program:
socket$inet_icmp_raw(0x2, 0x3, 0x1)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5)
close(0x4)
syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') (async)
syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00')
unshare(0x6a040000)
socket(0x8, 0x3, 0x0) (async)
r0 = socket(0x8, 0x3, 0x0)
ioctl$sock_netrom_SIOCADDRT(r0, 0x6180, 0x0)
ioctl$BTRFS_IOC_QUOTA_RESCAN(r0, 0x61d0, 0x0) (async)
ioctl$BTRFS_IOC_QUOTA_RESCAN(r0, 0x61d0, 0x0)
getsockopt$IP6T_SO_GET_REVISION_MATCH(r0, 0x29, 0x44, &(0x7f0000000000)={'IDLETIMER\x00'}, &(0x7f0000000040)=0x1e)

[   73.951141][ T5309] Bluetooth: hci0: command tx timeout
[   74.211961][ T5329] ==================================================================
[   74.215861][ T5329] BUG: KASAN: slab-use-after-free in lane_ioctl+0xa77/0x1e60
[   74.219624][ T5329] Read of size 8 at addr ffff88803f354e68 by task syz.0.0/5329
[   74.223881][ T5329] 
[   74.225333][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted 6.16.0-rc1-syzkaller-00005-g488ef3560196 #0 PREEMPT(full) 
[   74.225351][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[   74.225358][ T5329] Call Trace:
[   74.225366][ T5329]  <TASK>
[   74.225373][ T5329]  dump_stack_lvl+0x189/0x250
[   74.225438][ T5329]  ? __virt_addr_valid+0x1c8/0x5c0
[   74.225450][ T5329]  ? rcu_is_watching+0x15/0xb0
[   74.225466][ T5329]  ? __kasan_check_byte+0x12/0x40
[   74.225523][ T5329]  ? __pfx_dump_stack_lvl+0x10/0x10
[   74.225538][ T5329]  ? rcu_is_watching+0x15/0xb0
[   74.225553][ T5329]  ? lock_release+0x4b/0x3e0
[   74.225569][ T5329]  ? __virt_addr_valid+0x1c8/0x5c0
[   74.225580][ T5329]  ? __virt_addr_valid+0x4a5/0x5c0
[   74.225591][ T5329]  print_report+0xd2/0x2b0
[   74.225606][ T5329]  ? lane_ioctl+0xa77/0x1e60
[   74.225618][ T5329]  kasan_report+0x118/0x150
[   74.225629][ T5329]  ? lane_ioctl+0xa77/0x1e60
[   74.225643][ T5329]  lane_ioctl+0xa77/0x1e60
[   74.225656][ T5329]  ? __pfx_clip_ioctl+0x10/0x10
[   74.225666][ T5329]  ? br2684_ioctl+0x117/0x640
[   74.225676][ T5329]  ? tomoyo_path_number_perm+0x1bc/0x5a0
[   74.225714][ T5329]  ? __pfx_lane_ioctl+0x10/0x10
[   74.225726][ T5329]  ? tomoyo_path_number_perm+0x4e2/0x5a0
[   74.225738][ T5329]  ? atmtcp_ioctl+0x1ce/0xdf0
[   74.225751][ T5329]  ? __pfx_tomoyo_path_number_perm+0x10/0x10
[   74.225764][ T5329]  do_vcc_ioctl+0x36a/0x9e0
[   74.225778][ T5329]  sock_do_ioctl+0xd9/0x300
[   74.225796][ T5329]  ? __pfx_sock_do_ioctl+0x10/0x10
[   74.225811][ T5329]  ? __lock_acquire+0xab9/0xd20
[   74.225828][ T5329]  sock_ioctl+0x576/0x790
[   74.225843][ T5329]  ? __pfx_sock_ioctl+0x10/0x10
[   74.225858][ T5329]  ? __fget_files+0x2a/0x420
[   74.225884][ T5329]  ? __fget_files+0x3a0/0x420
[   74.225894][ T5329]  ? __fget_files+0x2a/0x420
[   74.225906][ T5329]  ? bpf_lsm_file_ioctl+0x9/0x20
[   74.225947][ T5329]  ? __pfx_sock_ioctl+0x10/0x10
[   74.225962][ T5329]  __se_sys_ioctl+0xf9/0x170
[   74.225978][ T5329]  do_syscall_64+0xfa/0x3b0
[   74.226049][ T5329]  ? lockdep_hardirqs_on+0x9c/0x150
[   74.226067][ T5329]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   74.226079][ T5329]  ? clear_bhb_loop+0x60/0xb0
