Extracting prog: 4m55.87018933s
Minimizing prog: 1h59m49.631285628s
Simplifying prog options: 0s
Extracting C: 3m27.033442905s
Simplifying C: 1h14m33.870150488s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$inet6-syz_emit_vhci-prctl$PR_SCHED_CORE-sched_setaffinity-syz_emit_vhci-openat$hwrng-preadv-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-ioctl$UI_SET_EVBIT-syz_open_dev$usbfs-ioctl$USBDEVFS_FREE_STREAMS-syz_emit_vhci-ioctl$UI_SET_LEDBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-ioctl$UI_DEV_DESTROY-socket$netlink
detailed listing:
executing program 0:
bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0xe24, 0x2, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, 0x3}, 0x1c)
syz_emit_vhci(&(0x7f00000004c0)=ANY=[@ANYBLOB="040e0501460c1f00c7f641737da8c5df97e629d54f8eef8f4b4c287248623393943b5ba71f4c252077dee7cda5f191af639f6bc9ccce6307303924e47e62deed5d1bb5921eea00000c30f73971da9388b9ec29139dedf9d61d113d31eeef342c9d"], 0x8)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x2b, &(0x7f0000000040)=0x200000000005)
syz_emit_vhci(&(0x7f0000000180)=@HCI_EVENT_PKT={0x4, @inquiry_info_with_rssi_and_pscan_mode={{0x22, 0x10}, {0x1, [{@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xf5, 0x3, 0x5, "a938a9", 0x80, 0xb1}]}}}, 0x13)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x1c9140, 0x0)
preadv(r0, 0x0, 0x0, 0x0, 0x5)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan0\x00'})
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x11)
r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x75, 0x1a9a81)
ioctl$USBDEVFS_FREE_STREAMS(r2, 0x802c550a, 0x0)
syz_emit_vhci(&(0x7f0000000300)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x2, 0x0, 0x46}, @l2cap_cid_signaling={{0x42}, [@l2cap_create_chan_rsp={{0xd, 0x7f, 0x8}, {0x2, 0x8, 0x0, 0x100}}, @l2cap_create_chan_rsp={{0xd, 0xf8, 0x8}, {0x9, 0xf, 0xa, 0x8}}, @l2cap_move_chan_rsp={{0xf, 0x1, 0x4}, {0x5, 0x7b}}, @l2cap_move_chan_cfm_rsp={{0x11, 0xc, 0x2}, {0x7}}, @l2cap_conn_req={{0x2, 0xf1, 0x4}, {0x2, 0x1}}, @l2cap_conn_rsp={{0x3, 0x83, 0x8}, {0x2, 0x0, 0x0, 0x7}}, @l2cap_move_chan_cfm={{0x10, 0x9, 0x4}, {0x3ff, 0x6}}]}}, 0x4b)
ioctl$UI_SET_LEDBIT(r1, 0x40045569, 0x1)
ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_CREATE(r1, 0x5501)
ioctl$UI_DEV_DESTROY(r1, 0x5502)
socket$netlink(0x10, 0x3, 0x0)

program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$inet6-syz_emit_vhci-prctl$PR_SCHED_CORE-sched_setaffinity-syz_emit_vhci-openat$hwrng-preadv-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-ioctl$UI_SET_EVBIT-syz_open_dev$usbfs-ioctl$USBDEVFS_FREE_STREAMS-syz_emit_vhci-ioctl$UI_SET_LEDBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-ioctl$UI_DEV_DESTROY-socket$netlink
detailed listing:
executing program 0:
bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0xe24, 0x2, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, 0x3}, 0x1c)
syz_emit_vhci(&(0x7f00000004c0)=ANY=[@ANYBLOB="040e0501460c1f00c7f641737da8c5df97e629d54f8eef8f4b4c287248623393943b5ba71f4c252077dee7cda5f191af639f6bc9ccce6307303924e47e62deed5d1bb5921eea00000c30f73971da9388b9ec29139dedf9d61d113d31eeef342c9d"], 0x8)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x2b, &(0x7f0000000040)=0x200000000005)
syz_emit_vhci(&(0x7f0000000180)=@HCI_EVENT_PKT={0x4, @inquiry_info_with_rssi_and_pscan_mode={{0x22, 0x10}, {0x1, [{@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xf5, 0x3, 0x5, "a938a9", 0x80, 0xb1}]}}}, 0x13)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x1c9140, 0x0)
preadv(r0, 0x0, 0x0, 0x0, 0x5)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan0\x00'})
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x11)
r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x75, 0x1a9a81)
ioctl$USBDEVFS_FREE_STREAMS(r2, 0x802c550a, 0x0)
syz_emit_vhci(&(0x7f0000000300)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x2, 0x0, 0x46}, @l2cap_cid_signaling={{0x42}, [@l2cap_create_chan_rsp={{0xd, 0x7f, 0x8}, {0x2, 0x8, 0x0, 0x100}}, @l2cap_create_chan_rsp={{0xd, 0xf8, 0x8}, {0x9, 0xf, 0xa, 0x8}}, @l2cap_move_chan_rsp={{0xf, 0x1, 0x4}, {0x5, 0x7b}}, @l2cap_move_chan_cfm_rsp={{0x11, 0xc, 0x2}, {0x7}}, @l2cap_conn_req={{0x2, 0xf1, 0x4}, {0x2, 0x1}}, @l2cap_conn_rsp={{0x3, 0x83, 0x8}, {0x2, 0x0, 0x0, 0x7}}, @l2cap_move_chan_cfm={{0x10, 0x9, 0x4}, {0x3ff, 0x6}}]}}, 0x4b)
ioctl$UI_SET_LEDBIT(r1, 0x40045569, 0x1)
ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_CREATE(r1, 0x5501)
ioctl$UI_DEV_DESTROY(r1, 0x5502)
socket$netlink(0x10, 0x3, 0x0)

program crashed: KASAN: slab-use-after-free Read in l2cap_send_cmd
single: successfully extracted reproducer
found reproducer with 18 syscalls
minimizing guilty program
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$inet6-syz_emit_vhci-prctl$PR_SCHED_CORE-sched_setaffinity-syz_emit_vhci-openat$hwrng-preadv-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-ioctl$UI_SET_EVBIT-syz_open_dev$usbfs-ioctl$USBDEVFS_FREE_STREAMS-syz_emit_vhci-ioctl$UI_SET_LEDBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE-ioctl$UI_DEV_DESTROY
detailed listing:
executing program 0:
bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0xe24, 0x2, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, 0x3}, 0x1c)
syz_emit_vhci(&(0x7f00000004c0)=ANY=[@ANYBLOB="040e0501460c1f00c7f641737da8c5df97e629d54f8eef8f4b4c287248623393943b5ba71f4c252077dee7cda5f191af639f6bc9ccce6307303924e47e62deed5d1bb5921eea00000c30f73971da9388b9ec29139dedf9d61d113d31eeef342c9d"], 0x8)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x2b, &(0x7f0000000040)=0x200000000005)
syz_emit_vhci(&(0x7f0000000180)=@HCI_EVENT_PKT={0x4, @inquiry_info_with_rssi_and_pscan_mode={{0x22, 0x10}, {0x1, [{@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xf5, 0x3, 0x5, "a938a9", 0x80, 0xb1}]}}}, 0x13)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x1c9140, 0x0)
preadv(r0, 0x0, 0x0, 0x0, 0x5)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan0\x00'})
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x11)
r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x75, 0x1a9a81)
ioctl$USBDEVFS_FREE_STREAMS(r2, 0x802c550a, 0x0)
syz_emit_vhci(&(0x7f0000000300)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x2, 0x0, 0x46}, @l2cap_cid_signaling={{0x42}, [@l2cap_create_chan_rsp={{0xd, 0x7f, 0x8}, {0x2, 0x8, 0x0, 0x100}}, @l2cap_create_chan_rsp={{0xd, 0xf8, 0x8}, {0x9, 0xf, 0xa, 0x8}}, @l2cap_move_chan_rsp={{0xf, 0x1, 0x4}, {0x5, 0x7b}}, @l2cap_move_chan_cfm_rsp={{0x11, 0xc, 0x2}, {0x7}}, @l2cap_conn_req={{0x2, 0xf1, 0x4}, {0x2, 0x1}}, @l2cap_conn_rsp={{0x3, 0x83, 0x8}, {0x2, 0x0, 0x0, 0x7}}, @l2cap_move_chan_cfm={{0x10, 0x9, 0x4}, {0x3ff, 0x6}}]}}, 0x4b)
ioctl$UI_SET_LEDBIT(r1, 0x40045569, 0x1)
ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_CREATE(r1, 0x5501)
ioctl$UI_DEV_DESTROY(r1, 0x5502)

