program:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xc3, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x8}, 0x0, 0x0, 0x1, 0x4, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x9) (async)
sendmsg$nl_xfrm(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100000000000000000000000000000000000000000a0060"], 0xb8}}, 0x0) (async)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@remote, 0x0, 0x400, 0x0, 0x0, 0xa, 0x60, 0x0, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {}, 0x9}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x0) (async)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6) (async)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0) (async, rerun: 64)
r4 = socket$nl_xfrm(0x10, 0x3, 0x6) (rerun: 64)
sendmsg$nl_xfrm(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@remote, 0x0, 0x400, 0x0, 0x0, 0xa, 0x60, 0x0, 0x0, 0x0, 0xee01}, {}, {}, 0x9}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x0) (async, rerun: 32)
sendmsg$nl_xfrm(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfd, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x9}, {0x6}, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0xb8}}, 0x4000) (rerun: 32)
getsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000000), &(0x7f0000000040)=0x4) (async)
ioctl$sock_bt_hci(r0, 0x400448cb, 0x0) (async)
syz_emit_vhci(&(0x7f00000006c0)=ANY=[@ANYBLOB="040e0402030c29"], 0x7)
[ 75.724027][ T4662] Bluetooth: hci0: command tx timeout
[ 75.844619][ T5322] ------------[ cut here ]------------
[ 75.847061][ T5322] workqueue: cannot queue hci_rx_work on wq hci0
[ 75.849983][ T5322] WARNING: CPU: 0 PID: 5322 at kernel/workqueue.c:2258 __queue_work+0xd62/0xfe0
[ 75.853919][ T5322] Modules linked in:
[ 75.855604][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted 6.15.0-rc7-syzkaller-00099-g94305e83eccb #0 PREEMPT(full)
[ 75.860416][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 75.864898][ T5322] RIP: 0010:__queue_work+0xd62/0xfe0
[ 75.867111][ T5322] Code: 42 80 3c 20 00 74 08 4c 89 ef e8 49 df 96 00 49 8b 75 00 49 81 c7 78 01 00 00 48 c7 c7 e0 cc 69 8b 4c 89 fa e8 9f 40 f9 ff 90 <0f> 0b 90 90 e9 f1 f4 ff ff e8 00 e4 34 00 90 0f 0b 90 e9 dd fc ff
[ 75.875248][ T5322] RSP: 0018:ffffc9000d3e7a88 EFLAGS: 00010046
[ 75.877874][ T5322] RAX: 17aab93bea108700 RBX: 0000000000000000 RCX: ffff88801f6cc880
[ 75.881266][ T5322] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002
[ 75.884600][ T5322] RBP: 1ffff11007ebb838 R08: ffff88801fe23e93 R09: 1ffff11003fc47d2
[ 75.887973][ T5322] R10: dffffc0000000000 R11: ffffed1003fc47d3 R12: dffffc0000000000
[ 75.891412][ T5322] R13: ffff888043b18a98 R14: ffff88801f6cc880 R15: ffff88803f5dc178
[ 75.894777][ T5322] FS: 00007f41229366c0(0000) GS:ffff88808d6c2000(0000) knlGS:0000000000000000
[ 75.898495][ T5322] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 75.901353][ T5322] CR2: 00007f4122935fc8 CR3: 00000000438b7000 CR4: 0000000000352ef0
[ 75.904773][ T5322] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 75.908092][ T5322] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 75.911497][ T5322] Call Trace:
[ 75.912940][ T5322]
[ 75.914292][ T5322] ? rcu_is_watching+0x15/0xb0
[ 75.916332][ T5322] queue_work_on+0x181/0x270
[ 75.918235][ T5322] ? lockdep_hardirqs_on+0x9c/0x150
[ 75.920478][ T5322] ? __pfx_queue_work_on+0x10/0x10
[ 75.922855][ T5322] ? _raw_spin_unlock_irqrestore+0xad/0x110
[ 75.925444][ T5322] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 75.928220][ T5322] ? skb_queue_tail+0x30/0xf0
[ 75.930406][ T5322] hci_recv_frame+0x5ad/0x700
[ 75.932490][ T5322] ? skb_pull+0xc1/0x1d0
[ 75.934362][ T5322] vhci_write+0x358/0x4a0
[ 75.936240][ T5322] vfs_write+0x548/0xa90
[ 75.938153][ T5322] ? __pfx_vhci_write+0x10/0x10
[ 75.940323][ T5322] ? __pfx_vfs_write+0x10/0x10
[ 75.942474][ T5322] ? __fget_files+0x2a/0x420
[ 75.944651][ T5322] ksys_write+0x145/0x250
[ 75.946591][ T5322] ? rcu_is_watching+0x15/0xb0
[ 75.948709][ T5322] ? __pfx_ksys_write+0x10/0x10
[ 75.950905][ T5322] ? do_syscall_64+0xba/0x210
[ 75.953100][ T5322] do_syscall_64+0xf6/0x210
[ 75.955117][ T5322] ? clear_bhb_loop+0x60/0xb0
[ 75.957222][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 75.959823][ T5322] RIP: 0033:0x7f4121b8d41f
[ 75.961819][ T5322] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
