program: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r1, 0x400448cb, 0x0) syz_emit_vhci(&(0x7f00000007c0)=ANY=[@ANYBLOB="040e06006220"], 0x9) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x5, @loopback}], 0x1c) sendto$inet6(r0, &(0x7f0000000080)="c7", 0x1, 0x0, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r4 = dup(r3) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000080)) write$cgroup_int(r2, &(0x7f00000000c0), 0x12) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r5, 0x84, 0x70, &(0x7f0000000440)={0x0, @in={{0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x25}}}, [0x6, 0xfff, 0x100, 0x7, 0x3, 0x8, 0x8, 0x9, 0x8000, 0x3, 0x6, 0x6, 0x3, 0x0, 0x3]}, &(0x7f0000000140)=0x100) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f00000001c0)={0x7, 0x6, 0xa, 0x87, 0x5, 0x2, 0x5, 0x56000, r7}, &(0x7f0000000200)=0x20) write$cgroup_int(r4, &(0x7f0000000100)=0xfd, 0x12) r8 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_REVOKE_LEASE(r8, 0xc00464c9, &(0x7f00000000c0)) write$binfmt_script(r0, &(0x7f0000000400), 0xb) write$binfmt_elf64(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="7f454c4601060210000100000000000002003e00ff0100003a0000000000000040000000000000002700000000004000000400000500380002000800c12ff700010000000900000054050400000000000000400e0000000000000300000000000000030000000000000900000000000000000200000000002a8a8ff0e2e27c789428639dea6f76596f50e9788f1ef75c61cd154e84d5017a22fcdbcdbcbd9e6a74c3cde26dc3b512e037f17d2297f0707caea6bb1f3247554632146406d19b9c3e47b6077f"], 0x78) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000180)={0x0, 0x0, 0x20}, 0xc) sendto$inet6(r0, &(0x7f0000000240)="1a", 0x19ff4, 0x0, 0x0, 0x0) [ 80.143862][ T5332] ------------[ cut here ]------------ [ 80.146267][ T5332] workqueue: cannot queue hci_rx_work on wq hci0 [ 80.149049][ T5332] WARNING: CPU: 0 PID: 5332 at kernel/workqueue.c:2258 __queue_work+0xdff/0x10a0 [ 80.152613][ T5332] Modules linked in: [ 80.154254][ T5332] CPU: 0 UID: 0 PID: 5332 Comm: syz.0.0 Not tainted 6.14.0-syzkaller-13524-gf4d2ef48250a #0 PREEMPT(full) [ 80.158769][ T5332] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 80.162941][ T5332] RIP: 0010:__queue_work+0xdff/0x10a0 [ 80.165237][ T5332] Code: e8 03 80 3c 28 00 74 08 4c 89 ff e8 5b 68 a3 00 49 8b 37 49 81 c5 78 01 00 00 48 c7 c7 c0 cf 49 8c 4c 89 ea e8 02 5f f8 ff 90 <0f> 0b 90 90 e9 5d f4 ff ff e8 c3 3e 39 00 90 0f 0b 90 e9 a7 fc ff [ 80.172833][ T5332] RSP: 0018:ffffc9000d537a68 EFLAGS: 00010046 [ 80.175310][ T5332] RAX: ba5fdbea976d2f00 RBX: ffff888000fb8000 RCX: 0000000000100000 [ 80.178467][ T5332] RDX: ffffc9000e823000 RSI: 0000000000000dd7 RDI: 0000000000000dd8 [ 80.181620][ T5332] RBP: dffffc0000000000 R08: ffffffff81827a12 R09: 1ffff11003f847d2 [ 80.184763][ T5332] R10: dffffc0000000000 R11: ffffed1003f847d3 R12: 1ffff110024c6e38 [ 80.187950][ T5332] R13: ffff888012637178 R14: 0000000000000008 R15: ffff888052228a98 [ 80.191217][ T5332] FS: 00007f8e2a09c6c0(0000) GS:ffff88808c596000(0000) knlGS:0000000000000000 [ 80.194676][ T5332] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 80.197258][ T5332] CR2: 00007f8e2a09bfd8 CR3: 0000000040c12000 CR4: 0000000000352ef0 [ 80.200206][ T5332] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 80.203220][ T5332] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 80.206439][ T5332] Call Trace: [ 80.207858][ T5332] [ 80.209136][ T5332] queue_work_on+0x1c4/0x380 [ 80.211089][ T5332] ? __pfx_queue_work_on+0x10/0x10 [ 80.213121][ T5332] ? _raw_spin_unlock_irqrestore+0xde/0x140 [ 80.215680][ T5332] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 80.218640][ T5332] ? skb_queue_tail+0x36/0x120 [ 80.220972][ T5332] hci_recv_frame+0x598/0x6f0 [ 80.223226][ T5332] vhci_write+0x353/0x4a0 [ 80.225336][ T5332] vfs_write+0x70f/0xd10 [ 80.227073][ T5332] ? __pfx_vhci_write+0x10/0x10 [ 80.228971][ T5332] ? __pfx_vfs_write+0x10/0x10 [ 80.230839][ T5332] ? __fget_files+0x2a/0x420 [ 80.232755][ T5332] ? __fget_files+0x2a/0x420 [ 80.234587][ T5332] ksys_write+0x19d/0x2d0 [ 80.236326][ T5332] ? __pfx_ksys_write+0x10/0x10 [ 80.238162][ T5332] ? do_syscall_64+0xb6/0x230 [ 80.240042][ T5332] do_syscall_64+0xf3/0x230 [ 80.241847][ T5332] ? clear_bhb_loop+0x45/0xa0 [ 80.243730][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.246240][ T5332] RIP: 0033:0x7f8e2918bc1f [ 80.248107][ T5332] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 80.255640][ T5332] RSP: 002b:00007f8e2a09c000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 80.258768][ T5332] RAX: ffffffffffffffda RBX: 00007f8e293a6080 RCX: 00007f8e2918bc1f [ 80.261980][ T5332] RDX: 0000000000000009 RSI: 00002000000007c0 RDI: 00000000000000ca [ 80.265094][ T5332] RBP: 00007f8e2920e2a0 R08: 0000000000000000 R09: 0000000000000000 [ 80.268223][ T5332] R10: 00002000000007c0 R11: 0000000000000293 R12: 0000000000000000 [ 80.271271][ T5332] R13: 0000000000000001 R14: 00007f8e293a6080 R15: 00007fffb9947438 [ 80.274310][ T5332] [ 80.275631][ T5332] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 80.278486][ T5332] CPU: 0 UID: 0 PID: 5332 Comm: syz.0.0 Not tainted 6.14.0-syzkaller-13524-gf4d2ef48250a #0 PREEMPT(full) [ 80.282803][ T5332] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 80.286812][ T5332] Call Trace: [ 80.288077][ T5332] [ 80.289189][ T5332] dump_stack_lvl+0x241/0x360 [ 80.290974][ T5332] ? __pfx_dump_stack_lvl+0x10/0x10 [ 80.292919][ T5332] ? __pfx__printk+0x10/0x10 [ 80.294654][ T5332] ? vscnprintf+0x5d/0x90 [ 80.296386][ T5332] panic+0x349/0x880 [ 80.297947][ T5332] ? __warn+0x174/0x4d0 [ 80.299532][ T5332] ? __pfx_panic+0x10/0x10 [ 80.301375][ T5332] __warn+0x344/0x4d0 [ 80.302774][ T5332] ? __queue_work+0xdff/0x10a0 [ 80.304662][ T5332] report_bug+0x2b3/0x500 [ 80.306353][ T5332] ? __queue_work+0xdff/0x10a0 [ 80.308258][ T5332] ? __queue_work+0xdff/0x10a0 [ 80.310063][ T5332] ? __queue_work+0xe01/0x10a0 [ 80.311850][ T5332] handle_bug+0x89/0x170 [ 80.313430][ T5332] exc_invalid_op+0x1a/0x50 [ 80.315283][ T5332] asm_exc_invalid_op+0x1a/0x20 [ 80.317181][ T5332] RIP: 0010:__queue_work+0xdff/0x10a0 [ 80.319309][ T5332] Code: e8 03 80 3c 28 00 74 08 4c 89 ff e8 5b 68 a3 00 49 8b 37 49 81 c5 78 01 00 00 48 c7 c7 c0 cf 49 8c 4c 89 ea e8 02 5f f8 ff 90 <0f> 0b 90 90 e9 5d f4 ff ff e8 c3 3e 39 00 90 0f 0b 90 e9 a7 fc ff [ 80.327043][ T5332] RSP: 0018:ffffc9000d537a68 EFLAGS: 00010046 [ 80.329558][ T5332] RAX: ba5fdbea976d2f00 RBX: ffff888000fb8000 RCX: 0000000000100000 [ 80.332545][ T5332] RDX: ffffc9000e823000 RSI: 0000000000000dd7 RDI: 0000000000000dd8 [ 80.335685][ T5332] RBP: dffffc0000000000 R08: ffffffff81827a12 R09: 1ffff11003f847d2 [ 80.338693][ T5332] R10: dffffc0000000000 R11: ffffed1003f847d3 R12: 1ffff110024c6e38 [ 80.341730][ T5332] R13: ffff888012637178 R14: 0000000000000008 R15: ffff888052228a98 [ 80.344634][ T5332] ? __warn_printk+0x2a2/0x360 [ 80.346410][ T5332] ? __queue_work+0xdfe/0x10a0 [ 80.348307][ T5332] queue_work_on+0x1c4/0x380 [ 80.350175][ T5332] ? __pfx_queue_work_on+0x10/0x10 [ 80.352129][ T5332] ? _raw_spin_unlock_irqrestore+0xde/0x140 [ 80.354245][ T5332] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 80.356576][ T5332] ? skb_queue_tail+0x36/0x120 [ 80.358324][ T5332] hci_recv_frame+0x598/0x6f0 [ 80.360056][ T5332] vhci_write+0x353/0x4a0 [ 80.361632][ T5332] vfs_write+0x70f/0xd10 [ 80.363260][ T5332] ? __pfx_vhci_write+0x10/0x10 [ 80.365048][ T5332] ? __pfx_vfs_write+0x10/0x10 [ 80.366815][ T5332] ? __fget_files+0x2a/0x420 [ 80.368524][ T5332] ? __fget_files+0x2a/0x420 [ 80.370143][ T5332] ksys_write+0x19d/0x2d0 [ 80.371764][ T5332] ? __pfx_ksys_write+0x10/0x10 [ 80.373514][ T5332] ? do_syscall_64+0xb6/0x230 [ 80.375486][ T5332] do_syscall_64+0xf3/0x230 [ 80.377021][ T5332] ? clear_bhb_loop+0x45/0xa0 [ 80.378763][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.381027][ T5332] RIP: 0033:0x7f8e2918bc1f [ 80.382673][ T5332] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 80.390468][ T5332] RSP: 002b:00007f8e2a09c000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 80.393717][ T5332] RAX: ffffffffffffffda RBX: 00007f8e293a6080 RCX: 00007f8e2918bc1f [ 80.396839][ T5332] RDX: 0000000000000009 RSI: 00002000000007c0 RDI: 00000000000000ca [ 80.399932][ T5332] RBP: 00007f8e2920e2a0 R08: 0000000000000000 R09: 0000000000000000 [ 80.402929][ T5332] R10: 00002000000007c0 R11: 0000000000000293 R12: 0000000000000000 [ 80.406001][ T5332] R13: 0000000000000001 R14: 00007f8e293a6080 R15: 00007fffb9947438 [ 80.409184][ T5332] [ 80.410661][ T5332] Kernel Offset: disabled [ 80.412411][ T5332] Rebooting in 86400 seconds..