Warning: Permanently added '10.128.0.255' (ED25519) to the list of known hosts.
[   77.658506][ T5061] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   77.670622][ T5061] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   77.678831][ T5061] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   77.686925][ T5061] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   77.694814][ T5061] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[   77.702155][ T5061] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
[   79.792187][ T4457] Bluetooth: hci0: command 0x0409 tx timeout
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
[   81.871486][ T5061] Bluetooth: hci0: command 0x041b tx timeout
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
[   83.951465][ T4457] Bluetooth: hci0: command 0x040f tx timeout
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
[   86.031458][ T5061] Bluetooth: hci0: command 0x0419 tx timeout
executing program
executing program
executing program
executing program
executing program
executing program
executing program
[   87.073744][   T55] cfg80211: failed to load regulatory.db
executing program
executing program
executing program
executing program
executing program
executing program
[   88.111474][ T5061] Bluetooth: hci0: command 0x0405 tx timeout
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
[   90.191493][ T5061] Bluetooth: hci0: command 0x0405 tx timeout
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
[  118.432106][  T782] ==================================================================
[  118.440237][  T782] BUG: KASAN: slab-use-after-free in sco_sock_timeout+0x67/0x240
[  118.448042][  T782] Write of size 4 at addr ffff8880757a8080 by task kworker/0:2/782
[  118.455939][  T782] 
[  118.458277][  T782] CPU: 0 PID: 782 Comm: kworker/0:2 Not tainted 6.7.0-rc7-syzkaller-00003-gfbafc3e621c3 #0
[  118.468379][  T782] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
[  118.478622][  T782] Workqueue: events sco_sock_timeout
[  118.484026][  T782] Call Trace:
[  118.487326][  T782]  <TASK>
[  118.490269][  T782]  dump_stack_lvl+0x1e7/0x2d0
[  118.494990][  T782]  ? nf_tcp_handle_invalid+0x650/0x650
[  118.500475][  T782]  ? panic+0x850/0x850
[  118.504551][  T782]  ? _printk+0xd5/0x120
[  118.508743][  T782]  print_report+0x163/0x540
[  118.513256][  T782]  ? __virt_addr_valid+0x22f/0x2e0
[  118.518676][  T782]  ? __phys_addr+0xba/0x170
[  118.523205][  T782]  ? sco_sock_timeout+0x67/0x240
[  118.528163][  T782]  kasan_report+0x142/0x170
[  118.532689][  T782]  ? read_lock_is_recursive+0x20/0x20
[  118.538102][  T782]  ? sco_sock_timeout+0x67/0x240
[  118.543061][  T782]  kasan_check_range+0x27e/0x290
[  118.548023][  T782]  sco_sock_timeout+0x67/0x240
[  118.552800][  T782]  ? process_scheduled_works+0x825/0x1420
[  118.558533][  T782]  process_scheduled_works+0x90f/0x1420
[  118.564098][  T782]  ? assign_work+0x3d0/0x3d0
[  118.568697][  T782]  ? assign_work+0x364/0x3d0
[  118.573306][  T782]  worker_thread+0xa5f/0x1000
[  118.577996][  T782]  ? _raw_spin_unlock_irqrestore+0xdd/0x140
[  118.583900][  T782]  kthread+0x2d3/0x370
[  118.587977][  T782]  ? pr_cont_work+0x5e0/0x5e0
[  118.592662][  T782]  ? kthread_blkcg+0xd0/0xd0
[  118.597257][  T782]  ret_from_fork+0x48/0x80
[  118.601692][  T782]  ? kthread_blkcg+0xd0/0xd0
[  118.606295][  T782]  ret_from_fork_asm+0x11/0x20
[  118.611081][  T782]  </TASK>
[  118.614103][  T782] 
[  118.616424][  T782] Allocated by task 5073:
[  118.620751][  T782]  kasan_set_track+0x4f/0x70
