last executing test programs:
kernel console output (not intermixed with test programs):
forked to background, child pid 4757
no interfaces have a carrier
[ 33.916185][ T4758] 8021q: adding VLAN 0 to HW filter on device bond0
[ 33.929665][ T4758] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK
syzkaller
Warning: Permanently added '10.128.1.92' (ED25519) to the list of known hosts.
syzkaller login: [ 51.231225][ T5075] cgroup: Unknown subsys name 'net'
[ 51.367342][ T5075] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 52.774832][ T5075] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 54.895886][ T5091] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 54.903900][ T5091] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 54.912648][ T5091] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 54.921900][ T5091] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 54.931393][ T5093] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 54.939178][ T5091] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[ 54.940455][ T5093] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 54.955001][ T5093] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 54.962723][ T5093] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[ 54.971046][ T5093] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 54.973644][ T5096] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[ 54.978307][ T5093] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[ 54.986905][ T5096] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[ 55.001305][ T5085] ==================================================================
[ 55.004554][ T5096] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[ 55.009371][ T5085] BUG: KASAN: slab-use-after-free in kfree_skb_reason+0x41/0x3b0
[ 55.009411][ T5085] Read of size 4 at addr ffff8880658e40e4 by task syz-executor/5085
[ 55.009425][ T5085]
[ 55.009436][ T5085] CPU: 0 PID: 5085 Comm: syz-executor Not tainted 6.10.0-rc2-syzkaller-00824-gfd8db07705c5 #0
[ 55.009453][ T5085] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
[ 55.009470][ T5085] Call Trace:
[ 55.009478][ T5085]
[ 55.009489][ T5085] dump_stack_lvl+0x241/0x360
[ 55.009511][ T5085] ? __pfx_dump_stack_lvl+0x10/0x10
[ 55.009529][ T5085] ? __pfx__printk+0x10/0x10
[ 55.009545][ T5085] ? _printk+0xd5/0x120
[ 55.009561][ T5085] ? __virt_addr_valid+0x183/0x520
[ 55.009582][ T5085] ? __virt_addr_valid+0x183/0x520
[ 55.009603][ T5085] print_report+0x169/0x550
[ 55.009624][ T5085] ? __virt_addr_valid+0x183/0x520
[ 55.009645][ T5085] ? __virt_addr_valid+0x183/0x520
[ 55.009666][ T5085] ? __virt_addr_valid+0x44e/0x520
[ 55.009685][ T5085] ? __phys_addr+0xba/0x170
[ 55.017841][ T5096] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3
[ 55.024305][ T5085] ? kfree_skb_reason+0x41/0x3b0
[ 55.024334][ T5085] kasan_report+0x143/0x180
[ 55.024358][ T5085] ? kfree_skb_reason+0x41/0x3b0
[ 55.024380][ T5085] kasan_check_range+0x282/0x290
[ 55.024402][ T5085] kfree_skb_reason+0x41/0x3b0
[ 55.032859][ T5096] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[ 55.034658][ T5085] __hci_req_sync+0x62f/0x950
