last executing test programs:
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.1.61' (ED25519) to the list of known hosts.
[ 70.324602][ T5095] cgroup: Unknown subsys name 'net'
[ 70.498359][ T5095] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 72.031452][ T1251] ieee802154 phy0 wpan0: encryption failed: -22
[ 72.038386][ T1251] ieee802154 phy1 wpan1: encryption failed: -22
[ 72.327380][ T5095] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 73.011777][ T5106] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 73.020955][ T5110] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 73.029233][ T5110] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 73.035175][ T5106] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 73.037831][ T5110] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 73.046183][ T5106] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 73.051571][ T5110] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 73.065100][ T5110] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 73.077800][ T4494] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[ 73.085149][ T5104] ==================================================================
[ 73.093346][ T5104] BUG: KASAN: slab-use-after-free in skb_release_data+0x46/0x880
[ 73.101147][ T5104] Read of size 8 at addr ffff88806ae53ad0 by task syz-executor/5104
[ 73.109162][ T5104]
[ 73.111528][ T5104] CPU: 1 PID: 5104 Comm: syz-executor Not tainted 6.10.0-rc4-syzkaller-00177-g058722ee350c #0
[ 73.121886][ T5104] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
[ 73.131974][ T5104] Call Trace:
[ 73.135272][ T5104]
[ 73.138204][ T5104] dump_stack_lvl+0x241/0x360
[ 73.142458][ T5109] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[ 73.142892][ T5104] ? __pfx_dump_stack_lvl+0x10/0x10
[ 73.152119][ T5109] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[ 73.155196][ T5104] ? __pfx__printk+0x10/0x10
[ 73.164196][ T5109] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[ 73.166824][ T5104] ? _printk+0xd5/0x120
[ 73.166867][ T5104] ? __virt_addr_valid+0x183/0x520
[ 73.166899][ T5104] ? __virt_addr_valid+0x183/0x520
[ 73.166932][ T5104] print_report+0x169/0x550
[ 73.176886][ T5109] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[ 73.178251][ T5104] ? __virt_addr_valid+0x183/0x520
[ 73.186891][ T5109] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[ 73.189145][ T5104] ? __virt_addr_valid+0x183/0x520
[ 73.195958][ T5109] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[ 73.200606][ T5104] ? __virt_addr_valid+0x44e/0x520
[ 73.200652][ T5104] ? __phys_addr+0xba/0x170
[ 73.200681][ T5104] ? skb_release_data+0x46/0x880
[ 73.200706][ T5104] kasan_report+0x143/0x180
[ 73.208222][ T5109] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[ 73.212762][ T5104] ? skb_release_data+0x46/0x880
[ 73.219613][ T5109] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[ 73.224802][ T5104] skb_release_data+0x46/0x880
[ 73.230835][ T5109] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[ 73.234502][ T5104] ? __hci_req_sync+0x62f/0x950
[ 73.241152][ T5109] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[ 73.243926][ T5104] kfree_skb_reason+0x1a3/0x3b0
[ 73.252062][ T5109] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[ 73.255836][ T5104] __hci_req_sync+0x62f/0x950
