last executing test programs:
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.0.114' (ED25519) to the list of known hosts.
[ 51.376785][ T5078] cgroup: Unknown subsys name 'net'
[ 51.574282][ T5078] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 52.989660][ T5078] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 55.010839][ T5092] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 55.028061][ T53] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 55.036388][ T53] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 55.043641][ T53] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 55.051375][ T53] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 55.058518][ T53] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[ 55.067660][ T53] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 55.074858][ T53] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[ 55.083243][ T53] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3
[ 55.099243][ T5094] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 55.120136][ T5102] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[ 55.127691][ T5102] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 55.141231][ T5104] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[ 55.150994][ T5105] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[ 55.159373][ T5092] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[ 55.160330][ T5102] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[ 55.167727][ T5104] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[ 55.174849][ T5102] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[ 55.181651][ T5105] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[ 55.188825][ T5102] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[ 55.195337][ T5104] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[ 55.201999][ T5102] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3
[ 55.209259][ T5105] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[ 55.215729][ T5102] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[ 55.224168][ T5105] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[ 55.236676][ T5105] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[ 55.244428][ T5105] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3
[ 55.252773][ T5105] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[ 55.260178][ T5105] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3
[ 55.267752][ T5102] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[ 55.281756][ T5098] ==================================================================
[ 55.289834][ T5098] BUG: KASAN: slab-use-after-free in kfree_skb_reason+0x41/0x3b0
[ 55.297574][ T5098] Read of size 4 at addr ffff888011d0c0e4 by task syz-executor/5098
[ 55.305565][ T5098]
[ 55.307901][ T5098] CPU: 0 PID: 5098 Comm: syz-executor Not tainted 6.10.0-rc2-syzkaller-00824-gfd8db07705c5 #0
[ 55.318142][ T5098] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
[ 55.328213][ T5098] Call Trace:
[ 55.331499][ T5098]
[ 55.334437][ T5098] dump_stack_lvl+0x241/0x360
[ 55.339128][ T5098] ? __pfx_dump_stack_lvl+0x10/0x10
[ 55.344346][ T5098] ? __pfx__printk+0x10/0x10
[ 55.348955][ T5098] ? _printk+0xd5/0x120
[ 55.353116][ T5098] ? __virt_addr_valid+0x183/0x520
[ 55.358247][ T5098] ? __virt_addr_valid+0x183/0x520
[ 55.363376][ T5098] print_report+0x169/0x550