program crashed: KASAN: slab-use-after-free Read in l2cap_send_cmd
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$inet6-syz_emit_vhci-prctl$PR_SCHED_CORE-sched_setaffinity-syz_emit_vhci-openat$hwrng-preadv-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-ioctl$UI_SET_EVBIT-syz_open_dev$usbfs-ioctl$USBDEVFS_FREE_STREAMS-syz_emit_vhci-ioctl$UI_SET_LEDBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_CREATE
detailed listing:
executing program 0:
bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0xe24, 0x2, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, 0x3}, 0x1c)
syz_emit_vhci(&(0x7f00000004c0)=ANY=[@ANYBLOB="040e0501460c1f00c7f641737da8c5df97e629d54f8eef8f4b4c287248623393943b5ba71f4c252077dee7cda5f191af639f6bc9ccce6307303924e47e62deed5d1bb5921eea00000c30f73971da9388b9ec29139dedf9d61d113d31eeef342c9d"], 0x8)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x2b, &(0x7f0000000040)=0x200000000005)
syz_emit_vhci(&(0x7f0000000180)=@HCI_EVENT_PKT={0x4, @inquiry_info_with_rssi_and_pscan_mode={{0x22, 0x10}, {0x1, [{@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xf5, 0x3, 0x5, "a938a9", 0x80, 0xb1}]}}}, 0x13)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x1c9140, 0x0)
preadv(r0, 0x0, 0x0, 0x0, 0x5)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan0\x00'})
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x11)
r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x75, 0x1a9a81)
ioctl$USBDEVFS_FREE_STREAMS(r2, 0x802c550a, 0x0)
syz_emit_vhci(&(0x7f0000000300)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x2, 0x0, 0x46}, @l2cap_cid_signaling={{0x42}, [@l2cap_create_chan_rsp={{0xd, 0x7f, 0x8}, {0x2, 0x8, 0x0, 0x100}}, @l2cap_create_chan_rsp={{0xd, 0xf8, 0x8}, {0x9, 0xf, 0xa, 0x8}}, @l2cap_move_chan_rsp={{0xf, 0x1, 0x4}, {0x5, 0x7b}}, @l2cap_move_chan_cfm_rsp={{0x11, 0xc, 0x2}, {0x7}}, @l2cap_conn_req={{0x2, 0xf1, 0x4}, {0x2, 0x1}}, @l2cap_conn_rsp={{0x3, 0x83, 0x8}, {0x2, 0x0, 0x0, 0x7}}, @l2cap_move_chan_cfm={{0x10, 0x9, 0x4}, {0x3ff, 0x6}}]}}, 0x4b)
ioctl$UI_SET_LEDBIT(r1, 0x40045569, 0x1)
ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_CREATE(r1, 0x5501)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$inet6-syz_emit_vhci-prctl$PR_SCHED_CORE-sched_setaffinity-syz_emit_vhci-openat$hwrng-preadv-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-ioctl$UI_SET_EVBIT-syz_open_dev$usbfs-ioctl$USBDEVFS_FREE_STREAMS-syz_emit_vhci-ioctl$UI_SET_LEDBIT-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
detailed listing:
executing program 0:
bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0xe24, 0x2, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, 0x3}, 0x1c)
syz_emit_vhci(&(0x7f00000004c0)=ANY=[@ANYBLOB="040e0501460c1f00c7f641737da8c5df97e629d54f8eef8f4b4c287248623393943b5ba71f4c252077dee7cda5f191af639f6bc9ccce6307303924e47e62deed5d1bb5921eea00000c30f73971da9388b9ec29139dedf9d61d113d31eeef342c9d"], 0x8)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x2b, &(0x7f0000000040)=0x200000000005)
syz_emit_vhci(&(0x7f0000000180)=@HCI_EVENT_PKT={0x4, @inquiry_info_with_rssi_and_pscan_mode={{0x22, 0x10}, {0x1, [{@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xf5, 0x3, 0x5, "a938a9", 0x80, 0xb1}]}}}, 0x13)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x1c9140, 0x0)
preadv(r0, 0x0, 0x0, 0x0, 0x5)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan0\x00'})
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x11)
r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x75, 0x1a9a81)
ioctl$USBDEVFS_FREE_STREAMS(r2, 0x802c550a, 0x0)
syz_emit_vhci(&(0x7f0000000300)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x2, 0x0, 0x46}, @l2cap_cid_signaling={{0x42}, [@l2cap_create_chan_rsp={{0xd, 0x7f, 0x8}, {0x2, 0x8, 0x0, 0x100}}, @l2cap_create_chan_rsp={{0xd, 0xf8, 0x8}, {0x9, 0xf, 0xa, 0x8}}, @l2cap_move_chan_rsp={{0xf, 0x1, 0x4}, {0x5, 0x7b}}, @l2cap_move_chan_cfm_rsp={{0x11, 0xc, 0x2}, {0x7}}, @l2cap_conn_req={{0x2, 0xf1, 0x4}, {0x2, 0x1}}, @l2cap_conn_rsp={{0x3, 0x83, 0x8}, {0x2, 0x0, 0x0, 0x7}}, @l2cap_move_chan_cfm={{0x10, 0x9, 0x4}, {0x3ff, 0x6}}]}}, 0x4b)
ioctl$UI_SET_LEDBIT(r1, 0x40045569, 0x1)
ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_DESTROY(r1, 0x5502)

program crashed: KASAN: slab-use-after-free Read in l2cap_send_cmd
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$inet6-syz_emit_vhci-prctl$PR_SCHED_CORE-sched_setaffinity-syz_emit_vhci-openat$hwrng-preadv-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-ioctl$UI_SET_EVBIT-syz_open_dev$usbfs-ioctl$USBDEVFS_FREE_STREAMS-syz_emit_vhci-ioctl$UI_SET_LEDBIT-ioctl$UI_DEV_DESTROY
detailed listing:
executing program 0:
bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0xe24, 0x2, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, 0x3}, 0x1c)
syz_emit_vhci(&(0x7f00000004c0)=ANY=[@ANYBLOB="040e0501460c1f00c7f641737da8c5df97e629d54f8eef8f4b4c287248623393943b5ba71f4c252077dee7cda5f191af639f6bc9ccce6307303924e47e62deed5d1bb5921eea00000c30f73971da9388b9ec29139dedf9d61d113d31eeef342c9d"], 0x8)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x2b, &(0x7f0000000040)=0x200000000005)
syz_emit_vhci(&(0x7f0000000180)=@HCI_EVENT_PKT={0x4, @inquiry_info_with_rssi_and_pscan_mode={{0x22, 0x10}, {0x1, [{@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xf5, 0x3, 0x5, "a938a9", 0x80, 0xb1}]}}}, 0x13)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x1c9140, 0x0)
preadv(r0, 0x0, 0x0, 0x0, 0x5)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan0\x00'})
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x11)
r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x75, 0x1a9a81)
ioctl$USBDEVFS_FREE_STREAMS(r2, 0x802c550a, 0x0)
syz_emit_vhci(&(0x7f0000000300)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x2, 0x0, 0x46}, @l2cap_cid_signaling={{0x42}, [@l2cap_create_chan_rsp={{0xd, 0x7f, 0x8}, {0x2, 0x8, 0x0, 0x100}}, @l2cap_create_chan_rsp={{0xd, 0xf8, 0x8}, {0x9, 0xf, 0xa, 0x8}}, @l2cap_move_chan_rsp={{0xf, 0x1, 0x4}, {0x5, 0x7b}}, @l2cap_move_chan_cfm_rsp={{0x11, 0xc, 0x2}, {0x7}}, @l2cap_conn_req={{0x2, 0xf1, 0x4}, {0x2, 0x1}}, @l2cap_conn_rsp={{0x3, 0x83, 0x8}, {0x2, 0x0, 0x0, 0x7}}, @l2cap_move_chan_cfm={{0x10, 0x9, 0x4}, {0x3ff, 0x6}}]}}, 0x4b)
ioctl$UI_SET_LEDBIT(r1, 0x40045569, 0x1)
ioctl$UI_DEV_DESTROY(r1, 0x5502)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$inet6-syz_emit_vhci-prctl$PR_SCHED_CORE-sched_setaffinity-syz_emit_vhci-openat$hwrng-preadv-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-ioctl$UI_SET_EVBIT-syz_open_dev$usbfs-ioctl$USBDEVFS_FREE_STREAMS-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
detailed listing:
executing program 0:
bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0xe24, 0x2, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, 0x3}, 0x1c)
syz_emit_vhci(&(0x7f00000004c0)=ANY=[@ANYBLOB="040e0501460c1f00c7f641737da8c5df97e629d54f8eef8f4b4c287248623393943b5ba71f4c252077dee7cda5f191af639f6bc9ccce6307303924e47e62deed5d1bb5921eea00000c30f73971da9388b9ec29139dedf9d61d113d31eeef342c9d"], 0x8)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x2b, &(0x7f0000000040)=0x200000000005)
syz_emit_vhci(&(0x7f0000000180)=@HCI_EVENT_PKT={0x4, @inquiry_info_with_rssi_and_pscan_mode={{0x22, 0x10}, {0x1, [{@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xf5, 0x3, 0x5, "a938a9", 0x80, 0xb1}]}}}, 0x13)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x1c9140, 0x0)
preadv(r0, 0x0, 0x0, 0x0, 0x5)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan0\x00'})
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x11)
r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x75, 0x1a9a81)
ioctl$USBDEVFS_FREE_STREAMS(r2, 0x802c550a, 0x0)
syz_emit_vhci(&(0x7f0000000300)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x2, 0x0, 0x46}, @l2cap_cid_signaling={{0x42}, [@l2cap_create_chan_rsp={{0xd, 0x7f, 0x8}, {0x2, 0x8, 0x0, 0x100}}, @l2cap_create_chan_rsp={{0xd, 0xf8, 0x8}, {0x9, 0xf, 0xa, 0x8}}, @l2cap_move_chan_rsp={{0xf, 0x1, 0x4}, {0x5, 0x7b}}, @l2cap_move_chan_cfm_rsp={{0x11, 0xc, 0x2}, {0x7}}, @l2cap_conn_req={{0x2, 0xf1, 0x4}, {0x2, 0x1}}, @l2cap_conn_rsp={{0x3, 0x83, 0x8}, {0x2, 0x0, 0x0, 0x7}}, @l2cap_move_chan_cfm={{0x10, 0x9, 0x4}, {0x3ff, 0x6}}]}}, 0x4b)
ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_DESTROY(r1, 0x5502)

