last executing test programs:
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.1.132' (ED25519) to the list of known hosts.
[ 80.524688][ T5084] cgroup: Unknown subsys name 'net'
[ 80.729864][ T5084] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 82.625091][ T5084] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 86.052831][ T5106] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 86.075656][ T5109] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[ 86.084309][ T5109] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[ 86.094774][ T5109] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[ 86.103102][ T5109] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[ 86.106790][ T5113] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 86.113568][ T5109] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[ 86.119791][ T5112] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 86.127168][ T5109] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[ 86.135329][ T5112] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[ 86.143110][ T5109] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[ 86.153314][ T5112] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 86.155913][ T5114] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[ 86.172488][ T5109] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[ 86.176819][ T5112] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 86.181131][ T5114] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[ 86.191778][ T5112] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[ 86.195920][ T5114] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[ 86.204158][ T5112] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[ 86.216703][ T5112] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3
[ 86.218450][ T5114] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3
[ 86.224347][ T5112] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3
[ 86.232906][ T5114] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 86.238910][ T5112] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[ 86.245950][ T5114] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 86.252886][ T5112] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[ 86.267608][ T5114] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3
[ 86.268881][ T5112] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[ 86.275170][ T5115] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 86.291172][ T5096] ==================================================================
[ 86.293135][ T5115] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[ 86.299432][ T5096] BUG: KASAN: slab-use-after-free in kfree_skb_reason+0x41/0x3b0
[ 86.299490][ T5096] Read of size 4 at addr ffff8880690f94a4 by task syz-executor/5096
[ 86.299507][ T5096]
[ 86.299518][ T5096] CPU: 1 PID: 5096 Comm: syz-executor Not tainted 6.10.0-rc2-syzkaller-00824-gfd8db07705c5 #0
[ 86.334997][ T5096] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
[ 86.345139][ T5096] Call Trace:
[ 86.348458][ T5096]
[ 86.351471][ T5096] dump_stack_lvl+0x241/0x360
[ 86.356351][ T5096] ? __pfx_dump_stack_lvl+0x10/0x10
[ 86.361868][ T5096] ? __pfx__printk+0x10/0x10
[ 86.366530][ T5096] ? _printk+0xd5/0x120
[ 86.370731][ T5096] ? __virt_addr_valid+0x183/0x520
[ 86.376104][ T5096] ? __virt_addr_valid+0x183/0x520
