Warning: Permanently added '10.128.1.13' (ED25519) to the list of known hosts.
2025/11/29 16:52:52 parsed 1 programs
[ 91.154203][ T5829] cgroup: Unknown subsys name 'net'
[ 91.282904][ T5829] cgroup: Unknown subsys name 'cpuset'
[ 91.292518][ T5829] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 93.015005][ T5829] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 96.058184][ T5842] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 97.251893][ T10] cfg80211: failed to load regulatory.db
[ 97.677905][ T5870] chnl_net:caif_netlink_parms(): no params data found
[ 97.780992][ T5870] bridge0: port 1(bridge_slave_0) entered blocking state
[ 97.788870][ T5870] bridge0: port 1(bridge_slave_0) entered disabled state
[ 97.796093][ T5870] bridge_slave_0: entered allmulticast mode
[ 97.804428][ T5870] bridge_slave_0: entered promiscuous mode
[ 97.814426][ T5870] bridge0: port 2(bridge_slave_1) entered blocking state
[ 97.821769][ T5870] bridge0: port 2(bridge_slave_1) entered disabled state
[ 97.829045][ T5870] bridge_slave_1: entered allmulticast mode
[ 97.836341][ T5870] bridge_slave_1: entered promiscuous mode
[ 97.876554][ T5870] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 97.890174][ T5870] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 97.925813][ T5870] team0: Port device team_slave_0 added
[ 97.935301][ T5870] team0: Port device team_slave_1 added
[ 97.965856][ T5870] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 97.973272][ T5870] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 97.999227][ T5870] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 98.012239][ T5870] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 98.019244][ T5870] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 98.045168][ T5870] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 98.093773][ T5870] hsr_slave_0: entered promiscuous mode
[ 98.100396][ T5870] hsr_slave_1: entered promiscuous mode
[ 98.289626][ T5870] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 98.303430][ T5870] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 98.314264][ T5870] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 98.326805][ T5870] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 98.362109][ T5870] bridge0: port 2(bridge_slave_1) entered blocking state
[ 98.369440][ T5870] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 98.377426][ T5870] bridge0: port 1(bridge_slave_0) entered blocking state
[ 98.384774][ T5870] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 98.447396][ T5870] 8021q: adding VLAN 0 to HW filter on device bond0
[ 98.467955][ T3000] bridge0: port 1(bridge_slave_0) entered disabled state
[ 98.477713][ T3000] bridge0: port 2(bridge_slave_1) entered disabled state
[ 98.495740][ T5870] 8021q: adding VLAN 0 to HW filter on device team0
[ 98.511880][ T36] bridge0: port 1(bridge_slave_0) entered blocking state
[ 98.519114][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 98.533930][ T12] bridge0: port 2(bridge_slave_1) entered blocking state
[ 98.541180][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 98.737977][ T5870] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 98.792235][ T5870] veth0_vlan: entered promiscuous mode
[ 98.805221][ T5870] veth1_vlan: entered promiscuous mode
[ 98.837843][ T5870] veth0_macvtap: entered promiscuous mode
[ 98.847763][ T5870] veth1_macvtap: entered promiscuous mode
[ 98.868511][ T5870] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 98.885681][ T5870] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 98.902895][ T36] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 98.913900][ T36] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 98.924826][ T36] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 98.933737][ T36] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 99.076131][ T3000] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 99.144435][ T3000] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 99.221863][ T3000] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 