last executing test programs:

kernel console output (not intermixed with test programs):

Warning: Permanently added '10.128.1.185' (ED25519) to the list of known hosts.
2024/06/21 13:36:43 fuzzer started
2024/06/21 13:36:44 dialing manager at 10.128.0.169:30012
[   75.100730][ T5093] cgroup: Unknown subsys name 'net'
[   75.365536][ T5093] cgroup: Unknown subsys name 'rlimit'
2024/06/21 13:36:46 starting 5 executor processes
[   76.824190][ T5099] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   76.839350][ T5099] syz-executor (5099) used greatest stack depth: 18968 bytes left
[   77.861892][ T5115] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   77.870342][ T5115] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   77.879633][ T5115] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   77.892528][ T5115] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   77.901182][ T5115] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   77.902059][ T5119] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   77.910406][ T5115] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   77.924391][ T5115] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3
[   77.931979][ T5115] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   77.941648][ T5115] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   77.961874][ T5115] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   77.970336][ T5115] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[   77.974457][ T5124] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   77.978112][ T5115] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   77.993643][ T5124] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   78.004711][ T5124] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   78.013845][ T5124] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3
[   78.022030][ T5124] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   78.029830][ T5124] ==================================================================
[   78.037938][ T5124] BUG: KASAN: double-free in hci_req_sync_complete+0xe7/0x290
[   78.045564][ T5124] Free of addr ffff8880253a4b40 by task kworker/u9:6/5124
[   78.052711][ T5124] 
[   78.055171][ T5124] CPU: 0 PID: 5124 Comm: kworker/u9:6 Not tainted 6.10.0-rc2-syzkaller-00242-g36534d3c5453 #0
[   78.065455][ T5124] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
[   78.075560][ T5124] Workqueue: hci0 hci_rx_work
[   78.080356][ T5124] Call Trace:
[   78.083769][ T5124]  <TASK>
[   78.087007][ T5124]  dump_stack_lvl+0x241/0x360
[   78.091761][ T5124]  ? __pfx_dump_stack_lvl+0x10/0x10
[   78.094018][ T5122] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[   78.097082][ T5124]  ? __pfx__printk+0x10/0x10
[   78.105724][ T5122] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[   78.108740][ T5124]  ? _printk+0xd5/0x120
[   78.108774][ T5124]  ? __virt_addr_valid+0x183/0x520
[   78.108805][ T5124]  ? __virt_addr_valid+0x183/0x520
[   78.108836][ T5124]  print_report+0x169/0x550
[   78.120293][ T5118] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[   78.125268][ T5124]  ? __virt_addr_valid+0x183/0x520
[   78.131980][ T5118] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[   78.134899][ T5124]  ? __virt_addr_valid+0x183/0x520
[   78.143251][ T5118] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[   78.147023][ T5124]  ? __virt_addr_valid+0x44e/0x520