program crashed: KASAN: slab-use-after-free Read in l2cap_send_cmd
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$inet6-syz_emit_vhci-prctl$PR_SCHED_CORE-sched_setaffinity-syz_emit_vhci-openat$hwrng-preadv-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-ioctl$UI_SET_EVBIT-syz_open_dev$usbfs-ioctl$USBDEVFS_FREE_STREAMS-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
detailed listing:
executing program 0:
bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0xe24, 0x2, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, 0x3}, 0x1c)
syz_emit_vhci(&(0x7f00000004c0)=ANY=[@ANYBLOB="040e0501460c1f00c7f641737da8c5df97e629d54f8eef8f4b4c287248623393943b5ba71f4c252077dee7cda5f191af639f6bc9ccce6307303924e47e62deed5d1bb5921eea00000c30f73971da9388b9ec29139dedf9d61d113d31eeef342c9d"], 0x8)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x2b, &(0x7f0000000040)=0x200000000005)
syz_emit_vhci(&(0x7f0000000180)=@HCI_EVENT_PKT={0x4, @inquiry_info_with_rssi_and_pscan_mode={{0x22, 0x10}, {0x1, [{@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xf5, 0x3, 0x5, "a938a9", 0x80, 0xb1}]}}}, 0x13)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x1c9140, 0x0)
preadv(r0, 0x0, 0x0, 0x0, 0x5)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan0\x00'})
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x11)
r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x75, 0x1a9a81)
ioctl$USBDEVFS_FREE_STREAMS(r2, 0x802c550a, 0x0)
ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_DESTROY(r1, 0x5502)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$inet6-syz_emit_vhci-prctl$PR_SCHED_CORE-sched_setaffinity-syz_emit_vhci-openat$hwrng-preadv-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-ioctl$UI_SET_EVBIT-syz_open_dev$usbfs-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
detailed listing:
executing program 0:
bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0xe24, 0x2, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, 0x3}, 0x1c)
syz_emit_vhci(&(0x7f00000004c0)=ANY=[@ANYBLOB="040e0501460c1f00c7f641737da8c5df97e629d54f8eef8f4b4c287248623393943b5ba71f4c252077dee7cda5f191af639f6bc9ccce6307303924e47e62deed5d1bb5921eea00000c30f73971da9388b9ec29139dedf9d61d113d31eeef342c9d"], 0x8)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x2b, &(0x7f0000000040)=0x200000000005)
syz_emit_vhci(&(0x7f0000000180)=@HCI_EVENT_PKT={0x4, @inquiry_info_with_rssi_and_pscan_mode={{0x22, 0x10}, {0x1, [{@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xf5, 0x3, 0x5, "a938a9", 0x80, 0xb1}]}}}, 0x13)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x1c9140, 0x0)
preadv(r0, 0x0, 0x0, 0x0, 0x5)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan0\x00'})
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x11)
syz_open_dev$usbfs(&(0x7f0000000100), 0x75, 0x1a9a81)
syz_emit_vhci(&(0x7f0000000300)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x2, 0x0, 0x46}, @l2cap_cid_signaling={{0x42}, [@l2cap_create_chan_rsp={{0xd, 0x7f, 0x8}, {0x2, 0x8, 0x0, 0x100}}, @l2cap_create_chan_rsp={{0xd, 0xf8, 0x8}, {0x9, 0xf, 0xa, 0x8}}, @l2cap_move_chan_rsp={{0xf, 0x1, 0x4}, {0x5, 0x7b}}, @l2cap_move_chan_cfm_rsp={{0x11, 0xc, 0x2}, {0x7}}, @l2cap_conn_req={{0x2, 0xf1, 0x4}, {0x2, 0x1}}, @l2cap_conn_rsp={{0x3, 0x83, 0x8}, {0x2, 0x0, 0x0, 0x7}}, @l2cap_move_chan_cfm={{0x10, 0x9, 0x4}, {0x3ff, 0x6}}]}}, 0x4b)
ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_DESTROY(r1, 0x5502)

program crashed: KASAN: slab-use-after-free Read in l2cap_send_cmd
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$inet6-syz_emit_vhci-prctl$PR_SCHED_CORE-sched_setaffinity-syz_emit_vhci-openat$hwrng-preadv-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-ioctl$UI_SET_EVBIT-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
detailed listing:
executing program 0:
bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0xe24, 0x2, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, 0x3}, 0x1c)
syz_emit_vhci(&(0x7f00000004c0)=ANY=[@ANYBLOB="040e0501460c1f00c7f641737da8c5df97e629d54f8eef8f4b4c287248623393943b5ba71f4c252077dee7cda5f191af639f6bc9ccce6307303924e47e62deed5d1bb5921eea00000c30f73971da9388b9ec29139dedf9d61d113d31eeef342c9d"], 0x8)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x2b, &(0x7f0000000040)=0x200000000005)
syz_emit_vhci(&(0x7f0000000180)=@HCI_EVENT_PKT={0x4, @inquiry_info_with_rssi_and_pscan_mode={{0x22, 0x10}, {0x1, [{@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xf5, 0x3, 0x5, "a938a9", 0x80, 0xb1}]}}}, 0x13)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x1c9140, 0x0)
preadv(r0, 0x0, 0x0, 0x0, 0x5)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan0\x00'})
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x11)
syz_emit_vhci(&(0x7f0000000300)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x2, 0x0, 0x46}, @l2cap_cid_signaling={{0x42}, [@l2cap_create_chan_rsp={{0xd, 0x7f, 0x8}, {0x2, 0x8, 0x0, 0x100}}, @l2cap_create_chan_rsp={{0xd, 0xf8, 0x8}, {0x9, 0xf, 0xa, 0x8}}, @l2cap_move_chan_rsp={{0xf, 0x1, 0x4}, {0x5, 0x7b}}, @l2cap_move_chan_cfm_rsp={{0x11, 0xc, 0x2}, {0x7}}, @l2cap_conn_req={{0x2, 0xf1, 0x4}, {0x2, 0x1}}, @l2cap_conn_rsp={{0x3, 0x83, 0x8}, {0x2, 0x0, 0x0, 0x7}}, @l2cap_move_chan_cfm={{0x10, 0x9, 0x4}, {0x3ff, 0x6}}]}}, 0x4b)
ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_DESTROY(r1, 0x5502)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$inet6-syz_emit_vhci-prctl$PR_SCHED_CORE-sched_setaffinity-syz_emit_vhci-openat$hwrng-preadv-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-syz_open_dev$usbfs-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
detailed listing:
executing program 0:
bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0xe24, 0x2, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, 0x3}, 0x1c)
syz_emit_vhci(&(0x7f00000004c0)=ANY=[@ANYBLOB="040e0501460c1f00c7f641737da8c5df97e629d54f8eef8f4b4c287248623393943b5ba71f4c252077dee7cda5f191af639f6bc9ccce6307303924e47e62deed5d1bb5921eea00000c30f73971da9388b9ec29139dedf9d61d113d31eeef342c9d"], 0x8)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x2b, &(0x7f0000000040)=0x200000000005)
syz_emit_vhci(&(0x7f0000000180)=@HCI_EVENT_PKT={0x4, @inquiry_info_with_rssi_and_pscan_mode={{0x22, 0x10}, {0x1, [{@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xf5, 0x3, 0x5, "a938a9", 0x80, 0xb1}]}}}, 0x13)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x1c9140, 0x0)
preadv(r0, 0x0, 0x0, 0x0, 0x5)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan0\x00'})
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
syz_open_dev$usbfs(&(0x7f0000000100), 0x75, 0x1a9a81)
syz_emit_vhci(&(0x7f0000000300)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x2, 0x0, 0x46}, @l2cap_cid_signaling={{0x42}, [@l2cap_create_chan_rsp={{0xd, 0x7f, 0x8}, {0x2, 0x8, 0x0, 0x100}}, @l2cap_create_chan_rsp={{0xd, 0xf8, 0x8}, {0x9, 0xf, 0xa, 0x8}}, @l2cap_move_chan_rsp={{0xf, 0x1, 0x4}, {0x5, 0x7b}}, @l2cap_move_chan_cfm_rsp={{0x11, 0xc, 0x2}, {0x7}}, @l2cap_conn_req={{0x2, 0xf1, 0x4}, {0x2, 0x1}}, @l2cap_conn_rsp={{0x3, 0x83, 0x8}, {0x2, 0x0, 0x0, 0x7}}, @l2cap_move_chan_cfm={{0x10, 0x9, 0x4}, {0x3ff, 0x6}}]}}, 0x4b)
ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_DESTROY(r1, 0x5502)