[ 55.061004][ T5096] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[ 55.061089][ T5085] ? __pfx___hci_req_sync+0x10/0x10
[ 55.066260][ T5096] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3
[ 55.070961][ T5085] ? __pfx___mutex_lock+0x10/0x10
[ 55.070990][ T5085] ? __pfx_autoremove_wake_function+0x10/0x10
[ 55.071011][ T5085] ? __pfx_hci_scan_req+0x10/0x10
[ 55.071030][ T5085] hci_req_sync+0xa9/0xd0
[ 55.071048][ T5085] hci_dev_cmd+0x4c5/0xa50
[ 55.071065][ T5085] ? security_capable+0x90/0xb0
[ 55.071082][ T5085] ? __pfx_hci_dev_cmd+0x10/0x10
[ 55.210330][ T5085] ? hci_sock_ioctl+0x6c4/0xa40
[ 55.215176][ T5085] sock_do_ioctl+0x158/0x460
[ 55.219796][ T5085] ? __pfx_sock_do_ioctl+0x10/0x10
[ 55.224897][ T5085] sock_ioctl+0x629/0x8e0
[ 55.229217][ T5085] ? __pfx_sock_ioctl+0x10/0x10
[ 55.234147][ T5085] ? __fget_files+0x29/0x470
[ 55.238734][ T5085] ? __fget_files+0x3f6/0x470
[ 55.243396][ T5085] ? __fget_files+0x29/0x470
[ 55.247977][ T5085] ? bpf_lsm_file_ioctl+0x9/0x10
[ 55.252909][ T5085] ? security_file_ioctl+0x87/0xb0
[ 55.258006][ T5085] ? __pfx_sock_ioctl+0x10/0x10
[ 55.262847][ T5085] __se_sys_ioctl+0xfc/0x170
[ 55.267425][ T5085] do_syscall_64+0xf3/0x230
[ 55.271915][ T5085] ? clear_bhb_loop+0x35/0x90
[ 55.276579][ T5085] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 55.282469][ T5085] RIP: 0033:0x7f4fbf3757db
[ 55.286876][ T5085] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
[ 55.306483][ T5085] RSP: 002b:00007ffca3e21d00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 55.314896][ T5085] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f4fbf3757db
[ 55.322853][ T5085] RDX: 00007ffca3e21d78 RSI: 00000000400448dd RDI: 0000000000000003
[ 55.330811][ T5085] RBP: 00005555931384a8 R08: 0000000000000000 R09: 0000000000000000
[ 55.338770][ T5085] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000000
[ 55.346728][ T5085] R13: 0000000000000000 R14: 0000000000000009 R15: 0000000000000009
[ 55.354689][ T5085]
[ 55.357698][ T5085]
[ 55.360005][ T5085] Allocated by task 4488:
[ 55.364308][ T5085] kasan_save_track+0x3f/0x80
[ 55.368973][ T5085] __kasan_slab_alloc+0x66/0x80
[ 55.373809][ T5085] kmem_cache_alloc_noprof+0x135/0x2a0
[ 55.379248][ T5085] skb_clone+0x20c/0x390
[ 55.383493][ T5085] hci_cmd_work+0x29e/0x670
[ 55.387980][ T5085] process_scheduled_works+0xa2c/0x1830
[ 55.393506][ T5085] worker_thread+0x86d/0xd70
[ 55.398163][ T5085] kthread+0x2f0/0x390
[ 55.402212][ T5085] ret_from_fork+0x4b/0x80
[ 55.406610][ T5085] ret_from_fork_asm+0x1a/0x30
[ 55.411363][ T5085]
[ 55.413667][ T5085] Freed by task 5094:
[ 55.417622][ T5085] kasan_save_track+0x3f/0x80
[ 55.422286][ T5085] kasan_save_free_info+0x40/0x50
[ 55.427295][ T5085] poison_slab_object+0xe0/0x150
[ 55.432215][ T5085] __kasan_slab_free+0x37/0x60
[ 55.437074][ T5085] kmem_cache_free+0x145/0x350
[ 55.441818][ T5085] hci_req_sync_complete+0xe7/0x290
[ 55.446995][ T5085] hci_event_packet+0xc71/0x1540
[ 55.451915][ T5085] hci_rx_work+0x3e8/0xca0
[ 55.456315][ T5085] process_scheduled_works+0xa2c/0x1830
[ 55.461844][ T5085] worker_thread+0x86d/0xd70
[ 55.466412][ T5085] kthread+0x2f0/0x390
[ 55.470464][ T5085] ret_from_fork+0x4b/0x80
[ 55.474863][ T5085] ret_from_fork_asm+0x1a/0x30