99.249861][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 99.258047][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 99.287122][ T3000] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 99.324008][ T4777] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 99.333340][ T4777] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 99.974564][ T5146] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 99.982494][ T5146] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 99.990868][ T5146] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 99.999494][ T5146] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 100.007806][ T5146] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
2025/11/29 16:53:05 executed programs: 0
[ 101.455385][ T5146] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 101.463429][ T5146] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 101.474381][ T5146] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 101.483610][ T5146] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 101.491434][ T5146] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 101.670245][ T5940] chnl_net:caif_netlink_parms(): no params data found
[ 101.752079][ T5940] bridge0: port 1(bridge_slave_0) entered blocking state
[ 101.759745][ T5940] bridge0: port 1(bridge_slave_0) entered disabled state
[ 101.766940][ T5940] bridge_slave_0: entered allmulticast mode
[ 101.774439][ T5940] bridge_slave_0: entered promiscuous mode
[ 101.782837][ T5940] bridge0: port 2(bridge_slave_1) entered blocking state
[ 101.790222][ T5940] bridge0: port 2(bridge_slave_1) entered disabled state
[ 101.797626][ T5940] bridge_slave_1: entered allmulticast mode
[ 101.805600][ T5940] bridge_slave_1: entered promiscuous mode
[ 101.841175][ T5940] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 101.853726][ T5940] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 101.894079][ T5940] team0: Port device team_slave_0 added
[ 101.902240][ T5940] team0: Port device team_slave_1 added
[ 101.943155][ T5940] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 101.950300][ T5940] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 101.977012][ T5940] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 102.000503][ T5940] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 102.007521][ T5940] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 102.033588][ T5940] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 102.105054][ T5940] hsr_slave_0: entered promiscuous mode
[ 102.113352][ T5940] hsr_slave_1: entered promiscuous mode
[ 102.121391][ T5940] debugfs: 'hsr0' already exists in 'hsr'
[ 102.127228][ T5940] Cannot create hsr debugfs directory
[ 102.174655][ T3000] bridge_slave_1: left allmulticast mode
[ 102.182946][ T3000] bridge_slave_1: left promiscuous mode
[ 102.189522][ T3000] bridge0: port 2(bridge_slave_1) entered disabled state
[ 102.203309][ T3000] bridge_slave_0: left allmulticast mode
[ 102.209359][ T3000] bridge_slave_0: left promiscuous mode
[ 102.215089][ T3000] bridge0: port 1(bridge_slave_0) entered disabled state
[ 102.451323][ T3000] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 102.462825][ T3000] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 102.473535][ T3000] bond0 (unregistering): Released all slaves
[ 102.578509][ T3000] hsr_slave_0: left promiscuous mode
[ 102.585001][ T3000] hsr_slave_1: left promiscuous mode
[ 102.591357][ T3000] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 102.598849][ T3000] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 102.607118][ T3000] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 102.614807][ T3000] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 102.633245][ T3000] veth1_macvtap: left promiscuous mode
[ 102.639158][ T3000] veth0_macvtap: left promiscuous mode
[ 102.644795][ T3000] veth1_vlan: left promiscuous mode
[ 102.650370][ T3000] veth0_vlan: left promiscuous mode
[ 102.977540][ T3000] team0 (unregistering): Port device team_slave_1 removed
[ 103.006696][ T3000] team0 (unregistering): Port device team_slave_0 removed