[   74.226091][ T5329]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   74.226103][ T5329] RIP: 0033:0x7f19b9f8e929
[   74.226117][ T5329] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   74.226126][ T5329] RSP: 002b:00007f19b63f5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[   74.226142][ T5329] RAX: ffffffffffffffda RBX: 00007f19ba1b5fa0 RCX: 00007f19b9f8e929
[   74.226149][ T5329] RDX: 0000000000000000 RSI: 00000000000061d0 RDI: 0000000000000004
[   74.226155][ T5329] RBP: 00007f19ba010b39 R08: 0000000000000000 R09: 0000000000000000
[   74.226161][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   74.226167][ T5329] R13: 0000000000000000 R14: 00007f19ba1b5fa0 R15: 00007ffdbb016c48
[   74.226178][ T5329]  </TASK>
[   74.226182][ T5329] 
[   74.367177][ T5329] Allocated by task 5332:
[   74.369229][ T5329]  kasan_save_track+0x3e/0x80
[   74.371387][ T5329]  __kasan_kmalloc+0x93/0xb0
[   74.373577][ T5329]  __kvmalloc_node_noprof+0x30d/0x5f0
[   74.376784][ T5329]  alloc_netdev_mqs+0xa6/0x11e0
[   74.379332][ T5329]  lane_ioctl+0xac6/0x1e60
[   74.381432][ T5329]  do_vcc_ioctl+0x36a/0x9e0
[   74.383573][ T5329]  sock_do_ioctl+0xd9/0x300
[   74.385782][ T5329]  sock_ioctl+0x576/0x790
[   74.387948][ T5329]  __se_sys_ioctl+0xf9/0x170
[   74.390386][ T5329]  do_syscall_64+0xfa/0x3b0
[   74.392778][ T5329]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   74.395587][ T5329] 
[   74.396761][ T5329] Freed by task 5332:
[   74.398636][ T5329]  kasan_save_track+0x3e/0x80
[   74.401092][ T5329]  kasan_save_free_info+0x46/0x50
[   74.403772][ T5329]  __kasan_slab_free+0x62/0x70
[   74.406289][ T5329]  kfree+0x18e/0x440
[   74.408135][ T5329]  lane_ioctl+0xbd2/0x1e60
[   74.410346][ T5329]  do_vcc_ioctl+0x36a/0x9e0
[   74.412360][ T5329]  sock_do_ioctl+0xd9/0x300
[   74.414643][ T5329]  sock_ioctl+0x576/0x790
[   74.417207][ T5329]  __se_sys_ioctl+0xf9/0x170
[   74.420010][ T5329]  do_syscall_64+0xfa/0x3b0
[   74.422221][ T5329]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   74.424904][ T5329] 
[   74.425919][ T5329] The buggy address belongs to the object at ffff88803f354000
[   74.425919][ T5329]  which belongs to the cache kmalloc-cg-4k of size 4096
[   74.432279][ T5329] The buggy address is located 3688 bytes inside of
[   74.432279][ T5329]  freed 4096-byte region [ffff88803f354000, ffff88803f355000)
[   74.439614][ T5329] 
[   74.440869][ T5329] The buggy address belongs to the physical page:
[   74.443846][ T5329] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3f350
[   74.447796][ T5329] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   74.452093][ T5329] memcg:ffff888042f95281
[   74.454525][ T5329] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff)
[   74.458371][ T5329] page_type: f5(slab)
[   74.460199][ T5329] raw: 04fff00000000040 ffff88801a44b500 dead000000000122 0000000000000000
[   74.464181][ T5329] raw: 0000000000000000 0000000080040004 00000000f5000000 ffff888042f95281
[   74.468586][ T5329] head: 04fff00000000040 ffff88801a44b500 dead000000000122 0000000000000000