program crashed: KASAN: slab-use-after-free Read in l2cap_send_cmd
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$inet6-syz_emit_vhci-prctl$PR_SCHED_CORE-sched_setaffinity-syz_emit_vhci-openat$hwrng-preadv-ioctl$sock_SIOCGIFINDEX_80211-syz_open_dev$usbfs-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
detailed listing:
executing program 0:
bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0xe24, 0x2, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, 0x3}, 0x1c)
syz_emit_vhci(&(0x7f00000004c0)=ANY=[@ANYBLOB="040e0501460c1f00c7f641737da8c5df97e629d54f8eef8f4b4c287248623393943b5ba71f4c252077dee7cda5f191af639f6bc9ccce6307303924e47e62deed5d1bb5921eea00000c30f73971da9388b9ec29139dedf9d61d113d31eeef342c9d"], 0x8)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x2b, &(0x7f0000000040)=0x200000000005)
syz_emit_vhci(&(0x7f0000000180)=@HCI_EVENT_PKT={0x4, @inquiry_info_with_rssi_and_pscan_mode={{0x22, 0x10}, {0x1, [{@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xf5, 0x3, 0x5, "a938a9", 0x80, 0xb1}]}}}, 0x13)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x1c9140, 0x0)
preadv(r0, 0x0, 0x0, 0x0, 0x5)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan0\x00'})
syz_open_dev$usbfs(&(0x7f0000000100), 0x75, 0x1a9a81)
syz_emit_vhci(&(0x7f0000000300)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x2, 0x0, 0x46}, @l2cap_cid_signaling={{0x42}, [@l2cap_create_chan_rsp={{0xd, 0x7f, 0x8}, {0x2, 0x8, 0x0, 0x100}}, @l2cap_create_chan_rsp={{0xd, 0xf8, 0x8}, {0x9, 0xf, 0xa, 0x8}}, @l2cap_move_chan_rsp={{0xf, 0x1, 0x4}, {0x5, 0x7b}}, @l2cap_move_chan_cfm_rsp={{0x11, 0xc, 0x2}, {0x7}}, @l2cap_conn_req={{0x2, 0xf1, 0x4}, {0x2, 0x1}}, @l2cap_conn_rsp={{0x3, 0x83, 0x8}, {0x2, 0x0, 0x0, 0x7}}, @l2cap_move_chan_cfm={{0x10, 0x9, 0x4}, {0x3ff, 0x6}}]}}, 0x4b)
ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502)

program crashed: lost connection to test machine
suppressed program crash: lost connection to test machine
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$inet6-syz_emit_vhci-prctl$PR_SCHED_CORE-sched_setaffinity-syz_emit_vhci-openat$hwrng-preadv-openat$uinput-syz_open_dev$usbfs-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
detailed listing:
executing program 0:
bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0xe24, 0x2, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, 0x3}, 0x1c)
syz_emit_vhci(&(0x7f00000004c0)=ANY=[@ANYBLOB="040e0501460c1f00c7f641737da8c5df97e629d54f8eef8f4b4c287248623393943b5ba71f4c252077dee7cda5f191af639f6bc9ccce6307303924e47e62deed5d1bb5921eea00000c30f73971da9388b9ec29139dedf9d61d113d31eeef342c9d"], 0x8)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x2b, &(0x7f0000000040)=0x200000000005)
syz_emit_vhci(&(0x7f0000000180)=@HCI_EVENT_PKT={0x4, @inquiry_info_with_rssi_and_pscan_mode={{0x22, 0x10}, {0x1, [{@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xf5, 0x3, 0x5, "a938a9", 0x80, 0xb1}]}}}, 0x13)
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x1c9140, 0x0)
preadv(r0, 0x0, 0x0, 0x0, 0x5)
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
syz_open_dev$usbfs(&(0x7f0000000100), 0x75, 0x1a9a81)
syz_emit_vhci(&(0x7f0000000300)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x2, 0x0, 0x46}, @l2cap_cid_signaling={{0x42}, [@l2cap_create_chan_rsp={{0xd, 0x7f, 0x8}, {0x2, 0x8, 0x0, 0x100}}, @l2cap_create_chan_rsp={{0xd, 0xf8, 0x8}, {0x9, 0xf, 0xa, 0x8}}, @l2cap_move_chan_rsp={{0xf, 0x1, 0x4}, {0x5, 0x7b}}, @l2cap_move_chan_cfm_rsp={{0x11, 0xc, 0x2}, {0x7}}, @l2cap_conn_req={{0x2, 0xf1, 0x4}, {0x2, 0x1}}, @l2cap_conn_rsp={{0x3, 0x83, 0x8}, {0x2, 0x0, 0x0, 0x7}}, @l2cap_move_chan_cfm={{0x10, 0x9, 0x4}, {0x3ff, 0x6}}]}}, 0x4b)
ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_DESTROY(r1, 0x5502)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$inet6-syz_emit_vhci-prctl$PR_SCHED_CORE-sched_setaffinity-syz_emit_vhci-openat$hwrng-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-syz_open_dev$usbfs-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
detailed listing:
executing program 0:
bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0xe24, 0x2, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, 0x3}, 0x1c)
syz_emit_vhci(&(0x7f00000004c0)=ANY=[@ANYBLOB="040e0501460c1f00c7f641737da8c5df97e629d54f8eef8f4b4c287248623393943b5ba71f4c252077dee7cda5f191af639f6bc9ccce6307303924e47e62deed5d1bb5921eea00000c30f73971da9388b9ec29139dedf9d61d113d31eeef342c9d"], 0x8)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x2b, &(0x7f0000000040)=0x200000000005)
syz_emit_vhci(&(0x7f0000000180)=@HCI_EVENT_PKT={0x4, @inquiry_info_with_rssi_and_pscan_mode={{0x22, 0x10}, {0x1, [{@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xf5, 0x3, 0x5, "a938a9", 0x80, 0xb1}]}}}, 0x13)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x1c9140, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan0\x00'})
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
syz_open_dev$usbfs(&(0x7f0000000100), 0x75, 0x1a9a81)
syz_emit_vhci(&(0x7f0000000300)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x2, 0x0, 0x46}, @l2cap_cid_signaling={{0x42}, [@l2cap_create_chan_rsp={{0xd, 0x7f, 0x8}, {0x2, 0x8, 0x0, 0x100}}, @l2cap_create_chan_rsp={{0xd, 0xf8, 0x8}, {0x9, 0xf, 0xa, 0x8}}, @l2cap_move_chan_rsp={{0xf, 0x1, 0x4}, {0x5, 0x7b}}, @l2cap_move_chan_cfm_rsp={{0x11, 0xc, 0x2}, {0x7}}, @l2cap_conn_req={{0x2, 0xf1, 0x4}, {0x2, 0x1}}, @l2cap_conn_rsp={{0x3, 0x83, 0x8}, {0x2, 0x0, 0x0, 0x7}}, @l2cap_move_chan_cfm={{0x10, 0x9, 0x4}, {0x3ff, 0x6}}]}}, 0x4b)
ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_DESTROY(r0, 0x5502)