[ 103.560416][ T52] Bluetooth: hci0: command tx timeout
[ 103.736058][ T5940] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 103.749707][ T5940] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 103.762111][ T5940] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 103.788947][ T5940] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 104.454789][ T5940] 8021q: adding VLAN 0 to HW filter on device bond0
[ 104.567715][ T5940] 8021q: adding VLAN 0 to HW filter on device team0
[ 104.590907][ T12] bridge0: port 1(bridge_slave_0) entered blocking state
[ 104.598150][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 104.719885][ T13] bridge0: port 2(bridge_slave_1) entered blocking state
[ 104.727039][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 104.864904][ T5940] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 105.165184][ T5940] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 105.211759][ T5940] veth0_vlan: entered promiscuous mode
[ 105.225697][ T5940] veth1_vlan: entered promiscuous mode
[ 105.257024][ T5940] veth0_macvtap: entered promiscuous mode
[ 105.267903][ T5940] veth1_macvtap: entered promiscuous mode
[ 105.288696][ T5940] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 105.305745][ T5940] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 105.320033][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 105.331501][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 105.341678][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 105.352630][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 105.416760][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 105.430739][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 105.462253][ T3000] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 105.471061][ T3000] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 105.649208][ T52] Bluetooth: hci0: command tx timeout
2025/11/29 16:53:11 executed programs: 31
[ 107.565995][ T5146] ==================================================================
[ 107.574135][ T5146] BUG: KASAN: slab-use-after-free in hci_conn_drop+0x34/0x2b0
[ 107.581631][ T5146] Write of size 4 at addr ffff88807699c010 by task kworker/u9:1/5146
[ 107.589728][ T5146]
[ 107.592083][ T5146] CPU: 1 UID: 0 PID: 5146 Comm: kworker/u9:1 Not tainted syzkaller #0 PREEMPT(full)
[ 107.592101][ T5146] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 107.592112][ T5146] Workqueue: hci0 hci_cmd_sync_work
[ 107.592144][ T5146] Call Trace:
[ 107.592151][ T5146]
[ 107.592157][ T5146] dump_stack_lvl+0x189/0x250
[ 107.592172][ T5146] ? __virt_addr_valid+0x1c8/0x5c0
[ 107.592188][ T5146] ? rcu_is_watching+0x15/0xb0
[ 107.592202][ T5146] ? __pfx_dump_stack_lvl+0x10/0x10
[ 107.592215][ T5146] ? rcu_is_watching+0x15/0xb0
[ 107.592233][ T5146] ? lock_release+0x4b/0x3b0
[ 107.592254][ T5146] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 107.592275][ T5146] ? __virt_addr_valid+0x1c8/0x5c0
[ 107.592291][ T5146] ? __virt_addr_valid+0x4a5/0x5c0
[ 107.592308][ T5146] print_report+0xca/0x240
[ 107.592324][ T5146] ? hci_conn_drop+0x34/0x2b0
[ 107.592337][ T5146] kasan_report+0x118/0x150
[ 107.592350][ T5146] ? hci_conn_valid+0x21/0x230
[ 107.592364][ T5146] ? hci_conn_drop+0x34/0x2b0
[ 107.592381][ T5146] kasan_check_range+0x2b0/0x2c0
[ 107.592396][ T5146] hci_conn_drop+0x34/0x2b0
[ 107.592409][ T5146] ? __pfx_le_read_features_complete+0x10/0x10
[ 107.592431][ T5146] hci_cmd_sync_work+0x262/0x400
[ 107.592454][ T5146] ? process_one_work+0x868/0x15a0
[ 107.592475][ T5146] process_one_work+0x93a/0x15a0
[ 107.592503][ T5146] ? __pfx_process_one_work+0x10/0x10
[ 107.592527][ T5146] ? assign_work+0x3a1/0x410
[ 107.592548][ T5146] worker_thread+0x9b0/0xee0
[ 107.592579][ T5146] kthread+0x711/0x8a0
[ 107.592595][ T5146] ? __pfx_worker_thread+0x10/0x10
[ 107.592617][ T5146] ? __pfx_kthread+0x10/0x10
[ 107.592632][ T5146] ? _raw_spin_unlock_irq+0x23/0x50
[ 107.592651][ T5146] ? lockdep_hardirqs_on+0x98/0x140
[ 107.592672][ T5146] ? __pfx_kthread+0x10/0x10
[ 107.592687][ T5146] ret_from_fork+0x599/0xb30