[  118.625351][  T782]  __kasan_kmalloc+0x98/0xb0
[  118.629945][  T782]  __kmalloc+0xb3/0x1a0
[  118.634105][  T782]  sk_prot_alloc+0xe0/0x210
[  118.638614][  T782]  sk_alloc+0x38/0x370
[  118.642690][  T782]  bt_sock_alloc+0x3c/0x330
[  118.647202][  T782]  sco_sock_create+0xbb/0x380
[  118.651889][  T782]  bt_sock_create+0x15d/0x230
[  118.656575][  T782]  __sock_create+0x48c/0x910
[  118.661176][  T782]  __sys_socket+0x14f/0x3b0
[  118.665689][  T782]  __x64_sys_socket+0x7a/0x90
[  118.670378][  T782]  do_syscall_64+0x45/0x110
[  118.674890][  T782]  entry_SYSCALL_64_after_hwframe+0x63/0x6b
[  118.680795][  T782] 
[  118.683126][  T782] Freed by task 5074:
[  118.687104][  T782]  kasan_set_track+0x4f/0x70
[  118.691700][  T782]  kasan_save_free_info+0x28/0x40
[  118.696735][  T782]  ____kasan_slab_free+0xd6/0x120
[  118.701765][  T782]  __kmem_cache_free+0x263/0x3a0
[  118.706711][  T782]  __sk_destruct+0x479/0x5f0
[  118.711578][  T782]  sco_sock_release+0x25d/0x320
[  118.716441][  T782]  sock_close+0xb8/0x230
[  118.720685][  T782]  __fput+0x3cc/0x9e0
[  118.724670][  T782]  task_work_run+0x24a/0x300
[  118.729300][  T782]  get_signal+0x166e/0x1840
[  118.733815][  T782]  arch_do_signal_or_restart+0x96/0x860
[  118.739374][  T782]  exit_to_user_mode_loop+0x6a/0x100
[  118.744669][  T782]  exit_to_user_mode_prepare+0xb1/0x150
[  118.750225][  T782]  syscall_exit_to_user_mode+0x69/0x2a0
[  118.755788][  T782]  do_syscall_64+0x52/0x110
[  118.760301][  T782]  entry_SYSCALL_64_after_hwframe+0x63/0x6b
[  118.766207][  T782] 
[  118.768532][  T782] The buggy address belongs to the object at ffff8880757a8000
[  118.768532][  T782]  which belongs to the cache kmalloc-2k of size 2048
[  118.782590][  T782] The buggy address is located 128 bytes inside of
[  118.782590][  T782]  freed 2048-byte region [ffff8880757a8000, ffff8880757a8800)
[  118.796494][  T782] 
[  118.798827][  T782] The buggy address belongs to the physical page:
[  118.805329][  T782] page:ffffea0001d5ea00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x757a8
[  118.815688][  T782] head:ffffea0001d5ea00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  118.824731][  T782] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[  118.832732][  T782] page_type: 0xffffffff()
[  118.837155][  T782] raw: 00fff00000000840 ffff888012c42000 dead000000000122 0000000000000000
[  118.845741][  T782] raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000
[  118.854322][  T782] page dumped because: kasan: bad access detected
[  118.860730][  T782] page_owner tracks the page as allocated
[  118.866787][  T782] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5073, tgid 5072 (syz-executor401), ts 78091738532, free_ts 25320043675
[  118.886411][  T782]  post_alloc_hook+0x1e6/0x210
[  118.891359][  T782]  get_page_from_freelist+0x33ea/0x3570
[  118.896921][  T782]  __alloc_pages+0x255/0x680
[  118.901513][  T782]  alloc_pages_mpol+0x3de/0x640
[  118.906375][  T782]  alloc_slab_page+0x6a/0x170
[  118.911137][  T782]  new_slab+0x84/0x2f0
[  118.915217][  T782]  ___slab_alloc+0xc8a/0x1330
[  118.919904][  T782]  __kmem_cache_alloc_node+0x21d/0x300
[  118.925394][  T782]  __kmalloc+0xa2/0x1a0
[  118.929553][  T782]  sk_prot_alloc+0xe0/0x210
[  118.934059][  T782]  sk_alloc+0x38/0x370
[  118.938130][  T782]  bt_sock_alloc+0x3c/0x330
[  118.942648][  T782]  sco_sock_create+0xbb/0x380
[  118.947335][  T782]  bt_sock_create+0x15d/0x230
[  118.952020][  T782]  __sock_create+0x48c/0x910
[  118.956620][  T782]  __sys_socket+0x14f/0x3b0
