Warning: Permanently added '10.128.0.239' (ED25519) to the list of known hosts.
2024/06/07 19:58:46 ignoring optional flag "sandboxArg"="0"
2024/06/07 19:58:46 parsed 1 programs
[  693.875806][ T5138] cgroup: Unknown subsys name 'net'
[  694.235995][ T5138] cgroup: Unknown subsys name 'rlimit'
[  695.629676][ T5158] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[  695.929470][   T53] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  695.938147][   T53] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  695.945743][   T53] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  695.955766][   T53] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  695.963917][   T53] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[  695.974033][   T53] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  695.987037][ T5176] ==================================================================
[  695.995135][ T5176] BUG: KASAN: slab-use-after-free in kfree_skb_reason+0x41/0x3b0
[  696.002919][ T5176] Read of size 4 at addr ffff888019fc8d64 by task syz-executor.0/5176
[  696.011077][ T5176] 
[  696.013399][ T5176] CPU: 0 PID: 5176 Comm: syz-executor.0 Not tainted 6.10.0-rc2-syzkaller-00228-gc44711b78608 #0
[  696.023802][ T5176] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
[  696.033863][ T5176] Call Trace:
[  696.037142][ T5176]  <TASK>
[  696.040096][ T5176]  dump_stack_lvl+0x241/0x360
[  696.044777][ T5176]  ? __pfx_dump_stack_lvl+0x10/0x10
[  696.049984][ T5176]  ? __pfx__printk+0x10/0x10
[  696.054584][ T5176]  ? _printk+0xd5/0x120
[  696.058736][ T5176]  ? __virt_addr_valid+0x183/0x520
[  696.063858][ T5176]  ? __virt_addr_valid+0x183/0x520
[  696.068969][ T5176]  print_report+0x169/0x550
[  696.073484][ T5176]  ? __virt_addr_valid+0x183/0x520
[  696.078595][ T5176]  ? __virt_addr_valid+0x183/0x520
[  696.083706][ T5176]  ? __virt_addr_valid+0x44e/0x520
[  696.088816][ T5176]  ? __phys_addr+0xba/0x170
[  696.093318][ T5176]  ? kfree_skb_reason+0x41/0x3b0
[  696.098343][ T5176]  kasan_report+0x143/0x180
[  696.102862][ T5176]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  696.109362][ T5176]  ? kfree_skb_reason+0x41/0x3b0
[  696.114301][ T5176]  kasan_check_range+0x282/0x290
[  696.119259][ T5176]  kfree_skb_reason+0x41/0x3b0
[  696.124036][ T5176]  __hci_req_sync+0x62f/0x950
[  696.128717][ T5176]  ? __pfx___hci_req_sync+0x10/0x10
[  696.133939][ T5176]  ? __pfx___mutex_lock+0x10/0x10
[  696.138963][ T5176]  ? __pfx_hci_scan_req+0x10/0x10
[  696.144006][ T5176]  hci_req_sync+0xa9/0xd0
[  696.148362][ T5176]  hci_dev_cmd+0x4c5/0xa50
[  696.152783][ T5176]  ? security_capable+0x90/0xb0
[  696.157666][ T5176]  ? __pfx_hci_dev_cmd+0x10/0x10
[  696.162616][ T5176]  ? hci_sock_ioctl+0x6c4/0xa40
[  696.167472][ T5176]  sock_do_ioctl+0x158/0x460
[  696.172072][ T5176]  ? __pfx_sock_do_ioctl+0x10/0x10
[  696.177218][ T5176]  sock_ioctl+0x629/0x8e0
[  696.181563][ T5176]  ? __pfx_sock_ioctl+0x10/0x10
[  696.186421][ T5176]  ? __fget_files+0x29/0x470
[  696.191009][ T5176]  ? __fget_files+0x3f6/0x470
[  696.195683][ T5176]  ? __fget_files+0x29/0x470
