program:
r0 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x7f, 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0)
mount$tmpfs(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='huge=always,huge=within_size,nr_blocks=5'])
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x0)
pwritev2(r1, &(0x7f0000001440)=[{&(0x7f0000000440)='.', 0x1}], 0x1, 0x540f, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0)
ioctl$EXT4_IOC_MOVE_EXT(r2, 0x40305829, &(0x7f0000000000)={0x17c04, 0xffffffffffffffff, 0x47d, 0xdf1c, 0x9, 0xfffffffffffff7f7})
r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x40)
pwrite64(r3, &(0x7f0000000140)='2', 0xfdef, 0xfecc)
ioctl$vim2m_VIDIOC_S_CTRL(r0, 0xc008561c, &(0x7f0000000000)={0xf0f043})
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x5, &(0x7f0000000280)=0x522, 0x4)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000780)={0x0, 0x4, 0x0, [0x806f, 0x0, 0x2d5, 0x2, 0x6], [0x6, 0x7, 0x1, 0x9, 0x8002, 0x0, 0x5, 0x2, 0x0, 0x802, 0x9, 0x200000100, 0x3, 0xfffffffffffffff4, 0x4a, 0x1000000000005, 0x100, 0xd, 0xdd, 0x8000000000000000, 0x1, 0x2a8, 0x3, 0xc39, 0x8, 0x8, 0xffff, 0x2, 0x7b1, 0x8, 0x401, 0x800000000000003, 0x7, 0xfffffffffffffffa, 0x81, 0x100, 0x5, 0x931, 0x101, 0x3, 0x8001, 0x8000000000000000, 0x7, 0x1, 0x8, 0x8, 0x6aa, 0x102, 0x1, 0x83, 0x538a, 0x9, 0xfffffffffffffff7, 0x4, 0x0, 0x4, 0x5, 0x8, 0x80008000, 0x8000000000000000, 0x4, 0xfffffffffffffffc, 0xfffffffffffffffd, 0x5bc, 0x1, 0x7fffffff, 0x4, 0x3ff, 0x3ff, 0x7, 0x7, 0x9, 0x82c, 0x8000, 0xe000000000000, 0xe4, 0x11, 0x0, 0x8, 0x22, 0xffffffffffffffff, 0x7, 0x1, 0x8000000000000000, 0x2000000009, 0x8, 0x0, 0x6, 0x6, 0x7, 0x100000002, 0x4, 0x4, 0x8, 0x7, 0x7, 0x9, 0x1, 0x16d, 0x6, 0x68d, 0xffffffffffff43b0, 0x8, 0x50000000000000, 0xe, 0x0, 0x0, 0x5, 0x4, 0x7, 0x406, 0x3, 0x5, 0x5, 0x0, 0x3, 0x40, 0x7fffffff, 0x0, 0x3, 0x4]})
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045)
r4 = io_uring_setup(0x899, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7})
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1c, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="dbaa00000071"], 0x0, 0xb, 0x0, 0x0, 0x41100, 0x6f, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94)
io_uring_enter(r4, 0x2219, 0x7721, 0x16, 0x0, 0x0)
ppoll(&(0x7f0000000100)=[{r0, 0x2007}, {r0, 0x400}, {r0, 0x4000}, {r0, 0x1000}], 0x4, 0x0, 0x0, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a14010000180a00000000000000000000000000080c000540000000000000000508000740a4ab32152078230000000608000740000000000900020073797a30000000000c0005400000000000000004cc0003800800024000800000540003801400010076657468310000000000000000000000140001006e723000000000000000000000000000140001006d6163736563300000000000000000001400010076657468315f746f5f626f6e6400000018000380140001006d61637365633000000000000000000054000380140001006261746164765f736c6176655f30000014000100697036677265746170300000000000001400010076657468315f766c616e0000000000001400010076657468305f766972745f776966690020000000000a01020000000000000000070000020c000440000000000000000514000000110001000000000000fd45b8ddc23f6601cdccff8665ec2cd6893873bebf62223b24c4021fbecc4e0a03563a64210d9ef32c596ca32acec452949324d99816c462150d5b9e675b"], 0x15c}, 0x1, 0x0, 0x0, 0x40}, 0x4040000)
