Warning: Permanently added '10.128.0.254' (ED25519) to the list of known hosts.
[   57.713205][ T5860] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   57.721349][ T5863] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   57.730209][ T5863] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[   57.740076][ T5864] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   57.750462][ T5864] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[   57.759472][ T5866] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   57.759536][ T5868] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   57.767114][ T5866] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   57.773605][ T5864] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[   57.782152][ T5866] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[   57.790031][ T5868] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   57.795434][ T5863] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   57.802253][ T5868] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   57.809737][ T5863] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   57.816018][ T5868] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3
[   57.823027][ T5866] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   57.832855][ T5868] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   57.837072][ T5863] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3
[   57.851486][ T5863] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   57.866294][ T5863] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[   57.873791][ T5863] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[   57.882647][ T5854] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   57.890237][ T5854] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[   57.898187][ T5866] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[   57.898547][ T5854] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3
[   57.915933][ T5863] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[   57.923146][ T5854] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[   57.930693][ T5863] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3
[   57.938027][ T5866] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   57.950198][ T5854] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
[   58.200855][ T5894] Bluetooth: MGMT ver 1.23
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
[   59.055615][ T5853] ==================================================================
[   59.063730][ T5853] BUG: KASAN: slab-use-after-free in __list_del_entry_valid_or_report+0x2f/0x140
[   59.072875][ T5853] Read of size 8 at addr ffff8881436c1888 by task kworker/u9:2/5853
[   59.080848][ T5853] 
[   59.083183][ T5853] CPU: 1 UID: 0 PID: 5853 Comm: kworker/u9:2 Not tainted 6.12.0-syzkaller-05517-g5dfd7d940094 #0
[   59.093675][ T5853] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[   59.103726][ T5853] Workqueue: hci0 hci_cmd_sync_work
[   59.108952][ T5853] Call Trace:
[   59.112224][ T5853]  <TASK>
[   59.115148][ T5853]  dump_stack_lvl+0x241/0x360
[   59.119822][ T5853]  ? __pfx_dump_stack_lvl+0x10/0x10
[   59.125012][ T5853]  ? __pfx__printk+0x10/0x10
[   59.129597][ T5853]  ? _printk+0xd5/0x120
[   59.133743][ T5853]  ? __virt_addr_valid+0x183/0x530
[   59.138846][ T5853]  ? __virt_addr_valid+0x183/0x530
[   59.143947][ T5853]  print_report+0x169/0x550
[   59.148440][ T5853]  ? __virt_addr_valid+0x183/0x530
[   59.153542][ T5853]  ? __virt_addr_valid+0x183/0x530
[   59.158641][ T5853]  ? __virt_addr_valid+0x45f/0x530
[   59.163746][ T5853]  ? __phys_addr+0xba/0x170
[   59.168244][ T5853]  ? __list_del_entry_valid_or_report+0x2f/0x140
[   59.174564][ T5853]  kasan_report+0x143/0x180
[   59.179065][ T5853]  ? __list_del_entry_valid_or_report+0x2f/0x140
[   59.185386][ T5853]  __list_del_entry_valid_or_report+0x2f/0x140
[   59.191530][ T5853]  mgmt_pending_remove+0x26/0x1a0
[   59.196548][ T5853]  mgmt_remove_adv_monitor_complete+0x2bf/0x550
