Warning: Permanently added '10.128.1.59' (ECDSA) to the list of known hosts.
syzkaller login: [ 49.703753][ T3600] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 49.711704][ T3600] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 49.719593][ T3600] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 49.727491][ T3600] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 49.735044][ T3600] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 49.742484][ T3600] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
executing program
[ 49.800320][ T3598] kernel profiling enabled (shift: 7)
[ 49.835615][ C1] ==================================================================
[ 49.843823][ C1] BUG: KASAN: stack-out-of-bounds in profile_pc+0xa4/0xe0
[ 49.850929][ C1] Read of size 8 at addr ffffc90001aaf120 by task syz-executor135/3598
[ 49.859166][ C1]
[ 49.861472][ C1] CPU: 1 PID: 3598 Comm: syz-executor135 Not tainted 5.17.0-rc4-syzkaller-00052-g359303076163 #0
[ 49.871947][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 49.881979][ C1] Call Trace:
[ 49.885247][ C1]
[ 49.888070][ C1] dump_stack_lvl+0x1dc/0x2d8
[ 49.892731][ C1] ? show_regs_print_info+0x12/0x12
[ 49.897904][ C1] ? _printk+0xcf/0x118
[ 49.902044][ C1] ? wake_up_klogd+0xb2/0xf0
[ 49.906610][ C1] ? log_buf_vmcoreinfo_setup+0x498/0x498
[ 49.912309][ C1] ? _raw_spin_lock_irqsave+0xdd/0x120
[ 49.917764][ C1] print_address_description+0x65/0x3a0
[ 49.923290][ C1] ? profile_pc+0xa4/0xe0
[ 49.927600][ C1] kasan_report+0x19a/0x1f0
[ 49.932082][ C1] ? profile_pc+0xa4/0xe0
[ 49.936393][ C1] ? _raw_spin_unlock_irqrestore+0xd4/0x130
[ 49.942280][ C1] profile_pc+0xa4/0xe0
[ 49.946434][ C1] profile_tick+0xcd/0x120
[ 49.950836][ C1] tick_sched_timer+0x287/0x420
[ 49.955678][ C1] __hrtimer_run_queues+0x4cb/0xa60
[ 49.960875][ C1] ? tick_setup_sched_timer+0x2c0/0x2c0
[ 49.966412][ C1] ? hrtimer_interrupt+0x1040/0x1040
[ 49.971706][ C1] ? ktime_get_update_offsets_now+0x449/0x460
[ 49.977763][ C1] hrtimer_interrupt+0x3b3/0x1040
[ 49.982799][ C1] ? __entry_text_end+0x1fecb5/0x1fecb5
[ 49.988344][ C1] __sysvec_apic_timer_interrupt+0xf9/0x270
[ 49.994227][ C1] sysvec_apic_timer_interrupt+0x8c/0xb0
[ 49.999845][ C1]
[ 50.002756][ C1]
[ 50.005671][ C1] asm_sysvec_apic_timer_interrupt+0x12/0x20
[ 50.011630][ C1] RIP: 0010:_raw_spin_unlock_irqrestore+0xd4/0x130
[ 50.018111][ C1] Code: 9c 8f 44 24 20 42 80 3c 23 00 74 08 4c 89 f7 e8 12 fa b2 f7 f6 44 24 21 02 75 4e 41 f7 c7 00 02 00 00 74 01 fb bf 01 00 00 00 e7 90 3b f7 65 8b 05 88 e7 e2 75 85 c0 74 3f 48 c7 04 24 0e 36
[ 50.037695][ C1] RSP: 0018:ffffc90001aaf120 EFLAGS: 00000206
[ 50.043752][ C1] RAX: 899bd1baf80f3600 RBX: 1ffff92000355e28 RCX: ffffffff81676751
[ 50.051701][ C1] RDX: dffffc0000000000 RSI: 0000000000000002 RDI: 0000000000000001
[ 50.059649][ C1] RBP: ffffc90001aaf1b0 R08: dffffc0000000000 R09: fffffbfff1ffb7c6
[ 50.067609][ C1] R10: fffffbfff1ffb7c6 R11: 0000000000000000 R12: dffffc0000000000
