last executing test programs: kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.255' (ED25519) to the list of known hosts. 2024/06/17 01:19:54 fuzzer started 2024/06/17 01:19:54 dialing manager at 10.128.0.169:30020 [ 51.243090][ T5090] cgroup: Unknown subsys name 'net' [ 51.435940][ T5090] cgroup: Unknown subsys name 'rlimit' 2024/06/17 01:19:56 starting 5 executor processes [ 52.553904][ T5096] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 53.619924][ T53] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 53.628774][ T53] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 53.636794][ T53] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 53.640794][ T5117] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 53.644662][ T53] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 53.652957][ T5117] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 53.665431][ T53] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 53.668830][ T5117] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 53.677597][ T5119] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 53.679924][ T5117] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 53.692310][ T53] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 53.694830][ T5117] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 53.706697][ T53] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 53.708284][ T5117] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 53.715353][ T53] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 53.729159][ T5117] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 53.730377][ T53] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 53.736938][ T5117] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 53.744265][ T53] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 53.751133][ T5117] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 53.758035][ T53] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 53.764484][ T5117] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 53.771137][ T53] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 53.778492][ T5117] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 53.795064][ T4492] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 53.802527][ T4492] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 53.813614][ T4492] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 53.832492][ T53] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 53.847411][ T5108] ================================================================== [ 53.847604][ T5116] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 53.855473][ T5108] BUG: KASAN: slab-use-after-free in kfree_skb_reason+0x41/0x3b0 [ 53.855510][ T5108] Read of size 4 at addr ffff88801fd409a4 by task syz-executor.3/5108 [ 53.855525][ T5108] [ 53.855534][ T5108] CPU: 1 PID: 5108 Comm: syz-executor.3 Not tainted 6.10.0-rc3-syzkaller-00044-g2ccbdf43d5e7 #0 [ 53.855552][ T5108] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 53.855566][ T5108] Call Trace: [ 53.855574][ T5108] [ 53.855582][ T5108] dump_stack_lvl+0x241/0x360 [ 53.855605][ T5108] ? __pfx_dump_stack_lvl+0x10/0x10 [ 53.855625][ T5108] ? __pfx__printk+0x10/0x10 [ 53.855643][ T5108] ? _printk+0xd5/0x120 [ 53.855661][ T5108] ? __virt_addr_valid+0x183/0x520 [ 53.855683][ T5108] ? __virt_addr_valid+0x183/0x520 [ 53.855705][ T5108] print_report+0x169/0x550 [ 53.855727][ T5108] ? __virt_addr_valid+0x183/0x520 [ 53.855748][ T5108] ? __virt_addr_valid+0x183/0x520 [ 53.863094][ T5116] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 53.870352][ T5108] ? __virt_addr_valid+0x44e/0x520 [ 53.870381][ T5108] ? __phys_addr+0xba/0x170 [ 53.870402][ T5108] ? kfree_skb_reason+0x41/0x3b0 [ 53.870419][ T5108] kasan_report+0x143/0x180 [ 53.870440][ T5108] ? kfree_skb_reason+0x41/0x3b0 [ 53.870460][ T5108] kasan_check_range+0x282/0x290 [ 53.870482][ T5108] kfree_skb_reason+0x41/0x3b0 [ 53.870500][ T5108] __hci_req_sync+0x62f/0x950 [ 53.995859][ T5108] ? __pfx___hci_req_sync+0x10/0x10 [ 54.001057][ T5108] ? __pfx___mutex_lock+0x10/0x10 [ 54.006066][ T5108] ? __pfx_autoremove_wake_function+0x10/0x10 [ 54.012118][ T5108] ? __pfx_hci_scan_req+0x10/0x10 [ 54.017128][ T5108] hci_req_sync+0xa9/0xd0 [ 54.021444][ T5108] hci_dev_cmd+0x4c5/0xa50 [ 54.025845][ T5108] ? security_capable+0x90/0xb0 [ 54.030689][ T5108] ? __pfx_hci_dev_cmd+0x10/0x10 [ 54.035615][ T5108] ? hci_sock_ioctl+0x6c4/0xa40 [ 54.040452][ T5108] compat_sock_ioctl+0x18b/0xf20 [ 54.045379][ T5108] ? __pfx_compat_sock_ioctl+0x10/0x10 [ 54.050824][ T5108] ? __fget_files+0x29/0x470 [ 54.055401][ T5108] ? __fget_files+0x3f6/0x470 [ 54.060066][ T5108] ? bpf_lsm_file_ioctl_compat+0x9/0x10 [ 54.065596][ T5108] ? security_file_ioctl_compat+0x87/0xb0 [ 54.071300][ T5108] __se_compat_sys_ioctl+0x51c/0xca0 [ 54.076572][ T5108] ? __pfx___se_compat_sys_ioctl+0x10/0x10 [ 54.082364][ T5108] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 54.088327][ T5108] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 54.094639][ T5108] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 54.101469][ T5108] ? lockdep_hardirqs_on+0x99/0x150 [ 54.106743][ T5108] __do_fast_syscall_32+0xb4/0x120 [ 54.111846][ T5108] do_fast_syscall_32+0x34/0x80 [ 54.116856][ T5108] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 54.123182][ T5108] RIP: 0023:0xf7494579 [ 54.127242][ T5108] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 54.146830][ T5108] RSP: 002b:00000000ffa13f44 EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 54.155236][ T5108] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000400448dd [ 54.163188][ T5108] RDX: 00000000ffa13f94 RSI: 00000000f7484ff4 RDI: 0000000000000004 [ 54.171145][ T5108] RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000 [ 54.179098][ T5108] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 54.187053][ T5108] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 54.195013][ T5108] [ 54.198023][ T5108] [ 54.200327][ T5108] Allocated by task 53: [ 54.204460][ T5108] kasan_save_track+0x3f/0x80 [ 54.209123][ T5108] __kasan_slab_alloc+0x66/0x80 [ 54.213961][ T5108] kmem_cache_alloc_noprof+0x135/0x2a0 [ 54.219405][ T5108] skb_clone+0x20c/0x390 [ 54.223629][ T5108] hci_cmd_work+0x29e/0x670 [ 54.228115][ T5108] process_scheduled_works+0xa2c/0x1830 [ 54.233728][ T5108] worker_thread+0x86d/0xd70 [ 54.238299][ T5108] kthread+0x2f0/0x390 [ 54.242352][ T5108] ret_from_fork+0x4b/0x80 [ 54.246752][ T5108] ret_from_fork_asm+0x1a/0x30 [ 54.251500][ T5108] [ 54.253804][ T5108] Freed by task 5116: [ 54.257802][ T5108] kasan_save_track+0x3f/0x80 [ 54.262461][ T5108] kasan_save_free_info+0x40/0x50 [ 54.267552][ T5108] poison_slab_object+0xe0/0x150 [ 54.272473][ T5108] __kasan_slab_free+0x37/0x60 [ 54.277220][ T5108] kmem_cache_free+0x145/0x350 [ 54.281964][ T5108] hci_req_sync_complete+0xe7/0x290 [ 54.287146][ T5108] hci_event_packet+0xc71/0x1540 [ 54.292064][ T5108] hci_rx_work+0x3e8/0xca0 [ 54.296462][ T5108] process_scheduled_works+0xa2c/0x1830 [ 54.301987][ T5108] worker_thread+0x86d/0xd70 [ 54.306562][ T5108] kthread+0x2f0/0x390 [ 54.310612][ T5108] ret_from_fork+0x4b/0x80 [ 54.315015][ T5108] ret_from_fork_asm+0x1a/0x30 [ 54.319768][ T5108] [ 54.322072][ T5108] The buggy address belongs to the object at ffff88801fd408c0 [ 54.322072][ T5108] which belongs to the cache skbuff_head_cache of size 240 [ 54.336624][ T5108] The buggy address is located 228 bytes inside of [ 54.336624][ T5108] freed 240-byte region [ffff88801fd408c0, ffff88801fd409b0) [ 54.350399][ T5108] [ 54.352790][ T5108] The buggy address belongs to the physical page: [ 54.359187][ T5108] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1fd40 [ 54.367929][ T5108] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 54.375025][ T5108] page_type: 0xffffefff(slab) [ 54.379683][ T5108] raw: 00fff00000000000 ffff888018ad7780 dead000000000122 0000000000000000 [ 54.388248][ T5108] raw: 0000000000000000 00000000800c000c 00000001ffffefff 0000000000000000 [ 54.396808][ T5108] page dumped because: kasan: bad access detected [ 54.403292][ T5108] page_owner tracks the page as allocated [ 54.409073][ T5108] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 53, tgid 53 (kworker/u9:0), ts 53846136221, free_ts 53804707100 [ 54.427978][ T5108] post_alloc_hook+0x1f3/0x230 [ 54.432735][ T5108] get_page_from_freelist+0x2e43/0x2f00 [ 54.438266][ T5108] __alloc_pages_noprof+0x256/0x6c0 [ 54.443450][ T5108] alloc_slab_page+0x5f/0x120 [ 54.448110][ T5108] allocate_slab+0x5a/0x2f0 [ 54.452595][ T5108] ___slab_alloc+0xcd1/0x14b0 [ 54.457252][ T5108] __slab_alloc+0x58/0xa0 [ 54.461561][ T5108] kmem_cache_alloc_noprof+0x1c1/0x2a0 [ 54.467008][ T5108] skb_clone+0x20c/0x390 [ 54.471231][ T5108] hci_event_packet+0x49c/0x1540 [ 54.476151][ T5108] hci_rx_work+0x3e8/0xca0 [ 54.480640][ T5108] process_scheduled_works+0xa2c/0x1830 [ 54.486167][ T5108] worker_thread+0x86d/0xd70 [ 54.490745][ T5108] kthread+0x2f0/0x390 [ 54.494797][ T5108] ret_from_fork+0x4b/0x80 [ 54.499197][ T5108] ret_from_fork_asm+0x1a/0x30 [ 54.503949][ T5108] page last free pid 5104 tgid 5104 stack trace: [ 54.510252][ T5108] free_unref_page+0xd22/0xea0 [ 54.515004][ T5108] __folio_put+0x3b9/0x620 [ 54.519399][ T5108] skb_release_data+0x467/0x880 [ 54.524229][ T5108] napi_consume_skb+0x146/0x1f0 [ 54.529063][ T5108] net_rx_action+0x584/0x10a0 [ 54.533723][ T5108] handle_softirqs+0x2c4/0x970 [ 54.538468][ T5108] do_softirq+0x11b/0x1e0 [ 54.542774][ T5108] __local_bh_enable_ip+0x1bb/0x200 [ 54.547957][ T5108] fpu_clone+0x3ee/0xad0 [ 54.552187][ T5108] copy_thread+0x3e5/0x980 [ 54.556587][ T5108] copy_process+0x1c0c/0x3dc0 [ 54.561244][ T5108] kernel_clone+0x226/0x8f0 [ 54.565729][ T5108] __ia32_compat_sys_ia32_clone+0x255/0x2a0 [ 54.571610][ T5108] do_int80_emulation+0x11f/0x200 [ 54.576618][ T5108] asm_int80_emulation+0x1a/0x20 [ 54.581538][ T5108] [ 54.583852][ T5108] Memory state around the buggy address: [ 54.589459][ T5108] ffff88801fd40880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 54.597519][ T5108] ffff88801fd40900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 54.605559][ T5108] >ffff88801fd40980: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc [ 54.613595][ T5108] ^ [ 54.618695][ T5108] ffff88801fd40a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 54.626735][ T5108] ffff88801fd40a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc [ 54.634863][ T5108] ================================================================== 2024/06/17 01:19:58 SYZFATAL: failed to recv *flatrpc.HostMessageRaw: EOF [ 54.716270][ T5108] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 54.723497][ T5108] CPU: 0 PID: 5108 Comm: syz-executor.3 Not tainted 6.10.0-rc3-syzkaller-00044-g2ccbdf43d5e7 #0 [ 54.733918][ T5108] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 54.743979][ T5108] Call Trace: [ 54.747268][ T5108] [ 54.750380][ T5108] dump_stack_lvl+0x241/0x360 [ 54.755073][ T5108] ? __pfx_dump_stack_lvl+0x10/0x10 [ 54.760285][ T5108] ? __pfx__printk+0x10/0x10 [ 54.764901][ T5108] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 54.770896][ T5108] ? vscnprintf+0x5d/0x90 [ 54.775243][ T5108] panic+0x349/0x860 [ 54.779155][ T5108] ? check_panic_on_warn+0x21/0xb0 [ 54.784281][ T5108] ? __pfx_panic+0x10/0x10 [ 54.788718][ T5108] ? _raw_spin_unlock_irqrestore+0x130/0x140 [ 54.794713][ T5108] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 54.801058][ T5108] check_panic_on_warn+0x86/0xb0 [ 54.806006][ T5108] ? kfree_skb_reason+0x41/0x3b0 [ 54.810955][ T5108] end_report+0x77/0x160 [ 54.815215][ T5108] kasan_report+0x154/0x180 [ 54.819740][ T5108] ? kfree_skb_reason+0x41/0x3b0 [ 54.824689][ T5108] kasan_check_range+0x282/0x290 [ 54.829641][ T5108] kfree_skb_reason+0x41/0x3b0 [ 54.834411][ T5108] __hci_req_sync+0x62f/0x950 [ 54.839094][ T5108] ? __pfx___hci_req_sync+0x10/0x10 [ 54.844295][ T5108] ? __pfx___mutex_lock+0x10/0x10 [ 54.849322][ T5108] ? __pfx_autoremove_wake_function+0x10/0x10 [ 54.855378][ T5108] ? __pfx_hci_scan_req+0x10/0x10 [ 54.860391][ T5108] hci_req_sync+0xa9/0xd0 [ 54.864708][ T5108] hci_dev_cmd+0x4c5/0xa50 [ 54.869113][ T5108] ? security_capable+0x90/0xb0 [ 54.873953][ T5108] ? __pfx_hci_dev_cmd+0x10/0x10 [ 54.878881][ T5108] ? hci_sock_ioctl+0x6c4/0xa40 [ 54.883722][ T5108] compat_sock_ioctl+0x18b/0xf20 [ 54.888649][ T5108] ? __pfx_compat_sock_ioctl+0x10/0x10 [ 54.894096][ T5108] ? __fget_files+0x29/0x470 [ 54.898672][ T5108] ? __fget_files+0x3f6/0x470 [ 54.903339][ T5108] ? bpf_lsm_file_ioctl_compat+0x9/0x10 [ 54.909222][ T5108] ? security_file_ioctl_compat+0x87/0xb0 [ 54.914929][ T5108] __se_compat_sys_ioctl+0x51c/0xca0 [ 54.920206][ T5108] ? __pfx___se_compat_sys_ioctl+0x10/0x10 [ 54.926094][ T5108] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 54.932066][ T5108] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 54.938380][ T5108] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 54.944960][ T5108] ? lockdep_hardirqs_on+0x99/0x150 [ 54.950171][ T5108] __do_fast_syscall_32+0xb4/0x120 [ 54.955274][ T5108] do_fast_syscall_32+0x34/0x80 [ 54.960116][ T5108] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 54.966433][ T5108] RIP: 0023:0xf7494579 [ 54.970484][ T5108] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 54.990073][ T5108] RSP: 002b:00000000ffa13f44 EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 54.998474][ T5108] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000400448dd [ 55.006776][ T5108] RDX: 00000000ffa13f94 RSI: 00000000f7484ff4 RDI: 0000000000000004 [ 55.014732][ T5108] RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000 [ 55.022692][ T5108] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 55.030647][ T5108] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 55.038631][ T5108] [ 55.041845][ T5108] Kernel Offset: disabled [ 55.046151][ T5108] Rebooting in 86400 seconds..