program:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
getsockopt$inet_mptcp_buf(r1, 0x11c, 0x4, 0x0, &(0x7f00000000c0))
perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0xc8, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x2, @perf_bp={0x0, 0x7}, 0x4005, 0x0, 0x5, 0x7, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x1) (async, rerun: 32)
ioctl$sock_bt_hci(r0, 0x400448cb, 0x0) (async, rerun: 32)
syz_emit_vhci(&(0x7f0000000000)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x3, 0x3, 0x16}, @l2cap_cid_le_signaling={{0x12}, @l2cap_ecred_conn_req={{0x17, 0xf7, 0xe}, {0x9, 0x4, 0x0, 0x80, [0x5, 0xffff, 0x10]}}}}, 0x1b)
[ 69.236500][ T5299] Bluetooth: hci0: command tx timeout
[ 69.295734][ T5321] ------------[ cut here ]------------
[ 69.298302][ T5321] workqueue: cannot queue hci_rx_work on wq hci0
[ 69.301320][ T5321] WARNING: CPU: 0 PID: 5321 at kernel/workqueue.c:2258 __queue_work+0xd38/0xfb0
[ 69.305171][ T5321] Modules linked in:
[ 69.306816][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 69.310696][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 69.315301][ T5321] RIP: 0010:__queue_work+0xd38/0xfb0
[ 69.317537][ T5321] Code: 42 80 3c 20 00 74 08 4c 89 ef e8 13 71 9d 00 49 8b 75 00 49 81 c7 78 01 00 00 48 c7 c7 20 eb 69 8b 4c 89 fa e8 b9 31 f9 ff 90 <0f> 0b 90 90 e9 1a f5 ff ff e8 2a 25 36 00 90 0f 0b 90 e9 dd fc ff
[ 69.325782][ T5321] RSP: 0018:ffffc9000d487a70 EFLAGS: 00010046
[ 69.328491][ T5321] RAX: a687bc09e5fabb00 RBX: 0000000000000000 RCX: ffff888000d22480
[ 69.331907][ T5321] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002
[ 69.335354][ T5321] RBP: 1ffff11007d29238 R08: ffff88801fe24293 R09: 1ffff11003fc4852
[ 69.338760][ T5321] R10: dffffc0000000000 R11: ffffed1003fc4853 R12: dffffc0000000000
[ 69.342209][ T5321] R13: ffff888032d78ae0 R14: ffff888000d22480 R15: ffff88803e949178
[ 69.345780][ T5321] FS: 00007f65dba6d6c0(0000) GS:ffff88808d730000(0000) knlGS:0000000000000000
[ 69.349706][ T5321] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 69.352406][ T5321] CR2: 00007f65dba6cfc8 CR3: 0000000040e31000 CR4: 0000000000352ef0
[ 69.355579][ T5321] Call Trace:
[ 69.357033][ T5321]
[ 69.358373][ T5321] ? rcu_is_watching+0x15/0xb0
[ 69.360492][ T5321] queue_work_on+0x181/0x270
[ 69.362562][ T5321] ? lockdep_hardirqs_on+0x9c/0x150
[ 69.364889][ T5321] ? __pfx_queue_work_on+0x10/0x10
[ 69.367218][ T5321] ? _raw_spin_unlock_irqrestore+0xad/0x110
[ 69.370206][ T5321] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 69.373700][ T5321] ? skb_queue_tail+0x30/0xf0
[ 69.376257][ T5321] hci_recv_frame+0x625/0x7c0
[ 69.378794][ T5321] ? skb_pull+0xc1/0x1d0
[ 69.380760][ T5321] vhci_write+0x358/0x4a0
[ 69.382648][ T5321] vfs_write+0x5c9/0xb30
[ 69.384561][ T5321] ? __pfx_vhci_write+0x10/0x10
[ 69.386720][ T5321] ? __pfx_vfs_write+0x10/0x10
[ 69.388891][ T5321] ? __fget_files+0x2a/0x420
[ 69.390883][ T5321] ksys_write+0x145/0x250
[ 69.392784][ T5321] ? __pfx_ksys_write+0x10/0x10
[ 69.395178][ T5321] ? do_syscall_64+0xbe/0xfa0
[ 69.397174][ T5321] do_syscall_64+0xfa/0xfa0
[ 69.399229][ T5321] ? lockdep_hardirqs_on+0x9c/0x150
[ 69.401460][ T5321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 69.403912][ T5321] ? clear_bhb_loop+0x60/0xb0
[ 69.405814][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 69.408152][ T5321] RIP: 0033:0x7f65dab8e17f
[ 69.409871][ T5321] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
[ 69.417547][ T5321] RSP: 002b:00007f65dba6d000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
[ 69.421230][ T5321] RAX: ffffffffffffffda RBX: 00007f65dade6180 RCX: 00007f65dab8e17f
[ 69.424717][ T5321] RDX: 000000000000001b RSI: 0000200000000000 RDI: 00000000000000ca
[ 69.428280][ T5321] RBP: 00007f65dac11f91 R08: 0000000000000000 R09: 0000000000000000
[ 69.431770][ T5321] R10: 0000200000000000 R11: 0000000000000293 R12: 0000000000000000
