Warning: Permanently added '10.128.10.25' (ED25519) to the list of known hosts.
[   85.895697][   T52] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   85.903462][   T52] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   85.911108][   T52] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   85.919289][   T52] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   85.927096][   T52] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[   85.934614][   T52] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
[   88.004772][ T4481] Bluetooth: hci0: command tx timeout
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
[   90.084124][ T4481] Bluetooth: hci0: command 0x041b tx timeout
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
[   92.164259][ T4481] Bluetooth: hci0: command 0x041b tx timeout
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
[   94.244132][ T4481] Bluetooth: hci0: command 0x041b tx timeout
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
[   96.314158][   T52] Bluetooth: hci0: command 0x041b tx timeout
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
[   98.394149][ T4481] Bluetooth: hci0: command 0x041b tx timeout
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
[  133.117991][ T5069] ==================================================================
[  133.126095][ T5069] BUG: KASAN: slab-use-after-free in sco_sock_timeout+0x67/0x240
[  133.133840][ T5069] Write of size 4 at addr ffff88807af15080 by task kworker/0:3/5069
[  133.141818][ T5069] 
[  133.144140][ T5069] CPU: 0 PID: 5069 Comm: kworker/0:3 Not tainted 6.9.0-rc1-next-20240328-syzkaller #0
[  133.153681][ T5069] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
[  133.163741][ T5069] Workqueue: events sco_sock_timeout
[  133.169124][ T5069] Call Trace:
[  133.172403][ T5069]  <TASK>
[  133.175336][ T5069]  dump_stack_lvl+0x241/0x360
[  133.180096][ T5069]  ? __pfx_dump_stack_lvl+0x10/0x10
[  133.185280][ T5069]  ? __pfx__printk+0x10/0x10
[  133.189861][ T5069]  ? _printk+0xd5/0x120
[  133.194009][ T5069]  ? __virt_addr_valid+0x183/0x520
[  133.199114][ T5069]  ? __virt_addr_valid+0x183/0x520
[  133.204218][ T5069]  print_report+0x169/0x550
[  133.208719][ T5069]  ? __virt_addr_valid+0x183/0x520
[  133.213818][ T5069]  ? __virt_addr_valid+0x183/0x520
[  133.218920][ T5069]  ? __virt_addr_valid+0x44e/0x520
[  133.224022][ T5069]  ? __phys_addr+0xba/0x170
[  133.228518][ T5069]  ? sco_sock_timeout+0x67/0x240
[  133.233440][ T5069]  kasan_report+0x143/0x180
[  133.237937][ T5069]  ? __pfx_lock_acquire+0x10/0x10
[  133.242951][ T5069]  ? sco_sock_timeout+0x67/0x240
[  133.247891][ T5069]  kasan_check_range+0x282/0x290
[  133.252814][ T5069]  sco_sock_timeout+0x67/0x240
[  133.257563][ T5069]  ? process_scheduled_works+0x945/0x1830
[  133.263270][ T5069]  process_scheduled_works+0xa2c/0x1830
[  133.268813][ T5069]  ? __pfx_process_scheduled_works+0x10/0x10
[  133.274782][ T5069]  ? assign_work+0x364/0x3d0
[  133.279359][ T5069]  worker_thread+0x86d/0xd70
[  133.283939][ T5069]  ? _raw_spin_unlock_irqrestore+0xdd/0x140
[  133.289819][ T5069]  ? __kthread_parkme+0x169/0x1d0
[  133.294857][ T5069]  ? __pfx_worker_thread+0x10/0x10
[  133.299953][ T5069]  kthread+0x2f0/0x390
[  133.304027][ T5069]  ? __pfx_worker_thread+0x10/0x10
[  133.309143][ T5069]  ? __pfx_kthread+0x10/0x10
[  133.313726][ T5069]  ret_from_fork+0x4b/0x80
[  133.318154][ T5069]  ? __pfx_kthread+0x10/0x10
[  133.322761][ T5069]  ret_from_fork_asm+0x1a/0x30
[  133.327532][ T5069]  </TASK>
[  133.330554][ T5069] 
[  133.332861][ T5069] Allocated by task 5266:
[  133.337189][ T5069]  kasan_save_track+0x3f/0x80