[ 107.592708][ T5146] ? __pfx_ret_from_fork+0x10/0x10
[ 107.592731][ T5146] ? __switch_to_asm+0x39/0x70
[ 107.592746][ T5146] ? __switch_to_asm+0x33/0x70
[ 107.592761][ T5146] ? __pfx_kthread+0x10/0x10
[ 107.592776][ T5146] ret_from_fork_asm+0x1a/0x30
[ 107.592798][ T5146]
[ 107.592803][ T5146]
[ 107.799141][ T5146] Allocated by task 52:
[ 107.803339][ T5146] kasan_save_track+0x3e/0x80
[ 107.808043][ T5146] __kasan_kmalloc+0x93/0xb0
[ 107.812735][ T5146] __kmalloc_cache_noprof+0x3e2/0x700
[ 107.818120][ T5146] __hci_conn_add+0x3c5/0x1b30
[ 107.822896][ T5146] le_conn_complete_evt+0x6f6/0x1420
[ 107.828194][ T5146] hci_le_enh_conn_complete_evt+0x189/0x4a0
[ 107.834101][ T5146] hci_event_packet+0x78f/0x1260
[ 107.839055][ T5146] hci_rx_work+0x3ee/0x1060
[ 107.843578][ T5146] process_one_work+0x93a/0x15a0
[ 107.848533][ T5146] worker_thread+0x9b0/0xee0
[ 107.853145][ T5146] kthread+0x711/0x8a0
[ 107.857245][ T5146] ret_from_fork+0x599/0xb30
[ 107.861862][ T5146] ret_from_fork_asm+0x1a/0x30
[ 107.866644][ T5146]
[ 107.868981][ T5146] Freed by task 52:
[ 107.872790][ T5146] kasan_save_track+0x3e/0x80
[ 107.877482][ T5146] kasan_save_free_info+0x46/0x50
[ 107.882517][ T5146] __kasan_slab_free+0x5c/0x80
[ 107.887296][ T5146] kfree+0x1c0/0x660
[ 107.891203][ T5146] device_release+0x9e/0x1d0
[ 107.895807][ T5146] kobject_put+0x228/0x570
[ 107.900234][ T5146] hci_conn_del+0xc36/0x1240
[ 107.904833][ T5146] hci_disconn_complete_evt+0x64e/0x950
[ 107.910399][ T5146] hci_event_packet+0x7e3/0x1260
[ 107.915359][ T5146] hci_rx_work+0x3ee/0x1060
[ 107.919878][ T5146] process_one_work+0x93a/0x15a0
[ 107.924828][ T5146] worker_thread+0x9b0/0xee0
[ 107.929436][ T5146] kthread+0x711/0x8a0
[ 107.933517][ T5146] ret_from_fork+0x599/0xb30
[ 107.938125][ T5146] ret_from_fork_asm+0x1a/0x30
[ 107.942901][ T5146]
[ 107.945231][ T5146] The buggy address belongs to the object at ffff88807699c000
[ 107.945231][ T5146] which belongs to the cache kmalloc-8k of size 8192
[ 107.959287][ T5146] The buggy address is located 16 bytes inside of
[ 107.959287][ T5146] freed 8192-byte region [ffff88807699c000, ffff88807699e000)
[ 107.973098][ T5146]
[ 107.975433][ T5146] The buggy address belongs to the physical page:
[ 107.981865][ T5146] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x76998
[ 107.990633][ T5146] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 107.999140][ T5146] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 108.006716][ T5146] page_type: f5(slab)
[ 108.010711][ T5146] raw: 00fff00000000040 ffff88813fe27280 ffffea0000a7f600 0000000000000004
[ 108.019303][ T5146] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[ 108.027899][ T5146] head: 00fff00000000040 ffff88813fe27280 ffffea0000a7f600 0000000000000004
[ 108.036579][ T5146] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[ 108.045260][ T5146] head: 00fff00000000003 ffffea0001da6601 00000000ffffffff 00000000ffffffff
[ 108.053941][ T5146] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 108.062661][ T5146] page dumped because: kasan: bad access detected
[ 108.069352][ T5146] page_owner tracks the page as allocated
[ 108.075089][ T5146] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5676, tgid 5676 (sh), ts 70333350172, free_ts 69886124165
[ 108.094822][ T5146] post_alloc_hook+0x234/0x290
[ 108.099609][ T5146] get_page_from_freelist+0x2365/0x2440
[ 108.105227][ T5146] __alloc_frozen_pages_noprof+0x181/0x370
[ 108.111049][ T5146] alloc_pages_mpol+0x232/0x4a0
[ 108.115910][ T5146] allocate_slab+0x86/0x3b0
[ 108.120432][ T5146] ___slab_alloc+0xf2b/0x1960
[ 108.125125][ T5146] __slab_alloc+0x65/0x100
[ 108.129550][ T5146] __kmalloc_cache_noprof+0x41e/0x700
[ 108.134936][ T5146] tomoyo_init_log+0x111f/0x1f70
[ 108.139982][ T5146] tomoyo_supervisor+0x340/0x1480
[ 108.145023][ T5146] tomoyo_find_next_domain+0x488/0x1aa0
[ 108.150579][ T5146] tomoyo_bprm_check_security+0x11c/0x180
[ 108.156319][ T5146] security_bprm_check+0x89/0x270
[ 108.161354][ T5146] bprm_execve+0x887/0x1400
[ 108.165873][ T5146] do_execveat_common+0x510/0x6a0
[ 108.171005][ T5146] __x64_sys_execve+0x94/0xb0