[   78.154886][ T5118] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[   78.159305][ T5124]  ? __phys_addr+0xba/0x170
[   78.159358][ T5124]  ? hci_req_sync_complete+0xe7/0x290
[   78.169770][ T5118] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[   78.171523][ T5124]  kasan_report_invalid_free+0x11a/0x140
[   78.179552][ T5118] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[   78.183099][ T5124]  ? hci_req_sync_complete+0xe7/0x290
[   78.190365][ T5118] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3
[   78.195414][ T5124]  ? hci_req_sync_complete+0xe7/0x290
[   78.201911][ T5118] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3
[   78.207971][ T5124]  poison_slab_object+0xf4/0x150
[   78.208018][ T5124]  ? hci_req_sync_complete+0xe7/0x290
[   78.208047][ T5124]  __kasan_slab_free+0x37/0x60
[   78.214317][ T5118] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[   78.220329][ T5124]  kmem_cache_free+0x145/0x350
[   78.220363][ T5124]  hci_req_sync_complete+0xe7/0x290
[   78.220395][ T5124]  hci_event_packet+0xc71/0x1540
[   78.226438][ T5118] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[   78.232859][ T5124]  ? __pfx_hci_cmd_complete_evt+0x10/0x10
[   78.232896][ T5124]  ? __pfx_hci_event_packet+0x10/0x10
[   78.232918][ T5124]  ? do_raw_spin_unlock+0x13c/0x8b0
[   78.294413][ T5124]  ? __pfx_hci_req_sync_complete+0x10/0x10
[   78.300363][ T5124]  ? hci_send_to_monitor+0xd8/0x7f0
[   78.305609][ T5124]  ? kcov_remote_start+0x9e/0x7e0
[   78.310697][ T5124]  hci_rx_work+0x3e8/0xca0
[   78.315327][ T5124]  ? process_scheduled_works+0x945/0x1830
[   78.321112][ T5124]  process_scheduled_works+0xa2c/0x1830
[   78.326726][ T5124]  ? __pfx_process_scheduled_works+0x10/0x10
[   78.332761][ T5124]  ? assign_work+0x364/0x3d0
[   78.337406][ T5124]  worker_thread+0x86d/0xd70
[   78.342233][ T5124]  ? _raw_spin_unlock_irqrestore+0xdd/0x140
[   78.348182][ T5124]  ? __kthread_parkme+0x169/0x1d0
[   78.353257][ T5124]  ? __pfx_worker_thread+0x10/0x10
[   78.358521][ T5124]  kthread+0x2f0/0x390
[   78.362735][ T5124]  ? __pfx_worker_thread+0x10/0x10
[   78.367936][ T5124]  ? __pfx_kthread+0x10/0x10
[   78.372710][ T5124]  ret_from_fork+0x4b/0x80
[   78.377362][ T5124]  ? __pfx_kthread+0x10/0x10
[   78.382111][ T5124]  ret_from_fork_asm+0x1a/0x30
[   78.386983][ T5124]  </TASK>
[   78.390038][ T5124] 
[   78.392409][ T5124] Allocated by task 4488:
[   78.396805][ T5124]  kasan_save_track+0x3f/0x80
[   78.401535][ T5124]  __kasan_slab_alloc+0x66/0x80
[   78.406430][ T5124]  kmem_cache_alloc_noprof+0x135/0x2a0
[   78.411947][ T5124]  skb_clone+0x20c/0x390
[   78.416239][ T5124]  hci_cmd_work+0x29e/0x670
[   78.420837][ T5124]  process_scheduled_works+0xa2c/0x1830
[   78.426469][ T5124]  worker_thread+0x86d/0xd70
[   78.431117][ T5124]  kthread+0x2f0/0x390
[   78.435236][ T5124]  ret_from_fork+0x4b/0x80
[   78.439722][ T5124]  ret_from_fork_asm+0x1a/0x30
[   78.444557][ T5124] 
[   78.446919][ T5124] Freed by task 5113:
[   78.450933][ T5124]  kasan_save_track+0x3f/0x80
[   78.455679][ T5124]  kasan_save_free_info+0x40/0x50
[   78.460757][ T5124]  poison_slab_object+0xe0/0x150
[   78.465746][ T5124]  __kasan_slab_free+0x37/0x60
[   78.470588][ T5124]  kmem_cache_free+0x145/0x350
[   78.475395][ T5124]  __hci_req_sync+0x62f/0x950
