dccp(0xa, 0x6, 0x0)
setsockopt$inet6_group_source_req(r4, 0x29, 0x2c, &(0x7f0000000000)={0x40, {{0xa, 0x4e23, 0x6, @private1, 0xc8}}, {{0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x8}}}, 0x108) (async, rerun: 32)
syz_emit_vhci(&(0x7f0000000080)=ANY=[@ANYBLOB="040e0402030c", @ANYRES8=r0], 0x7) (rerun: 32)
[ 68.229386][ T4673] Bluetooth: hci0: command tx timeout
[ 68.341338][ T5326] Bluetooth: hci0: Opcode 0x0c03 failed: -112
[ 68.354610][ T5328] Bluetooth: hci0: Opcode 0x0c1a failed: -38
[ 68.358172][ T5326] Bluetooth: hci0: Opcode 0x0c03 failed: -38
[ 68.361973][ T5326] Bluetooth: hci0: Opcode 0x0c03 failed: -38
[ 68.365138][ T5326] Bluetooth: hci0: Opcode 0x0c03 failed: -38
[ 68.367821][ T5326] Bluetooth: hci0: Opcode 0x0c03 failed: -38
[ 68.370996][ T5326] Bluetooth: hci0: Opcode 0x0c03 failed: -38
[ 68.373566][ T5326] Bluetooth: hci0: Opcode 0x0c03 failed: -38
[ 68.376109][ T5326] Bluetooth: hci0: Opcode 0x0c03 failed: -38
[ 68.380448][ T5327] ------------[ cut here ]------------
[ 68.382557][ T5327] WARNING: CPU: 0 PID: 5327 at kernel/workqueue.c:2257 __queue_work+0xcd3/0xf50
[ 68.386063][ T5327] Modules linked in:
[ 68.387536][ T5327] CPU: 0 UID: 0 PID: 5327 Comm: syz.0.0 Not tainted 6.12.0-rc6-syzkaller-00077-g2e1b3cc9d7f7 #0
[ 68.391373][ T5327] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 68.395371][ T5327] RIP: 0010:__queue_work+0xcd3/0xf50
[ 68.397403][ T5327] Code: ff e8 f1 ad 37 00 90 0f 0b 90 e9 1e fd ff ff e8 e3 ad 37 00 eb 13 e8 dc ad 37 00 eb 0c e8 d5 ad 37 00 eb 05 e8 ce ad 37 00 90 <0f> 0b 90 48 83 c4 60 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc
[ 68.404503][ T5327] RSP: 0018:ffffc9000cf7fa88 EFLAGS: 00010093
[ 68.406870][ T5327] RAX: ffffffff815d2c84 RBX: ffff88801e2e8000 RCX: ffff88801e2e8000
[ 68.409938][ T5327] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 68.412798][ T5327] RBP: 0000000000000000 R08: ffffffff815d20e4 R09: 0000000000000000
[ 68.415670][ T5327] R10: ffffc9000cf7fb60 R11: fffff520019eff6d R12: ffff888045444000
[ 68.418530][ T5327] R13: ffff8880454441c0 R14: dffffc0000000000 R15: 0000000000000008
[ 68.421329][ T5327] FS: 00007f60cc9106c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
[ 68.424451][ T5327] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 68.426776][ T5327] CR2: 00007f60cc90ff98 CR3: 000000003f416000 CR4: 0000000000352ef0
[ 68.429278][ T5327] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 68.432704][ T5327] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 68.435505][ T5327] Call Trace:
[ 68.436756][ T5327]
[ 68.437796][ T5327] ? __warn+0x168/0x4e0
[ 68.439195][ T5327] ? __queue_work+0xcd3/0xf50
[ 68.440845][ T5327] ? report_bug+0x2b3/0x500
[ 68.442468][ T5327] ? __queue_work+0xcd3/0xf50
[ 68.444104][ T5327] ? handle_bug+0x60/0x90