program crashed: KASAN: slab-use-after-free Read in l2cap_send_cmd
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$inet6-syz_emit_vhci-prctl$PR_SCHED_CORE-sched_setaffinity-syz_emit_vhci-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-syz_open_dev$usbfs-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
detailed listing:
executing program 0:
bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0xe24, 0x2, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, 0x3}, 0x1c)
syz_emit_vhci(&(0x7f00000004c0)=ANY=[@ANYBLOB="040e0501460c1f00c7f641737da8c5df97e629d54f8eef8f4b4c287248623393943b5ba71f4c252077dee7cda5f191af639f6bc9ccce6307303924e47e62deed5d1bb5921eea00000c30f73971da9388b9ec29139dedf9d61d113d31eeef342c9d"], 0x8)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x2b, &(0x7f0000000040)=0x200000000005)
syz_emit_vhci(&(0x7f0000000180)=@HCI_EVENT_PKT={0x4, @inquiry_info_with_rssi_and_pscan_mode={{0x22, 0x10}, {0x1, [{@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xf5, 0x3, 0x5, "a938a9", 0x80, 0xb1}]}}}, 0x13)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan0\x00'})
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
syz_open_dev$usbfs(&(0x7f0000000100), 0x75, 0x1a9a81)
syz_emit_vhci(&(0x7f0000000300)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x2, 0x0, 0x46}, @l2cap_cid_signaling={{0x42}, [@l2cap_create_chan_rsp={{0xd, 0x7f, 0x8}, {0x2, 0x8, 0x0, 0x100}}, @l2cap_create_chan_rsp={{0xd, 0xf8, 0x8}, {0x9, 0xf, 0xa, 0x8}}, @l2cap_move_chan_rsp={{0xf, 0x1, 0x4}, {0x5, 0x7b}}, @l2cap_move_chan_cfm_rsp={{0x11, 0xc, 0x2}, {0x7}}, @l2cap_conn_req={{0x2, 0xf1, 0x4}, {0x2, 0x1}}, @l2cap_conn_rsp={{0x3, 0x83, 0x8}, {0x2, 0x0, 0x0, 0x7}}, @l2cap_move_chan_cfm={{0x10, 0x9, 0x4}, {0x3ff, 0x6}}]}}, 0x4b)
ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_DESTROY(r0, 0x5502)

program crashed: KASAN: slab-use-after-free Read in l2cap_send_cmd
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$inet6-syz_emit_vhci-prctl$PR_SCHED_CORE-sched_setaffinity-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-syz_open_dev$usbfs-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
detailed listing:
executing program 0:
bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0xe24, 0x2, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, 0x3}, 0x1c)
syz_emit_vhci(&(0x7f00000004c0)=ANY=[@ANYBLOB="040e0501460c1f00c7f641737da8c5df97e629d54f8eef8f4b4c287248623393943b5ba71f4c252077dee7cda5f191af639f6bc9ccce6307303924e47e62deed5d1bb5921eea00000c30f73971da9388b9ec29139dedf9d61d113d31eeef342c9d"], 0x8)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x2b, &(0x7f0000000040)=0x200000000005)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan0\x00'})
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
syz_open_dev$usbfs(&(0x7f0000000100), 0x75, 0x1a9a81)
syz_emit_vhci(&(0x7f0000000300)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x2, 0x0, 0x46}, @l2cap_cid_signaling={{0x42}, [@l2cap_create_chan_rsp={{0xd, 0x7f, 0x8}, {0x2, 0x8, 0x0, 0x100}}, @l2cap_create_chan_rsp={{0xd, 0xf8, 0x8}, {0x9, 0xf, 0xa, 0x8}}, @l2cap_move_chan_rsp={{0xf, 0x1, 0x4}, {0x5, 0x7b}}, @l2cap_move_chan_cfm_rsp={{0x11, 0xc, 0x2}, {0x7}}, @l2cap_conn_req={{0x2, 0xf1, 0x4}, {0x2, 0x1}}, @l2cap_conn_rsp={{0x3, 0x83, 0x8}, {0x2, 0x0, 0x0, 0x7}}, @l2cap_move_chan_cfm={{0x10, 0x9, 0x4}, {0x3ff, 0x6}}]}}, 0x4b)
ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_DESTROY(r0, 0x5502)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$inet6-syz_emit_vhci-prctl$PR_SCHED_CORE-syz_emit_vhci-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-syz_open_dev$usbfs-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
detailed listing:
executing program 0:
bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0xe24, 0x2, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, 0x3}, 0x1c)
syz_emit_vhci(&(0x7f00000004c0)=ANY=[@ANYBLOB="040e0501460c1f00c7f641737da8c5df97e629d54f8eef8f4b4c287248623393943b5ba71f4c252077dee7cda5f191af639f6bc9ccce6307303924e47e62deed5d1bb5921eea00000c30f73971da9388b9ec29139dedf9d61d113d31eeef342c9d"], 0x8)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
syz_emit_vhci(&(0x7f0000000180)=@HCI_EVENT_PKT={0x4, @inquiry_info_with_rssi_and_pscan_mode={{0x22, 0x10}, {0x1, [{@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xf5, 0x3, 0x5, "a938a9", 0x80, 0xb1}]}}}, 0x13)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan0\x00'})
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
syz_open_dev$usbfs(&(0x7f0000000100), 0x75, 0x1a9a81)
syz_emit_vhci(&(0x7f0000000300)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x2, 0x0, 0x46}, @l2cap_cid_signaling={{0x42}, [@l2cap_create_chan_rsp={{0xd, 0x7f, 0x8}, {0x2, 0x8, 0x0, 0x100}}, @l2cap_create_chan_rsp={{0xd, 0xf8, 0x8}, {0x9, 0xf, 0xa, 0x8}}, @l2cap_move_chan_rsp={{0xf, 0x1, 0x4}, {0x5, 0x7b}}, @l2cap_move_chan_cfm_rsp={{0x11, 0xc, 0x2}, {0x7}}, @l2cap_conn_req={{0x2, 0xf1, 0x4}, {0x2, 0x1}}, @l2cap_conn_rsp={{0x3, 0x83, 0x8}, {0x2, 0x0, 0x0, 0x7}}, @l2cap_move_chan_cfm={{0x10, 0x9, 0x4}, {0x3ff, 0x6}}]}}, 0x4b)
ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_DESTROY(r0, 0x5502)

program crashed: lost connection to test machine
suppressed program crash: lost connection to test machine
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$inet6-syz_emit_vhci-sched_setaffinity-syz_emit_vhci-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-syz_open_dev$usbfs-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
detailed listing:
executing program 0:
bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0xe24, 0x2, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, 0x3}, 0x1c)
syz_emit_vhci(&(0x7f00000004c0)=ANY=[@ANYBLOB="040e0501460c1f00c7f641737da8c5df97e629d54f8eef8f4b4c287248623393943b5ba71f4c252077dee7cda5f191af639f6bc9ccce6307303924e47e62deed5d1bb5921eea00000c30f73971da9388b9ec29139dedf9d61d113d31eeef342c9d"], 0x8)
sched_setaffinity(0x0, 0x2b, &(0x7f0000000040)=0x200000000005)
syz_emit_vhci(&(0x7f0000000180)=@HCI_EVENT_PKT={0x4, @inquiry_info_with_rssi_and_pscan_mode={{0x22, 0x10}, {0x1, [{@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xf5, 0x3, 0x5, "a938a9", 0x80, 0xb1}]}}}, 0x13)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan0\x00'})
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
syz_open_dev$usbfs(&(0x7f0000000100), 0x75, 0x1a9a81)
syz_emit_vhci(&(0x7f0000000300)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x2, 0x0, 0x46}, @l2cap_cid_signaling={{0x42}, [@l2cap_create_chan_rsp={{0xd, 0x7f, 0x8}, {0x2, 0x8, 0x0, 0x100}}, @l2cap_create_chan_rsp={{0xd, 0xf8, 0x8}, {0x9, 0xf, 0xa, 0x8}}, @l2cap_move_chan_rsp={{0xf, 0x1, 0x4}, {0x5, 0x7b}}, @l2cap_move_chan_cfm_rsp={{0x11, 0xc, 0x2}, {0x7}}, @l2cap_conn_req={{0x2, 0xf1, 0x4}, {0x2, 0x1}}, @l2cap_conn_rsp={{0x3, 0x83, 0x8}, {0x2, 0x0, 0x0, 0x7}}, @l2cap_move_chan_cfm={{0x10, 0x9, 0x4}, {0x3ff, 0x6}}]}}, 0x4b)
ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_DESTROY(r0, 0x5502)