[ 50.075557][ C1] R13: 1ffff92000355e24 R14: ffffc90001aaf140 R15: 0000000000000246
[ 50.083625][ C1] ? mark_lock+0x191/0x1e00
[ 50.088125][ C1] ? _raw_spin_unlock+0x40/0x40
[ 50.092963][ C1] ? do_raw_spin_unlock+0x134/0x8a0
[ 50.098150][ C1] __debug_object_init+0x830/0x1860
[ 50.103345][ C1] ? debug_object_init+0x10/0x10
[ 50.108283][ C1] ? _raw_spin_unlock_irqrestore+0x8b/0x130
[ 50.114158][ C1] ? lockdep_hardirqs_on+0x95/0x140
[ 50.119356][ C1] ? _raw_spin_unlock_irqrestore+0xd9/0x130
[ 50.125241][ C1] ? _raw_spin_unlock+0x40/0x40
[ 50.130097][ C1] debug_object_activate+0x188/0x6a0
[ 50.135385][ C1] kvfree_call_rcu+0xb3/0x880
[ 50.140066][ C1] ? do_raw_spin_lock+0x151/0x8e0
[ 50.145077][ C1] ? call_rcu+0xa70/0xa70
[ 50.149386][ C1] ? __rwlock_init+0x140/0x140
[ 50.154135][ C1] drop_sysctl_table+0x2cd/0x400
[ 50.159054][ C1] ? insert_header+0xda0/0xda0
[ 50.163793][ C1] ? do_raw_spin_lock+0x151/0x8e0
[ 50.168796][ C1] ? call_rcu+0xa70/0xa70
[ 50.173102][ C1] ? __rwlock_init+0x140/0x140
[ 50.177848][ C1] drop_sysctl_table+0x2eb/0x400
[ 50.182769][ C1] ? insert_header+0xda0/0xda0
[ 50.187513][ C1] ? do_raw_spin_lock+0x151/0x8e0
[ 50.192535][ C1] ? __might_sleep+0xe0/0xe0
[ 50.197120][ C1] ? __rwlock_init+0x140/0x140
[ 50.201893][ C1] unregister_sysctl_table+0x86/0x130
[ 50.207255][ C1] neigh_sysctl_unregister+0x74/0x90
[ 50.212525][ C1] inetdev_event+0x774/0x1410
[ 50.217188][ C1] ? ipv4_doint_and_flush+0x130/0x130
[ 50.222547][ C1] raw_notifier_call_chain+0xe7/0x170
[ 50.227903][ C1] unregister_netdevice_many+0xfae/0x19e0
[ 50.233609][ C1] ? alloc_netdev_mqs+0xda0/0xda0
[ 50.238608][ C1] ? lockdep_hardirqs_on_prepare+0x412/0x780
[ 50.244564][ C1] ? __lock_acquire+0x2b00/0x2b00
[ 50.249566][ C1] ? print_irqtrace_events+0x220/0x220
[ 50.255007][ C1] ? queue_delayed_work_on+0x165/0x230
[ 50.260448][ C1] ? lockdep_hardirqs_on+0x95/0x140
[ 50.265624][ C1] unregister_netdevice_queue+0x2e6/0x350
[ 50.271322][ C1] ? delayed_work_timer_fn+0x80/0x80
[ 50.276600][ C1] ? list_netdevice+0x450/0x450
[ 50.281429][ C1] ? linkwatch_fire_event+0x317/0x3a0
[ 50.286783][ C1] __tun_detach+0x642/0x1d40
[ 50.291371][ C1] ? tun_chr_open+0x470/0x470
[ 50.296022][ C1] tun_chr_close+0xed/0x130
[ 50.300503][ C1] __fput+0x3fc/0x870
[ 50.304482][ C1] task_work_run+0x146/0x1c0
[ 50.309062][ C1] do_exit+0x63b/0x22f0
[ 50.313202][ C1] ? __lock_acquire+0x2b00/0x2b00
[ 50.318206][ C1] ? mm_update_next_owner+0x6d0/0x6d0
[ 50.323554][ C1] ? lockdep_hardirqs_on_prepare+0x412/0x780
[ 50.329524][ C1] ? print_irqtrace_events+0x220/0x220
[ 50.334968][ C1] ? vtime_user_exit+0x2b2/0x3e0
[ 50.339886][ C1] do_group_exit+0x2af/0x2b0
[ 50.344457][ C1] __do_sys_exit_group+0x13/0x20
[ 50.349369][ C1] __se_sys_exit_group+0x10/0x10
[ 50.354285][ C1] __x64_sys_exit_group+0x37/0x40
[ 50.359283][ C1] do_syscall_64+0x44/0xd0
[ 50.363680][ C1] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 50.369548][ C1] RIP: 0033:0x7f201cacb509
[ 50.373954][ C1] Code: Unable to access opcode bytes at RIP 0x7f201cacb4df.