[ 73.265722][ T5109] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3
[ 73.267570][ T5104] ? __pfx___hci_req_sync+0x10/0x10
[ 73.267616][ T5104] ? __pfx___mutex_lock+0x10/0x10
[ 73.275052][ T5109] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[ 73.279408][ T5104] ? __pfx_hci_scan_req+0x10/0x10
[ 73.279440][ T5104] hci_req_sync+0xa9/0xd0
[ 73.279475][ T5104] hci_dev_cmd+0x4c5/0xa50
[ 73.287860][ T5109] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[ 73.291252][ T5104] ? security_capable+0x90/0xb0
[ 73.300269][ T5109] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3
[ 73.302857][ T5104] ? __pfx_hci_dev_cmd+0x10/0x10
[ 73.311376][ T5109] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[ 73.314978][ T5104] ? hci_sock_ioctl+0x6c4/0xa40
[ 73.322044][ T5109] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3
[ 73.326973][ T5104] sock_do_ioctl+0x158/0x460
[ 73.327027][ T5104] ? __pfx_sock_do_ioctl+0x10/0x10
[ 73.327067][ T5104] sock_ioctl+0x629/0x8e0
[ 73.334113][ T53] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3
[ 73.336402][ T5104] ? __pfx_sock_ioctl+0x10/0x10
[ 73.341785][ T5109] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[ 73.347737][ T5104] ? __fget_files+0x29/0x470
[ 73.347776][ T5104] ? __fget_files+0x3f6/0x470
[ 73.347801][ T5104] ? __fget_files+0x29/0x470
[ 73.352927][ T53] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[ 73.359583][ T5104] ? bpf_lsm_file_ioctl+0x9/0x10
[ 73.359616][ T5104] ? security_file_ioctl+0x87/0xb0
[ 73.359642][ T5104] ? __pfx_sock_ioctl+0x10/0x10
[ 73.365578][ T5109] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[ 73.371523][ T5104] __se_sys_ioctl+0xfc/0x170
[ 73.371562][ T5104] do_syscall_64+0xf3/0x230
[ 73.371594][ T5104] ? clear_bhb_loop+0x35/0x90
[ 73.473090][ T5104] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 73.479056][ T5104] RIP: 0033:0x7f587f17593b
[ 73.483536][ T5104] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
[ 73.503190][ T5104] RSP: 002b:00007ffd06066f00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 73.511647][ T5104] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f587f17593b
[ 73.519656][ T5104] RDX: 00007ffd06066f78 RSI: 00000000400448dd RDI: 0000000000000003
[ 73.527664][ T5104] RBP: 00005555864af4a8 R08: 0000000000000000 R09: 0000000000000000
[ 73.535670][ T5104] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000000
[ 73.543678][ T5104] R13: 0000000000000000 R14: 0000000000000009 R15: 0000000000000009
[ 73.551801][ T5104]
[ 73.554890][ T5104]
[ 73.557229][ T5104] Allocated by task 5110:
[ 73.561678][ T5104] kasan_save_track+0x3f/0x80
[ 73.566400][ T5104] __kasan_slab_alloc+0x66/0x80
[ 73.571293][ T5104] kmem_cache_alloc_noprof+0x135/0x2a0
[ 73.576805][ T5104] skb_clone+0x20c/0x390
[ 73.581087][ T5104] hci_cmd_work+0x29e/0x670
[ 73.585640][ T5104] process_scheduled_works+0xa2c/0x1830
[ 73.591219][ T5104] worker_thread+0x86d/0xd70
[ 73.595855][ T5104] kthread+0x2f0/0x390
[ 73.599968][ T5104] ret_from_fork+0x4b/0x80
[ 73.604425][ T5104] ret_from_fork_asm+0x1a/0x30
[ 73.609234][ T5104]
[ 73.611577][ T5104] Freed by task 5110:
[ 73.615578][ T5104] kasan_save_track+0x3f/0x80
[ 73.620300][ T5104] kasan_save_free_info+0x40/0x50
[ 73.625373][ T5104] poison_slab_object+0xe0/0x150
[ 73.630741][ T5104] __kasan_slab_free+0x37/0x60