[   78.480213][ T5124]  hci_req_sync+0xa9/0xd0
[   78.484605][ T5124]  hci_dev_cmd+0x4c5/0xa50
[   78.489094][ T5124]  sock_do_ioctl+0x158/0x460
[   78.493823][ T5124]  sock_ioctl+0x629/0x8e0
[   78.498297][ T5124]  __se_sys_ioctl+0xfc/0x170
[   78.502962][ T5124]  do_syscall_64+0xf3/0x230
[   78.507516][ T5124]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   78.513474][ T5124] 
[   78.515828][ T5124] The buggy address belongs to the object at ffff8880253a4b40
[   78.515828][ T5124]  which belongs to the cache skbuff_head_cache of size 240
[   78.530476][ T5124] The buggy address is located 0 bytes inside of
[   78.530476][ T5124]  240-byte region [ffff8880253a4b40, ffff8880253a4c30)
[   78.543795][ T5124] 
[   78.546153][ T5124] The buggy address belongs to the physical page:
[   78.552850][ T5124] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x253a4
[   78.561786][ T5124] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[   78.568957][ T5124] page_type: 0xffffefff(slab)
[   78.573688][ T5124] raw: 00fff00000000000 ffff888018ae4780 ffffea000072b980 dead000000000002
[   78.582320][ T5124] raw: 0000000000000000 00000000000c000c 00000001ffffefff 0000000000000000
[   78.591034][ T5124] page dumped because: kasan: bad access detected
[   78.597506][ T5124] page_owner tracks the page as allocated
[   78.603259][ T5124] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 4545, tgid 4545 (udevadm), ts 32230063751, free_ts 32207104936
[   78.622233][ T5124]  post_alloc_hook+0x1f3/0x230
[   78.627060][ T5124]  get_page_from_freelist+0x2e2d/0x2ee0
[   78.632669][ T5124]  __alloc_pages_noprof+0x256/0x6c0
[   78.637972][ T5124]  alloc_slab_page+0x5f/0x120
[   78.642701][ T5124]  allocate_slab+0x5a/0x2e0
[   78.647252][ T5124]  ___slab_alloc+0xcd1/0x14b0
[   78.651976][ T5124]  __slab_alloc+0x58/0xa0
[   78.656359][ T5124]  kmem_cache_alloc_node_noprof+0x1fe/0x320
[   78.662332][ T5124]  __alloc_skb+0x1c3/0x440
[   78.666813][ T5124]  alloc_uevent_skb+0x74/0x230
[   78.671634][ T5124]  kobject_uevent_net_broadcast+0x2fd/0x580
[   78.677594][ T5124]  kobject_uevent_env+0x57d/0x8e0
[   78.682689][ T5124]  kobject_synth_uevent+0x4ef/0xae0
[   78.688041][ T5124]  store_uevent+0x25/0x50
[   78.692419][ T5124]  module_attr_store+0x60/0x80
[   78.697344][ T5124]  kernfs_fop_write_iter+0x3a1/0x500
[   78.702686][ T5124] page last free pid 4552 tgid 4552 stack trace:
[   78.709084][ T5124]  free_unref_page+0xd22/0xea0
[   78.713910][ T5124]  __slab_free+0x31b/0x3d0
[   78.718396][ T5124]  qlist_free_all+0x9e/0x140
[   78.723034][ T5124]  kasan_quarantine_reduce+0x14f/0x170
[   78.728549][ T5124]  __kasan_slab_alloc+0x23/0x80
[   78.733455][ T5124]  kmem_cache_alloc_noprof+0x135/0x2a0
[   78.738999][ T5124]  getname_flags+0xbd/0x4f0
[   78.743563][ T5124]  do_sys_openat2+0xd2/0x1d0
[   78.748220][ T5124]  __x64_sys_openat+0x247/0x2a0
[   78.753198][ T5124]  do_syscall_64+0xf3/0x230
[   78.757744][ T5124]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   78.763783][ T5124] 
[   78.766581][ T5124] Memory state around the buggy address:
[   78.772515][ T5124]  ffff8880253a4a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   78.780979][ T5124]  ffff8880253a4a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[   78.789494][ T5124] >ffff8880253a4b00: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[   78.797622][ T5124]                                            ^