[   74.472679][ T5329] head: 0000000000000000 0000000080040004 00000000f5000000 ffff888042f95281
[   74.476679][ T5329] head: 04fff00000000003 ffffea0000fcd401 00000000ffffffff 00000000ffffffff
[   74.481083][ T5329] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[   74.485997][ T5329] page dumped because: kasan: bad access detected
[   74.488459][ T5329] page_owner tracks the page as allocated
[   74.491110][ T5329] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5330, tgid 5328 (syz.0.0), ts 74201777564, free_ts 74199738484
[   74.499336][ T5329]  post_alloc_hook+0x240/0x2a0
[   74.501932][ T5329]  get_page_from_freelist+0x21e4/0x22c0
[   74.505105][ T5329]  __alloc_frozen_pages_noprof+0x181/0x370
[   74.507952][ T5329]  alloc_pages_mpol+0x232/0x4a0
[   74.510140][ T5329]  allocate_slab+0x8a/0x3b0
[   74.512234][ T5329]  ___slab_alloc+0xbfc/0x1480
[   74.514389][ T5329]  __kmalloc_noprof+0x305/0x4f0
[   74.516491][ T5329]  __register_sysctl_table+0x72/0x1340
[   74.519335][ T5329]  __addrconf_sysctl_register+0x398/0x530
[   74.522758][ T5329]  addrconf_sysctl_register+0x168/0x1c0
[   74.525577][ T5329]  ipv6_add_dev+0xd46/0x1370
[   74.527783][ T5329]  addrconf_notify+0x794/0x1010
[   74.530049][ T5329]  notifier_call_chain+0x1b3/0x3e0
[   74.532458][ T5329]  register_netdevice+0x1608/0x1ae0
[   74.534930][ T5329]  __ip_tunnel_create+0x3e7/0x560
[   74.537485][ T5329]  ip_tunnel_init_net+0x2ba/0x800
[   74.540685][ T5329] page last free pid 55 tgid 55 stack trace:
[   74.543556][ T5329]  __free_frozen_pages+0xc71/0xe70
[   74.545913][ T5329]  __put_partials+0x161/0x1c0
[   74.548070][ T5329]  put_cpu_partial+0x17c/0x250
[   74.550592][ T5329]  __slab_free+0x2f7/0x400
[   74.553085][ T5329]  qlist_free_all+0x97/0x140
[   74.555358][ T5329]  kasan_quarantine_reduce+0x148/0x160
[   74.557949][ T5329]  __kasan_slab_alloc+0x22/0x80
[   74.560611][ T5329]  kmem_cache_alloc_node_noprof+0x1bb/0x3c0
[   74.563829][ T5329]  __alloc_skb+0x112/0x2d0
[   74.566434][ T5329]  mld_newpack+0x13c/0xc40
[   74.569204][ T5329]  add_grhead+0x5a/0x2a0
[   74.571540][ T5329]  add_grec+0x13b2/0x1670
[   74.573619][ T5329]  mld_send_initial_cr+0x22d/0x4c0
[   74.575951][ T5329]  mld_dad_work+0x45/0x520
[   74.578125][ T5329]  process_scheduled_works+0xae1/0x17b0
[   74.581293][ T5329]  worker_thread+0x8a0/0xda0
[   74.584066][ T5329] 
[   74.585243][ T5329] Memory state around the buggy address:
[   74.587823][ T5329]  ffff88803f354d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   74.591300][ T5329]  ffff88803f354d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   74.594905][ T5329] >ffff88803f354e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   74.599158][ T5329]                                                           ^
[   74.602980][ T5329]  ffff88803f354e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   74.606684][ T5329]  ffff88803f354f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   74.610704][ T5329] ==================================================================
[   74.699638][ T5329] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   74.703078][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted 6.16.0-rc1-syzkaller-00005-g488ef3560196 #0 PREEMPT(full) 