[ 55.367891][ T5098] ? __virt_addr_valid+0x183/0x520
[ 55.373022][ T5098] ? __virt_addr_valid+0x183/0x520
[ 55.378150][ T5098] ? __virt_addr_valid+0x44e/0x520
[ 55.383277][ T5098] ? __phys_addr+0xba/0x170
[ 55.387791][ T5098] ? kfree_skb_reason+0x41/0x3b0
[ 55.392721][ T5098] kasan_report+0x143/0x180
[ 55.397226][ T5098] ? kfree_skb_reason+0x41/0x3b0
[ 55.402166][ T5098] kasan_check_range+0x282/0x290
[ 55.407109][ T5098] kfree_skb_reason+0x41/0x3b0
[ 55.411865][ T5098] __hci_req_sync+0x62f/0x950
[ 55.416533][ T5098] ? __pfx___hci_req_sync+0x10/0x10
[ 55.421720][ T5098] ? __pfx___mutex_lock+0x10/0x10
[ 55.426734][ T5098] ? __pfx_autoremove_wake_function+0x10/0x10
[ 55.432786][ T5098] ? __pfx_hci_scan_req+0x10/0x10
[ 55.437799][ T5098] hci_req_sync+0xa9/0xd0
[ 55.442115][ T5098] hci_dev_cmd+0x4c5/0xa50
[ 55.446517][ T5098] ? security_capable+0x90/0xb0
[ 55.451370][ T5098] ? __pfx_hci_dev_cmd+0x10/0x10
[ 55.456293][ T5098] ? hci_sock_ioctl+0x6c4/0xa40
[ 55.461128][ T5098] sock_do_ioctl+0x158/0x460
[ 55.465703][ T5098] ? __pfx_sock_do_ioctl+0x10/0x10
[ 55.470803][ T5098] sock_ioctl+0x629/0x8e0
[ 55.475123][ T5098] ? __pfx_sock_ioctl+0x10/0x10
[ 55.479960][ T5098] ? __fget_files+0x29/0x470
[ 55.484564][ T5098] ? __fget_files+0x3f6/0x470
[ 55.489228][ T5098] ? __fget_files+0x29/0x470
[ 55.493809][ T5098] ? bpf_lsm_file_ioctl+0x9/0x10
[ 55.498733][ T5098] ? security_file_ioctl+0x87/0xb0
[ 55.503850][ T5098] ? __pfx_sock_ioctl+0x10/0x10
[ 55.508707][ T5098] __se_sys_ioctl+0xfc/0x170
[ 55.513307][ T5098] do_syscall_64+0xf3/0x230
[ 55.517805][ T5098] ? clear_bhb_loop+0x35/0x90
[ 55.522475][ T5098] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 55.528369][ T5098] RIP: 0033:0x7fb1919757db
[ 55.532773][ T5098] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
[ 55.552365][ T5098] RSP: 002b:00007ffc916b9660 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 55.560765][ T5098] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fb1919757db
[ 55.568736][ T5098] RDX: 00007ffc916b96d8 RSI: 00000000400448dd RDI: 0000000000000003
[ 55.576710][ T5098] RBP: 00005555786d04a8 R08: 0000000000000000 R09: 0000000000000000
[ 55.584683][ T5098] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000002
[ 55.592646][ T5098] R13: 0000000000000002 R14: 0000000000000009 R15: 0000000000000009
[ 55.600620][ T5098]
[ 55.603626][ T5098]
[ 55.605933][ T5098] Allocated by task 5102:
[ 55.610241][ T5098] kasan_save_track+0x3f/0x80
[ 55.614911][ T5098] __kasan_slab_alloc+0x66/0x80
[ 55.619752][ T5098] kmem_cache_alloc_noprof+0x135/0x2a0
[ 55.625200][ T5098] skb_clone+0x20c/0x390
[ 55.629434][ T5098] hci_cmd_work+0x29e/0x670
[ 55.633925][ T5098] process_scheduled_works+0xa2c/0x1830
[ 55.639456][ T5098] worker_thread+0x86d/0xd70
[ 55.644509][ T5098] kthread+0x2f0/0x390
[ 55.648574][ T5098] ret_from_fork+0x4b/0x80
[ 55.652988][ T5098] ret_from_fork_asm+0x1a/0x30
[ 55.657877][ T5098]
[ 55.660205][ T5098] Freed by task 5097:
[ 55.664164][ T5098] kasan_save_track+0x3f/0x80
[ 55.668831][ T5098] kasan_save_free_info+0x40/0x50
[ 55.673842][ T5098] poison_slab_object+0xe0/0x150
[ 55.678768][ T5098] __kasan_slab_free+0x37/0x60
[ 55.683521][ T5098] kmem_cache_free+0x145/0x350
[ 55.688271][ T5098] hci_req_sync_complete+0xe7/0x290
[ 55.693454][ T5098] hci_event_packet+0xc71/0x1540
[ 55.698381][ T5098] hci_rx_work+0x3e8/0xca0