program crashed: KASAN: slab-use-after-free Read in hci_disconnect
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$inet6-sched_setaffinity-syz_emit_vhci-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-syz_open_dev$usbfs-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
detailed listing:
executing program 0:
bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0xe24, 0x2, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, 0x3}, 0x1c)
sched_setaffinity(0x0, 0x2b, &(0x7f0000000040)=0x200000000005)
syz_emit_vhci(&(0x7f0000000180)=@HCI_EVENT_PKT={0x4, @inquiry_info_with_rssi_and_pscan_mode={{0x22, 0x10}, {0x1, [{@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xf5, 0x3, 0x5, "a938a9", 0x80, 0xb1}]}}}, 0x13)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan0\x00'})
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
syz_open_dev$usbfs(&(0x7f0000000100), 0x75, 0x1a9a81)
syz_emit_vhci(&(0x7f0000000300)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x2, 0x0, 0x46}, @l2cap_cid_signaling={{0x42}, [@l2cap_create_chan_rsp={{0xd, 0x7f, 0x8}, {0x2, 0x8, 0x0, 0x100}}, @l2cap_create_chan_rsp={{0xd, 0xf8, 0x8}, {0x9, 0xf, 0xa, 0x8}}, @l2cap_move_chan_rsp={{0xf, 0x1, 0x4}, {0x5, 0x7b}}, @l2cap_move_chan_cfm_rsp={{0x11, 0xc, 0x2}, {0x7}}, @l2cap_conn_req={{0x2, 0xf1, 0x4}, {0x2, 0x1}}, @l2cap_conn_rsp={{0x3, 0x83, 0x8}, {0x2, 0x0, 0x0, 0x7}}, @l2cap_move_chan_cfm={{0x10, 0x9, 0x4}, {0x3ff, 0x6}}]}}, 0x4b)
ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_DESTROY(r0, 0x5502)

program crashed: KASAN: slab-use-after-free Read in l2cap_send_cmd
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sched_setaffinity-syz_emit_vhci-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-syz_open_dev$usbfs-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
detailed listing:
executing program 0:
sched_setaffinity(0x0, 0x2b, &(0x7f0000000040)=0x200000000005)
syz_emit_vhci(&(0x7f0000000180)=@HCI_EVENT_PKT={0x4, @inquiry_info_with_rssi_and_pscan_mode={{0x22, 0x10}, {0x1, [{@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xf5, 0x3, 0x5, "a938a9", 0x80, 0xb1}]}}}, 0x13)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan0\x00'})
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
syz_open_dev$usbfs(&(0x7f0000000100), 0x75, 0x1a9a81)
syz_emit_vhci(&(0x7f0000000300)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x2, 0x0, 0x46}, @l2cap_cid_signaling={{0x42}, [@l2cap_create_chan_rsp={{0xd, 0x7f, 0x8}, {0x2, 0x8, 0x0, 0x100}}, @l2cap_create_chan_rsp={{0xd, 0xf8, 0x8}, {0x9, 0xf, 0xa, 0x8}}, @l2cap_move_chan_rsp={{0xf, 0x1, 0x4}, {0x5, 0x7b}}, @l2cap_move_chan_cfm_rsp={{0x11, 0xc, 0x2}, {0x7}}, @l2cap_conn_req={{0x2, 0xf1, 0x4}, {0x2, 0x1}}, @l2cap_conn_rsp={{0x3, 0x83, 0x8}, {0x2, 0x0, 0x0, 0x7}}, @l2cap_move_chan_cfm={{0x10, 0x9, 0x4}, {0x3ff, 0x6}}]}}, 0x4b)
ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_DESTROY(r0, 0x5502)

program crashed: KASAN: slab-use-after-free Read in l2cap_send_cmd
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sched_setaffinity-syz_emit_vhci-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-syz_open_dev$usbfs-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
detailed listing:
executing program 0:
sched_setaffinity(0x0, 0x0, 0x0)
syz_emit_vhci(&(0x7f0000000180)=@HCI_EVENT_PKT={0x4, @inquiry_info_with_rssi_and_pscan_mode={{0x22, 0x10}, {0x1, [{@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xf5, 0x3, 0x5, "a938a9", 0x80, 0xb1}]}}}, 0x13)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan0\x00'})
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
syz_open_dev$usbfs(&(0x7f0000000100), 0x75, 0x1a9a81)
syz_emit_vhci(&(0x7f0000000300)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x2, 0x0, 0x46}, @l2cap_cid_signaling={{0x42}, [@l2cap_create_chan_rsp={{0xd, 0x7f, 0x8}, {0x2, 0x8, 0x0, 0x100}}, @l2cap_create_chan_rsp={{0xd, 0xf8, 0x8}, {0x9, 0xf, 0xa, 0x8}}, @l2cap_move_chan_rsp={{0xf, 0x1, 0x4}, {0x5, 0x7b}}, @l2cap_move_chan_cfm_rsp={{0x11, 0xc, 0x2}, {0x7}}, @l2cap_conn_req={{0x2, 0xf1, 0x4}, {0x2, 0x1}}, @l2cap_conn_rsp={{0x3, 0x83, 0x8}, {0x2, 0x0, 0x0, 0x7}}, @l2cap_move_chan_cfm={{0x10, 0x9, 0x4}, {0x3ff, 0x6}}]}}, 0x4b)
ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_DESTROY(r0, 0x5502)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sched_setaffinity-syz_emit_vhci-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-syz_open_dev$usbfs-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
detailed listing:
executing program 0:
sched_setaffinity(0x0, 0x2b, &(0x7f0000000040)=0x200000000005)
syz_emit_vhci(0x0, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan0\x00'})
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
syz_open_dev$usbfs(&(0x7f0000000100), 0x75, 0x1a9a81)
syz_emit_vhci(&(0x7f0000000300)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x2, 0x0, 0x46}, @l2cap_cid_signaling={{0x42}, [@l2cap_create_chan_rsp={{0xd, 0x7f, 0x8}, {0x2, 0x8, 0x0, 0x100}}, @l2cap_create_chan_rsp={{0xd, 0xf8, 0x8}, {0x9, 0xf, 0xa, 0x8}}, @l2cap_move_chan_rsp={{0xf, 0x1, 0x4}, {0x5, 0x7b}}, @l2cap_move_chan_cfm_rsp={{0x11, 0xc, 0x2}, {0x7}}, @l2cap_conn_req={{0x2, 0xf1, 0x4}, {0x2, 0x1}}, @l2cap_conn_rsp={{0x3, 0x83, 0x8}, {0x2, 0x0, 0x0, 0x7}}, @l2cap_move_chan_cfm={{0x10, 0x9, 0x4}, {0x3ff, 0x6}}]}}, 0x4b)
ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_DESTROY(r0, 0x5502)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sched_setaffinity-syz_emit_vhci-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-syz_open_dev$usbfs-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
detailed listing:
executing program 0:
sched_setaffinity(0x0, 0x2b, &(0x7f0000000040)=0x200000000005)
syz_emit_vhci(&(0x7f0000000180)=@HCI_EVENT_PKT={0x4, @inquiry_info_with_rssi_and_pscan_mode={{0x22, 0x10}, {0x1, [{@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xf5, 0x3, 0x5, "a938a9", 0x80, 0xb1}]}}}, 0x13)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0)
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
syz_open_dev$usbfs(&(0x7f0000000100), 0x75, 0x1a9a81)
syz_emit_vhci(&(0x7f0000000300)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x2, 0x0, 0x46}, @l2cap_cid_signaling={{0x42}, [@l2cap_create_chan_rsp={{0xd, 0x7f, 0x8}, {0x2, 0x8, 0x0, 0x100}}, @l2cap_create_chan_rsp={{0xd, 0xf8, 0x8}, {0x9, 0xf, 0xa, 0x8}}, @l2cap_move_chan_rsp={{0xf, 0x1, 0x4}, {0x5, 0x7b}}, @l2cap_move_chan_cfm_rsp={{0x11, 0xc, 0x2}, {0x7}}, @l2cap_conn_req={{0x2, 0xf1, 0x4}, {0x2, 0x1}}, @l2cap_conn_rsp={{0x3, 0x83, 0x8}, {0x2, 0x0, 0x0, 0x7}}, @l2cap_move_chan_cfm={{0x10, 0x9, 0x4}, {0x3ff, 0x6}}]}}, 0x4b)
ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_DESTROY(r0, 0x5502)