[ 50.381291][ C1] RSP: 002b:00007ffe3db5cb18 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 50.389680][ C1] RAX: ffffffffffffffda RBX: 00007f201cb55470 RCX: 00007f201cacb509
[ 50.397626][ C1] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001
[ 50.405572][ C1] RBP: 0000000000000001 R08: ffffffffffffffb8 R09: 00007ffe00000003
[ 50.413531][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f201cb55470
[ 50.421481][ C1] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[ 50.429458][ C1]
[ 50.432453][ C1]
[ 50.434764][ C1]
[ 50.437075][ C1] addr ffffc90001aaf120 is located in stack of task syz-executor135/3598 at offset 0 in frame:
[ 50.447368][ C1] _raw_spin_unlock_irqrestore+0x0/0x130
[ 50.452979][ C1]
[ 50.455280][ C1] this frame has 1 object:
[ 50.459668][ C1] [32, 40) 'flags.i.i.i.i'
[ 50.459676][ C1]
[ 50.466441][ C1] Memory state around the buggy address:
[ 50.472043][ C1] ffffc90001aaf000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 50.480077][ C1] ffffc90001aaf080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 50.488109][ C1] >ffffc90001aaf100: 00 00 00 00 f1 f1 f1 f1 00 f3 f3 f3 00 00 00 00
[ 50.496139][ C1] ^
[ 50.501222][ C1] ffffc90001aaf180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 50.509259][ C1] ffffc90001aaf200: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
[ 50.517291][ C1] ==================================================================
[ 50.525322][ C1] Disabling lock debugging due to kernel taint
[ 50.531442][ C1] Kernel panic - not syncing: panic_on_warn set ...
