[ 143.249115][ T1332] ieee802154 phy0 wpan0: encryption failed: -22
[ 143.249247][ T1332] ieee802154 phy1 wpan1: encryption failed: -22
[ 143.485328][ T1026] ata1.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x0
[ 143.485363][ T1026] ata1.00: irq_stat 0x40000000
[ 143.485375][ T1026] ata1.00: failed command: WRITE DMA EXT
[ 143.485384][ T1026] ata1.00: cmd 35/00:d8:8e:58:04/00:0b:00:00:00/e0 tag 30 dma 1552384 out
[ 143.485384][ T1026] res 41/04:d8:8e:58:04/00:0b:00:00:00/e0 Emask 0x1 (device error)
[ 143.485415][ T1026] ata1.00: status: { DRDY ERR }
[ 143.485423][ T1026] ata1.00: error: { ABRT }
[ 143.488958][ T1026] ata1.00: configured for UDMA/66
[ 143.489057][ T1026] ata1: EH complete
[ 145.514810][ T1026] ata1.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x0
[ 145.514833][ T1026] ata1.00: irq_stat 0x40000000
[ 145.514841][ T1026] ata1.00: failed command: WRITE DMA EXT
[ 145.514846][ T1026] ata1.00: cmd 35/00:00:b6:0d:05/00:06:00:00:00/e0 tag 14 dma 786432 out
[ 145.514846][ T1026] res 41/04:00:b6:0d:05/00:06:00:00:00/e0 Emask 0x1 (device error)
[ 145.514867][ T1026] ata1.00: status: { DRDY ERR }
[ 145.514873][ T1026] ata1.00: error: { ABRT }
[ 145.518513][ T1026] ata1.00: configured for UDMA/66
[ 145.518594][ T1026] ata1: EH complete
Warning: Permanently added '[localhost]:40575' (ED25519) to the list of known hosts.
[*] Starting reproducer for WARNING in hci_connect_sco / __queue_work...
[+] open /dev/vhci successful.
[+] write create_dev to /dev/vhci successful.
[+] Created virtual Bluetooth adapter hci0.
[+] vhci_responder_thread started successfully.
[+] Device hci0 is UP (flags=0x5).
[+] hci0 is UP and fully operational.
[*] Spawning racer threads...
sched_setaffinity: Invalid argument
sched_setaffinity: Invalid argument
sched_setaffinity: Invalid argument
sched_setaffinity: Invalid argument
[+] All 8 racer threads spawned successfully.
[*] Racing HCIDEVDOWN/HCIDEVUP vs connect(BTPROTO_SCO)...
[ 156.020494][ T4650] Bluetooth: hci0: unexpected event for opcode 0x0405
[ 157.609038][ T4650] Bluetooth: hci0: unexpected event for opcode 0x0405
[ 169.456544][ T4650] Bluetooth: hci0: unexpected event for opcode 0x0405
[ 173.709533][ T5621] ------------[ cut here ]------------
[ 173.709600][ T5621] workqueue: cannot queue hci_conn_timeout on wq hci0
[ 173.709751][ T5621] WARNING: kernel/workqueue.c:2353 at __queue_work+0xd93/0x10e0, CPU#0: syz-executor112/5621
[ 173.719490][ T5621] Modules linked in:
[ 173.721238][ T5621] CPU: 0 UID: 0 PID: 5621 Comm: syz-executor112 Not tainted syzkaller #0 PREEMPT(full)
[ 173.725300][ T5621] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 173.729691][ T5621] RIP: 0010:__queue_work+0xdaf/0x10e0
[ 173.732107][ T5621] Code: 49 81 c7 70 01 00 00 4c 8d 35 dd 07 ef 0f 48 89 f8 48 c1 e8 03 80 3c 18 00 74 05 e8 8b 37 ac 00 49 8b 75 18 4c 89 f7 4c 89 fa <67> 48 0f b9 3a 4c 89 e8 48 c1 e8 03 80 3c 18 00 74 08 4c 89 ef e8
[ 173.741901][ T5621] RSP: 0018:ffffc900030a7af8 EFLAGS: 00010046