[ 73.635634][ T5104] kmem_cache_free+0x145/0x350
[ 73.640460][ T5104] hci_req_sync_complete+0xe7/0x290
[ 73.645711][ T5104] hci_event_packet+0xc71/0x1540
[ 73.650695][ T5104] hci_rx_work+0x3e8/0xca0
[ 73.655212][ T5104] process_scheduled_works+0xa2c/0x1830
[ 73.660798][ T5104] worker_thread+0x86d/0xd70
[ 73.665419][ T5104] kthread+0x2f0/0x390
[ 73.669522][ T5104] ret_from_fork+0x4b/0x80
[ 73.673976][ T5104] ret_from_fork_asm+0x1a/0x30
[ 73.678784][ T5104]
[ 73.681129][ T5104] The buggy address belongs to the object at ffff88806ae53a00
[ 73.681129][ T5104] which belongs to the cache skbuff_head_cache of size 240
[ 73.695822][ T5104] The buggy address is located 208 bytes inside of
[ 73.695822][ T5104] freed 240-byte region [ffff88806ae53a00, ffff88806ae53af0)
[ 73.709657][ T5104]
[ 73.712094][ T5104] The buggy address belongs to the physical page:
[ 73.718538][ T5104] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6ae53
[ 73.727338][ T5104] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 73.734558][ T5104] page_type: 0xffffefff(slab)
[ 73.739276][ T5104] raw: 00fff00000000000 ffff888018ea3780 dead000000000122 0000000000000000
[ 73.747901][ T5104] raw: 0000000000000000 00000000000c000c 00000001ffffefff 0000000000000000
[ 73.756515][ T5104] page dumped because: kasan: bad access detected
[ 73.762973][ T5104] page_owner tracks the page as allocated
[ 73.768721][ T5104] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5110, tgid 5110 (kworker/u9:4), ts 73073171373, free_ts 27078589246
[ 73.788048][ T5104] post_alloc_hook+0x1f3/0x230
[ 73.792861][ T5104] get_page_from_freelist+0x2e43/0x2f00
[ 73.798468][ T5104] __alloc_pages_noprof+0x256/0x6c0
[ 73.803718][ T5104] alloc_slab_page+0x5f/0x120
[ 73.808439][ T5104] allocate_slab+0x5a/0x2f0
[ 73.812987][ T5104] ___slab_alloc+0xcd1/0x14b0
[ 73.817706][ T5104] __slab_alloc+0x58/0xa0
[ 73.822084][ T5104] kmem_cache_alloc_noprof+0x1c1/0x2a0
[ 73.827677][ T5104] skb_clone+0x20c/0x390
[ 73.832058][ T5104] hci_event_packet+0x49c/0x1540
[ 73.837037][ T5104] hci_rx_work+0x3e8/0xca0
[ 73.841497][ T5104] process_scheduled_works+0xa2c/0x1830
[ 73.847086][ T5104] worker_thread+0x86d/0xd70
[ 73.851854][ T5104] kthread+0x2f0/0x390
[ 73.855959][ T5104] ret_from_fork+0x4b/0x80
[ 73.860430][ T5104] ret_from_fork_asm+0x1a/0x30
[ 73.865243][ T5104] page last free pid 1 tgid 1 stack trace:
[ 73.871249][ T5104] free_unref_page+0xd22/0xea0
[ 73.876057][ T5104] free_contig_range+0x9e/0x160
[ 73.880948][ T5104] destroy_args+0x8a/0x890
[ 73.885423][ T5104] debug_vm_pgtable+0x4be/0x550
[ 73.890408][ T5104] do_one_initcall+0x248/0x880
[ 73.895314][ T5104] do_initcall_level+0x157/0x210
[ 73.900309][ T5104] do_initcalls+0x3f/0x80
[ 73.904806][ T5104] kernel_init_freeable+0x435/0x5d0
[ 73.910055][ T5104] kernel_init+0x1d/0x2b0
[ 73.914427][ T5104] ret_from_fork+0x4b/0x80
[ 73.918888][ T5104] ret_from_fork_asm+0x1a/0x30
[ 73.923787][ T5104]
[ 73.926119][ T5104] Memory state around the buggy address:
[ 73.931762][ T5104] ffff88806ae53980: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[ 73.939849][ T5104] ffff88806ae53a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 73.947916][ T5104] >ffff88806ae53a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 73.955998][ T5104] ^
[ 73.962700][ T5104] ffff88806ae53b00: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
