Warning: Permanently added '10.128.10.13' (ECDSA) to the list of known hosts.
syzkaller login: [   40.961903][ T6815] IPVS: ftp: loaded support on port[0] = 21
executing program
[   42.091514][ T6815] ==================================================================
[   42.099706][ T6815] BUG: KASAN: use-after-free in hci_chan_del+0x33/0x130
[   42.106634][ T6815] Read of size 8 at addr ffff8880a7b83218 by task syz-executor901/6815
[   42.114854][ T6815] 
[   42.117178][ T6815] CPU: 1 PID: 6815 Comm: syz-executor901 Not tainted 5.8.0-syzkaller #0
[   42.125489][ T6815] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   42.135514][ T6815] Call Trace:
[   42.138776][ T6815]  dump_stack+0x1f0/0x31e
[   42.143077][ T6815]  print_address_description+0x66/0x5a0
[   42.148591][ T6815]  ? vprintk_emit+0x342/0x3c0
[   42.153236][ T6815]  ? printk+0x62/0x83
[   42.157187][ T6815]  ? vprintk_emit+0x339/0x3c0
[   42.161836][ T6815]  kasan_report+0x132/0x1d0
[   42.166317][ T6815]  ? hci_chan_del+0x33/0x130
[   42.170878][ T6815]  hci_chan_del+0x33/0x130
[   42.175264][ T6815]  l2cap_conn_del+0x4c2/0x650
[   42.179914][ T6815]  ? l2cap_connect_cfm+0x12b0/0x12b0
[   42.185252][ T6815]  hci_conn_hash_flush+0x127/0x200
[   42.190334][ T6815]  hci_dev_do_close+0xb7b/0x1040
[   42.195246][ T6815]  hci_unregister_dev+0x185/0x1590
[   42.200329][ T6815]  ? vhci_open+0x290/0x290
[   42.204719][ T6815]  vhci_release+0x73/0xc0
[   42.209020][ T6815]  __fput+0x2f0/0x750
[   42.212975][ T6815]  task_work_run+0x137/0x1c0
[   42.217574][ T6815]  do_exit+0x5f3/0x1f20
[   42.221705][ T6815]  do_group_exit+0x161/0x2d0
[   42.226262][ T6815]  ? syscall_enter_from_user_mode+0x24/0x190
[   42.232211][ T6815]  __do_sys_exit_group+0x13/0x20
[   42.237117][ T6815]  __se_sys_exit_group+0x10/0x10
[   42.242024][ T6815]  __x64_sys_exit_group+0x37/0x40
[   42.247135][ T6815]  do_syscall_64+0x31/0x70
[   42.251523][ T6815]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[   42.257392][ T6815] RIP: 0033:0x445028
[   42.261253][ T6815] Code: Bad RIP value.
[   42.265289][ T6815] RSP: 002b:00007fff7752e7e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   42.273665][ T6815] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000445028
[   42.281606][ T6815] RDX: 0000000000000001 RSI: 000000000000003c RDI: 0000000000000001
[   42.289547][ T6815] RBP: 00000000004cce10 R08: 00000000000000e7 R09: ffffffffffffffd0
[   42.297619][ T6815] R10: 00007f9b532be9d0 R11: 0000000000000246 R12: 0000000000000001
[   42.305559][ T6815] R13: 00000000006e0200 R14: 000000000248f850 R15: 0000000000000001
[   42.313506][ T6815] 
[   42.315817][ T6815] Allocated by task 6840:
[   42.320115][ T6815]  __kasan_kmalloc+0x103/0x140
[   42.324847][ T6815]  kmem_cache_alloc_trace+0x234/0x300
[   42.330211][ T6815]  hci_chan_create+0x9a/0x270
[   42.334858][ T6815]  l2cap_conn_add+0x66/0xb00
[   42.339414][ T6815]  l2cap_connect_cfm+0xdb/0x12b0
[   42.344315][ T6815]  le_conn_complete_evt+0x88d/0x1380
[   42.349567][ T6815]  hci_event_packet+0x16e3/0x17e10
[   42.354643][ T6815]  hci_rx_work+0x246/0xa20
[   42.359026][ T6815]  process_one_work+0x789/0xfc0
[   42.363843][ T6815]  worker_thread+0xaa4/0x1460
[   42.368497][ T6815]  kthread+0x37e/0x3a0
[   42.372554][ T6815]  ret_from_fork+0x1f/0x30
[   42.376950][ T6815] 
[   42.379266][ T6815] Freed by task 6840:
[   42.383248][ T6815]  __kasan_slab_free+0x114/0x170
[   42.388174][ T6815]  kfree+0x10a/0x220
[   42.392038][ T6815]  hci_event_packet+0x2018/0x17e10
[   42.397157][ T6815]  hci_rx_work+0x246/0xa20
[   42.401543][ T6815]  process_one_work+0x789/0xfc0
[   42.406357][ T6815]  worker_thread+0xaa4/0x1460
[   42.411000][ T6815]  kthread+0x37e/0x3a0
[   42.415039][ T6815]  ret_from_fork+0x1f/0x30
[   42.419418][ T6815] 