[ 173.744499][ T5621] RAX: 1ffff1100a7cc94d RBX: dffffc0000000000 RCX: ffff888040b12580
[ 173.747989][ T5621] RDX: ffff888013a00170 RSI: ffffffff8add09c0 RDI: ffffffff917d6ea0
[ 173.751410][ T5621] RBP: 0000000000000000 R08: ffff888053e64a57 R09: 1ffff1100a7cc94a
[ 173.754705][ T5621] R10: dffffc0000000000 R11: ffffed100a7cc94b R12: 0000000000000008
[ 173.758067][ T5621] R13: ffff888053e64a50 R14: ffffffff917d6ea0 R15: ffff888013a00170
[ 173.761066][ T5621] FS: 00007f0105e7e6c0(0000) GS:ffff88808b0b4000(0000) knlGS:0000000000000000
[ 173.764431][ T5621] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 173.767373][ T5621] CR2: 00005555905b7708 CR3: 0000000034424000 CR4: 0000000000352ef0
[ 173.770859][ T5621] Call Trace:
[ 173.772327][ T5621]
[ 173.773650][ T5621] ? rcu_is_watching+0x16/0xb0
[ 173.775722][ T5621] queue_delayed_work_on+0x11a/0x1e0
[ 173.778087][ T5621] hci_connect_sco+0xe9/0x390
[ 173.780045][ T5621] sco_sock_connect+0x45e/0xb10
[ 173.782234][ T5621] ? __pfx_sco_sock_connect+0x10/0x10
[ 173.784585][ T5621] ? tomoyo_socket_connect_permission+0x199/0x270
[ 173.787512][ T5621] ? bpf_lsm_socket_connect+0x9/0x20
[ 173.789789][ T5621] __sys_connect+0x316/0x450
[ 173.791894][ T5621] ? __pfx___sys_connect+0x10/0x10
[ 173.794258][ T5621] ? rcu_is_watching+0x16/0xb0
[ 173.796515][ T5621] __x64_sys_connect+0x7a/0x90
[ 173.798747][ T5621] do_syscall_64+0x166/0x520
[ 173.800736][ T5621] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 173.803131][ T5621] ? clear_bhb_loop+0x70/0xc0
[ 173.805165][ T5621] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 173.807786][ T5621] RIP: 0033:0x7f01096e299e
[ 173.809856][ T5621] Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[ 173.818133][ T5621] RSP: 002b:00007f0105e7e0e8 EFLAGS: 00000246 ORIG_RAX: 000000000000002a
[ 173.821765][ T5621] RAX: ffffffffffffffda RBX: 00007f0105e7e6c0 RCX: 00007f01096e299e
[ 173.824952][ T5621] RDX: 0000000000000008 RSI: 00007f0105e7e160 RDI: 0000000000000008
[ 173.828238][ T5621] RBP: 000000000001e435 R08: 0000000000000000 R09: 0000000000000000
[ 173.831568][ T5621] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000008
[ 173.835057][ T5621] R13: 000000000001e438 R14: 00007f0105e7e160 R15: 00007f0105e7e158
[ 173.838557][ T5621]
[ 173.839964][ T5621] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 173.843235][ T5621] CPU: 0 UID: 0 PID: 5621 Comm: syz-executor112 Not tainted syzkaller #0 PREEMPT(full)
[ 173.847494][ T5621] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 173.851669][ T5621] Call Trace:
[ 173.853223][ T5621]
[ 173.854507][ T5621] vpanic+0x56d/0xa60
[ 173.856219][ T5621] ? __pfx__printk+0x10/0x10
[ 173.858245][ T5621] ? __pfx_vpanic+0x10/0x10
[ 173.860242][ T5621] ? is_bpf_text_address+0x292/0x2b0
[ 173.862452][ T5621] ? is_bpf_text_address+0x26/0x2b0
[ 173.864690][ T5621] panic+0xc5/0xd0
[ 173.866350][ T5621] ? __pfx_panic+0x10/0x10
[ 173.868332][ T5621] __warn+0x315/0x4c0
[ 173.870125][ T5621] ? __queue_work+0xd93/0x10e0
[ 173.872245][ T5621] ? __queue_work+0xd93/0x10e0