[ 68.445622][ T5327] ? exc_invalid_op+0x1a/0x50
[ 68.447255][ T5327] ? asm_exc_invalid_op+0x1a/0x20
[ 68.448945][ T5327] ? __queue_work+0x124/0xf50
[ 68.450492][ T5327] ? __queue_work+0xcc4/0xf50
[ 68.452073][ T5327] ? __queue_work+0xcd3/0xf50
[ 68.453897][ T5327] ? __queue_work+0xcc4/0xf50
[ 68.455649][ T5327] queue_work_on+0x1c2/0x380
[ 68.457429][ T5327] ? __pfx_queue_work_on+0x10/0x10
[ 68.459377][ T5327] ? _raw_spin_unlock_irqrestore+0xdd/0x140
[ 68.461610][ T5327] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 68.463860][ T5327] ? skb_queue_tail+0x36/0x120
[ 68.465629][ T5327] hci_recv_frame+0x598/0x6f0
[ 68.467353][ T5327] vhci_write+0x35a/0x490
[ 68.468986][ T5327] vfs_write+0xaeb/0xd30
[ 68.470534][ T5327] ? __pfx_vhci_write+0x10/0x10
[ 68.472458][ T5327] ? __pfx_vfs_write+0x10/0x10
[ 68.474339][ T5327] ? fdget_pos+0x19a/0x320
[ 68.476077][ T5327] ksys_write+0x183/0x2b0
[ 68.477694][ T5327] ? __pfx_ksys_write+0x10/0x10
[ 68.479312][ T5327] ? do_syscall_64+0x100/0x230
[ 68.480862][ T5327] ? do_syscall_64+0xb6/0x230
[ 68.482367][ T5327] do_syscall_64+0xf3/0x230
[ 68.483831][ T5327] ? clear_bhb_loop+0x35/0x90
[ 68.485391][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 68.487299][ T5327] RIP: 0033:0x7f60cbb7d1ff
[ 68.488786][ T5327] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 c9 8d 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 1c 8e 02 00 48
[ 68.495076][ T5327] RSP: 002b:00007f60cc910000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
[ 68.498154][ T5327] RAX: ffffffffffffffda RBX: 00007f60cbd36058 RCX: 00007f60cbb7d1ff
[ 68.501042][ T5327] RDX: 0000000000000007 RSI: 0000000020000080 RDI: 00000000000000ca
[ 68.504022][ T5327] RBP: 00007f60cbbf139e R08: 0000000000000000 R09: 0000000000000000
[ 68.506986][ T5327] R10: 0000000020000080 R11: 0000000000000293 R12: 0000000000000000
[ 68.509890][ T5327] R13: 0000000000000000 R14: 00007f60cbd36058 R15: 00007ffef710d2c8
[ 68.512715][ T5327]
[ 68.513850][ T5327] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 68.516282][ T5327] CPU: 0 UID: 0 PID: 5327 Comm: syz.0.0 Not tainted 6.12.0-rc6-syzkaller-00077-g2e1b3cc9d7f7 #0
[ 68.519935][ T5327] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 68.523783][ T5327] Call Trace:
[ 68.525059][ T5327]
[ 68.526117][ T5327] dump_stack_lvl+0x241/0x360
[ 68.527932][ T5327] ? __pfx_dump_stack_lvl+0x10/0x10
[ 68.529904][ T5327] ? __pfx__printk+0x10/0x10
[ 68.531579][ T5327] ? vscnprintf+0x5d/0x90
[ 68.533140][ T5327] panic+0x349/0x880
[ 68.534644][ T5327] ? __warn+0x177/0x4e0
[ 68.536212][ T5327] ? __pfx_panic+0x10/0x10
[ 68.537997][ T5327] __warn+0x34b/0x4e0
[ 68.539461][ T5327] ? __queue_work+0xcd3/0xf50
[ 68.541255][ T5327] report_bug+0x2b3/0x500
[ 68.542909][ T5327] ? __queue_work+0xcd3/0xf50
[ 68.544668][ T5327] handle_bug+0x60/0x90