[ 55.702782][ T5098] process_scheduled_works+0xa2c/0x1830
[ 55.708314][ T5098] worker_thread+0x86d/0xd70
[ 55.712887][ T5098] kthread+0x2f0/0x390
[ 55.716941][ T5098] ret_from_fork+0x4b/0x80
[ 55.721343][ T5098] ret_from_fork_asm+0x1a/0x30
[ 55.726094][ T5098]
[ 55.728403][ T5098] The buggy address belongs to the object at ffff888011d0c000
[ 55.728403][ T5098] which belongs to the cache skbuff_head_cache of size 240
[ 55.742959][ T5098] The buggy address is located 228 bytes inside of
[ 55.742959][ T5098] freed 240-byte region [ffff888011d0c000, ffff888011d0c0f0)
[ 55.756737][ T5098]
[ 55.759044][ T5098] The buggy address belongs to the physical page:
[ 55.765441][ T5098] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11d0c
[ 55.774184][ T5098] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 55.781278][ T5098] page_type: 0xffffefff(slab)
[ 55.785937][ T5098] raw: 00fff00000000000 ffff888017ae4640 dead000000000122 0000000000000000
[ 55.794502][ T5098] raw: 0000000000000000 00000000800c000c 00000001ffffefff 0000000000000000
[ 55.803062][ T5098] page dumped because: kasan: bad access detected
[ 55.809458][ T5098] page_owner tracks the page as allocated
[ 55.815150][ T5098] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5102, tgid 5102 (kworker/u9:5), ts 55281278319, free_ts 53484893379
[ 55.834405][ T5098] post_alloc_hook+0x1f3/0x230
[ 55.839166][ T5098] get_page_from_freelist+0x2e2d/0x2ee0
[ 55.844695][ T5098] __alloc_pages_noprof+0x256/0x6c0
[ 55.849876][ T5098] alloc_slab_page+0x5f/0x120
[ 55.854537][ T5098] allocate_slab+0x5a/0x2e0
[ 55.859029][ T5098] ___slab_alloc+0xcd1/0x14b0
[ 55.863686][ T5098] __slab_alloc+0x58/0xa0
[ 55.867998][ T5098] kmem_cache_alloc_noprof+0x1c1/0x2a0
[ 55.873440][ T5098] skb_clone+0x20c/0x390
[ 55.877671][ T5098] hci_cmd_work+0x29e/0x670
[ 55.882160][ T5098] process_scheduled_works+0xa2c/0x1830
[ 55.887687][ T5098] worker_thread+0x86d/0xd70
[ 55.892259][ T5098] kthread+0x2f0/0x390
[ 55.896314][ T5098] ret_from_fork+0x4b/0x80
[ 55.900715][ T5098] ret_from_fork_asm+0x1a/0x30
[ 55.905463][ T5098] page last free pid 5078 tgid 5078 stack trace:
[ 55.911766][ T5098] free_unref_page+0xd22/0xea0
[ 55.916519][ T5098] __folio_put+0x3b9/0x620
[ 55.920917][ T5098] skb_release_data+0x467/0x880
[ 55.925752][ T5098] __kfree_skb+0x55/0x70
[ 55.929980][ T5098] tcp_ack+0x2442/0x6bc0
[ 55.934209][ T5098] tcp_rcv_established+0x109a/0x2020
[ 55.939479][ T5098] tcp_v4_do_rcv+0x965/0xc60
[ 55.944054][ T5098] __release_sock+0x214/0x350
[ 55.948719][ T5098] __sk_flush_backlog+0x36/0xc0
[ 55.953553][ T5098] tcp_sendmsg_locked+0x3cbb/0x4e10
[ 55.958738][ T5098] tcp_sendmsg+0x30/0x50
[ 55.962964][ T5098] __sock_sendmsg+0x1a6/0x270
[ 55.967623][ T5098] sock_write_iter+0x2dd/0x400
[ 55.972375][ T5098] vfs_write+0xa72/0xc90
[ 55.976605][ T5098] ksys_write+0x1a0/0x2c0
[ 55.980920][ T5098] do_syscall_64+0xf3/0x230
[ 55.985406][ T5098]
[ 55.987711][ T5098] Memory state around the buggy address:
[ 55.993319][ T5098] ffff888011d0bf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 56.001363][ T5098] ffff888011d0c000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 56.009406][ T5098] >ffff888011d0c080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 56.017447][ T5098] ^