[   59.202808][ T5853]  ? hci_remove_all_adv_monitor+0x13f/0x1b0
[   59.208691][ T5853]  ? __pfx_mgmt_remove_adv_monitor_complete+0x10/0x10
[   59.215469][ T5853]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[   59.221441][ T5853]  ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[   59.227760][ T5853]  ? __pfx_mgmt_remove_adv_monitor_complete+0x10/0x10
[   59.234514][ T5853]  hci_cmd_sync_work+0x280/0x400
[   59.239453][ T5853]  ? process_scheduled_works+0x976/0x1850
[   59.245170][ T5853]  process_scheduled_works+0xa63/0x1850
[   59.250720][ T5853]  ? __pfx_process_scheduled_works+0x10/0x10
[   59.256697][ T5853]  ? assign_work+0x364/0x3d0
[   59.261305][ T5853]  worker_thread+0x870/0xd30
[   59.265896][ T5853]  ? __kthread_parkme+0x169/0x1d0
[   59.270920][ T5853]  ? __pfx_worker_thread+0x10/0x10
[   59.276027][ T5853]  kthread+0x2f0/0x390
[   59.280089][ T5853]  ? __pfx_worker_thread+0x10/0x10
[   59.285193][ T5853]  ? __pfx_kthread+0x10/0x10
[   59.289777][ T5853]  ret_from_fork+0x4b/0x80
[   59.294185][ T5853]  ? __pfx_kthread+0x10/0x10
[   59.298769][ T5853]  ret_from_fork_asm+0x1a/0x30
[   59.303534][ T5853]  </TASK>
[   59.306546][ T5853] 
[   59.308859][ T5853] Allocated by task 6082:
[   59.313174][ T5853]  kasan_save_track+0x3f/0x80
[   59.317851][ T5853]  __kasan_kmalloc+0x98/0xb0
[   59.322457][ T5853]  __kmalloc_cache_noprof+0x19c/0x2c0
[   59.327835][ T5853]  mgmt_pending_new+0x65/0x250
[   59.332601][ T5853]  mgmt_pending_add+0x36/0x120
[   59.337360][ T5853]  remove_adv_monitor+0x102/0x1b0
[   59.342382][ T5853]  hci_mgmt_cmd+0xc47/0x11d0
[   59.346969][ T5853]  hci_sock_sendmsg+0x7b8/0x11c0
[   59.351909][ T5853]  __sock_sendmsg+0x221/0x270
[   59.356579][ T5853]  sock_write_iter+0x2d7/0x3f0
[   59.361333][ T5853]  vfs_write+0xaeb/0xd30
[   59.365572][ T5853]  ksys_write+0x18f/0x2b0
[   59.369904][ T5853]  do_syscall_64+0xf3/0x230
[   59.374408][ T5853]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   59.380303][ T5853] 
[   59.382653][ T5853] Freed by task 6085:
[   59.386622][ T5853]  kasan_save_track+0x3f/0x80
[   59.391298][ T5853]  kasan_save_free_info+0x40/0x50
[   59.396315][ T5853]  __kasan_slab_free+0x59/0x70
[   59.401075][ T5853]  kfree+0x1a0/0x440
[   59.404961][ T5853]  mgmt_pending_foreach+0xd1/0x130
[   59.410089][ T5853]  mgmt_index_removed+0x133/0x390
[   59.415117][ T5853]  hci_sock_bind+0xcce/0x1150
[   59.419791][ T5853]  __sys_bind+0x1e4/0x290
[   59.424113][ T5853]  __x64_sys_bind+0x7a/0x90
[   59.428606][ T5853]  do_syscall_64+0xf3/0x230
[   59.433104][ T5853]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   59.438991][ T5853] 
[   59.441305][ T5853] The buggy address belongs to the object at ffff8881436c1880
[   59.441305][ T5853]  which belongs to the cache kmalloc-96 of size 96
[   59.455183][ T5853] The buggy address is located 8 bytes inside of
[   59.455183][ T5853]  freed 96-byte region [ffff8881436c1880, ffff8881436c18e0)
[   59.468729][ T5853] 
[   59.471055][ T5853] The buggy address belongs to the physical page:
[   59.477473][ T5853] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1436c1
[   59.486327][ T5853] flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff)
[   59.493526][ T5853] page_type: f5(slab)
[   59.497505][ T5853] raw: 057ff00000000000 ffff88801b041280 dead000000000100 dead000000000122
[   59.506082][ T5853] raw: 0000000000000000 0000000080200020 00000001f5000000 0000000000000000
[   59.514652][ T5853] page dumped because: kasan: bad access detected
[   59.521058][ T5853] page_owner tracks the page as allocated
[   59.526760][ T5853] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 1, tgid 1 (swapper/0), ts 3012747150, free_ts 0
[   59.544301][ T5853]  post_alloc_hook+0x1f3/0x230
[   59.549087][ T5853]  get_page_from_freelist+0x3649/0x3790
[   59.554630][ T5853]  __alloc_pages_noprof+0x292/0x710
[   59.559822][ T5853]  alloc_pages_mpol_noprof+0x3e8/0x680
[   59.565286][ T5853]  alloc_slab_page+0x6a/0x140
[   59.569963][ T5853]  allocate_slab+0x5a/0x2f0