program crashed: KASAN: slab-use-after-free Read in l2cap_send_cmd
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sched_setaffinity-syz_emit_vhci-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-syz_open_dev$usbfs-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
detailed listing:
executing program 0:
sched_setaffinity(0x0, 0x2b, &(0x7f0000000040)=0x200000000005)
syz_emit_vhci(&(0x7f0000000180)=@HCI_EVENT_PKT={0x4, @inquiry_info_with_rssi_and_pscan_mode={{0x22, 0x10}, {0x1, [{@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xf5, 0x3, 0x5, "a938a9", 0x80, 0xb1}]}}}, 0x13)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0)
r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0)
syz_open_dev$usbfs(&(0x7f0000000100), 0x75, 0x1a9a81)
syz_emit_vhci(&(0x7f0000000300)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x2, 0x0, 0x46}, @l2cap_cid_signaling={{0x42}, [@l2cap_create_chan_rsp={{0xd, 0x7f, 0x8}, {0x2, 0x8, 0x0, 0x100}}, @l2cap_create_chan_rsp={{0xd, 0xf8, 0x8}, {0x9, 0xf, 0xa, 0x8}}, @l2cap_move_chan_rsp={{0xf, 0x1, 0x4}, {0x5, 0x7b}}, @l2cap_move_chan_cfm_rsp={{0x11, 0xc, 0x2}, {0x7}}, @l2cap_conn_req={{0x2, 0xf1, 0x4}, {0x2, 0x1}}, @l2cap_conn_rsp={{0x3, 0x83, 0x8}, {0x2, 0x0, 0x0, 0x7}}, @l2cap_move_chan_cfm={{0x10, 0x9, 0x4}, {0x3ff, 0x6}}]}}, 0x4b)
ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_DESTROY(r0, 0x5502)

program crashed: KASAN: slab-use-after-free Read in l2cap_send_cmd
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sched_setaffinity-syz_emit_vhci-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-syz_open_dev$usbfs-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
detailed listing:
executing program 0:
sched_setaffinity(0x0, 0x2b, &(0x7f0000000040)=0x200000000005)
syz_emit_vhci(&(0x7f0000000180)=@HCI_EVENT_PKT={0x4, @inquiry_info_with_rssi_and_pscan_mode={{0x22, 0x10}, {0x1, [{@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xf5, 0x3, 0x5, "a938a9", 0x80, 0xb1}]}}}, 0x13)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0)
r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0)
syz_open_dev$usbfs(0x0, 0x75, 0x1a9a81)
syz_emit_vhci(&(0x7f0000000300)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x2, 0x0, 0x46}, @l2cap_cid_signaling={{0x42}, [@l2cap_create_chan_rsp={{0xd, 0x7f, 0x8}, {0x2, 0x8, 0x0, 0x100}}, @l2cap_create_chan_rsp={{0xd, 0xf8, 0x8}, {0x9, 0xf, 0xa, 0x8}}, @l2cap_move_chan_rsp={{0xf, 0x1, 0x4}, {0x5, 0x7b}}, @l2cap_move_chan_cfm_rsp={{0x11, 0xc, 0x2}, {0x7}}, @l2cap_conn_req={{0x2, 0xf1, 0x4}, {0x2, 0x1}}, @l2cap_conn_rsp={{0x3, 0x83, 0x8}, {0x2, 0x0, 0x0, 0x7}}, @l2cap_move_chan_cfm={{0x10, 0x9, 0x4}, {0x3ff, 0x6}}]}}, 0x4b)
ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_DESTROY(r0, 0x5502)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sched_setaffinity-syz_emit_vhci-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-syz_open_dev$usbfs-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
detailed listing:
executing program 0:
sched_setaffinity(0x0, 0x2b, &(0x7f0000000040)=0x200000000005)
syz_emit_vhci(&(0x7f0000000180)=@HCI_EVENT_PKT={0x4, @inquiry_info_with_rssi_and_pscan_mode={{0x22, 0x10}, {0x1, [{@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xf5, 0x3, 0x5, "a938a9", 0x80, 0xb1}]}}}, 0x13)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0)
r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0)
syz_open_dev$usbfs(&(0x7f0000000100), 0x75, 0x1a9a81)
syz_emit_vhci(0x0, 0x0)
ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_DESTROY(r0, 0x5502)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sched_setaffinity-syz_emit_vhci-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-syz_open_dev$usbfs-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
detailed listing:
executing program 0:
sched_setaffinity(0x0, 0x2b, &(0x7f0000000040)=0x200000000005)
syz_emit_vhci(&(0x7f0000000180)=@HCI_EVENT_PKT={0x4, @inquiry_info_with_rssi_and_pscan_mode={{0x22, 0x10}, {0x1, [{@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xf5, 0x3, 0x5, "a938a9", 0x80, 0xb1}]}}}, 0x13)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0)
r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0)
syz_open_dev$usbfs(&(0x7f0000000100), 0x75, 0x1a9a81)
syz_emit_vhci(&(0x7f0000000300)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x2, 0x0, 0x4}}, 0x9)
ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'})
ioctl$UI_DEV_DESTROY(r0, 0x5502)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sched_setaffinity-syz_emit_vhci-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-syz_open_dev$usbfs-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
detailed listing:
executing program 0:
sched_setaffinity(0x0, 0x2b, &(0x7f0000000040)=0x200000000005)
syz_emit_vhci(&(0x7f0000000180)=@HCI_EVENT_PKT={0x4, @inquiry_info_with_rssi_and_pscan_mode={{0x22, 0x10}, {0x1, [{@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xf5, 0x3, 0x5, "a938a9", 0x80, 0xb1}]}}}, 0x13)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0)
r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0)
syz_open_dev$usbfs(&(0x7f0000000100), 0x75, 0x1a9a81)
syz_emit_vhci(&(0x7f0000000300)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x2, 0x0, 0x46}, @l2cap_cid_signaling={{0x42}, [@l2cap_create_chan_rsp={{0xd, 0x7f, 0x8}, {0x2, 0x8, 0x0, 0x100}}, @l2cap_create_chan_rsp={{0xd, 0xf8, 0x8}, {0x9, 0xf, 0xa, 0x8}}, @l2cap_move_chan_rsp={{0xf, 0x1, 0x4}, {0x5, 0x7b}}, @l2cap_move_chan_cfm_rsp={{0x11, 0xc, 0x2}, {0x7}}, @l2cap_conn_req={{0x2, 0xf1, 0x4}, {0x2, 0x1}}, @l2cap_conn_rsp={{0x3, 0x83, 0x8}, {0x2, 0x0, 0x0, 0x7}}, @l2cap_move_chan_cfm={{0x10, 0x9, 0x4}, {0x3ff, 0x6}}]}}, 0x4b)
ioctl$UI_DEV_SETUP(r0, 0x405c5503, 0x0)
ioctl$UI_DEV_DESTROY(r0, 0x5502)

program did not crash
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sched_setaffinity-syz_emit_vhci-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-syz_open_dev$usbfs-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
program crashed: KASAN: slab-use-after-free Read in l2cap_send_cmd
simplifying C reproducer
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sched_setaffinity-syz_emit_vhci-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-syz_open_dev$usbfs-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
program crashed: KASAN: slab-use-after-free Read in l2cap_send_cmd
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sched_setaffinity-syz_emit_vhci-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-syz_open_dev$usbfs-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sched_setaffinity-syz_emit_vhci-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-syz_open_dev$usbfs-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sched_setaffinity-syz_emit_vhci-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-syz_open_dev$usbfs-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sched_setaffinity-syz_emit_vhci-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-syz_open_dev$usbfs-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
program crashed: KASAN: slab-use-after-free Read in l2cap_send_cmd
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sched_setaffinity-syz_emit_vhci-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-syz_open_dev$usbfs-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sched_setaffinity-syz_emit_vhci-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-syz_open_dev$usbfs-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sched_setaffinity-syz_emit_vhci-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-syz_open_dev$usbfs-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sched_setaffinity-syz_emit_vhci-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-syz_open_dev$usbfs-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sched_setaffinity-syz_emit_vhci-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-syz_open_dev$usbfs-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sched_setaffinity-syz_emit_vhci-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-syz_open_dev$usbfs-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sched_setaffinity-syz_emit_vhci-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-syz_open_dev$usbfs-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sched_setaffinity-syz_emit_vhci-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-syz_open_dev$usbfs-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sched_setaffinity-syz_emit_vhci-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-syz_open_dev$usbfs-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:false Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sched_setaffinity-syz_emit_vhci-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-syz_open_dev$usbfs-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sched_setaffinity-syz_emit_vhci-ioctl$sock_SIOCGIFINDEX_80211-openat$uinput-syz_open_dev$usbfs-syz_emit_vhci-ioctl$UI_DEV_SETUP-ioctl$UI_DEV_DESTROY
program crashed: KASAN: slab-use-after-free Read in l2cap_send_cmd
reproducing took 3h22m46.405097293s
repro crashed as (corrupted=false):
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x10
Bluetooth: Wrong link type (-22)
==================================================================
BUG: KASAN: slab-use-after-free in l2cap_build_cmd net/bluetooth/l2cap_core.c:2951 [inline]
BUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x67b/0x8d0 net/bluetooth/l2cap_core.c:954
Read of size 4 at addr ffff8880353b0010 by task kworker/u9:1/5143