[   74.708757][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[   74.713748][ T5329] Call Trace:
[   74.715260][ T5329]  <TASK>
[   74.716745][ T5329]  dump_stack_lvl+0x99/0x250
[   74.719243][ T5329]  ? __asan_memcpy+0x40/0x70
[   74.721727][ T5329]  ? __pfx_dump_stack_lvl+0x10/0x10
[   74.724160][ T5329]  ? __pfx__printk+0x10/0x10
[   74.726366][ T5329]  panic+0x2db/0x790
[   74.728051][ T5329]  ? __pfx_panic+0x10/0x10
[   74.730251][ T5329]  ? _raw_spin_unlock_irqrestore+0xfd/0x110
[   74.733102][ T5329]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   74.736164][ T5329]  ? print_memory_metadata+0x314/0x400
[   74.738650][ T5329]  ? lane_ioctl+0xa77/0x1e60
[   74.740932][ T5329]  check_panic_on_warn+0x89/0xb0
[   74.743499][ T5329]  ? lane_ioctl+0xa77/0x1e60
[   74.745849][ T5329]  end_report+0x78/0x160
[   74.747785][ T5329]  kasan_report+0x129/0x150
[   74.749875][ T5329]  ? lane_ioctl+0xa77/0x1e60
[   74.751960][ T5329]  lane_ioctl+0xa77/0x1e60
[   74.754336][ T5329]  ? __pfx_clip_ioctl+0x10/0x10
[   74.756935][ T5329]  ? br2684_ioctl+0x117/0x640
[   74.759015][ T5329]  ? tomoyo_path_number_perm+0x1bc/0x5a0
[   74.761564][ T5329]  ? __pfx_lane_ioctl+0x10/0x10
[   74.763731][ T5329]  ? tomoyo_path_number_perm+0x4e2/0x5a0
[   74.766304][ T5329]  ? atmtcp_ioctl+0x1ce/0xdf0
[   74.768711][ T5329]  ? __pfx_tomoyo_path_number_perm+0x10/0x10
[   74.771816][ T5329]  do_vcc_ioctl+0x36a/0x9e0
[   74.773712][ T5329]  sock_do_ioctl+0xd9/0x300
[   74.775646][ T5329]  ? __pfx_sock_do_ioctl+0x10/0x10
[   74.777905][ T5329]  ? __lock_acquire+0xab9/0xd20
[   74.780055][ T5329]  sock_ioctl+0x576/0x790
[   74.782126][ T5329]  ? __pfx_sock_ioctl+0x10/0x10
[   74.784650][ T5329]  ? __fget_files+0x2a/0x420
[   74.787179][ T5329]  ? __fget_files+0x3a0/0x420
[   74.789633][ T5329]  ? __fget_files+0x2a/0x420
[   74.791907][ T5329]  ? bpf_lsm_file_ioctl+0x9/0x20
[   74.794290][ T5329]  ? __pfx_sock_ioctl+0x10/0x10
[   74.796526][ T5329]  __se_sys_ioctl+0xf9/0x170
[   74.798680][ T5329]  do_syscall_64+0xfa/0x3b0
[   74.801415][ T5329]  ? lockdep_hardirqs_on+0x9c/0x150
[   74.804141][ T5329]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   74.806810][ T5329]  ? clear_bhb_loop+0x60/0xb0
[   74.809007][ T5329]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   74.812084][ T5329] RIP: 0033:0x7f19b9f8e929
[   74.814286][ T5329] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   74.823850][ T5329] RSP: 002b:00007f19b63f5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[   74.827653][ T5329] RAX: ffffffffffffffda RBX: 00007f19ba1b5fa0 RCX: 00007f19b9f8e929
[   74.831728][ T5329] RDX: 0000000000000000 RSI: 00000000000061d0 RDI: 0000000000000004
[   74.835261][ T5329] RBP: 00007f19ba010b39 R08: 0000000000000000 R09: 0000000000000000
[   74.838744][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   74.842757][ T5329] R13: 0000000000000000 R14: 00007f19ba1b5fa0 R15: 00007ffdbb016c48
[   74.847093][ T5329]  </TASK>
[   74.848907][ T5329] Kernel Offset: disabled
[   74.851023][ T5329] Rebooting in 86400 seconds..