[ 55.479614][ T5085]
[ 55.481919][ T5085] The buggy address belongs to the object at ffff8880658e4000
[ 55.481919][ T5085] which belongs to the cache skbuff_head_cache of size 240
[ 55.496490][ T5085] The buggy address is located 228 bytes inside of
[ 55.496490][ T5085] freed 240-byte region [ffff8880658e4000, ffff8880658e40f0)
[ 55.510360][ T5085]
[ 55.512666][ T5085] The buggy address belongs to the physical page:
[ 55.519060][ T5085] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x658e4
[ 55.527805][ T5085] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 55.534899][ T5085] page_type: 0xffffefff(slab)
[ 55.539563][ T5085] raw: 00fff00000000000 ffff888018ae0780 dead000000000122 0000000000000000
[ 55.548128][ T5085] raw: 0000000000000000 00000000800c000c 00000001ffffefff 0000000000000000
[ 55.556693][ T5085] page dumped because: kasan: bad access detected
[ 55.563090][ T5085] page_owner tracks the page as allocated
[ 55.568784][ T5085] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 4488, tgid 4488 (kworker/u9:1), ts 55000617538, free_ts 14984768255
[ 55.588041][ T5085] post_alloc_hook+0x1f3/0x230
[ 55.592797][ T5085] get_page_from_freelist+0x2e2d/0x2ee0
[ 55.598324][ T5085] __alloc_pages_noprof+0x256/0x6c0
[ 55.603503][ T5085] alloc_slab_page+0x5f/0x120
[ 55.608166][ T5085] allocate_slab+0x5a/0x2e0
[ 55.612672][ T5085] ___slab_alloc+0xcd1/0x14b0
[ 55.617350][ T5085] __slab_alloc+0x58/0xa0
[ 55.621679][ T5085] kmem_cache_alloc_noprof+0x1c1/0x2a0
[ 55.627122][ T5085] skb_clone+0x20c/0x390
[ 55.631351][ T5085] hci_cmd_work+0x29e/0x670
[ 55.635849][ T5085] process_scheduled_works+0xa2c/0x1830
[ 55.641388][ T5085] worker_thread+0x86d/0xd70
[ 55.645961][ T5085] kthread+0x2f0/0x390
[ 55.650012][ T5085] ret_from_fork+0x4b/0x80
[ 55.654416][ T5085] ret_from_fork_asm+0x1a/0x30
[ 55.659168][ T5085] page last free pid 1 tgid 1 stack trace:
[ 55.664949][ T5085] free_unref_page+0xd22/0xea0
[ 55.669702][ T5085] free_contig_range+0x9e/0x160
[ 55.674535][ T5085] destroy_args+0x8a/0x890
[ 55.678932][ T5085] debug_vm_pgtable+0x4be/0x550
[ 55.683772][ T5085] do_one_initcall+0x248/0x880
[ 55.688519][ T5085] do_initcall_level+0x157/0x210
[ 55.693449][ T5085] do_initcalls+0x3f/0x80
[ 55.697765][ T5085] kernel_init_freeable+0x435/0x5d0
[ 55.702965][ T5085] kernel_init+0x1d/0x2b0
[ 55.707281][ T5085] ret_from_fork+0x4b/0x80
[ 55.711687][ T5085] ret_from_fork_asm+0x1a/0x30
[ 55.716439][ T5085]
[ 55.718742][ T5085] Memory state around the buggy address:
[ 55.724353][ T5085] ffff8880658e3f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 55.732402][ T5085] ffff8880658e4000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 55.740443][ T5085] >ffff8880658e4080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 55.748479][ T5085] ^
[ 55.755648][ T5085] ffff8880658e4100: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 55.763687][ T5085] ffff8880658e4180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 55.771725][ T5085] ==================================================================