[ 56.024620][ T5098] ffff888011d0c100: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 56.032662][ T5098] ffff888011d0c180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 56.040701][ T5098] ==================================================================
[ 56.062339][ T5098] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 56.069558][ T5098] CPU: 0 PID: 5098 Comm: syz-executor Not tainted 6.10.0-rc2-syzkaller-00824-gfd8db07705c5 #0
[ 56.079803][ T5098] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
[ 56.089867][ T5098] Call Trace:
[ 56.093150][ T5098]
[ 56.096087][ T5098] dump_stack_lvl+0x241/0x360
[ 56.100781][ T5098] ? __pfx_dump_stack_lvl+0x10/0x10
[ 56.105990][ T5098] ? __pfx__printk+0x10/0x10
[ 56.110594][ T5098] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 56.116586][ T5098] ? vscnprintf+0x5d/0x90
[ 56.120933][ T5098] panic+0x349/0x860
[ 56.124838][ T5098] ? check_panic_on_warn+0x21/0xb0
[ 56.129960][ T5098] ? __pfx_panic+0x10/0x10
[ 56.134397][ T5098] ? _raw_spin_unlock_irqrestore+0x130/0x140
[ 56.140395][ T5098] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 56.146738][ T5098] check_panic_on_warn+0x86/0xb0
[ 56.151689][ T5098] ? kfree_skb_reason+0x41/0x3b0
[ 56.156640][ T5098] end_report+0x77/0x160
[ 56.160900][ T5098] kasan_report+0x154/0x180
[ 56.165412][ T5098] ? kfree_skb_reason+0x41/0x3b0
[ 56.170344][ T5098] kasan_check_range+0x282/0x290
[ 56.175273][ T5098] kfree_skb_reason+0x41/0x3b0
[ 56.180024][ T5098] __hci_req_sync+0x62f/0x950
[ 56.184691][ T5098] ? __pfx___hci_req_sync+0x10/0x10
[ 56.189877][ T5098] ? __pfx___mutex_lock+0x10/0x10
[ 56.194892][ T5098] ? __pfx_autoremove_wake_function+0x10/0x10
[ 56.200943][ T5098] ? __pfx_hci_scan_req+0x10/0x10
[ 56.205953][ T5098] hci_req_sync+0xa9/0xd0
[ 56.210269][ T5098] hci_dev_cmd+0x4c5/0xa50
[ 56.214667][ T5098] ? security_capable+0x90/0xb0
[ 56.219503][ T5098] ? __pfx_hci_dev_cmd+0x10/0x10
[ 56.224427][ T5098] ? hci_sock_ioctl+0x6c4/0xa40
[ 56.229276][ T5098] sock_do_ioctl+0x158/0x460
[ 56.233862][ T5098] ? __pfx_sock_do_ioctl+0x10/0x10
[ 56.238976][ T5098] sock_ioctl+0x629/0x8e0
[ 56.243303][ T5098] ? __pfx_sock_ioctl+0x10/0x10
[ 56.248150][ T5098] ? __fget_files+0x29/0x470
[ 56.252736][ T5098] ? __fget_files+0x3f6/0x470
[ 56.257402][ T5098] ? __fget_files+0x29/0x470
[ 56.261986][ T5098] ? bpf_lsm_file_ioctl+0x9/0x10
[ 56.266914][ T5098] ? security_file_ioctl+0x87/0xb0
[ 56.272062][ T5098] ? __pfx_sock_ioctl+0x10/0x10
[ 56.276910][ T5098] __se_sys_ioctl+0xfc/0x170
[ 56.281490][ T5098] do_syscall_64+0xf3/0x230
[ 56.285982][ T5098] ? clear_bhb_loop+0x35/0x90
[ 56.290648][ T5098] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 56.296529][ T5098] RIP: 0033:0x7fb1919757db
[ 56.300931][ T5098] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
[ 56.320525][ T5098] RSP: 002b:00007ffc916b9660 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 56.328927][ T5098] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fb1919757db
[ 56.336884][ T5098] RDX: 00007ffc916b96d8 RSI: 00000000400448dd RDI: 0000000000000003
[ 56.344840][ T5098] RBP: 00005555786d04a8 R08: 0000000000000000 R09: 0000000000000000
[ 56.352795][ T5098] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000002
[ 56.360747][ T5098] R13: 0000000000000002 R14: 0000000000000009 R15: 0000000000000009
[ 56.368711][ T5098]
[ 56.371940][ T5098] Kernel Offset: disabled
[ 56.376458][ T5098] Rebooting in 86400 seconds..