[ 73.970774][ T5104] ffff88806ae53b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 73.978839][ T5104] ==================================================================
[ 73.987954][ T5104] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 73.995196][ T5104] CPU: 0 PID: 5104 Comm: syz-executor Not tainted 6.10.0-rc4-syzkaller-00177-g058722ee350c #0
[ 74.005446][ T5104] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
[ 74.015520][ T5104] Call Trace:
[ 74.018809][ T5104]
[ 74.021753][ T5104] dump_stack_lvl+0x241/0x360
[ 74.026563][ T5104] ? __pfx_dump_stack_lvl+0x10/0x10
[ 74.031783][ T5104] ? __pfx__printk+0x10/0x10
[ 74.036392][ T5104] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 74.042412][ T5104] ? vscnprintf+0x5d/0x90
[ 74.046757][ T5104] panic+0x349/0x860
[ 74.050674][ T5104] ? check_panic_on_warn+0x21/0xb0
[ 74.055803][ T5104] ? __pfx_panic+0x10/0x10
[ 74.060241][ T5104] ? _raw_spin_unlock_irqrestore+0x130/0x140
[ 74.066235][ T5104] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 74.072579][ T5104] check_panic_on_warn+0x86/0xb0
[ 74.077535][ T5104] ? skb_release_data+0x46/0x880
[ 74.082487][ T5104] end_report+0x77/0x160
[ 74.086783][ T5104] kasan_report+0x154/0x180
[ 74.091320][ T5104] ? skb_release_data+0x46/0x880
[ 74.096278][ T5104] skb_release_data+0x46/0x880
[ 74.101071][ T5104] ? __hci_req_sync+0x62f/0x950
[ 74.105966][ T5104] kfree_skb_reason+0x1a3/0x3b0
[ 74.110867][ T5104] __hci_req_sync+0x62f/0x950
[ 74.115567][ T5104] ? __pfx___hci_req_sync+0x10/0x10
[ 74.120790][ T5104] ? __pfx___mutex_lock+0x10/0x10
[ 74.125859][ T5104] ? __pfx_hci_scan_req+0x10/0x10
[ 74.130896][ T5104] hci_req_sync+0xa9/0xd0
[ 74.135249][ T5104] hci_dev_cmd+0x4c5/0xa50
[ 74.139681][ T5104] ? security_capable+0x90/0xb0
[ 74.144551][ T5104] ? __pfx_hci_dev_cmd+0x10/0x10
[ 74.149504][ T5104] ? hci_sock_ioctl+0x6c4/0xa40
[ 74.154367][ T5104] sock_do_ioctl+0x158/0x460
[ 74.158988][ T5104] ? __pfx_sock_do_ioctl+0x10/0x10
[ 74.164137][ T5104] sock_ioctl+0x629/0x8e0
[ 74.168535][ T5104] ? __pfx_sock_ioctl+0x10/0x10
[ 74.173431][ T5104] ? __fget_files+0x29/0x470
[ 74.178044][ T5104] ? __fget_files+0x3f6/0x470
[ 74.182736][ T5104] ? __fget_files+0x29/0x470
[ 74.187347][ T5104] ? bpf_lsm_file_ioctl+0x9/0x10
[ 74.192295][ T5104] ? security_file_ioctl+0x87/0xb0
[ 74.197545][ T5104] ? __pfx_sock_ioctl+0x10/0x10
[ 74.202415][ T5104] __se_sys_ioctl+0xfc/0x170
[ 74.207021][ T5104] do_syscall_64+0xf3/0x230
[ 74.211543][ T5104] ? clear_bhb_loop+0x35/0x90
[ 74.216243][ T5104] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 74.222161][ T5104] RIP: 0033:0x7f587f17593b
[ 74.226678][ T5104] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
[ 74.246298][ T5104] RSP: 002b:00007ffd06066f00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 74.254727][ T5104] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f587f17593b
[ 74.262710][ T5104] RDX: 00007ffd06066f78 RSI: 00000000400448dd RDI: 0000000000000003
[ 74.270697][ T5104] RBP: 00005555864af4a8 R08: 0000000000000000 R09: 0000000000000000
[ 74.278682][ T5104] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000000
[ 74.286668][ T5104] R13: 0000000000000000 R14: 0000000000000009 R15: 0000000000000009
[ 74.294661][ T5104]
[ 74.298090][ T5104] Kernel Offset: disabled
[ 74.302421][ T5104] Rebooting in 86400 seconds..