last executing test programs:

kernel console output (not intermixed with test programs):

Warning: Permanently added '10.128.1.86' (ED25519) to the list of known hosts.
[   51.224754][ T5079] cgroup: Unknown subsys name 'net'
[   51.358549][ T5079] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   52.760398][ T5079] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   53.373716][ T5093] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   53.390654][ T5094] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   53.399695][ T5097] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   53.408203][ T5097] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   53.418204][ T5099] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   53.427444][ T5099] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   53.432422][ T5102] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[   53.435114][ T5099] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[   53.447890][ T5103] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   53.451210][ T5099] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   53.458372][ T5103] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   53.464520][ T5104] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[   53.477858][ T5099] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[   53.481025][ T5103] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[   53.486219][ T5099] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   53.493082][ T5105] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   53.499719][ T5104] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[   53.508546][ T5099] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   53.519983][ T5104] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[   53.528196][ T4491] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[   53.538583][ T4491] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3
[   53.546626][ T4491] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[   53.553934][ T5104] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3
[   53.566207][ T5104] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   53.574345][ T5104] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   53.582531][ T5097] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[   53.590080][ T5104] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3
[   53.600574][ T5100] ==================================================================
[   53.601486][   T53] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   53.608653][ T5100] BUG: KASAN: slab-use-after-free in kfree_skb_reason+0x41/0x3b0
[   53.623297][ T5100] Read of size 4 at addr ffff8880675f3c24 by task syz-executor/5100
[   53.630917][   T53] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3
[   53.631272][ T5100] 
[   53.631292][ T5100] CPU: 1 PID: 5100 Comm: syz-executor Not tainted 6.10.0-rc4-syzkaller-g482000cf7fd5 #0
[   53.638819][   T53] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[   53.640495][ T5100] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
[   53.640516][ T5100] Call Trace:
[   53.640524][ T5100]  <TASK>
[   53.640531][ T5100]  dump_stack_lvl+0x241/0x360
[   53.640559][ T5100]  ? __pfx_dump_stack_lvl+0x10/0x10
[   53.683398][ T5100]  ? __pfx__printk+0x10/0x10
[   53.688008][ T5100]  ? _printk+0xd5/0x120
[   53.692188][ T5100]  ? __virt_addr_valid+0x183/0x520
[   53.697324][ T5100]  ? __virt_addr_valid+0x183/0x520