[  118.961131][  T782] page last free stack trace:
[  118.965891][  T782]  free_unref_page_prepare+0x931/0xa60
[  118.971378][  T782]  free_unref_page+0x37/0x3f0
[  118.976059][  T782]  free_contig_range+0x9e/0x160
[  118.980913][  T782]  destroy_args+0x8a/0x890
[  118.985394][  T782]  debug_vm_pgtable+0x4ba/0x540
[  118.990269][  T782]  do_one_initcall+0x234/0x810
[  118.995084][  T782]  do_initcall_level+0x157/0x210
[  119.000055][  T782]  do_initcalls+0x3f/0x80
[  119.004416][  T782]  kernel_init_freeable+0x429/0x5c0
[  119.009750][  T782]  kernel_init+0x1d/0x2a0
[  119.014112][  T782]  ret_from_fork+0x48/0x80
[  119.018541][  T782]  ret_from_fork_asm+0x11/0x20
[  119.023328][  T782] 
[  119.025651][  T782] Memory state around the buggy address:
[  119.031280][  T782]  ffff8880757a7f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  119.039346][  T782]  ffff8880757a8000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  119.047407][  T782] >ffff8880757a8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  119.055467][  T782]                    ^
[  119.059558][  T782]  ffff8880757a8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  119.067639][  T782]  ffff8880757a8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  119.075699][  T782] ==================================================================
[  119.084109][  T782] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  119.091321][  T782] CPU: 0 PID: 782 Comm: kworker/0:2 Not tainted 6.7.0-rc7-syzkaller-00003-gfbafc3e621c3 #0
[  119.101343][  T782] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
[  119.111750][  T782] Workqueue: events sco_sock_timeout
[  119.117087][  T782] Call Trace:
[  119.120409][  T782]  <TASK>
[  119.123392][  T782]  dump_stack_lvl+0x1e7/0x2d0
[  119.128137][  T782]  ? nf_tcp_handle_invalid+0x650/0x650
[  119.133654][  T782]  ? panic+0x850/0x850
[  119.137858][  T782]  ? lockdep_hardirqs_on_prepare+0x43c/0x780
[  119.143894][  T782]  ? vscnprintf+0x5d/0x80
[  119.148284][  T782]  panic+0x349/0x850
[  119.152210][  T782]  ? check_panic_on_warn+0x21/0xa0
[  119.157369][  T782]  ? __memcpy_flushcache+0x2b0/0x2b0
[  119.162680][  T782]  ? _raw_spin_unlock_irqrestore+0xd8/0x140
[  119.168616][  T782]  ? _raw_spin_unlock_irqrestore+0xdd/0x140
[  119.174517][  T782]  ? _raw_spin_unlock+0x40/0x40
[  119.179466][  T782]  check_panic_on_warn+0x82/0xa0
[  119.184423][  T782]  ? sco_sock_timeout+0x67/0x240
[  119.189369][  T782]  end_report+0x6e/0x140
[  119.193627][  T782]  kasan_report+0x153/0x170
[  119.198140][  T782]  ? read_lock_is_recursive+0x20/0x20
[  119.203522][  T782]  ? sco_sock_timeout+0x67/0x240
[  119.208530][  T782]  kasan_check_range+0x27e/0x290
[  119.213485][  T782]  sco_sock_timeout+0x67/0x240
[  119.218270][  T782]  ? process_scheduled_works+0x825/0x1420
[  119.224120][  T782]  process_scheduled_works+0x90f/0x1420
[  119.229688][  T782]  ? assign_work+0x3d0/0x3d0
[  119.234293][  T782]  ? assign_work+0x364/0x3d0
[  119.239524][  T782]  worker_thread+0xa5f/0x1000
[  119.244309][  T782]  ? _raw_spin_unlock_irqrestore+0xdd/0x140
[  119.250230][  T782]  kthread+0x2d3/0x370
[  119.254329][  T782]  ? pr_cont_work+0x5e0/0x5e0
[  119.259017][  T782]  ? kthread_blkcg+0xd0/0xd0
[  119.263614][  T782]  ret_from_fork+0x48/0x80
[  119.268039][  T782]  ? kthread_blkcg+0xd0/0xd0
[  119.272646][  T782]  ret_from_fork_asm+0x11/0x20
[  119.277808][  T782]  </TASK>
[  119.281122][  T782] Kernel Offset: disabled
[  119.285456][  T782] Rebooting in 86400 seconds..