[ 68.546200][ T5327] exc_invalid_op+0x1a/0x50
[ 68.547876][ T5327] asm_exc_invalid_op+0x1a/0x20
[ 68.549625][ T5327] RIP: 0010:__queue_work+0xcd3/0xf50
[ 68.551580][ T5327] Code: ff e8 f1 ad 37 00 90 0f 0b 90 e9 1e fd ff ff e8 e3 ad 37 00 eb 13 e8 dc ad 37 00 eb 0c e8 d5 ad 37 00 eb 05 e8 ce ad 37 00 90 <0f> 0b 90 48 83 c4 60 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc
[ 68.558623][ T5327] RSP: 0018:ffffc9000cf7fa88 EFLAGS: 00010093
[ 68.560855][ T5327] RAX: ffffffff815d2c84 RBX: ffff88801e2e8000 RCX: ffff88801e2e8000
[ 68.563778][ T5327] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 68.566740][ T5327] RBP: 0000000000000000 R08: ffffffff815d20e4 R09: 0000000000000000
[ 68.569720][ T5327] R10: ffffc9000cf7fb60 R11: fffff520019eff6d R12: ffff888045444000
[ 68.572630][ T5327] R13: ffff8880454441c0 R14: dffffc0000000000 R15: 0000000000000008
[ 68.575584][ T5327] ? __queue_work+0x124/0xf50
[ 68.577284][ T5327] ? __queue_work+0xcc4/0xf50
[ 68.578845][ T5327] ? __queue_work+0xcc4/0xf50
[ 68.580456][ T5327] queue_work_on+0x1c2/0x380
[ 68.582006][ T5327] ? __pfx_queue_work_on+0x10/0x10
[ 68.583757][ T5327] ? _raw_spin_unlock_irqrestore+0xdd/0x140
[ 68.585790][ T5327] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 68.588042][ T5327] ? skb_queue_tail+0x36/0x120
[ 68.589810][ T5327] hci_recv_frame+0x598/0x6f0
[ 68.591464][ T5327] vhci_write+0x35a/0x490
[ 68.593029][ T5327] vfs_write+0xaeb/0xd30
[ 68.594609][ T5327] ? __pfx_vhci_write+0x10/0x10
[ 68.596411][ T5327] ? __pfx_vfs_write+0x10/0x10
[ 68.598202][ T5327] ? fdget_pos+0x19a/0x320
[ 68.599926][ T5327] ksys_write+0x183/0x2b0
[ 68.601564][ T5327] ? __pfx_ksys_write+0x10/0x10
[ 68.603356][ T5327] ? do_syscall_64+0x100/0x230
[ 68.605258][ T5327] ? do_syscall_64+0xb6/0x230
[ 68.607065][ T5327] do_syscall_64+0xf3/0x230
[ 68.608714][ T5327] ? clear_bhb_loop+0x35/0x90
[ 68.610455][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 68.612504][ T5327] RIP: 0033:0x7f60cbb7d1ff
[ 68.614094][ T5327] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 c9 8d 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 1c 8e 02 00 48
[ 68.620994][ T5327] RSP: 002b:00007f60cc910000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
[ 68.624083][ T5327] RAX: ffffffffffffffda RBX: 00007f60cbd36058 RCX: 00007f60cbb7d1ff
[ 68.626930][ T5327] RDX: 0000000000000007 RSI: 0000000020000080 RDI: 00000000000000ca
[ 68.629790][ T5327] RBP: 00007f60cbbf139e R08: 0000000000000000 R09: 0000000000000000
[ 68.632350][ T5327] R10: 0000000020000080 R11: 0000000000000293 R12: 0000000000000000
[ 68.635027][ T5327] R13: 0000000000000000 R14: 00007f60cbd36058 R15: 00007ffef710d2c8
[ 68.637783][ T5327]
[ 68.639077][ T5327] Kernel Offset: disabled
[ 68.640642][ T5327] Rebooting in 86400 seconds..