[ 50.537997][ C1] CPU: 1 PID: 3598 Comm: syz-executor135 Tainted: G B 5.17.0-rc4-syzkaller-00052-g359303076163 #0
[ 50.549855][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 50.559882][ C1] Call Trace:
[ 50.563140][ C1]
[ 50.565960][ C1] dump_stack_lvl+0x1dc/0x2d8
[ 50.570614][ C1] ? show_regs_print_info+0x12/0x12
[ 50.575785][ C1] ? log_buf_vmcoreinfo_setup+0x498/0x498
[ 50.581481][ C1] panic+0x2d6/0x810
[ 50.585354][ C1] ? nmi_panic+0x90/0x90
[ 50.589569][ C1] ? _raw_spin_unlock_irqrestore+0xd9/0x130
[ 50.595442][ C1] ? print_memory_metadata+0xe0/0x140
[ 50.600791][ C1] ? profile_pc+0xa4/0xe0
[ 50.605096][ C1] end_report+0x83/0x90
[ 50.609223][ C1] kasan_report+0x1bf/0x1f0
[ 50.613699][ C1] ? profile_pc+0xa4/0xe0
[ 50.618002][ C1] ? _raw_spin_unlock_irqrestore+0xd4/0x130
[ 50.623868][ C1] profile_pc+0xa4/0xe0
[ 50.627996][ C1] profile_tick+0xcd/0x120
[ 50.632386][ C1] tick_sched_timer+0x287/0x420
[ 50.637215][ C1] __hrtimer_run_queues+0x4cb/0xa60
[ 50.642387][ C1] ? tick_setup_sched_timer+0x2c0/0x2c0
[ 50.647924][ C1] ? hrtimer_interrupt+0x1040/0x1040
[ 50.653183][ C1] ? ktime_get_update_offsets_now+0x449/0x460
[ 50.659224][ C1] hrtimer_interrupt+0x3b3/0x1040
[ 50.664234][ C1] ? __entry_text_end+0x1fecb5/0x1fecb5
[ 50.669767][ C1] __sysvec_apic_timer_interrupt+0xf9/0x270
[ 50.675640][ C1] sysvec_apic_timer_interrupt+0x8c/0xb0
[ 50.681258][ C1]
[ 50.684176][ C1]
[ 50.687089][ C1] asm_sysvec_apic_timer_interrupt+0x12/0x20
[ 50.693051][ C1] RIP: 0010:_raw_spin_unlock_irqrestore+0xd4/0x130
[ 50.699552][ C1] Code: 9c 8f 44 24 20 42 80 3c 23 00 74 08 4c 89 f7 e8 12 fa b2 f7 f6 44 24 21 02 75 4e 41 f7 c7 00 02 00 00 74 01 fb bf 01 00 00 00 e7 90 3b f7 65 8b 05 88 e7 e2 75 85 c0 74 3f 48 c7 04 24 0e 36
[ 50.719132][ C1] RSP: 0018:ffffc90001aaf120 EFLAGS: 00000206
[ 50.725176][ C1] RAX: 899bd1baf80f3600 RBX: 1ffff92000355e28 RCX: ffffffff81676751
[ 50.733137][ C1] RDX: dffffc0000000000 RSI: 0000000000000002 RDI: 0000000000000001
[ 50.741091][ C1] RBP: ffffc90001aaf1b0 R08: dffffc0000000000 R09: fffffbfff1ffb7c6
[ 50.749036][ C1] R10: fffffbfff1ffb7c6 R11: 0000000000000000 R12: dffffc0000000000
[ 50.756982][ C1] R13: 1ffff92000355e24 R14: ffffc90001aaf140 R15: 0000000000000246
[ 50.764929][ C1] ? mark_lock+0x191/0x1e00
[ 50.769415][ C1] ? _raw_spin_unlock+0x40/0x40
[ 50.774242][ C1] ? do_raw_spin_unlock+0x134/0x8a0
[ 50.779415][ C1] __debug_object_init+0x830/0x1860
[ 50.784597][ C1] ? debug_object_init+0x10/0x10
[ 50.789521][ C1] ? _raw_spin_unlock_irqrestore+0x8b/0x130
[ 50.795390][ C1] ? lockdep_hardirqs_on+0x95/0x140
[ 50.800576][ C1] ? _raw_spin_unlock_irqrestore+0xd9/0x130
[ 50.806444][ C1] ? _raw_spin_unlock+0x40/0x40
[ 50.811274][ C1] debug_object_activate+0x188/0x6a0
[ 50.816534][ C1] kvfree_call_rcu+0xb3/0x880
[ 50.821186][ C1] ? do_raw_spin_lock+0x151/0x8e0
[ 50.826186][ C1] ? call_rcu+0xa70/0xa70