[ 108.175784][ T5146] page last free pid 5671 tgid 5671 stack trace:
[ 108.182111][ T5146] __free_frozen_pages+0xbc8/0xd30
[ 108.187242][ T5146] __put_partials+0x146/0x170
[ 108.191924][ T5146] put_cpu_partial+0x1f2/0x2d0
[ 108.196706][ T5146] __slab_free+0x288/0x2a0
[ 108.201135][ T5146] qlist_free_all+0x97/0x100
[ 108.205746][ T5146] kasan_quarantine_reduce+0x148/0x160
[ 108.211223][ T5146] __kasan_slab_alloc+0x22/0x80
[ 108.216092][ T5146] __kmalloc_node_track_caller_noprof+0x526/0x820
[ 108.222527][ T5146] kmalloc_reserve+0x136/0x290
[ 108.227310][ T5146] __alloc_skb+0x27e/0x430
[ 108.231742][ T5146] alloc_skb_with_frags+0xca/0x890
[ 108.236872][ T5146] sock_alloc_send_pskb+0x84d/0x980
[ 108.242085][ T5146] unix_dgram_sendmsg+0x454/0x1840
[ 108.247221][ T5146] sock_sendmsg_nosec+0x18f/0x1d0
[ 108.252267][ T5146] __sys_sendto+0x3ce/0x540
[ 108.256787][ T5146] __x64_sys_sendto+0xde/0x100
[ 108.261567][ T5146]
[ 108.263894][ T5146] Memory state around the buggy address:
[ 108.269546][ T5146] ffff88807699bf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 108.277616][ T5146] ffff88807699bf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 108.285687][ T5146] >ffff88807699c000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 108.293756][ T5146] ^
[ 108.298348][ T5146] ffff88807699c080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 108.306423][ T5146] ffff88807699c100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 108.314491][ T5146] ==================================================================
[ 108.323839][ T52] Bluetooth: hci0: command 0x040f tx timeout
[ 108.328890][ T5146] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 108.328914][ T5146] CPU: 1 UID: 0 PID: 5146 Comm: kworker/u9:1 Not tainted syzkaller #0 PREEMPT(full)
[ 108.328951][ T5146] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 108.328968][ T5146] Workqueue: hci0 hci_cmd_sync_work
[ 108.329009][ T5146] Call Trace:
[ 108.329020][ T5146]
[ 108.329033][ T5146] dump_stack_lvl+0x99/0x250
[ 108.329059][ T5146] ? __asan_memcpy+0x40/0x70
[ 108.329091][ T5146] ? __pfx_dump_stack_lvl+0x10/0x10
[ 108.329113][ T5146] ? __pfx__printk+0x10/0x10
[ 108.329156][ T5146] vpanic+0x237/0x6d0
[ 108.329185][ T5146] ? __pfx_vpanic+0x10/0x10
[ 108.329214][ T5146] ? preempt_schedule+0xae/0xc0
[ 108.329248][ T5146] ? __pfx_preempt_schedule+0x10/0x10
[ 108.329284][ T5146] panic+0xb9/0xc0
[ 108.329313][ T5146] ? __pfx_panic+0x10/0x10
[ 108.329345][ T5146] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 108.329378][ T5146] ? is_module_address+0x17/0xf0
[ 108.329412][ T5146] ? hci_conn_drop+0x34/0x2b0
[ 108.329433][ T5146] check_panic_on_warn+0x89/0xb0
[ 108.329461][ T5146] ? hci_conn_drop+0x34/0x2b0
[ 108.329484][ T5146] end_report+0x6f/0x140
[ 108.329504][ T5146] kasan_report+0x129/0x150
[ 108.329524][ T5146] ? hci_conn_valid+0x21/0x230
[ 108.329549][ T5146] ? hci_conn_drop+0x34/0x2b0
[ 108.329577][ T5146] kasan_check_range+0x2b0/0x2c0
[ 108.329602][ T5146] hci_conn_drop+0x34/0x2b0
[ 108.329625][ T5146] ? __pfx_le_read_features_complete+0x10/0x10
[ 108.329658][ T5146] hci_cmd_sync_work+0x262/0x400
[ 108.329698][ T5146] ? process_one_work+0x868/0x15a0
[ 108.329730][ T5146] process_one_work+0x93a/0x15a0
[ 108.329776][ T5146] ? __pfx_process_one_work+0x10/0x10
[ 108.329813][ T5146] ? assign_work+0x3a1/0x410
[ 108.329848][ T5146] worker_thread+0x9b0/0xee0
[ 108.329896][ T5146] kthread+0x711/0x8a0
[ 108.329919][ T5146] ? __pfx_worker_thread+0x10/0x10
[ 108.329956][ T5146] ? __pfx_kthread+0x10/0x10
[ 108.329978][ T5146] ? _raw_spin_unlock_irq+0x23/0x50
[ 108.330005][ T5146] ? lockdep_hardirqs_on+0x98/0x140
[ 108.330034][ T5146] ? __pfx_kthread+0x10/0x10
[ 108.330056][ T5146] ret_from_fork+0x599/0xb30
[ 108.330086][ T5146] ? __pfx_ret_from_fork+0x10/0x10
[ 108.330119][ T5146] ? __switch_to_asm+0x39/0x70
[ 108.330141][ T5146] ? __switch_to_asm+0x33/0x70
[ 108.330162][ T5146] ? __pfx_kthread+0x10/0x10
[ 108.330184][ T5146] ret_from_fork_asm+0x1a/0x30
[ 108.330215][ T5146]
[ 108.330501][ T5146] Kernel Offset: disabled