[  696.200276][ T5176]  ? bpf_lsm_file_ioctl+0x9/0x10
[  696.205216][ T5176]  ? security_file_ioctl+0x87/0xb0
[  696.210337][ T5176]  ? __pfx_sock_ioctl+0x10/0x10
[  696.215186][ T5176]  __se_sys_ioctl+0xfc/0x170
[  696.219774][ T5176]  do_syscall_64+0xf3/0x230
[  696.224268][ T5176]  ? clear_bhb_loop+0x35/0x90
[  696.228948][ T5176]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  696.234872][ T5176] RIP: 0033:0x7fec7187cccb
[  696.239302][ T5176] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
[  696.258924][ T5176] RSP: 002b:00007ffe37025c10 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  696.267355][ T5176] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fec7187cccb
[  696.275333][ T5176] RDX: 00007ffe37025c88 RSI: 00000000400448dd RDI: 0000000000000003
[  696.283395][ T5176] RBP: 0000555571496430 R08: 0000000000000000 R09: 0000000000000000
[  696.291378][ T5176] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000000
[  696.299343][ T5176] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000001
[  696.307334][ T5176]  </TASK>
[  696.310343][ T5176] 
[  696.312655][ T5176] Allocated by task 4492:
[  696.317085][ T5176]  kasan_save_track+0x3f/0x80
[  696.321761][ T5176]  __kasan_slab_alloc+0x66/0x80
[  696.326694][ T5176]  kmem_cache_alloc_noprof+0x135/0x2a0
[  696.332164][ T5176]  skb_clone+0x20c/0x390
[  696.336405][ T5176]  hci_cmd_work+0x29e/0x670
[  696.340901][ T5176]  process_scheduled_works+0xa2c/0x1830
[  696.346440][ T5176]  worker_thread+0x86d/0xd70
[  696.351036][ T5176]  kthread+0x2f0/0x390
[  696.355188][ T5176]  ret_from_fork+0x4b/0x80
[  696.359614][ T5176]  ret_from_fork_asm+0x1a/0x30
[  696.364484][ T5176] 
[  696.366825][ T5176] Freed by task 4492:
[  696.370846][ T5176]  kasan_save_track+0x3f/0x80
[  696.375527][ T5176]  kasan_save_free_info+0x40/0x50
[  696.380543][ T5176]  poison_slab_object+0xe0/0x150
[  696.385478][ T5176]  __kasan_slab_free+0x37/0x60
[  696.390254][ T5176]  kmem_cache_free+0x145/0x350
[  696.395018][ T5176]  hci_req_sync_complete+0xe7/0x290
[  696.400211][ T5176]  hci_event_packet+0xc71/0x1540
[  696.405140][ T5176]  hci_rx_work+0x3e8/0xca0
[  696.409553][ T5176]  process_scheduled_works+0xa2c/0x1830
[  696.415087][ T5176]  worker_thread+0x86d/0xd70
[  696.419670][ T5176]  kthread+0x2f0/0x390
[  696.423742][ T5176]  ret_from_fork+0x4b/0x80
[  696.428155][ T5176]  ret_from_fork_asm+0x1a/0x30
[  696.432917][ T5176] 
[  696.435240][ T5176] The buggy address belongs to the object at ffff888019fc8c80
[  696.435240][ T5176]  which belongs to the cache skbuff_head_cache of size 240
[  696.449808][ T5176] The buggy address is located 228 bytes inside of
[  696.449808][ T5176]  freed 240-byte region [ffff888019fc8c80, ffff888019fc8d70)
[  696.463600][ T5176] 
[  696.465916][ T5176] The buggy address belongs to the physical page:
[  696.472326][ T5176] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x19fc8
[  696.481085][ T5176] anon flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[  696.488637][ T5176] page_type: 0xffffefff(slab)