[ 86.381388][ T5096] print_report+0x169/0x550
[ 86.386433][ T5096] ? __virt_addr_valid+0x183/0x520
[ 86.391939][ T5096] ? __virt_addr_valid+0x183/0x520
[ 86.397170][ T5096] ? __virt_addr_valid+0x44e/0x520
[ 86.402384][ T5096] ? __phys_addr+0xba/0x170
[ 86.406994][ T5096] ? kfree_skb_reason+0x41/0x3b0
[ 86.412079][ T5096] kasan_report+0x143/0x180
[ 86.416609][ T5096] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 86.423060][ T5096] ? kfree_skb_reason+0x41/0x3b0
[ 86.428217][ T5096] kasan_check_range+0x282/0x290
[ 86.433196][ T5096] kfree_skb_reason+0x41/0x3b0
[ 86.438420][ T5096] __hci_req_sync+0x62f/0x950
[ 86.443196][ T5096] ? __pfx___hci_req_sync+0x10/0x10
[ 86.448480][ T5096] ? __pfx___mutex_lock+0x10/0x10
[ 86.453948][ T5096] ? __pfx_hci_scan_req+0x10/0x10
[ 86.459059][ T5096] hci_req_sync+0xa9/0xd0
[ 86.463438][ T5096] hci_dev_cmd+0x4c5/0xa50
[ 86.467959][ T5096] ? security_capable+0x90/0xb0
[ 86.472820][ T5096] ? __pfx_hci_dev_cmd+0x10/0x10
[ 86.477796][ T5096] ? hci_sock_ioctl+0x6c4/0xa40
[ 86.482746][ T5096] sock_do_ioctl+0x158/0x460
[ 86.487364][ T5096] ? __pfx_sock_do_ioctl+0x10/0x10
[ 86.492490][ T5096] sock_ioctl+0x629/0x8e0
[ 86.496930][ T5096] ? __pfx_sock_ioctl+0x10/0x10
[ 86.501795][ T5096] ? __fget_files+0x29/0x470
[ 86.506571][ T5096] ? __fget_files+0x3f6/0x470
[ 86.511302][ T5096] ? __fget_files+0x29/0x470
[ 86.515909][ T5096] ? bpf_lsm_file_ioctl+0x9/0x10
[ 86.520904][ T5096] ? security_file_ioctl+0x87/0xb0
[ 86.526038][ T5096] ? __pfx_sock_ioctl+0x10/0x10
[ 86.530907][ T5096] __se_sys_ioctl+0xfc/0x170
[ 86.535508][ T5096] do_syscall_64+0xf3/0x230
[ 86.540062][ T5096] ? clear_bhb_loop+0x35/0x90
[ 86.544838][ T5096] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.550846][ T5096] RIP: 0033:0x7fddac7757db
[ 86.555442][ T5096] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
[ 86.575141][ T5096] RSP: 002b:00007fff8aa30440 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 86.583674][ T5096] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fddac7757db
[ 86.591651][ T5096] RDX: 00007fff8aa304b8 RSI: 00000000400448dd RDI: 0000000000000003
[ 86.599629][ T5096] RBP: 00005555578214a8 R08: 0000000000000000 R09: 0000000000000000
[ 86.607606][ T5096] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000004
[ 86.615581][ T5096] R13: 0000000000000004 R14: 0000000000000009 R15: 0000000000000009
[ 86.623917][ T5096]
[ 86.626945][ T5096]
[ 86.629268][ T5096] Allocated by task 5112:
[ 86.633596][ T5096] kasan_save_track+0x3f/0x80
[ 86.638291][ T5096] __kasan_slab_alloc+0x66/0x80
[ 86.643342][ T5096] kmem_cache_alloc_noprof+0x135/0x2a0
[ 86.648811][ T5096] skb_clone+0x20c/0x390
[ 86.653074][ T5096] hci_cmd_work+0x29e/0x670
[ 86.657596][ T5096] process_scheduled_works+0xa2c/0x1830
[ 86.663249][ T5096] worker_thread+0x86d/0xd70
[ 86.668001][ T5096] kthread+0x2f0/0x390
[ 86.672977][ T5096] ret_from_fork+0x4b/0x80
[ 86.677588][ T5096] ret_from_fork_asm+0x1a/0x30
[ 86.682372][ T5096]
[ 86.684704][ T5096] Freed by task 5114:
[ 86.688715][ T5096] kasan_save_track+0x3f/0x80
[ 86.693442][ T5096] kasan_save_free_info+0x40/0x50
[ 86.698490][ T5096] poison_slab_object+0xe0/0x150
[ 86.703472][ T5096] __kasan_slab_free+0x37/0x60
[ 86.708285][ T5096] kmem_cache_free+0x145/0x350
[ 86.713073][ T5096] hci_req_sync_complete+0xe7/0x290