syz_usb_connect$hid(0x3, 0x36, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e1f0a"], 0x22)
syz_emit_vhci(&(0x7f0000000080)=ANY=[@ANYBLOB="0406"], 0x7)
[ 94.847281][ T52[ 94.483525][ T5289] Bluetooth: hci0: command tx timeout
[ 94.750499][ T4653] Bluetooth: hci0: unexpected event 0x06 length: 4 > 3
[ 96.503781][ T4653] Bluetooth: hci0: command tx timeout
[ 96.824636][ T5289] ------------[ cut here ]------------
[ 96.827571][ T5289] refcnt < 0
[ 96.827579][ T5289] WARNING: net/bluetooth/hci_conn.c:631 at hci_conn_timeout+0xff/0x2c0, CPU#0: kworker/u5:2/5289
[ 96.833750][ T5289] Modules linked in:
[ 96.835443][ T5289] CPU: 0 UID: 0 PID: 5289 Comm: kworker/u5:2 Not tainted syzkaller #0 PREEMPT(full)
[ 96.839164][ T5289] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 96.843325][ T5289] Workqueue: hci0 hci_conn_timeout
[ 96.845449][ T5289] RIP: 0010:hci_conn_timeout+0xff/0x2c0
[ 96.847725][ T5289] Code: 48 89 df e8 b3 c3 09 00 eb 07 e8 bc 55 00 f7 b0 13 0f b6 f0 48 89 df 5b 41 5c 41 5e 41 5f 5d e9 57 a1 fe ff e8 a2 55 00 f7 90 <0f> 0b 90 eb 8c 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 31 ff ff ff
[ 96.855544][ T5289] RSP: 0018:ffffc9000eeffad0 EFLAGS: 00010293
[ 96.858072][ T5289] RAX: ffffffff8ac6beae RBX: ffff888040f40000 RCX: ffff888000a48000
[ 96.861396][ T5289] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000
[ 96.864721][ T5289] RBP: 00000000ffffffff R08: ffff888040f40013 R09: 1ffff110081e8002
[ 96.867838][ T5289] R10: dffffc0000000000 R11: ffffed10081e8003 R12: dffffc0000000000
[ 96.870781][ T5289] R13: dffffc0000000000 R14: ffff888040f40a40 R15: ffff888040f40010
[ 96.874011][ T5289] FS: 0000000000000000(0000) GS:ffff88808c543000(0000) knlGS:0000000000000000
[ 96.877503][ T5289] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 96.880136][ T5289] CR2: 00007fce9e67a120 CR3: 0000000050c49000 CR4: 0000000000352ef0
[ 96.883480][ T5289] Call Trace:
[ 96.884889][ T5289]
[ 96.886168][ T5289] ? process_scheduled_works+0xa20/0x14e0
[ 96.888461][ T5289] process_scheduled_works+0xa8e/0x14e0
[ 96.890776][ T5289] ? __pfx_process_scheduled_works+0x10/0x10
[ 96.893318][ T5289] ? assign_work+0x3cf/0x5d0
[ 96.895228][ T5289] worker_thread+0xa47/0xfb0
[ 96.897175][ T5289] ? __kthread_parkme+0x71/0x1f0
[ 96.899203][ T5289] kthread+0x388/0x470
[ 96.900851][ T5289] ? __pfx_worker_thread+0x10/0x10
[ 96.903527][ T5289] ? __pfx_kthread+0x10/0x10
[ 96.905791][ T5289] ret_from_fork+0x514/0xb70
[ 96.907799][ T5289] ? __pfx_ret_from_fork+0x10/0x10
[ 96.910098][ T5289] ? __switch_to+0xc89/0x1420
[ 96.912246][ T5289] ? __pfx_kthread+0x10/0x10
[ 96.914268][ T5289] ret_from_fork_asm+0x1a/0x30
[ 96.916287][ T5289]
[ 96.917574][ T5289] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 96.921243][ T5289] CPU: 0 UID: 0 PID: 5289 Comm: kworker/u5:2 Not tainted syzkaller #0 PREEMPT(full)