[ 75.970071][ T5322] RSP: 002b:00007f4122936000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
[ 75.973703][ T5322] RAX: ffffffffffffffda RBX: 00007f4121db6160 RCX: 00007f4121b8d41f
[ 75.977892][ T5322] RDX: 0000000000000007 RSI: 00002000000006c0 RDI: 00000000000000ca
[ 75.981141][ T5322] RBP: 00007f4121c10ab1 R08: 0000000000000000 R09: 0000000000000000
[ 75.984475][ T5322] R10: 00002000000006c0 R11: 0000000000000293 R12: 0000000000000000
[ 75.987977][ T5322] R13: 0000000000000000 R14: 00007f4121db6160 R15: 00007ffcb5dac7d8
[ 75.991460][ T5322]
[ 75.992884][ T5322] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 75.996118][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted 6.15.0-rc7-syzkaller-00099-g94305e83eccb #0 PREEMPT(full)
[ 76.000941][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 76.005644][ T5322] Call Trace:
[ 76.007135][ T5322]
[ 76.008442][ T5322] dump_stack_lvl+0x99/0x250
[ 76.010501][ T5322] ? __asan_memcpy+0x40/0x70
[ 76.012418][ T5322] ? __pfx_dump_stack_lvl+0x10/0x10
[ 76.014538][ T5322] ? __pfx__printk+0x10/0x10
[ 76.016457][ T5322] panic+0x2db/0x790
[ 76.018068][ T5322] ? __pfx_panic+0x10/0x10
[ 76.019865][ T5322] ? show_trace_log_lvl+0x4fb/0x550
[ 76.022026][ T5322] __warn+0x31b/0x4b0
[ 76.023720][ T5322] ? __queue_work+0xd62/0xfe0
[ 76.025732][ T5322] ? __queue_work+0xd62/0xfe0
[ 76.027728][ T5322] report_bug+0x2be/0x4f0
[ 76.029666][ T5322] ? __queue_work+0xd62/0xfe0
[ 76.031746][ T5322] ? __queue_work+0xd62/0xfe0
[ 76.033885][ T5322] ? __queue_work+0xd64/0xfe0
[ 76.035972][ T5322] handle_bug+0x84/0x160
[ 76.037811][ T5322] exc_invalid_op+0x1a/0x50
[ 76.039723][ T5322] asm_exc_invalid_op+0x1a/0x20
[ 76.041809][ T5322] RIP: 0010:__queue_work+0xd62/0xfe0
[ 76.044037][ T5322] Code: 42 80 3c 20 00 74 08 4c 89 ef e8 49 df 96 00 49 8b 75 00 49 81 c7 78 01 00 00 48 c7 c7 e0 cc 69 8b 4c 89 fa e8 9f 40 f9 ff 90 <0f> 0b 90 90 e9 f1 f4 ff ff e8 00 e4 34 00 90 0f 0b 90 e9 dd fc ff
[ 76.051899][ T5322] RSP: 0018:ffffc9000d3e7a88 EFLAGS: 00010046
[ 76.054626][ T5322] RAX: 17aab93bea108700 RBX: 0000000000000000 RCX: ffff88801f6cc880
[ 76.058137][ T5322] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002
[ 76.061588][ T5322] RBP: 1ffff11007ebb838 R08: ffff88801fe23e93 R09: 1ffff11003fc47d2
[ 76.064986][ T5322] R10: dffffc0000000000 R11: ffffed1003fc47d3 R12: dffffc0000000000
[ 76.068397][ T5322] R13: ffff888043b18a98 R14: ffff88801f6cc880 R15: ffff88803f5dc178
[ 76.071779][ T5322] ? __queue_work+0xd61/0xfe0
[ 76.073824][ T5322] ? rcu_is_watching+0x15/0xb0
[ 76.075899][ T5322] queue_work_on+0x181/0x270
[ 76.077890][ T5322] ? lockdep_hardirqs_on+0x9c/0x150
[ 76.080150][ T5322] ? __pfx_queue_work_on+0x10/0x10
[ 76.082456][ T5322] ? _raw_spin_unlock_irqrestore+0xad/0x110
[ 76.085043][ T5322] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 76.087910][ T5322] ? skb_queue_tail+0x30/0xf0
[ 76.090041][ T5322] hci_recv_frame+0x5ad/0x700
[ 76.092149][ T5322] ? skb_pull+0xc1/0x1d0
[ 76.094084][ T5322] vhci_write+0x358/0x4a0
[ 76.095950][ T5322] vfs_write+0x548/0xa90
[ 76.097814][ T5322] ? __pfx_vhci_write+0x10/0x10
[ 76.099985][ T5322] ? __pfx_vfs_write+0x10/0x10
[ 76.102023][ T5322] ? __fget_files+0x2a/0x420
[ 76.104032][ T5322] ksys_write+0x145/0x250
[ 76.105903][ T5322] ? rcu_is_watching+0x15/0xb0
[ 76.107913][ T5322] ? __pfx_ksys_write+0x10/0x10
[ 76.109997][ T5322] ? do_syscall_64+0xba/0x210
[ 76.112007][ T5322] do_syscall_64+0xf6/0x210
[ 76.113981][ T5322] ? clear_bhb_loop+0x60/0xb0
[ 76.116115][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 76.118734][ T5322] RIP: 0033:0x7f4121b8d41f
[ 76.120711][ T5322] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
[ 76.128951][ T5322] RSP: 002b:00007f4122936000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
[ 76.132502][ T5322] RAX: ffffffffffffffda RBX: 00007f4121db6160 RCX: 00007f4121b8d41f
[ 76.135843][ T5322] RDX: 0000000000000007 RSI: 00002000000006c0 RDI: 00000000000000ca
[ 76.139330][ T5322] RBP: 00007f4121c10ab1 R08: 0000000000000000 R09: 0000000000000000
[ 76.142817][ T5322] R10: 00002000000006c0 R11: 0000000000000293 R12: 0000000000000000
[ 76.146222][ T5322] R13: 0000000000000000 R14: 00007f4121db6160 R15: 00007ffcb5dac7d8
[ 76.149644][ T5322]
[ 76.151306][ T5322] Kernel Offset: disabled
[ 76.153203][ T5322] Rebooting in 86400 seconds..