[ 69.435292][ T5321] R13: 00007f65dade6218 R14: 00007f65dade6180 R15: 00007ffdc0391448
[ 69.438786][ T5321]
[ 69.440178][ T5321] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 69.443440][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 69.447350][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 69.452008][ T5321] Call Trace:
[ 69.453496][ T5321]
[ 69.454770][ T5321] dump_stack_lvl+0x99/0x250
[ 69.456832][ T5321] ? __asan_memcpy+0x40/0x70
[ 69.458891][ T5321] ? __pfx_dump_stack_lvl+0x10/0x10
[ 69.461114][ T5321] ? __pfx__printk+0x10/0x10
[ 69.463063][ T5321] vpanic+0x237/0x6d0
[ 69.464778][ T5321] ? __pfx_vpanic+0x10/0x10
[ 69.466717][ T5321] panic+0xb9/0xc0
[ 69.468268][ T5321] ? __pfx_panic+0x10/0x10
[ 69.470112][ T5321] __warn+0x31b/0x4b0
[ 69.471767][ T5321] ? __queue_work+0xd38/0xfb0
[ 69.473887][ T5321] ? __queue_work+0xd38/0xfb0
[ 69.476049][ T5321] report_bug+0x2be/0x4f0
[ 69.477980][ T5321] ? __queue_work+0xd38/0xfb0
[ 69.480070][ T5321] ? __queue_work+0xd38/0xfb0
[ 69.482181][ T5321] ? __queue_work+0xd3a/0xfb0
[ 69.484129][ T5321] handle_bug+0x84/0x160
[ 69.485757][ T5321] exc_invalid_op+0x1a/0x50
[ 69.487729][ T5321] asm_exc_invalid_op+0x1a/0x20
[ 69.489788][ T5321] RIP: 0010:__queue_work+0xd38/0xfb0
[ 69.492168][ T5321] Code: 42 80 3c 20 00 74 08 4c 89 ef e8 13 71 9d 00 49 8b 75 00 49 81 c7 78 01 00 00 48 c7 c7 20 eb 69 8b 4c 89 fa e8 b9 31 f9 ff 90 <0f> 0b 90 90 e9 1a f5 ff ff e8 2a 25 36 00 90 0f 0b 90 e9 dd fc ff
[ 69.500252][ T5321] RSP: 0018:ffffc9000d487a70 EFLAGS: 00010046
[ 69.502785][ T5321] RAX: a687bc09e5fabb00 RBX: 0000000000000000 RCX: ffff888000d22480
[ 69.506169][ T5321] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002
[ 69.509597][ T5321] RBP: 1ffff11007d29238 R08: ffff88801fe24293 R09: 1ffff11003fc4852
[ 69.512938][ T5321] R10: dffffc0000000000 R11: ffffed1003fc4853 R12: dffffc0000000000
[ 69.516397][ T5321] R13: ffff888032d78ae0 R14: ffff888000d22480 R15: ffff88803e949178
[ 69.519831][ T5321] ? rcu_is_watching+0x15/0xb0
[ 69.521925][ T5321] queue_work_on+0x181/0x270
[ 69.523975][ T5321] ? lockdep_hardirqs_on+0x9c/0x150
[ 69.526230][ T5321] ? __pfx_queue_work_on+0x10/0x10
[ 69.528345][ T5321] ? _raw_spin_unlock_irqrestore+0xad/0x110
[ 69.530922][ T5321] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 69.533657][ T5321] ? skb_queue_tail+0x30/0xf0
[ 69.535631][ T5321] hci_recv_frame+0x625/0x7c0
[ 69.537740][ T5321] ? skb_pull+0xc1/0x1d0
[ 69.539494][ T5321] vhci_write+0x358/0x4a0
[ 69.541186][ T5321] vfs_write+0x5c9/0xb30
[ 69.542865][ T5321] ? __pfx_vhci_write+0x10/0x10
[ 69.544823][ T5321] ? __pfx_vfs_write+0x10/0x10
[ 69.547092][ T5321] ? __fget_files+0x2a/0x420
[ 69.548996][ T5321] ksys_write+0x145/0x250
[ 69.550671][ T5321] ? __pfx_ksys_write+0x10/0x10
[ 69.552858][ T5321] ? do_syscall_64+0xbe/0xfa0
[ 69.554532][ T5321] do_syscall_64+0xfa/0xfa0
[ 69.556543][ T5321] ? lockdep_hardirqs_on+0x9c/0x150
[ 69.558871][ T5321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 69.561414][ T5321] ? clear_bhb_loop+0x60/0xb0
[ 69.563357][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 69.566026][ T5321] RIP: 0033:0x7f65dab8e17f
[ 69.568116][ T5321] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
[ 69.576016][ T5321] RSP: 002b:00007f65dba6d000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
[ 69.579507][ T5321] RAX: ffffffffffffffda RBX: 00007f65dade6180 RCX: 00007f65dab8e17f
[ 69.582954][ T5321] RDX: 000000000000001b RSI: 0000200000000000 RDI: 00000000000000ca
[ 69.586411][ T5321] RBP: 00007f65dac11f91 R08: 0000000000000000 R09: 0000000000000000
[ 69.590280][ T5321] R10: 0000200000000000 R11: 0000000000000293 R12: 0000000000000000
[ 69.593770][ T5321] R13: 00007f65dade6218 R14: 00007f65dade6180 R15: 00007ffdc0391448
[ 69.597142][ T5321]
[ 69.599045][ T5321] Kernel Offset: disabled
[ 69.601006][ T5321] Rebooting in 86400 seconds..