[   78.803873][ T5124]  ffff8880253a4b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
2024/06/21 13:36:48 SYZFATAL: failed to recv *flatrpc.HostMessageRaw: EOF
[   78.812008][ T5124]  ffff8880253a4c00: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[   78.820199][ T5124] ==================================================================
[   78.838748][ T5124] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   78.846112][ T5124] CPU: 0 PID: 5124 Comm: kworker/u9:6 Not tainted 6.10.0-rc2-syzkaller-00242-g36534d3c5453 #0
[   78.857096][ T5124] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
[   78.867203][ T5124] Workqueue: hci0 hci_rx_work
[   78.872080][ T5124] Call Trace:
[   78.875492][ T5124]  <TASK>
[   78.879025][ T5124]  dump_stack_lvl+0x241/0x360
[   78.883794][ T5124]  ? __pfx_dump_stack_lvl+0x10/0x10
[   78.889011][ T5124]  ? __pfx__printk+0x10/0x10
[   78.893612][ T5124]  ? preempt_schedule+0xe1/0xf0
[   78.898574][ T5124]  ? vscnprintf+0x5d/0x90
[   78.903014][ T5124]  panic+0x349/0x860
[   78.907047][ T5124]  ? check_panic_on_warn+0x21/0xb0
[   78.912440][ T5124]  ? __pfx_panic+0x10/0x10
[   78.916969][ T5124]  ? _raw_spin_unlock_irqrestore+0x130/0x140
[   78.922970][ T5124]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   78.929320][ T5124]  ? print_report+0x502/0x550
[   78.934109][ T5124]  check_panic_on_warn+0x86/0xb0
[   78.939067][ T5124]  ? hci_req_sync_complete+0xe7/0x290
[   78.944486][ T5124]  end_report+0x77/0x160
[   78.948756][ T5124]  kasan_report_invalid_free+0x12a/0x140
[   78.954517][ T5124]  ? hci_req_sync_complete+0xe7/0x290
[   78.959907][ T5124]  ? hci_req_sync_complete+0xe7/0x290
[   78.965761][ T5124]  poison_slab_object+0xf4/0x150
[   78.970743][ T5124]  ? hci_req_sync_complete+0xe7/0x290
[   78.976237][ T5124]  __kasan_slab_free+0x37/0x60
[   78.981022][ T5124]  kmem_cache_free+0x145/0x350
[   78.985807][ T5124]  hci_req_sync_complete+0xe7/0x290
[   78.991057][ T5124]  hci_event_packet+0xc71/0x1540
[   78.996032][ T5124]  ? __pfx_hci_cmd_complete_evt+0x10/0x10
[   79.001787][ T5124]  ? __pfx_hci_event_packet+0x10/0x10
[   79.007274][ T5124]  ? do_raw_spin_unlock+0x13c/0x8b0
[   79.012547][ T5124]  ? __pfx_hci_req_sync_complete+0x10/0x10
[   79.018388][ T5124]  ? hci_send_to_monitor+0xd8/0x7f0
[   79.023609][ T5124]  ? kcov_remote_start+0x9e/0x7e0
[   79.028649][ T5124]  hci_rx_work+0x3e8/0xca0
[   79.033083][ T5124]  ? process_scheduled_works+0x945/0x1830
[   79.038833][ T5124]  process_scheduled_works+0xa2c/0x1830
[   79.044435][ T5124]  ? __pfx_process_scheduled_works+0x10/0x10
[   79.050442][ T5124]  ? assign_work+0x364/0x3d0
[   79.055130][ T5124]  worker_thread+0x86d/0xd70
[   79.059742][ T5124]  ? _raw_spin_unlock_irqrestore+0xdd/0x140
[   79.065657][ T5124]  ? __kthread_parkme+0x169/0x1d0
[   79.070989][ T5124]  ? __pfx_worker_thread+0x10/0x10
[   79.076145][ T5124]  kthread+0x2f0/0x390
[   79.080365][ T5124]  ? __pfx_worker_thread+0x10/0x10
[   79.085504][ T5124]  ? __pfx_kthread+0x10/0x10
[   79.090145][ T5124]  ret_from_fork+0x4b/0x80
[   79.094594][ T5124]  ? __pfx_kthread+0x10/0x10
[   79.099224][ T5124]  ret_from_fork_asm+0x1a/0x30
[   79.104133][ T5124]  </TASK>
[   79.107479][ T5124] Kernel Offset: disabled
[   79.111828][ T5124] Rebooting in 86400 seconds..