[   59.574459][ T5853]  ___slab_alloc+0xcd1/0x14b0
[   59.579128][ T5853]  __slab_alloc+0x58/0xa0
[   59.583449][ T5853]  __kmalloc_cache_noprof+0x1d5/0x2c0
[   59.588811][ T5853]  acpi_ut_evaluate_object+0x108/0x4a0
[   59.594262][ T5853]  acpi_ut_execute_HID+0xbf/0x3f0
[   59.599276][ T5853]  acpi_get_object_info+0x328/0x1220
[   59.604559][ T5853]  acpi_init_device_object+0xbeb/0x31a0
[   59.610097][ T5853]  acpi_add_single_object+0x106/0x1e00
[   59.615568][ T5853]  acpi_bus_check_add+0x32b/0x980
[   59.620601][ T5853]  acpi_ns_walk_namespace+0x294/0x4f0
[   59.625981][ T5853] page_owner free stack trace missing
[   59.631426][ T5853] 
[   59.633739][ T5853] Memory state around the buggy address:
[   59.639357][ T5853]  ffff8881436c1780: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[   59.647407][ T5853]  ffff8881436c1800: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[   59.655454][ T5853] >ffff8881436c1880: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[   59.663519][ T5853]                       ^
[   59.667844][ T5853]  ffff8881436c1900: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[   59.675941][ T5853]  ffff8881436c1980: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[   59.683997][ T5853] ==================================================================
[   59.697504][ T5853] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   59.704741][ T5853] CPU: 1 UID: 0 PID: 5853 Comm: kworker/u9:2 Not tainted 6.12.0-syzkaller-05517-g5dfd7d940094 #0
[   59.715239][ T5853] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[   59.725300][ T5853] Workqueue: hci0 hci_cmd_sync_work
[   59.730509][ T5853] Call Trace:
[   59.733780][ T5853]  <TASK>
[   59.736751][ T5853]  dump_stack_lvl+0x241/0x360
[   59.741430][ T5853]  ? __pfx_dump_stack_lvl+0x10/0x10
[   59.746648][ T5853]  ? __pfx__printk+0x10/0x10
[   59.751322][ T5853]  ? preempt_schedule+0xe1/0xf0
[   59.756216][ T5853]  ? vscnprintf+0x5d/0x90
[   59.760539][ T5853]  panic+0x349/0x880
[   59.764430][ T5853]  ? check_panic_on_warn+0x21/0xb0
[   59.769539][ T5853]  ? __pfx_panic+0x10/0x10
[   59.773954][ T5853]  ? _raw_spin_unlock_irqrestore+0x130/0x140
[   59.779936][ T5853]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   59.786349][ T5853]  ? print_report+0x502/0x550
[   59.791026][ T5853]  check_panic_on_warn+0x86/0xb0
[   59.795960][ T5853]  ? __list_del_entry_valid_or_report+0x2f/0x140
[   59.802280][ T5853]  end_report+0x77/0x160
[   59.806518][ T5853]  kasan_report+0x154/0x180
[   59.811014][ T5853]  ? __list_del_entry_valid_or_report+0x2f/0x140
[   59.817348][ T5853]  __list_del_entry_valid_or_report+0x2f/0x140
[   59.823605][ T5853]  mgmt_pending_remove+0x26/0x1a0
[   59.828628][ T5853]  mgmt_remove_adv_monitor_complete+0x2bf/0x550
[   59.834865][ T5853]  ? hci_remove_all_adv_monitor+0x13f/0x1b0
[   59.840757][ T5853]  ? __pfx_mgmt_remove_adv_monitor_complete+0x10/0x10
[   59.847532][ T5853]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[   59.853505][ T5853]  ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[   59.859823][ T5853]  ? __pfx_mgmt_remove_adv_monitor_complete+0x10/0x10
[   59.866581][ T5853]  hci_cmd_sync_work+0x280/0x400
[   59.871520][ T5853]  ? process_scheduled_works+0x976/0x1850
[   59.877233][ T5853]  process_scheduled_works+0xa63/0x1850
[   59.882783][ T5853]  ? __pfx_process_scheduled_works+0x10/0x10
[   59.889109][ T5853]  ? assign_work+0x364/0x3d0
[   59.893697][ T5853]  worker_thread+0x870/0xd30
[   59.898292][ T5853]  ? __kthread_parkme+0x169/0x1d0
[   59.903318][ T5853]  ? __pfx_worker_thread+0x10/0x10
[   59.908444][ T5853]  kthread+0x2f0/0x390
[   59.912515][ T5853]  ? __pfx_worker_thread+0x10/0x10
[   59.917621][ T5853]  ? __pfx_kthread+0x10/0x10
[   59.922202][ T5853]  ret_from_fork+0x4b/0x80
[   59.926693][ T5853]  ? __pfx_kthread+0x10/0x10
[   59.931276][ T5853]  ret_from_fork_asm+0x1a/0x30
[   59.936040][ T5853]  </TASK>
[   59.939289][ T5853] Kernel Offset: disabled
[   59.943605][ T5853] Rebooting in 86400 seconds..