[   53.702458][ T5100]  print_report+0x169/0x550
[   53.706985][ T5100]  ? __virt_addr_valid+0x183/0x520
[   53.712118][ T5100]  ? __virt_addr_valid+0x183/0x520
[   53.717251][ T5100]  ? __virt_addr_valid+0x44e/0x520
[   53.722386][ T5100]  ? __phys_addr+0xba/0x170
[   53.726913][ T5100]  ? kfree_skb_reason+0x41/0x3b0
[   53.731873][ T5100]  kasan_report+0x143/0x180
[   53.736399][ T5100]  ? kfree_skb_reason+0x41/0x3b0
[   53.741360][ T5100]  kasan_check_range+0x282/0x290
[   53.746327][ T5100]  kfree_skb_reason+0x41/0x3b0
[   53.751112][ T5100]  __hci_req_sync+0x62f/0x950
[   53.755837][ T5100]  ? __pfx___hci_req_sync+0x10/0x10
[   53.761068][ T5100]  ? __pfx___mutex_lock+0x10/0x10
[   53.766113][ T5100]  ? __pfx_autoremove_wake_function+0x10/0x10
[   53.772375][ T5100]  ? __pfx_hci_scan_req+0x10/0x10
[   53.777419][ T5100]  hci_req_sync+0xa9/0xd0
[   53.781786][ T5100]  hci_dev_cmd+0x4c5/0xa50
[   53.786218][ T5100]  ? security_capable+0x90/0xb0
[   53.791101][ T5100]  ? __pfx_hci_dev_cmd+0x10/0x10
[   53.796063][ T5100]  ? hci_sock_ioctl+0x6c4/0xa40
[   53.800933][ T5100]  sock_do_ioctl+0x158/0x460
[   53.805558][ T5100]  ? __pfx_sock_do_ioctl+0x10/0x10
[   53.810703][ T5100]  sock_ioctl+0x629/0x8e0
[   53.815078][ T5100]  ? __pfx_sock_ioctl+0x10/0x10
[   53.819953][ T5100]  ? __fget_files+0x29/0x470
[   53.824564][ T5100]  ? __fget_files+0x3f6/0x470
[   53.829257][ T5100]  ? __fget_files+0x29/0x470
[   53.833879][ T5100]  ? bpf_lsm_file_ioctl+0x9/0x10
[   53.838830][ T5100]  ? security_file_ioctl+0x87/0xb0
[   53.843959][ T5100]  ? __pfx_sock_ioctl+0x10/0x10
[   53.848831][ T5100]  __se_sys_ioctl+0xfc/0x170
[   53.853445][ T5100]  do_syscall_64+0xf3/0x230
[   53.857971][ T5100]  ? clear_bhb_loop+0x35/0x90
[   53.862679][ T5100]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   53.868601][ T5100] RIP: 0033:0x7fdf2037593b
[   53.873035][ T5100] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
[   53.892645][ T5100] RSP: 002b:00007ffe711344d0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[   53.901056][ T5100] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fdf2037593b
[   53.909019][ T5100] RDX: 00007ffe71134548 RSI: 00000000400448dd RDI: 0000000000000003
[   53.916992][ T5100] RBP: 00005555875834a8 R08: 0000000000000000 R09: 0000000000000000
[   53.924964][ T5100] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000004
[   53.932961][ T5100] R13: 0000000000000004 R14: 0000000000000009 R15: 0000000000000009
[   53.940931][ T5100]  </TASK>
[   53.943934][ T5100] 
[   53.946241][ T5100] Allocated by task 5104:
[   53.950548][ T5100]  kasan_save_track+0x3f/0x80
[   53.955218][ T5100]  __kasan_slab_alloc+0x66/0x80
[   53.960078][ T5100]  kmem_cache_alloc_noprof+0x135/0x2a0
[   53.965530][ T5100]  skb_clone+0x20c/0x390
[   53.969764][ T5100]  hci_cmd_work+0x29e/0x670
[   53.974264][ T5100]  process_scheduled_works+0xa2c/0x1830
[   53.979796][ T5100]  worker_thread+0x86d/0xd70
[   53.984379][ T5100]  kthread+0x2f0/0x390
[   53.988439][ T5100]  ret_from_fork+0x4b/0x80
[   53.992871][ T5100]  ret_from_fork_asm+0x1a/0x30
[   53.997639][ T5100] 
[   53.999949][ T5100] Freed by task 53:
[   54.003735][ T5100]  kasan_save_track+0x3f/0x80
[   54.008403][ T5100]  kasan_save_free_info+0x40/0x50
[   54.013419][ T5100]  poison_slab_object+0xe0/0x150
[   54.018342][ T5100]  __kasan_slab_free+0x37/0x60
[   54.023101][ T5100]  kmem_cache_free+0x145/0x350
[   54.027853][ T5100]  hci_req_sync_complete+0xe7/0x290