[  696.493332][ T5176] raw: 00fff00000000000 ffff888018ad8780 ffffea00006da240 dead000000000005
[  696.501936][ T5176] raw: 0000000000000000 00000000000c000c 00000001ffffefff 0000000000000000
[  696.510519][ T5176] page dumped because: kasan: bad access detected
[  696.516931][ T5176] page_owner tracks the page as allocated
[  696.522654][ T5176] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 4548, tgid 4548 (udevd), ts 31380921066, free_ts 31366039393
[  696.541316][ T5176]  post_alloc_hook+0x1f3/0x230
[  696.546081][ T5176]  get_page_from_freelist+0x2e2d/0x2ee0
[  696.551627][ T5176]  __alloc_pages_noprof+0x256/0x6c0
[  696.556828][ T5176]  alloc_slab_page+0x5f/0x120
[  696.561588][ T5176]  allocate_slab+0x5a/0x2e0
[  696.566086][ T5176]  ___slab_alloc+0xcd1/0x14b0
[  696.570754][ T5176]  __slab_alloc+0x58/0xa0
[  696.575072][ T5176]  kmem_cache_alloc_node_noprof+0x1fe/0x320
[  696.580965][ T5176]  __alloc_skb+0x1c3/0x440
[  696.585378][ T5176]  netlink_sendmsg+0x631/0xcb0
[  696.590137][ T5176]  __sock_sendmsg+0x221/0x270
[  696.594811][ T5176]  ____sys_sendmsg+0x525/0x7d0
[  696.599565][ T5176]  __sys_sendmsg+0x2b0/0x3a0
[  696.604144][ T5176]  do_syscall_64+0xf3/0x230
[  696.608643][ T5176]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  696.614530][ T5176] page last free pid 4549 tgid 4549 stack trace:
[  696.620842][ T5176]  free_unref_page+0xd22/0xea0
[  696.625620][ T5176]  __put_partials+0xeb/0x130
[  696.630201][ T5176]  put_cpu_partial+0x17c/0x250
[  696.634960][ T5176]  __slab_free+0x2ea/0x3d0
[  696.639369][ T5176]  qlist_free_all+0x9e/0x140
[  696.643951][ T5176]  kasan_quarantine_reduce+0x14f/0x170
[  696.649414][ T5176]  __kasan_slab_alloc+0x23/0x80
[  696.654271][ T5176]  kmem_cache_alloc_node_noprof+0x16b/0x320
[  696.660162][ T5176]  kmalloc_reserve+0xa8/0x2a0
[  696.664837][ T5176]  __alloc_skb+0x1f3/0x440
[  696.669255][ T5176]  alloc_uevent_skb+0x74/0x230
[  696.674019][ T5176]  kobject_uevent_net_broadcast+0x2fd/0x580
[  696.679908][ T5176]  kobject_uevent_env+0x57d/0x8e0
[  696.684934][ T5176]  kobject_synth_uevent+0x4ef/0xae0
[  696.690128][ T5176]  uevent_store+0x4b/0x70
[  696.694466][ T5176]  kernfs_fop_write_iter+0x3a1/0x500
[  696.699859][ T5176] 
[  696.702206][ T5176] Memory state around the buggy address:
[  696.707835][ T5176]  ffff888019fc8c00: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[  696.715894][ T5176]  ffff888019fc8c80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  696.723954][ T5176] >ffff888019fc8d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[  696.732007][ T5176]                                                        ^
[  696.739191][ T5176]  ffff888019fc8d80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[  696.747242][ T5176]  ffff888019fc8e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  696.755295][ T5176] ==================================================================
[  696.776790][ T5176] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  696.784036][ T5176] CPU: 0 PID: 5176 Comm: syz-executor.0 Not tainted 6.10.0-rc2-syzkaller-00228-gc44711b78608 #0
[  696.794469][ T5176] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