[  133.341863][ T5069]  __kasan_kmalloc+0x98/0xb0
[  133.346447][ T5069]  __kmalloc_noprof+0x200/0x410
[  133.351294][ T5069]  sk_prot_alloc+0xe0/0x210
[  133.355798][ T5069]  sk_alloc+0x38/0x370
[  133.359868][ T5069]  bt_sock_alloc+0x3c/0x340
[  133.364371][ T5069]  sco_sock_create+0xbb/0x390
[  133.369056][ T5069]  bt_sock_create+0x161/0x230
[  133.373730][ T5069]  __sock_create+0x490/0x920
[  133.378319][ T5069]  __sys_socket+0x150/0x3c0
[  133.382808][ T5069]  __x64_sys_socket+0x7a/0x90
[  133.387474][ T5069]  do_syscall_64+0xfb/0x240
[  133.391971][ T5069]  entry_SYSCALL_64_after_hwframe+0x6d/0x75
[  133.397883][ T5069] 
[  133.400214][ T5069] Freed by task 5267:
[  133.404190][ T5069]  kasan_save_track+0x3f/0x80
[  133.408859][ T5069]  kasan_save_free_info+0x40/0x50
[  133.413871][ T5069]  poison_slab_object+0xe0/0x150
[  133.418799][ T5069]  __kasan_slab_free+0x37/0x60
[  133.423552][ T5069]  kfree+0x149/0x350
[  133.427432][ T5069]  __sk_destruct+0x476/0x5f0
[  133.432007][ T5069]  sco_sock_release+0x25e/0x320
[  133.436848][ T5069]  sock_close+0xbc/0x240
[  133.441081][ T5069]  __fput+0x429/0x8a0
[  133.445051][ T5069]  task_work_run+0x24f/0x310
[  133.449629][ T5069]  get_signal+0x15e6/0x1740
[  133.454123][ T5069]  arch_do_signal_or_restart+0x96/0x860
[  133.459658][ T5069]  syscall_exit_to_user_mode+0xc9/0x360
[  133.465198][ T5069]  do_syscall_64+0x10a/0x240
[  133.469772][ T5069]  entry_SYSCALL_64_after_hwframe+0x6d/0x75
[  133.475656][ T5069] 
[  133.477965][ T5069] The buggy address belongs to the object at ffff88807af15000
[  133.477965][ T5069]  which belongs to the cache kmalloc-2k of size 2048
[  133.492009][ T5069] The buggy address is located 128 bytes inside of
[  133.492009][ T5069]  freed 2048-byte region [ffff88807af15000, ffff88807af15800)
[  133.505874][ T5069] 
[  133.508191][ T5069] The buggy address belongs to the physical page:
[  133.514583][ T5069] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7af10
[  133.523329][ T5069] head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  133.530861][ T5069] flags: 0xfff80000000040(head|node=0|zone=1|lastcpupid=0xfff)
[  133.538475][ T5069] page_type: 0xffffefff(slab)
[  133.543143][ T5069] raw: 00fff80000000040 ffff888015042000 dead000000000122 0000000000000000
[  133.551715][ T5069] raw: 0000000000000000 0000000000080008 00000001ffffefff 0000000000000000
[  133.560284][ T5069] head: 00fff80000000040 ffff888015042000 dead000000000122 0000000000000000
[  133.568936][ T5069] head: 0000000000000000 0000000000080008 00000001ffffefff 0000000000000000
[  133.577589][ T5069] head: 00fff80000000003 ffffea0001ebc401 dead000000000122 00000000ffffffff
[  133.586244][ T5069] head: 0000000800000000 0000000000000000 00000000ffffffff 0000000000000000
[  133.594891][ T5069] page dumped because: kasan: bad access detected
[  133.601285][ T5069] page_owner tracks the page as allocated
[  133.606987][ T5069] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4524, tgid 1981418428 (klogd), ts 4524, free_ts 92120695701
[  133.627721][ T5069]  post_alloc_hook+0x1f3/0x230
[  133.632477][ T5069]  get_page_from_freelist+0x2e8a/0x2f40
[  133.638011][ T5069]  __alloc_pages_noprof+0x256/0x6c0
[  133.643197][ T5069]  alloc_slab_page+0x5f/0x120
[  133.647866][ T5069]  allocate_slab+0x5a/0x2e0
[  133.652358][ T5069]  ___slab_alloc+0xea8/0x1430
[  133.657024][ T5069]  __slab_alloc+0x58/0xa0
[  133.661346][ T5069]  kmalloc_trace_noprof+0x1d5/0x2b0
[  133.666531][ T5069]  syslog_print+0x121/0x9c0
[  133.671020][ T5069]  do_syslog+0x3bb/0x810
[  133.675249][ T5069]  __x64_sys_syslog+0x7c/0x90