[   54.033044][ T5100]  hci_event_packet+0xc71/0x1540
[   54.037970][ T5100]  hci_rx_work+0x3e8/0xca0
[   54.042385][ T5100]  process_scheduled_works+0xa2c/0x1830
[   54.048004][ T5100]  worker_thread+0x86d/0xd70
[   54.052593][ T5100]  kthread+0x2f0/0x390
[   54.056663][ T5100]  ret_from_fork+0x4b/0x80
[   54.061066][ T5100]  ret_from_fork_asm+0x1a/0x30
[   54.065826][ T5100] 
[   54.068133][ T5100] The buggy address belongs to the object at ffff8880675f3b40
[   54.068133][ T5100]  which belongs to the cache skbuff_head_cache of size 240
[   54.082697][ T5100] The buggy address is located 228 bytes inside of
[   54.082697][ T5100]  freed 240-byte region [ffff8880675f3b40, ffff8880675f3c30)
[   54.096481][ T5100] 
[   54.098792][ T5100] The buggy address belongs to the physical page:
[   54.105194][ T5100] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x675f3
[   54.113942][ T5100] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[   54.121043][ T5100] page_type: 0xffffefff(slab)
[   54.125722][ T5100] raw: 00fff00000000000 ffff888018add780 dead000000000122 0000000000000000
[   54.134304][ T5100] raw: 0000000000000000 00000000000c000c 00000001ffffefff 0000000000000000
[   54.142869][ T5100] page dumped because: kasan: bad access detected
[   54.149272][ T5100] page_owner tracks the page as allocated
[   54.154971][ T5100] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5097, tgid 5097 (kworker/u9:4), ts 53598355773, free_ts 15953517520
[   54.174335][ T5100]  post_alloc_hook+0x1f3/0x230
[   54.179095][ T5100]  get_page_from_freelist+0x2e43/0x2f00
[   54.184634][ T5100]  __alloc_pages_noprof+0x256/0x6c0
[   54.189858][ T5100]  alloc_slab_page+0x5f/0x120
[   54.194582][ T5100]  allocate_slab+0x5a/0x2f0
[   54.199161][ T5100]  ___slab_alloc+0xcd1/0x14b0
[   54.203821][ T5100]  __slab_alloc+0x58/0xa0
[   54.208137][ T5100]  kmem_cache_alloc_noprof+0x1c1/0x2a0
[   54.213586][ T5100]  skb_clone+0x20c/0x390
[   54.217817][ T5100]  hci_cmd_work+0x29e/0x670
[   54.222309][ T5100]  process_scheduled_works+0xa2c/0x1830
[   54.227840][ T5100]  worker_thread+0x86d/0xd70
[   54.232415][ T5100]  kthread+0x2f0/0x390
[   54.236558][ T5100]  ret_from_fork+0x4b/0x80
[   54.241135][ T5100]  ret_from_fork_asm+0x1a/0x30
[   54.245892][ T5100] page last free pid 1 tgid 1 stack trace:
[   54.251696][ T5100]  free_unref_page+0xd22/0xea0
[   54.256474][ T5100]  free_contig_range+0x9e/0x160
[   54.261328][ T5100]  destroy_args+0x8a/0x890
[   54.265838][ T5100]  debug_vm_pgtable+0x4be/0x550
[   54.270731][ T5100]  do_one_initcall+0x248/0x880
[   54.275500][ T5100]  do_initcall_level+0x157/0x210
[   54.280433][ T5100]  do_initcalls+0x3f/0x80
[   54.284748][ T5100]  kernel_init_freeable+0x435/0x5d0
[   54.289935][ T5100]  kernel_init+0x1d/0x2b0
[   54.294338][ T5100]  ret_from_fork+0x4b/0x80
[   54.298745][ T5100]  ret_from_fork_asm+0x1a/0x30
[   54.303499][ T5100] 
[   54.305806][ T5100] Memory state around the buggy address:
[   54.311439][ T5100]  ffff8880675f3b00: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[   54.319479][ T5100]  ffff8880675f3b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   54.327525][ T5100] >ffff8880675f3c00: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[   54.335843][ T5100]                                ^
[   54.340936][ T5100]  ffff8880675f3c80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   54.348975][ T5100]  ffff8880675f3d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[   54.357023][ T5100] ==================================================================