[ 86.718365][ T5096] hci_event_packet+0xc71/0x1540
[ 86.723782][ T5096] hci_rx_work+0x3e8/0xca0
[ 86.729011][ T5096] process_scheduled_works+0xa2c/0x1830
[ 86.734582][ T5096] worker_thread+0x86d/0xd70
[ 86.739282][ T5096] kthread+0x2f0/0x390
[ 86.743385][ T5096] ret_from_fork+0x4b/0x80
[ 86.747813][ T5096] ret_from_fork_asm+0x1a/0x30
[ 86.752590][ T5096]
[ 86.754923][ T5096] The buggy address belongs to the object at ffff8880690f93c0
[ 86.754923][ T5096] which belongs to the cache skbuff_head_cache of size 240
[ 86.769592][ T5096] The buggy address is located 228 bytes inside of
[ 86.769592][ T5096] freed 240-byte region [ffff8880690f93c0, ffff8880690f94b0)
[ 86.783571][ T5096]
[ 86.785904][ T5096] The buggy address belongs to the physical page:
[ 86.792413][ T5096] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x690f9
[ 86.801568][ T5096] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 86.808690][ T5096] page_type: 0xffffefff(slab)
[ 86.813376][ T5096] raw: 00fff00000000000 ffff888018ea4780 dead000000000122 0000000000000000
[ 86.821967][ T5096] raw: 0000000000000000 00000000000c000c 00000001ffffefff 0000000000000000
[ 86.830722][ T5096] page dumped because: kasan: bad access detected
[ 86.837143][ T5096] page_owner tracks the page as allocated
[ 86.842949][ T5096] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5106, tgid 5106 (kworker/u9:4), ts 86287459610, free_ts 27693098885
[ 86.862344][ T5096] post_alloc_hook+0x1f3/0x230
[ 86.867128][ T5096] get_page_from_freelist+0x2e2d/0x2ee0
[ 86.872680][ T5096] __alloc_pages_noprof+0x256/0x6c0
[ 86.877909][ T5096] alloc_slab_page+0x5f/0x120
[ 86.882684][ T5096] allocate_slab+0x5a/0x2e0
[ 86.887201][ T5096] ___slab_alloc+0xcd1/0x14b0
[ 86.891907][ T5096] __slab_alloc+0x58/0xa0
[ 86.896300][ T5096] kmem_cache_alloc_node_noprof+0x1fe/0x320
[ 86.902217][ T5096] __alloc_skb+0x1c3/0x440
[ 86.906758][ T5096] mgmt_send_event+0x46/0x1a0
[ 86.911469][ T5096] mgmt_index_added+0x1cb/0x260
[ 86.916342][ T5096] hci_power_on+0x4a2/0x6b0
[ 86.920863][ T5096] process_scheduled_works+0xa2c/0x1830
[ 86.926453][ T5096] worker_thread+0x86d/0xd70
[ 86.931064][ T5096] kthread+0x2f0/0x390
[ 86.935189][ T5096] ret_from_fork+0x4b/0x80
[ 86.939642][ T5096] page last free pid 1 tgid 1 stack trace:
[ 86.945973][ T5096] free_unref_page+0xd22/0xea0
[ 86.950757][ T5096] free_contig_range+0x9e/0x160
[ 86.955703][ T5096] destroy_args+0x8a/0x890
[ 86.960129][ T5096] debug_vm_pgtable+0x4be/0x550
[ 86.965000][ T5096] do_one_initcall+0x248/0x880
[ 86.969790][ T5096] do_initcall_level+0x157/0x210
[ 86.974825][ T5096] do_initcalls+0x3f/0x80
[ 86.979180][ T5096] kernel_init_freeable+0x435/0x5d0
[ 86.984395][ T5096] kernel_init+0x1d/0x2b0
[ 86.988738][ T5096] ret_from_fork+0x4b/0x80
[ 86.993254][ T5096] ret_from_fork_asm+0x1a/0x30
[ 86.998078][ T5096]
[ 87.000406][ T5096] Memory state around the buggy address:
[ 87.006038][ T5096] ffff8880690f9380: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 87.014103][ T5096] ffff8880690f9400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 87.022254][ T5096] >ffff8880690f9480: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[ 87.030342][ T5096] ^
