[  OK  ] Reached target Login Prompts.
[  OK  ] Reached target Multi-User System.
[  OK  ] Reached target Graphical Interface.
         Starting Update UTMP about System Runlevel Changes...
[  OK  ] Started Update UTMP about System Runlevel Changes.

Debian GNU/Linux 9 syzkaller ttyS0

Warning: Permanently added '10.128.0.176' (ECDSA) to the list of known hosts.
syzkaller login: [   33.957486] IPVS: ftp: loaded support on port[0] = 21
[   34.046757] Bluetooth: hci0: advertising data len corrected
[   34.052656] ==================================================================
[   34.060140] BUG: KASAN: slab-out-of-bounds in hci_le_meta_evt+0x383e/0x3f20
[   34.067239] Read of size 1 at addr ffff8880955af18d by task kworker/u5:2/8123
[   34.074508] 
[   34.076124] CPU: 0 PID: 8123 Comm: kworker/u5:2 Not tainted 4.19.211-syzkaller #0
[   34.083735] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[   34.093114] Workqueue: hci0 hci_rx_work
[   34.097135] Call Trace:
[   34.099716]  dump_stack+0x1fc/0x2ef
[   34.103351]  print_address_description.cold+0x54/0x219
[   34.108636]  kasan_report_error.cold+0x8a/0x1b9
[   34.113300]  ? hci_le_meta_evt+0x383e/0x3f20
[   34.117714]  __asan_report_load1_noabort+0x88/0x90
[   34.122653]  ? hci_le_meta_evt+0x383e/0x3f20
[   34.127070]  hci_le_meta_evt+0x383e/0x3f20
[   34.131308]  ? deref_stack_reg+0x134/0x1d0
[   34.135535]  ? hci_cmd_status_evt+0x6fc0/0x6fc0
[   34.140195]  ? __lock_acquire+0x6de/0x3ff0
[   34.144436]  ? __lock_acquire+0x6de/0x3ff0
[   34.148674]  ? __lock_acquire+0x6de/0x3ff0
[   34.152912]  hci_event_packet+0x34ad/0x7e20
[   34.157342]  ? mark_held_locks+0xf0/0xf0
[   34.161408]  ? __lock_acquire+0x6de/0x3ff0
[   34.165651]  ? hci_cmd_complete_evt+0xc280/0xc280
[   34.170495]  ? mark_held_locks+0xf0/0xf0
[   34.174549]  ? debug_object_deactivate+0x1f9/0x2e0
[   34.179477]  ? mark_held_locks+0xa6/0xf0
[   34.183531]  ? _raw_spin_unlock_irqrestore+0x79/0xe0
[   34.188623]  ? lockdep_hardirqs_on+0x3a8/0x5c0
[   34.193199]  hci_rx_work+0x4ad/0xc70
[   34.196906]  process_one_work+0x864/0x1570
[   34.201220]  ? pwq_dec_nr_in_flight+0x2d0/0x2d0
[   34.205890]  worker_thread+0x64c/0x1130
[   34.210982]  ? __kthread_parkme+0x133/0x1e0
[   34.215290]  ? process_one_work+0x1570/0x1570
[   34.219769]  kthread+0x33f/0x460
[   34.223119]  ? kthread_park+0x180/0x180
[   34.227080]  ret_from_fork+0x24/0x30
[   34.230780] 
[   34.232391] Allocated by task 8116:
[   34.236009]  __kmalloc_node_track_caller+0x4c/0x70
[   34.240939]  __alloc_skb+0xae/0x560
[   34.244548]  vhci_write+0xbd/0x450
[   34.248080]  __vfs_write+0x51b/0x770
[   34.251778]  vfs_write+0x1f3/0x540
[   34.255300]  ksys_write+0x12b/0x2a0
[   34.259000]  do_syscall_64+0xf9/0x620
[   34.262783]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   34.267948] 
[   34.269560] Freed by task 6538:
[   34.272825]  kfree+0xcc/0x210
[   34.275912]  skb_release_data+0x6de/0x920
[   34.280050]  consume_skb+0x113/0x3d0
[   34.283745]  netlink_unicast+0x4dd/0x690
[   34.287788]  netlink_sendmsg+0x6c3/0xc50
[   34.291840]  sock_sendmsg+0xc3/0x120
[   34.295539]  ___sys_sendmsg+0x7bb/0x8e0
[   34.299504]  __x64_sys_sendmsg+0x132/0x220
[   34.303745]  do_syscall_64+0xf9/0x620
[   34.307537]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   34.312703] 
[   34.314315] The buggy address belongs to the object at ffff8880955aed80