[  696.804534][ T5176] Call Trace:
[  696.807900][ T5176]  <TASK>
[  696.810824][ T5176]  dump_stack_lvl+0x241/0x360
[  696.815514][ T5176]  ? __pfx_dump_stack_lvl+0x10/0x10
[  696.820709][ T5176]  ? __pfx__printk+0x10/0x10
[  696.825314][ T5176]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[  696.831296][ T5176]  ? vscnprintf+0x5d/0x90
[  696.835624][ T5176]  panic+0x349/0x860
[  696.839605][ T5176]  ? check_panic_on_warn+0x21/0xb0
[  696.844717][ T5176]  ? __pfx_panic+0x10/0x10
[  696.849145][ T5176]  ? _raw_spin_unlock_irqrestore+0x130/0x140
[  696.855127][ T5176]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  696.861472][ T5176]  check_panic_on_warn+0x86/0xb0
[  696.866462][ T5176]  ? kfree_skb_reason+0x41/0x3b0
[  696.871413][ T5176]  end_report+0x77/0x160
[  696.875665][ T5176]  kasan_report+0x154/0x180
[  696.880183][ T5176]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  696.886527][ T5176]  ? kfree_skb_reason+0x41/0x3b0
[  696.891567][ T5176]  kasan_check_range+0x282/0x290
[  696.896520][ T5176]  kfree_skb_reason+0x41/0x3b0
[  696.901291][ T5176]  __hci_req_sync+0x62f/0x950
[  696.905973][ T5176]  ? __pfx___hci_req_sync+0x10/0x10
[  696.911180][ T5176]  ? __pfx___mutex_lock+0x10/0x10
[  696.916214][ T5176]  ? __pfx_hci_scan_req+0x10/0x10
[  696.921241][ T5176]  hci_req_sync+0xa9/0xd0
[  696.925580][ T5176]  hci_dev_cmd+0x4c5/0xa50
[  696.930089][ T5176]  ? security_capable+0x90/0xb0
[  696.934937][ T5176]  ? __pfx_hci_dev_cmd+0x10/0x10
[  696.939878][ T5176]  ? hci_sock_ioctl+0x6c4/0xa40
[  696.944743][ T5176]  sock_do_ioctl+0x158/0x460
[  696.949348][ T5176]  ? __pfx_sock_do_ioctl+0x10/0x10
[  696.954471][ T5176]  sock_ioctl+0x629/0x8e0
[  696.958804][ T5176]  ? __pfx_sock_ioctl+0x10/0x10
[  696.963660][ T5176]  ? __fget_files+0x29/0x470
[  696.968263][ T5176]  ? __fget_files+0x3f6/0x470
[  696.972941][ T5176]  ? __fget_files+0x29/0x470
[  696.977532][ T5176]  ? bpf_lsm_file_ioctl+0x9/0x10
[  696.982463][ T5176]  ? security_file_ioctl+0x87/0xb0
[  696.987569][ T5176]  ? __pfx_sock_ioctl+0x10/0x10
[  696.992510][ T5176]  __se_sys_ioctl+0xfc/0x170
[  696.997099][ T5176]  do_syscall_64+0xf3/0x230
[  697.001626][ T5176]  ? clear_bhb_loop+0x35/0x90
[  697.006300][ T5176]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  697.012191][ T5176] RIP: 0033:0x7fec7187cccb
[  697.016601][ T5176] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
[  697.036202][ T5176] RSP: 002b:00007ffe37025c10 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  697.044616][ T5176] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fec7187cccb
[  697.052582][ T5176] RDX: 00007ffe37025c88 RSI: 00000000400448dd RDI: 0000000000000003
[  697.060548][ T5176] RBP: 0000555571496430 R08: 0000000000000000 R09: 0000000000000000
[  697.068528][ T5176] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000000
[  697.076498][ T5176] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000001
[  697.084478][ T5176]  </TASK>
[  697.087825][ T5176] Kernel Offset: disabled
[  697.092170][ T5176] Rebooting in 86400 seconds..