[   54.371801][ T5100] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   54.379033][ T5100] CPU: 1 PID: 5100 Comm: syz-executor Not tainted 6.10.0-rc4-syzkaller-g482000cf7fd5 #0
[   54.388756][ T5100] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
[   54.398912][ T5100] Call Trace:
[   54.402208][ T5100]  <TASK>
[   54.405156][ T5100]  dump_stack_lvl+0x241/0x360
[   54.409857][ T5100]  ? __pfx_dump_stack_lvl+0x10/0x10
[   54.415056][ T5100]  ? __pfx__printk+0x10/0x10
[   54.419638][ T5100]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[   54.425700][ T5100]  ? vscnprintf+0x5d/0x90
[   54.430020][ T5100]  panic+0x349/0x860
[   54.433912][ T5100]  ? check_panic_on_warn+0x21/0xb0
[   54.439019][ T5100]  ? __pfx_panic+0x10/0x10
[   54.443429][ T5100]  ? _raw_spin_unlock_irqrestore+0x130/0x140
[   54.449455][ T5100]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   54.455800][ T5100]  check_panic_on_warn+0x86/0xb0
[   54.460745][ T5100]  ? kfree_skb_reason+0x41/0x3b0
[   54.465770][ T5100]  end_report+0x77/0x160
[   54.470011][ T5100]  kasan_report+0x154/0x180
[   54.474522][ T5100]  ? kfree_skb_reason+0x41/0x3b0
[   54.479457][ T5100]  kasan_check_range+0x282/0x290
[   54.484388][ T5100]  kfree_skb_reason+0x41/0x3b0
[   54.489142][ T5100]  __hci_req_sync+0x62f/0x950
[   54.493817][ T5100]  ? __pfx___hci_req_sync+0x10/0x10
[   54.499104][ T5100]  ? __pfx___mutex_lock+0x10/0x10
[   54.504122][ T5100]  ? __pfx_autoremove_wake_function+0x10/0x10
[   54.510180][ T5100]  ? __pfx_hci_scan_req+0x10/0x10
[   54.515194][ T5100]  hci_req_sync+0xa9/0xd0
[   54.519520][ T5100]  hci_dev_cmd+0x4c5/0xa50
[   54.523926][ T5100]  ? security_capable+0x90/0xb0
[   54.528774][ T5100]  ? __pfx_hci_dev_cmd+0x10/0x10
[   54.533708][ T5100]  ? hci_sock_ioctl+0x6c4/0xa40
[   54.538548][ T5100]  sock_do_ioctl+0x158/0x460
[   54.543146][ T5100]  ? __pfx_sock_do_ioctl+0x10/0x10
[   54.548256][ T5100]  sock_ioctl+0x629/0x8e0
[   54.552579][ T5100]  ? __pfx_sock_ioctl+0x10/0x10
[   54.557420][ T5100]  ? __fget_files+0x29/0x470
[   54.562015][ T5100]  ? __fget_files+0x3f6/0x470
[   54.566730][ T5100]  ? __fget_files+0x29/0x470
[   54.571313][ T5100]  ? bpf_lsm_file_ioctl+0x9/0x10
[   54.576329][ T5100]  ? security_file_ioctl+0x87/0xb0
[   54.581431][ T5100]  ? __pfx_sock_ioctl+0x10/0x10
[   54.586275][ T5100]  __se_sys_ioctl+0xfc/0x170
[   54.590861][ T5100]  do_syscall_64+0xf3/0x230
[   54.595385][ T5100]  ? clear_bhb_loop+0x35/0x90
[   54.600057][ T5100]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   54.605944][ T5100] RIP: 0033:0x7fdf2037593b
[   54.610351][ T5100] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
[   54.629949][ T5100] RSP: 002b:00007ffe711344d0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[   54.638360][ T5100] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fdf2037593b
[   54.646322][ T5100] RDX: 00007ffe71134548 RSI: 00000000400448dd RDI: 0000000000000003
[   54.654281][ T5100] RBP: 00005555875834a8 R08: 0000000000000000 R09: 0000000000000000
[   54.662240][ T5100] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000004
[   54.670199][ T5100] R13: 0000000000000004 R14: 0000000000000009 R15: 0000000000000009
[   54.678162][ T5100]  </TASK>
[   54.681386][ T5100] Kernel Offset: disabled
[   54.685785][ T5100] Rebooting in 86400 seconds..