[ 96.925104][ T5289] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 96.929193][ T5289] Workqueue: hci0 hci_conn_timeout
[ 96.931314][ T5289] Call Trace:
[ 96.932702][ T5289]
[ 96.933985][ T5289] vpanic+0x56c/0xa60
[ 96.935636][ T5289] ? __pfx__printk+0x10/0x10
[ 96.937540][ T5289] ? __pfx_vpanic+0x10/0x10
[ 96.939401][ T5289] ? is_bpf_text_address+0x292/0x2b0
[ 96.941618][ T5289] ? is_bpf_text_address+0x26/0x2b0
[ 96.943840][ T5289] panic+0xc5/0xd0
[ 96.945471][ T5289] ? __pfx_panic+0x10/0x10
[ 96.947377][ T5289] ? ret_from_fork_asm+0x1a/0x30
[ 96.949491][ T5289] __warn+0x315/0x4c0
[ 96.951055][ T5289] ? hci_conn_timeout+0xff/0x2c0
[ 96.952975][ T5289] ? hci_conn_timeout+0xff/0x2c0
[ 96.955024][ T5289] __report_bug+0x276/0x570
[ 96.956985][ T5289] ? hci_conn_timeout+0xff/0x2c0
[ 96.959104][ T5289] ? __pfx___report_bug+0x10/0x10
[ 96.961159][ T5289] ? add_lock_to_list+0xc7/0x100
[ 96.963286][ T5289] ? lockdep_unlock+0x5d/0xd0
[ 96.965348][ T5289] ? __lock_acquire+0x13e8/0x2cf0
[ 96.967630][ T5289] ? hci_conn_timeout+0xff/0x2c0
[ 96.969754][ T5289] report_bug+0x16a/0x220
[ 96.971603][ T5289] ? hci_conn_timeout+0xff/0x2c0
[ 96.973721][ T5289] ? hci_conn_timeout+0x101/0x2c0
[ 96.975837][ T5289] handle_bug+0x9c/0x200
[ 96.977635][ T5289] exc_invalid_op+0x1a/0x50
[ 96.979604][ T5289] asm_exc_invalid_op+0x1a/0x20
[ 96.981690][ T5289] RIP: 0010:hci_conn_timeout+0xff/0x2c0
[ 96.984038][ T5289] Code: 48 89 df e8 b3 c3 09 00 eb 07 e8 bc 55 00 f7 b0 13 0f b6 f0 48 89 df 5b 41 5c 41 5e 41 5f 5d e9 57 a1 fe ff e8 a2 55 00 f7 90 <0f> 0b 90 eb 8c 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 31 ff ff ff
[ 96.992082][ T5289] RSP: 0018:ffffc9000eeffad0 EFLAGS: 00010293
[ 96.994687][ T5289] RAX: ffffffff8ac6beae RBX: ffff888040f40000 RCX: ffff888000a48000
[ 96.998166][ T5289] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000
[ 97.001618][ T5289] RBP: 00000000ffffffff R08: ffff888040f40013 R09: 1ffff110081e8002
[ 97.005520][ T5289] R10: dffffc0000000000 R11: ffffed10081e8003 R12: dffffc0000000000
[ 97.009062][ T5289] R13: dffffc0000000000 R14: ffff888040f40a40 R15: ffff888040f40010
[ 97.012449][ T5289] ? hci_conn_timeout+0xfe/0x2c0
[ 97.014545][ T5289] ? process_scheduled_works+0xa20/0x14e0
[ 97.016945][ T5289] process_scheduled_works+0xa8e/0x14e0
[ 97.019674][ T5289] ? __pfx_process_scheduled_works+0x10/0x10
[ 97.022759][ T5289] ? assign_work+0x3cf/0x5d0
[ 97.024716][ T5289] worker_thread+0xa47/0xfb0
[ 97.026760][ T5289] ? __kthread_parkme+0x71/0x1f0
[ 97.029032][ T5289] kthread+0x388/0x470
[ 97.030826][ T5289] ? __pfx_worker_thread+0x10/0x10
[ 97.032955][ T5289] ? __pfx_kthread+0x10/0x10
[ 97.034984][ T5289] ret_from_fork+0x514/0xb70
[ 97.037059][ T5289] ? __pfx_ret_from_fork+0x10/0x10
[ 97.039189][ T5289] ? __switch_to+0xc89/0x1420
[ 97.041238][ T5289] ? __pfx_kthread+0x10/0x10
[ 97.043263][ T5289] ret_from_fork_asm+0x1a/0x30
[ 97.045388][ T5289]
[ 97.047068][ T5289] Kernel Offset: disabled
[ 97.048884][ T5289] Rebooting in 86400 seconds..