[ 50.830498][ C1] ? __rwlock_init+0x140/0x140
[ 50.835248][ C1] drop_sysctl_table+0x2cd/0x400
[ 50.840172][ C1] ? insert_header+0xda0/0xda0
[ 50.844906][ C1] ? do_raw_spin_lock+0x151/0x8e0
[ 50.849916][ C1] ? call_rcu+0xa70/0xa70
[ 50.854222][ C1] ? __rwlock_init+0x140/0x140
[ 50.858961][ C1] drop_sysctl_table+0x2eb/0x400
[ 50.863871][ C1] ? insert_header+0xda0/0xda0
[ 50.868608][ C1] ? do_raw_spin_lock+0x151/0x8e0
[ 50.873614][ C1] ? __might_sleep+0xe0/0xe0
[ 50.878177][ C1] ? __rwlock_init+0x140/0x140
[ 50.882915][ C1] unregister_sysctl_table+0x86/0x130
[ 50.888261][ C1] neigh_sysctl_unregister+0x74/0x90
[ 50.893523][ C1] inetdev_event+0x774/0x1410
[ 50.898187][ C1] ? ipv4_doint_and_flush+0x130/0x130
[ 50.903536][ C1] raw_notifier_call_chain+0xe7/0x170
[ 50.908884][ C1] unregister_netdevice_many+0xfae/0x19e0
[ 50.914588][ C1] ? alloc_netdev_mqs+0xda0/0xda0
[ 50.919592][ C1] ? lockdep_hardirqs_on_prepare+0x412/0x780
[ 50.925545][ C1] ? __lock_acquire+0x2b00/0x2b00
[ 50.930542][ C1] ? print_irqtrace_events+0x220/0x220
[ 50.935986][ C1] ? queue_delayed_work_on+0x165/0x230
[ 50.941423][ C1] ? lockdep_hardirqs_on+0x95/0x140
[ 50.946682][ C1] unregister_netdevice_queue+0x2e6/0x350
[ 50.952378][ C1] ? delayed_work_timer_fn+0x80/0x80
[ 50.957637][ C1] ? list_netdevice+0x450/0x450
[ 50.962461][ C1] ? linkwatch_fire_event+0x317/0x3a0
[ 50.967819][ C1] __tun_detach+0x642/0x1d40
[ 50.972397][ C1] ? tun_chr_open+0x470/0x470
[ 50.977049][ C1] tun_chr_close+0xed/0x130
[ 50.981537][ C1] __fput+0x3fc/0x870
[ 50.985495][ C1] task_work_run+0x146/0x1c0
[ 50.990062][ C1] do_exit+0x63b/0x22f0
[ 50.994195][ C1] ? __lock_acquire+0x2b00/0x2b00
[ 50.999195][ C1] ? mm_update_next_owner+0x6d0/0x6d0
[ 51.004630][ C1] ? lockdep_hardirqs_on_prepare+0x412/0x780
[ 51.010583][ C1] ? print_irqtrace_events+0x220/0x220
[ 51.016013][ C1] ? vtime_user_exit+0x2b2/0x3e0
[ 51.020925][ C1] do_group_exit+0x2af/0x2b0
[ 51.025491][ C1] __do_sys_exit_group+0x13/0x20
[ 51.030407][ C1] __se_sys_exit_group+0x10/0x10
[ 51.035754][ C1] __x64_sys_exit_group+0x37/0x40
[ 51.040749][ C1] do_syscall_64+0x44/0xd0
[ 51.045153][ C1] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 51.051020][ C1] RIP: 0033:0x7f201cacb509
[ 51.055414][ C1] Code: Unable to access opcode bytes at RIP 0x7f201cacb4df.
[ 51.062769][ C1] RSP: 002b:00007ffe3db5cb18 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 51.071153][ C1] RAX: ffffffffffffffda RBX: 00007f201cb55470 RCX: 00007f201cacb509
[ 51.079098][ C1] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001
[ 51.087042][ C1] RBP: 0000000000000001 R08: ffffffffffffffb8 R09: 00007ffe00000003
[ 51.094995][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f201cb55470
[ 51.102940][ C1] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[ 51.110886][ C1]
[ 51.114077][ C1] Kernel Offset: disabled
[ 51.118385][ C1] Rebooting in 86400 seconds..