[ 173.874401][ T5621] __report_bug+0x276/0x570
[ 173.876431][ T5621] ? __queue_work+0xd93/0x10e0
[ 173.878552][ T5621] ? __pfx___report_bug+0x10/0x10
[ 173.880811][ T5621] ? __pfx_hci_conn_timeout+0x10/0x10
[ 173.883111][ T5621] ? do_raw_spin_lock+0x12b/0x2f0
[ 173.885321][ T5621] report_bug_entry+0x19b/0x290
[ 173.887423][ T5621] ? __queue_work+0xdaf/0x10e0
[ 173.889457][ T5621] ? __queue_work+0xdb4/0x10e0
[ 173.891607][ T5621] handle_bug+0xce/0x200
[ 173.893551][ T5621] exc_invalid_op+0x1a/0x50
[ 173.895593][ T5621] asm_exc_invalid_op+0x1a/0x20
[ 173.897774][ T5621] RIP: 0010:__queue_work+0xdaf/0x10e0
[ 173.900157][ T5621] Code: 49 81 c7 70 01 00 00 4c 8d 35 dd 07 ef 0f 48 89 f8 48 c1 e8 03 80 3c 18 00 74 05 e8 8b 37 ac 00 49 8b 75 18 4c 89 f7 4c 89 fa <67> 48 0f b9 3a 4c 89 e8 48 c1 e8 03 80 3c 18 00 74 08 4c 89 ef e8
[ 173.908599][ T5621] RSP: 0018:ffffc900030a7af8 EFLAGS: 00010046
[ 173.911424][ T5621] RAX: 1ffff1100a7cc94d RBX: dffffc0000000000 RCX: ffff888040b12580
[ 173.914836][ T5621] RDX: ffff888013a00170 RSI: ffffffff8add09c0 RDI: ffffffff917d6ea0
[ 173.918325][ T5621] RBP: 0000000000000000 R08: ffff888053e64a57 R09: 1ffff1100a7cc94a
[ 173.921846][ T5621] R10: dffffc0000000000 R11: ffffed100a7cc94b R12: 0000000000000008
[ 173.925224][ T5621] R13: ffff888053e64a50 R14: ffffffff917d6ea0 R15: ffff888013a00170
[ 173.928681][ T5621] ? __pfx_hci_conn_timeout+0x10/0x10
[ 173.931073][ T5621] ? __queue_work+0xd6e/0x10e0
[ 173.933254][ T5621] ? rcu_is_watching+0x16/0xb0
[ 173.935417][ T5621] queue_delayed_work_on+0x11a/0x1e0
[ 173.937788][ T5621] hci_connect_sco+0xe9/0x390
[ 173.939566][ T5621] sco_sock_connect+0x45e/0xb10
[ 173.941382][ T5621] ? __pfx_sco_sock_connect+0x10/0x10
[ 173.943134][ T5621] ? tomoyo_socket_connect_permission+0x199/0x270
[ 173.945819][ T5621] ? bpf_lsm_socket_connect+0x9/0x20
[ 173.948154][ T5621] __sys_connect+0x316/0x450
[ 173.950216][ T5621] ? __pfx___sys_connect+0x10/0x10
[ 173.952550][ T5621] ? rcu_is_watching+0x16/0xb0
[ 173.954717][ T5621] __x64_sys_connect+0x7a/0x90
[ 173.956895][ T5621] do_syscall_64+0x166/0x520
[ 173.958973][ T5621] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 173.961666][ T5621] ? clear_bhb_loop+0x70/0xc0
[ 173.963798][ T5621] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 173.966395][ T5621] RIP: 0033:0x7f01096e299e
[ 173.968211][ T5621] Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[ 173.976285][ T5621] RSP: 002b:00007f0105e7e0e8 EFLAGS: 00000246 ORIG_RAX: 000000000000002a
[ 173.979778][ T5621] RAX: ffffffffffffffda RBX: 00007f0105e7e6c0 RCX: 00007f01096e299e
[ 173.983026][ T5621] RDX: 0000000000000008 RSI: 00007f0105e7e160 RDI: 0000000000000008
[ 173.986439][ T5621] RBP: 000000000001e435 R08: 0000000000000000 R09: 0000000000000000
[ 173.989616][ T5621] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000008
[ 173.993036][ T5621] R13: 000000000001e438 R14: 00007f0105e7e160 R15: 00007f0105e7e158
[ 173.996448][ T5621]
[ 173.998336][ T5621] Kernel Offset: disabled
[ 174.000231][ T5621] Rebooting in 86400 seconds..