[  133.679913][ T5069]  do_syscall_64+0xfb/0x240
[  133.684400][ T5069]  entry_SYSCALL_64_after_hwframe+0x6d/0x75
[  133.690282][ T5069] page last free pid 5241 tgid 5240 stack trace:
[  133.696591][ T5069]  free_unref_page+0xd3c/0xec0
[  133.701337][ T5069]  __folio_put_large+0x168/0x1d0
[  133.706265][ T5069]  __folio_put+0x299/0x390
[  133.710666][ T5069]  page_to_skb+0x3dc/0x9b0
[  133.715068][ T5069]  receive_buf+0x3b3/0x3890
[  133.719563][ T5069]  virtnet_poll+0x850/0x1ad0
[  133.724134][ T5069]  __napi_poll+0xcb/0x490
[  133.728462][ T5069]  net_rx_action+0x7bb/0x10a0
[  133.733125][ T5069]  __do_softirq+0x2c6/0x980
[  133.737618][ T5069] 
[  133.739923][ T5069] Memory state around the buggy address:
[  133.745534][ T5069]  ffff88807af14f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  133.753578][ T5069]  ffff88807af15000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  133.761623][ T5069] >ffff88807af15080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  133.769675][ T5069]                    ^
[  133.773724][ T5069]  ffff88807af15100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  133.781855][ T5069]  ffff88807af15180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  133.789895][ T5069] ==================================================================
[  133.798336][ T5069] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  133.805539][ T5069] CPU: 0 PID: 5069 Comm: kworker/0:3 Not tainted 6.9.0-rc1-next-20240328-syzkaller #0
[  133.815097][ T5069] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
[  133.825154][ T5069] Workqueue: events sco_sock_timeout
[  133.830455][ T5069] Call Trace:
[  133.833734][ T5069]  <TASK>
[  133.836666][ T5069]  dump_stack_lvl+0x241/0x360
[  133.841359][ T5069]  ? __pfx_dump_stack_lvl+0x10/0x10
[  133.846562][ T5069]  ? __pfx__printk+0x10/0x10
[  133.851160][ T5069]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[  133.857152][ T5069]  ? vscnprintf+0x5d/0x90
[  133.861498][ T5069]  panic+0x349/0x860
[  133.865411][ T5069]  ? check_panic_on_warn+0x21/0xb0
[  133.870538][ T5069]  ? __pfx_panic+0x10/0x10
[  133.874973][ T5069]  ? _raw_spin_unlock_irqrestore+0xd8/0x140
[  133.880872][ T5069]  ? _raw_spin_unlock_irqrestore+0xdd/0x140
[  133.886767][ T5069]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  133.893098][ T5069]  check_panic_on_warn+0x86/0xb0
[  133.898047][ T5069]  ? sco_sock_timeout+0x67/0x240
[  133.902997][ T5069]  end_report+0x77/0x160
[  133.907256][ T5069]  kasan_report+0x154/0x180
[  133.911769][ T5069]  ? __pfx_lock_acquire+0x10/0x10
[  133.916789][ T5069]  ? sco_sock_timeout+0x67/0x240
[  133.921719][ T5069]  kasan_check_range+0x282/0x290
[  133.926643][ T5069]  sco_sock_timeout+0x67/0x240
[  133.931393][ T5069]  ? process_scheduled_works+0x945/0x1830
[  133.937108][ T5069]  process_scheduled_works+0xa2c/0x1830
[  133.942649][ T5069]  ? __pfx_process_scheduled_works+0x10/0x10
[  133.948622][ T5069]  ? assign_work+0x364/0x3d0
[  133.953200][ T5069]  worker_thread+0x86d/0xd70
[  133.957784][ T5069]  ? _raw_spin_unlock_irqrestore+0xdd/0x140
[  133.963666][ T5069]  ? __kthread_parkme+0x169/0x1d0
[  133.968688][ T5069]  ? __pfx_worker_thread+0x10/0x10
[  133.973786][ T5069]  kthread+0x2f0/0x390
[  133.977855][ T5069]  ? __pfx_worker_thread+0x10/0x10
[  133.982951][ T5069]  ? __pfx_kthread+0x10/0x10
[  133.987544][ T5069]  ret_from_fork+0x4b/0x80
[  133.991952][ T5069]  ? __pfx_kthread+0x10/0x10
[  133.996533][ T5069]  ret_from_fork_asm+0x1a/0x30
[  134.001295][ T5069]  </TASK>
[  134.004564][ T5069] Kernel Offset: disabled
[  134.008871][ T5069] Rebooting in 86400 seconds..