[   42.421717][ T6815] The buggy address belongs to the object at ffff8880a7b83200
[   42.421717][ T6815]  which belongs to the cache kmalloc-128 of size 128
[   42.435737][ T6815] The buggy address is located 24 bytes inside of
[   42.435737][ T6815]  128-byte region [ffff8880a7b83200, ffff8880a7b83280)
[   42.448885][ T6815] The buggy address belongs to the page:
[   42.454488][ T6815] page:ffffea00029ee0c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880a7b83b00
[   42.464859][ T6815] flags: 0xfffe0000000200(slab)
[   42.469687][ T6815] raw: 00fffe0000000200 ffffea00028bdcc8 ffffea000285be88 ffff8880aa400700
[   42.478239][ T6815] raw: ffff8880a7b83b00 ffff8880a7b83000 0000000100000003 0000000000000000
[   42.486784][ T6815] page dumped because: kasan: bad access detected
[   42.493160][ T6815] 
[   42.495453][ T6815] Memory state around the buggy address:
[   42.501052][ T6815]  ffff8880a7b83100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   42.509080][ T6815]  ffff8880a7b83180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   42.517106][ T6815] >ffff8880a7b83200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   42.525130][ T6815]                             ^
[   42.529948][ T6815]  ffff8880a7b83280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   42.537976][ T6815]  ffff8880a7b83300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   42.546002][ T6815] ==================================================================
[   42.554027][ T6815] Disabling lock debugging due to kernel taint
[   42.560745][ T6815] Kernel panic - not syncing: panic_on_warn set ...
[   42.567331][ T6815] CPU: 1 PID: 6815 Comm: syz-executor901 Tainted: G    B             5.8.0-syzkaller #0
[   42.577024][ T6815] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   42.587065][ T6815] Call Trace:
[   42.590343][ T6815]  dump_stack+0x1f0/0x31e
[   42.594662][ T6815]  panic+0x264/0x7a0
[   42.598538][ T6815]  ? trace_hardirqs_on+0x30/0x80
[   42.603442][ T6815]  kasan_report+0x1c9/0x1d0
[   42.607911][ T6815]  ? hci_chan_del+0x33/0x130
[   42.612466][ T6815]  hci_chan_del+0x33/0x130
[   42.616847][ T6815]  l2cap_conn_del+0x4c2/0x650
[   42.621490][ T6815]  ? l2cap_connect_cfm+0x12b0/0x12b0
[   42.626737][ T6815]  hci_conn_hash_flush+0x127/0x200
[   42.631815][ T6815]  hci_dev_do_close+0xb7b/0x1040
[   42.636717][ T6815]  hci_unregister_dev+0x185/0x1590
[   42.641795][ T6815]  ? vhci_open+0x290/0x290
[   42.646174][ T6815]  vhci_release+0x73/0xc0
[   42.650469][ T6815]  __fput+0x2f0/0x750
[   42.654417][ T6815]  task_work_run+0x137/0x1c0
[   42.658973][ T6815]  do_exit+0x5f3/0x1f20
[   42.663097][ T6815]  do_group_exit+0x161/0x2d0
[   42.667655][ T6815]  ? syscall_enter_from_user_mode+0x24/0x190
[   42.673599][ T6815]  __do_sys_exit_group+0x13/0x20
[   42.678501][ T6815]  __se_sys_exit_group+0x10/0x10
[   42.683402][ T6815]  __x64_sys_exit_group+0x37/0x40
[   42.688393][ T6815]  do_syscall_64+0x31/0x70
[   42.692776][ T6815]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[   42.698632][ T6815] RIP: 0033:0x445028
[   42.702489][ T6815] Code: Bad RIP value.
[   42.706529][ T6815] RSP: 002b:00007fff7752e7e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   42.714913][ T6815] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000445028
[   42.722851][ T6815] RDX: 0000000000000001 RSI: 000000000000003c RDI: 0000000000000001
[   42.730787][ T6815] RBP: 00000000004cce10 R08: 00000000000000e7 R09: ffffffffffffffd0
[   42.738725][ T6815] R10: 00007f9b532be9d0 R11: 0000000000000246 R12: 0000000000000001
[   42.746676][ T6815] R13: 00000000006e0200 R14: 000000000248f850 R15: 0000000000000001
[   42.755789][ T6815] Kernel Offset: disabled
[   42.760097][ T6815] Rebooting in 86400 seconds..