[ 87.035449][ T5096] ffff8880690f9500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 87.043515][ T5096] ffff8880690f9580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 87.051600][ T5096] ==================================================================
[ 87.060797][ T5096] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 87.068048][ T5096] CPU: 0 PID: 5096 Comm: syz-executor Not tainted 6.10.0-rc2-syzkaller-00824-gfd8db07705c5 #0
[ 87.078321][ T5096] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
[ 87.088412][ T5096] Call Trace:
[ 87.091724][ T5096]
[ 87.094688][ T5096] dump_stack_lvl+0x241/0x360
[ 87.099419][ T5096] ? __pfx_dump_stack_lvl+0x10/0x10
[ 87.104664][ T5096] ? __pfx__printk+0x10/0x10
[ 87.109289][ T5096] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 87.115321][ T5096] ? vscnprintf+0x5d/0x90
[ 87.119701][ T5096] panic+0x349/0x860
[ 87.123830][ T5096] ? check_panic_on_warn+0x21/0xb0
[ 87.129088][ T5096] ? __pfx_panic+0x10/0x10
[ 87.133635][ T5096] ? _raw_spin_unlock_irqrestore+0x130/0x140
[ 87.139693][ T5096] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 87.146091][ T5096] check_panic_on_warn+0x86/0xb0
[ 87.151049][ T5096] ? kfree_skb_reason+0x41/0x3b0
[ 87.156113][ T5096] end_report+0x77/0x160
[ 87.160467][ T5096] kasan_report+0x154/0x180
[ 87.165252][ T5096] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 87.171872][ T5096] ? kfree_skb_reason+0x41/0x3b0
[ 87.177420][ T5096] kasan_check_range+0x282/0x290
[ 87.183324][ T5096] kfree_skb_reason+0x41/0x3b0
[ 87.188177][ T5096] __hci_req_sync+0x62f/0x950
[ 87.192886][ T5096] ? __pfx___hci_req_sync+0x10/0x10
[ 87.198107][ T5096] ? __pfx___mutex_lock+0x10/0x10
[ 87.203433][ T5096] ? __pfx_hci_scan_req+0x10/0x10
[ 87.208504][ T5096] hci_req_sync+0xa9/0xd0
[ 87.212861][ T5096] hci_dev_cmd+0x4c5/0xa50
[ 87.217291][ T5096] ? security_capable+0x90/0xb0
[ 87.222154][ T5096] ? __pfx_hci_dev_cmd+0x10/0x10
[ 87.227113][ T5096] ? hci_sock_ioctl+0x6c4/0xa40
[ 87.232952][ T5096] sock_do_ioctl+0x158/0x460
[ 87.237564][ T5096] ? __pfx_sock_do_ioctl+0x10/0x10
[ 87.242754][ T5096] sock_ioctl+0x629/0x8e0
[ 87.247113][ T5096] ? __pfx_sock_ioctl+0x10/0x10
[ 87.252156][ T5096] ? __fget_files+0x29/0x470
[ 87.256765][ T5096] ? __fget_files+0x3f6/0x470
[ 87.261476][ T5096] ? __fget_files+0x29/0x470
[ 87.266171][ T5096] ? bpf_lsm_file_ioctl+0x9/0x10
[ 87.271123][ T5096] ? security_file_ioctl+0x87/0xb0
[ 87.276252][ T5096] ? __pfx_sock_ioctl+0x10/0x10
[ 87.281128][ T5096] __se_sys_ioctl+0xfc/0x170
[ 87.285743][ T5096] do_syscall_64+0xf3/0x230
[ 87.290455][ T5096] ? clear_bhb_loop+0x35/0x90
[ 87.295160][ T5096] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.301085][ T5096] RIP: 0033:0x7fddac7757db
[ 87.305533][ T5096] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
[ 87.325585][ T5096] RSP: 002b:00007fff8aa30440 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 87.334113][ T5096] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fddac7757db
[ 87.342538][ T5096] RDX: 00007fff8aa304b8 RSI: 00000000400448dd RDI: 0000000000000003
[ 87.350520][ T5096] RBP: 00005555578214a8 R08: 0000000000000000 R09: 0000000000000000
[ 87.358676][ T5096] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000004
[ 87.366945][ T5096] R13: 0000000000000004 R14: 0000000000000009 R15: 0000000000000009
[ 87.374971][ T5096]
[ 87.378267][ T5096] Kernel Offset: disabled
[ 87.382623][ T5096] Rebooting in 86400 seconds..