[   34.314315]  which belongs to the cache kmalloc-1024 of size 1024
[   34.327131] The buggy address is located 13 bytes to the right of
[   34.327131]  1024-byte region [ffff8880955aed80, ffff8880955af180)
[   34.339508] The buggy address belongs to the page:
[   34.344426] page:ffffea0002556b80 count:1 mapcount:0 mapping:ffff88813bff0ac0 index:0xffff8880955afb00 compound_mapcount: 0
[   34.355680] flags: 0xfff00000008100(slab|head)
[   34.360252] raw: 00fff00000008100 ffffea0002c96c08 ffff88813bff1838 ffff88813bff0ac0
[   34.368120] raw: ffff8880955afb00 ffff8880955ae000 0000000100000006 0000000000000000
[   34.375983] page dumped because: kasan: bad access detected
[   34.381676] 
[   34.383284] Memory state around the buggy address:
[   34.388196]  ffff8880955af080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
executing program
[   34.395536]  ffff8880955af100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   34.402886] >ffff8880955af180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   34.410226]                       ^
[   34.413837]  ffff8880955af200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   34.421180]  ffff8880955af280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   34.428532] ==================================================================
[   34.435872] Disabling lock debugging due to kernel taint
[   34.442374] Kernel panic - not syncing: panic_on_warn set ...
[   34.442374] 
[   34.449754] CPU: 0 PID: 8123 Comm: kworker/u5:2 Tainted: G    B             4.19.211-syzkaller #0
[   34.458759] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[   34.468119] Workqueue: hci0 hci_rx_work
[   34.472096] Call Trace:
[   34.474668]  dump_stack+0x1fc/0x2ef
[   34.478273]  panic+0x26a/0x50e
[   34.481447]  ? __warn_printk+0xf3/0xf3
[   34.485313]  ? preempt_schedule_common+0x45/0xc0
[   34.490057]  ? ___preempt_schedule+0x16/0x18
[   34.495792]  ? trace_hardirqs_on+0x55/0x210
[   34.500095]  kasan_end_report+0x43/0x49
[   34.504050]  kasan_report_error.cold+0xa7/0x1b9
[   34.508695]  ? hci_le_meta_evt+0x383e/0x3f20
[   34.513170]  __asan_report_load1_noabort+0x88/0x90
[   34.518099]  ? hci_le_meta_evt+0x383e/0x3f20
[   34.522486]  hci_le_meta_evt+0x383e/0x3f20
[   34.526700]  ? deref_stack_reg+0x134/0x1d0
[   34.530913]  ? hci_cmd_status_evt+0x6fc0/0x6fc0
[   34.535558]  ? __lock_acquire+0x6de/0x3ff0
[   34.539768]  ? __lock_acquire+0x6de/0x3ff0
[   34.543987]  ? __lock_acquire+0x6de/0x3ff0
[   34.548202]  hci_event_packet+0x34ad/0x7e20
[   34.552503]  ? mark_held_locks+0xf0/0xf0
[   34.556542]  ? __lock_acquire+0x6de/0x3ff0
[   34.560756]  ? hci_cmd_complete_evt+0xc280/0xc280
[   34.565577]  ? mark_held_locks+0xf0/0xf0
[   34.569617]  ? debug_object_deactivate+0x1f9/0x2e0
[   34.574527]  ? mark_held_locks+0xa6/0xf0
[   34.578570]  ? _raw_spin_unlock_irqrestore+0x79/0xe0
[   34.583650]  ? lockdep_hardirqs_on+0x3a8/0x5c0
[   34.588213]  hci_rx_work+0x4ad/0xc70
[   34.592032]  process_one_work+0x864/0x1570
[   34.596247]  ? pwq_dec_nr_in_flight+0x2d0/0x2d0
[   34.600900]  worker_thread+0x64c/0x1130
[   34.604854]  ? __kthread_parkme+0x133/0x1e0
[   34.609157]  ? process_one_work+0x1570/0x1570
[   34.613628]  kthread+0x33f/0x460
[   34.616970]  ? kthread_park+0x180/0x180
[   34.620927]  ret_from_fork+0x24/0x30
[   34.624794] Kernel Offset: disabled
[   34.628415] Rebooting in 86400 seconds..