[ 55.782244][ T5091] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[ 55.789769][ T5096] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[ 55.824590][ T5085] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 55.831820][ T5085] CPU: 1 PID: 5085 Comm: syz-executor Not tainted 6.10.0-rc2-syzkaller-00824-gfd8db07705c5 #0
[ 55.842069][ T5085] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
[ 55.852144][ T5085] Call Trace:
[ 55.855433][ T5085]
[ 55.858371][ T5085] dump_stack_lvl+0x241/0x360
[ 55.863066][ T5085] ? __pfx_dump_stack_lvl+0x10/0x10
[ 55.868280][ T5085] ? __pfx__printk+0x10/0x10
[ 55.872875][ T5085] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 55.878876][ T5085] ? vscnprintf+0x5d/0x90
[ 55.883225][ T5085] panic+0x349/0x860
[ 55.887138][ T5085] ? check_panic_on_warn+0x21/0xb0
[ 55.892273][ T5085] ? __pfx_panic+0x10/0x10
[ 55.896707][ T5085] ? _raw_spin_unlock_irqrestore+0x130/0x140
[ 55.902707][ T5085] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 55.909061][ T5085] check_panic_on_warn+0x86/0xb0
[ 55.914020][ T5085] ? kfree_skb_reason+0x41/0x3b0
[ 55.918953][ T5085] end_report+0x77/0x160
[ 55.923186][ T5085] kasan_report+0x154/0x180
[ 55.927681][ T5085] ? kfree_skb_reason+0x41/0x3b0
[ 55.932616][ T5085] kasan_check_range+0x282/0x290
[ 55.937547][ T5085] kfree_skb_reason+0x41/0x3b0
[ 55.942303][ T5085] __hci_req_sync+0x62f/0x950
[ 55.946973][ T5085] ? __pfx___hci_req_sync+0x10/0x10
[ 55.952162][ T5085] ? __pfx___mutex_lock+0x10/0x10
[ 55.957175][ T5085] ? __pfx_autoremove_wake_function+0x10/0x10
[ 55.963229][ T5085] ? __pfx_hci_scan_req+0x10/0x10
[ 55.968242][ T5085] hci_req_sync+0xa9/0xd0
[ 55.972596][ T5085] hci_dev_cmd+0x4c5/0xa50
[ 55.977002][ T5085] ? security_capable+0x90/0xb0
[ 55.981840][ T5085] ? __pfx_hci_dev_cmd+0x10/0x10
[ 55.986766][ T5085] ? hci_sock_ioctl+0x6c4/0xa40
[ 55.991605][ T5085] sock_do_ioctl+0x158/0x460
[ 55.996182][ T5085] ? __pfx_sock_do_ioctl+0x10/0x10
[ 56.001283][ T5085] sock_ioctl+0x629/0x8e0
[ 56.005610][ T5085] ? __pfx_sock_ioctl+0x10/0x10
[ 56.010539][ T5085] ? __fget_files+0x29/0x470
[ 56.015119][ T5085] ? __fget_files+0x3f6/0x470
[ 56.019785][ T5085] ? __fget_files+0x29/0x470
[ 56.024387][ T5085] ? bpf_lsm_file_ioctl+0x9/0x10
[ 56.029317][ T5085] ? security_file_ioctl+0x87/0xb0
[ 56.034418][ T5085] ? __pfx_sock_ioctl+0x10/0x10
[ 56.039258][ T5085] __se_sys_ioctl+0xfc/0x170
[ 56.043840][ T5085] do_syscall_64+0xf3/0x230
[ 56.048328][ T5085] ? clear_bhb_loop+0x35/0x90
[ 56.052996][ T5085] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 56.058873][ T5085] RIP: 0033:0x7f4fbf3757db
[ 56.063276][ T5085] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
[ 56.082867][ T5085] RSP: 002b:00007ffca3e21d00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 56.091266][ T5085] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f4fbf3757db
[ 56.099224][ T5085] RDX: 00007ffca3e21d78 RSI: 00000000400448dd RDI: 0000000000000003
[ 56.107181][ T5085] RBP: 00005555931384a8 R08: 0000000000000000 R09: 0000000000000000
[ 56.115136][ T5085] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000000
[ 56.123095][ T5085] R13: 0000000000000000 R14: 0000000000000009 R15: 0000000000000009
[ 56.131058][ T5085]
[ 56.134177][ T5085] Kernel Offset: disabled
[ 56.138507][ T5085] Rebooting in 86400 seconds..