last executing test programs: kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.10.26' (ED25519) to the list of known hosts. [ 74.682871][ T29] audit: type=1400 audit(1719927854.394:87): avc: denied { mounton } for pid=5071 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1925 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 74.691667][ T5071] cgroup: Unknown subsys name 'net' [ 74.705695][ T29] audit: type=1400 audit(1719927854.404:88): avc: denied { mount } for pid=5071 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 74.733843][ T29] audit: type=1400 audit(1719927854.434:89): avc: denied { unmount } for pid=5071 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 74.915676][ T5071] cgroup: Unknown subsys name 'rlimit' [ 75.046850][ T29] audit: type=1400 audit(1719927854.764:90): avc: denied { setattr } for pid=5071 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=733 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 75.071239][ T29] audit: type=1400 audit(1719927854.764:91): avc: denied { create } for pid=5071 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 75.111183][ T29] audit: type=1400 audit(1719927854.764:92): avc: denied { write } for pid=5071 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 75.133588][ T29] audit: type=1400 audit(1719927854.764:93): avc: denied { read } for pid=5071 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 75.154156][ T29] audit: type=1400 audit(1719927854.784:94): avc: denied { mounton } for pid=5071 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 75.179303][ T29] audit: type=1400 audit(1719927854.784:95): avc: denied { mount } for pid=5071 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 75.194644][ T5073] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 75.203058][ T29] audit: type=1400 audit(1719927854.814:96): avc: denied { read } for pid=4748 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 76.588892][ T5071] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 77.306279][ T53] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 77.317461][ T5091] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 77.331004][ T5094] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 77.332263][ T5091] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 77.339323][ T5094] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 77.347525][ T5091] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 77.356750][ T5094] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 77.360422][ T5091] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 77.376372][ T5094] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 77.377067][ T5091] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 77.383986][ T5094] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 77.393123][ T5091] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 77.398544][ T5094] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 77.405847][ T5091] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 77.414845][ T5094] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 77.420679][ T5091] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 77.427221][ T5094] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 77.434488][ T5091] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 77.448189][ T4478] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 77.456551][ T5096] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 77.465872][ T5096] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 77.469271][ T5094] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 77.473522][ T5096] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 77.482690][ T5094] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 77.489813][ T5096] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 77.502946][ T5096] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 77.513704][ T5096] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 77.522919][ T5087] ================================================================== [ 77.523430][ T5093] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 77.531000][ T5087] BUG: KASAN: slab-use-after-free in kfree_skb_reason+0x36/0x210 [ 77.545784][ T5087] Read of size 4 at addr ffff888064debae4 by task syz-executor/5087 [ 77.553837][ T5087] [ 77.556170][ T5087] CPU: 1 PID: 5087 Comm: syz-executor Not tainted 6.10.0-rc6-syzkaller-00051-g1dfe225e9af5 #0 [ 77.566404][ T5087] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 77.576470][ T5087] Call Trace: [ 77.579748][ T5087] [ 77.582688][ T5087] dump_stack_lvl+0x116/0x1f0 [ 77.587400][ T5087] print_report+0xc3/0x620 [ 77.591832][ T5087] ? __virt_addr_valid+0x5e/0x580 [ 77.596944][ T5087] ? __phys_addr+0xc6/0x150 [ 77.601471][ T5087] kasan_report+0xd9/0x110 [ 77.605917][ T5087] ? kfree_skb_reason+0x36/0x210 [ 77.610867][ T5087] ? kfree_skb_reason+0x36/0x210 [ 77.615839][ T5087] kasan_check_range+0xef/0x1a0 [ 77.620710][ T5087] kfree_skb_reason+0x36/0x210 [ 77.625573][ T5087] __hci_req_sync+0x61d/0x980 [ 77.630355][ T5087] ? __pfx___hci_req_sync+0x10/0x10 [ 77.635558][ T5087] ? __mutex_lock+0x1a6/0x9c0 [ 77.640236][ T5087] ? __pfx_autoremove_wake_function+0x10/0x10 [ 77.646313][ T5087] ? hci_req_sync+0x3f/0xd0 [ 77.650815][ T5087] ? __pfx___might_resched+0x10/0x10 [ 77.656106][ T5087] hci_req_sync+0x97/0xd0 [ 77.660527][ T5087] ? __pfx_hci_scan_req+0x10/0x10 [ 77.665553][ T5087] hci_dev_cmd+0x634/0x960 [ 77.669982][ T5087] ? cap_capable+0x1cf/0x240 [ 77.674586][ T5087] ? __pfx_hci_dev_cmd+0x10/0x10 [ 77.679538][ T5087] ? security_capable+0x98/0xd0 [ 77.684574][ T5087] hci_sock_ioctl+0x4f3/0x880 [ 77.689253][ T5087] ? __pfx_hci_sock_ioctl+0x10/0x10 [ 77.694463][ T5087] sock_do_ioctl+0x116/0x280 [ 77.699053][ T5087] ? __pfx_sock_do_ioctl+0x10/0x10 [ 77.704161][ T5087] ? ioctl_has_perm.constprop.0.isra.0+0x2f9/0x470 [ 77.710664][ T5087] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 77.717517][ T5087] sock_ioctl+0x22e/0x6c0 [ 77.721843][ T5087] ? __pfx_sock_ioctl+0x10/0x10 [ 77.726692][ T5087] ? selinux_file_ioctl+0x180/0x270 [ 77.731893][ T5087] ? selinux_file_ioctl+0xb4/0x270 [ 77.737002][ T5087] ? __pfx_sock_ioctl+0x10/0x10 [ 77.741851][ T5087] __x64_sys_ioctl+0x193/0x220 [ 77.746622][ T5087] do_syscall_64+0xcd/0x250 [ 77.751149][ T5087] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.757057][ T5087] RIP: 0033:0x7f0cb2775b1b [ 77.761478][ T5087] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 77.781105][ T5087] RSP: 002b:00007ffc3fcd8b20 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 77.789605][ T5087] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f0cb2775b1b [ 77.797571][ T5087] RDX: 00007ffc3fcd8b98 RSI: 00000000400448dd RDI: 0000000000000003 [ 77.805535][ T5087] RBP: 000055555b2414a8 R08: 0000000000000000 R09: 0000000000000000 [ 77.813500][ T5087] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000004 [ 77.821473][ T5087] R13: 0000000000000004 R14: 0000000000000009 R15: 0000000000000009 [ 77.829441][ T5087] [ 77.832452][ T5087] [ 77.834788][ T5087] Allocated by task 5096: [ 77.839102][ T5087] kasan_save_stack+0x33/0x60 [ 77.843784][ T5087] kasan_save_track+0x14/0x30 [ 77.848460][ T5087] __kasan_slab_alloc+0x89/0x90 [ 77.853312][ T5087] kmem_cache_alloc_noprof+0x121/0x2f0 [ 77.858781][ T5087] skb_clone+0x190/0x3f0 [ 77.863022][ T5087] hci_cmd_work+0x66a/0x710 [ 77.867523][ T5087] process_one_work+0x9c5/0x1b40 [ 77.872466][ T5087] worker_thread+0x6c8/0xf30 [ 77.877047][ T5087] kthread+0x2c1/0x3a0 [ 77.881112][ T5087] ret_from_fork+0x45/0x80 [ 77.885548][ T5087] ret_from_fork_asm+0x1a/0x30 [ 77.890316][ T5087] [ 77.892633][ T5087] Freed by task 5093: [ 77.897128][ T5087] kasan_save_stack+0x33/0x60 [ 77.901807][ T5087] kasan_save_track+0x14/0x30 [ 77.906572][ T5087] kasan_save_free_info+0x3b/0x60 [ 77.911597][ T5087] poison_slab_object+0xf7/0x160 [ 77.916539][ T5087] __kasan_slab_free+0x32/0x50 [ 77.921391][ T5087] kmem_cache_free+0x12f/0x3a0 [ 77.926158][ T5087] kfree_skbmem+0x10e/0x200 [ 77.930657][ T5087] kfree_skb_reason+0x138/0x210 [ 77.935602][ T5087] hci_req_sync_complete+0x16c/0x270 [ 77.940908][ T5087] hci_event_packet+0x963/0x1170 [ 77.945842][ T5087] hci_rx_work+0x2c4/0x1610 [ 77.950339][ T5087] process_one_work+0x9c5/0x1b40 [ 77.955272][ T5087] worker_thread+0x6c8/0xf30 [ 77.959854][ T5087] kthread+0x2c1/0x3a0 [ 77.963923][ T5087] ret_from_fork+0x45/0x80 [ 77.968430][ T5087] ret_from_fork_asm+0x1a/0x30 [ 77.973194][ T5087] [ 77.975508][ T5087] The buggy address belongs to the object at ffff888064deba00 [ 77.975508][ T5087] which belongs to the cache skbuff_head_cache of size 240 [ 77.990082][ T5087] The buggy address is located 228 bytes inside of [ 77.990082][ T5087] freed 240-byte region [ffff888064deba00, ffff888064debaf0) [ 78.003870][ T5087] [ 78.006181][ T5087] The buggy address belongs to the physical page: [ 78.012612][ T5087] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x64deb [ 78.021409][ T5087] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 78.028547][ T5087] page_type: 0xffffefff(slab) [ 78.033236][ T5087] raw: 00fff00000000000 ffff8880192a6780 dead000000000122 0000000000000000 [ 78.041815][ T5087] raw: 0000000000000000 00000000800c000c 00000001ffffefff 0000000000000000 [ 78.050475][ T5087] page dumped because: kasan: bad access detected [ 78.056886][ T5087] page_owner tracks the page as allocated [ 78.062597][ T5087] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5096, tgid 5096 (kworker/u9:8), ts 77513660138, free_ts 26475657177 [ 78.081881][ T5087] post_alloc_hook+0x2d1/0x350 [ 78.086660][ T5087] get_page_from_freelist+0x1353/0x2e50 [ 78.092211][ T5087] __alloc_pages_noprof+0x22b/0x2460 [ 78.097507][ T5087] alloc_slab_page+0x56/0x110 [ 78.102181][ T5087] new_slab+0x84/0x260 [ 78.106249][ T5087] ___slab_alloc+0xdac/0x1870 [ 78.110928][ T5087] __slab_alloc.constprop.0+0x56/0xb0 [ 78.116306][ T5087] kmem_cache_alloc_noprof+0x2a7/0x2f0 [ 78.121768][ T5087] skb_clone+0x190/0x3f0 [ 78.126009][ T5087] hci_event_packet+0x2ce/0x1170 [ 78.130956][ T5087] hci_rx_work+0x2c4/0x1610 [ 78.135506][ T5087] process_one_work+0x9c5/0x1b40 [ 78.140443][ T5087] worker_thread+0x6c8/0xf30 [ 78.145023][ T5087] kthread+0x2c1/0x3a0 [ 78.149110][ T5087] ret_from_fork+0x45/0x80 [ 78.153526][ T5087] ret_from_fork_asm+0x1a/0x30 [ 78.158293][ T5087] page last free pid 1 tgid 1 stack trace: [ 78.164084][ T5087] free_unref_page+0x64a/0xe40 [ 78.168933][ T5087] free_contig_range+0xb6/0x1a0 [ 78.173785][ T5087] destroy_args+0xa4e/0xe20 [ 78.178290][ T5087] debug_vm_pgtable+0x1705/0x3280 [ 78.183322][ T5087] do_one_initcall+0x128/0x700 [ 78.188176][ T5087] kernel_init_freeable+0x69d/0xca0 [ 78.193377][ T5087] kernel_init+0x1c/0x2b0 [ 78.197709][ T5087] ret_from_fork+0x45/0x80 [ 78.202267][ T5087] ret_from_fork_asm+0x1a/0x30 [ 78.207033][ T5087] [ 78.209345][ T5087] Memory state around the buggy address: [ 78.215071][ T5087] ffff888064deb980: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc [ 78.223258][ T5087] ffff888064deba00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 78.231348][ T5087] >ffff888064deba80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc [ 78.239589][ T5087] ^ [ 78.246788][ T5087] ffff888064debb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 78.254852][ T5087] ffff888064debb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 78.262903][ T5087] ================================================================== [ 78.293680][ T5087] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 78.300928][ T5087] CPU: 0 PID: 5087 Comm: syz-executor Not tainted 6.10.0-rc6-syzkaller-00051-g1dfe225e9af5 #0 [ 78.311200][ T5087] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 78.321381][ T5087] Call Trace: [ 78.324683][ T5087] [ 78.327634][ T5087] dump_stack_lvl+0x3d/0x1f0 [ 78.332257][ T5087] panic+0x6f5/0x7a0 [ 78.336288][ T5087] ? __pfx_panic+0x10/0x10 [ 78.340739][ T5087] ? irqentry_exit+0x3b/0x90 [ 78.345542][ T5087] ? lockdep_hardirqs_on+0x7c/0x110 [ 78.350772][ T5087] ? preempt_schedule_thunk+0x1a/0x30 [ 78.356353][ T5087] ? preempt_schedule_common+0x44/0xc0 [ 78.361841][ T5087] ? check_panic_on_warn+0x1f/0xb0 [ 78.367078][ T5087] check_panic_on_warn+0xab/0xb0 [ 78.372033][ T5087] end_report+0x117/0x180 [ 78.376377][ T5087] kasan_report+0xe9/0x110 [ 78.380800][ T5087] ? kfree_skb_reason+0x36/0x210 [ 78.385743][ T5087] ? kfree_skb_reason+0x36/0x210 [ 78.390687][ T5087] kasan_check_range+0xef/0x1a0 [ 78.395538][ T5087] kfree_skb_reason+0x36/0x210 [ 78.400320][ T5087] __hci_req_sync+0x61d/0x980 [ 78.405013][ T5087] ? __pfx___hci_req_sync+0x10/0x10 [ 78.410210][ T5087] ? __mutex_lock+0x1a6/0x9c0 [ 78.414886][ T5087] ? __pfx_autoremove_wake_function+0x10/0x10 [ 78.420961][ T5087] ? hci_req_sync+0x3f/0xd0 [ 78.425549][ T5087] ? __pfx___might_resched+0x10/0x10 [ 78.430858][ T5087] hci_req_sync+0x97/0xd0 [ 78.435186][ T5087] ? __pfx_hci_scan_req+0x10/0x10 [ 78.440208][ T5087] hci_dev_cmd+0x634/0x960 [ 78.444628][ T5087] ? cap_capable+0x1cf/0x240 [ 78.449222][ T5087] ? __pfx_hci_dev_cmd+0x10/0x10 [ 78.454162][ T5087] ? security_capable+0x98/0xd0 [ 78.459020][ T5087] hci_sock_ioctl+0x4f3/0x880 [ 78.463698][ T5087] ? __pfx_hci_sock_ioctl+0x10/0x10 [ 78.468913][ T5087] sock_do_ioctl+0x116/0x280 [ 78.473518][ T5087] ? __pfx_sock_do_ioctl+0x10/0x10 [ 78.478624][ T5087] ? ioctl_has_perm.constprop.0.isra.0+0x2f9/0x470 [ 78.485124][ T5087] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 78.491978][ T5087] sock_ioctl+0x22e/0x6c0 [ 78.496305][ T5087] ? __pfx_sock_ioctl+0x10/0x10 [ 78.501165][ T5087] ? selinux_file_ioctl+0x180/0x270 [ 78.506363][ T5087] ? selinux_file_ioctl+0xb4/0x270 [ 78.511470][ T5087] ? __pfx_sock_ioctl+0x10/0x10 [ 78.516318][ T5087] __x64_sys_ioctl+0x193/0x220 [ 78.521080][ T5087] do_syscall_64+0xcd/0x250 [ 78.525617][ T5087] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 78.531530][ T5087] RIP: 0033:0x7f0cb2775b1b [ 78.535944][ T5087] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 78.555553][ T5087] RSP: 002b:00007ffc3fcd8b20 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 78.563967][ T5087] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f0cb2775b1b [ 78.571948][ T5087] RDX: 00007ffc3fcd8b98 RSI: 00000000400448dd RDI: 0000000000000003 [ 78.579934][ T5087] RBP: 000055555b2414a8 R08: 0000000000000000 R09: 0000000000000000 [ 78.587902][ T5087] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000004 [ 78.595872][ T5087] R13: 0000000000000004 R14: 0000000000000009 R15: 0000000000000009 [ 78.603931][ T5087] [ 78.607181][ T5087] Kernel Offset: disabled [ 78.611492][ T5087] Rebooting in 86400 seconds..