CPU: 1 UID: 0 PID: 5143 Comm: kworker/u9:1 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: hci2 hci_rx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x169/0x550 mm/kasan/report.c:489
 kasan_report+0x143/0x180 mm/kasan/report.c:602
 l2cap_build_cmd net/bluetooth/l2cap_core.c:2951 [inline]
 l2cap_send_cmd+0x67b/0x8d0 net/bluetooth/l2cap_core.c:954
 l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline]
 l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline]
 l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817
 hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline]
 hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040
 process_one_work kernel/workqueue.c:3229 [inline]
 process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
 worker_thread+0x870/0xd30 kernel/workqueue.c:3391
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>

Allocated by task 5868:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
 __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
 kasan_kmalloc include/linux/kasan.h:260 [inline]
 __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329
 kmalloc_noprof include/linux/slab.h:901 [inline]
 kzalloc_noprof include/linux/slab.h:1037 [inline]
 l2cap_conn_add+0xa9/0x8e0 net/bluetooth/l2cap_core.c:6860
 l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7239
 hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
 hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726
 hci_event_func net/bluetooth/hci_event.c:7473 [inline]
 hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525
 hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035
 process_one_work kernel/workqueue.c:3229 [inline]
 process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
 worker_thread+0x870/0xd30 kernel/workqueue.c:3391
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Freed by task 5860:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582
 poison_slab_object mm/kasan/common.c:247 [inline]
 __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
 kasan_slab_free include/linux/kasan.h:233 [inline]
 slab_free_hook mm/slub.c:2353 [inline]
 slab_free mm/slub.c:4613 [inline]
 kfree+0x196/0x430 mm/slub.c:4761
 l2cap_connect_cfm+0xcc/0x1090 net/bluetooth/l2cap_core.c:7235
 hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
 hci_conn_failed+0x287/0x400 net/bluetooth/hci_conn.c:1266
 hci_abort_conn_sync+0x56c/0x11f0 net/bluetooth/hci_sync.c:5603
 hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332
 process_one_work kernel/workqueue.c:3229 [inline]
 process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
 worker_thread+0x870/0xd30 kernel/workqueue.c:3391
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Last potentially related work creation:
 kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47
 __kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:544
 insert_work+0x3e/0x330 kernel/workqueue.c:2183
 __queue_work+0xc8b/0xf50 kernel/workqueue.c:2339
 call_timer_fn+0x187/0x650 kernel/time/timer.c:1793
 expire_timers kernel/time/timer.c:1839 [inline]
 __run_timers kernel/time/timer.c:2418 [inline]
 __run_timer_base+0x695/0x8e0 kernel/time/timer.c:2430
 run_timer_base kernel/time/timer.c:2439 [inline]
 run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2449
 handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561
 __do_softirq kernel/softirq.c:595 [inline]
 invoke_softirq kernel/softirq.c:435 [inline]
 __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702

Second to last potentially related work creation:
 kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47
 __kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:544
 insert_work+0x3e/0x330 kernel/workqueue.c:2183
 __queue_work+0xb66/0xf50 kernel/workqueue.c:2343
 queue_work_on+0x1c2/0x380 kernel/workqueue.c:2390
 queue_work include/linux/workqueue.h:662 [inline]
 l2cap_conn_ready net/bluetooth/l2cap_core.c:1640 [inline]
 l2cap_connect_cfm+0xdd5/0x1090 net/bluetooth/l2cap_core.c:7280
 hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
 hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726
 hci_event_func net/bluetooth/hci_event.c:7473 [inline]
 hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525
 hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035
 process_one_work kernel/workqueue.c:3229 [inline]
 process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
 worker_thread+0x870/0xd30 kernel/workqueue.c:3391
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

The buggy address belongs to the object at ffff8880353b0000
 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 16 bytes inside of
 freed 1024-byte region [ffff8880353b0000, ffff8880353b0400)

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x353b0
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801ac41dc0 ffffea0001ec9c00 dead000000000002
raw: 0000000000000000 0000000000100010 00000001f5000000 0000000000000000
head: 00fff00000000040 ffff88801ac41dc0 ffffea0001ec9c00 dead000000000002
head: 0000000000000000 0000000000100010 00000001f5000000 0000000000000000
head: 00fff00000000003 ffffea0000d4ec01 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 28272630773, free_ts 0
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1558
 prep_new_page mm/page_alloc.c:1566 [inline]
 get_page_from_freelist+0x365c/0x37a0 mm/page_alloc.c:3476
 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4753
 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2269
 alloc_slab_page+0x6a/0x110 mm/slub.c:2423
 allocate_slab+0x5a/0x2b0 mm/slub.c:2589
 new_slab mm/slub.c:2642 [inline]
 ___slab_alloc+0xc27/0x14a0 mm/slub.c:3830
 __slab_alloc+0x58/0xa0 mm/slub.c:3920
 __slab_alloc_node mm/slub.c:3995 [inline]
 slab_alloc_node mm/slub.c:4156 [inline]
 __do_kmalloc_node mm/slub.c:4297 [inline]
 __kmalloc_noprof+0x2e6/0x4c0 mm/slub.c:4310
 mpi_powm+0x119d/0x2420 lib/crypto/mpi/mpi-pow.c:155
 _rsa_enc crypto/rsa.c:62 [inline]
 rsa_enc+0x32c/0x480 crypto/rsa.c:141
 crypto_akcipher_encrypt include/crypto/akcipher.h:279 [inline]
 rsassa_pkcs1_verify+0x44f/0xa40 crypto/rsassa-pkcs1.c:255
 crypto_sig_verify include/crypto/sig.h:220 [inline]
 public_key_verify_signature+0x5da/0x830 crypto/asymmetric_keys/public_key.c:427
 x509_check_for_self_signed+0x324/0x420 crypto/asymmetric_keys/x509_public_key.c:125
 x509_cert_parse+0x66f/0x780 crypto/asymmetric_keys/x509_cert_parser.c:129
 x509_key_preparse+0x65/0x6a0 crypto/asymmetric_keys/x509_public_key.c:157
page_owner free stack trace missing

Memory state around the buggy address:
 ffff8880353aff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8880353aff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8880353b0000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                         ^
 ffff8880353b0080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8880353b0100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

final repro crashed as (corrupted=false):
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x10
Bluetooth: Wrong link type (-22)
==================================================================
BUG: KASAN: slab-use-after-free in l2cap_build_cmd net/bluetooth/l2cap_core.c:2951 [inline]
BUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x67b/0x8d0 net/bluetooth/l2cap_core.c:954
Read of size 4 at addr ffff8880353b0010 by task kworker/u9:1/5143

CPU: 1 UID: 0 PID: 5143 Comm: kworker/u9:1 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: hci2 hci_rx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x169/0x550 mm/kasan/report.c:489
 kasan_report+0x143/0x180 mm/kasan/report.c:602
 l2cap_build_cmd net/bluetooth/l2cap_core.c:2951 [inline]
 l2cap_send_cmd+0x67b/0x8d0 net/bluetooth/l2cap_core.c:954
 l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline]
 l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline]
 l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817
 hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline]
 hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040
 process_one_work kernel/workqueue.c:3229 [inline]
 process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
 worker_thread+0x870/0xd30 kernel/workqueue.c:3391
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>

Allocated by task 5868:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
 __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
 kasan_kmalloc include/linux/kasan.h:260 [inline]
 __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329
 kmalloc_noprof include/linux/slab.h:901 [inline]
 kzalloc_noprof include/linux/slab.h:1037 [inline]
 l2cap_conn_add+0xa9/0x8e0 net/bluetooth/l2cap_core.c:6860
 l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7239
 hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
 hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726
 hci_event_func net/bluetooth/hci_event.c:7473 [inline]
 hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525
 hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035
 process_one_work kernel/workqueue.c:3229 [inline]
 process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
 worker_thread+0x870/0xd30 kernel/workqueue.c:3391
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Freed by task 5860:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582
 poison_slab_object mm/kasan/common.c:247 [inline]
 __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
 kasan_slab_free include/linux/kasan.h:233 [inline]
 slab_free_hook mm/slub.c:2353 [inline]
 slab_free mm/slub.c:4613 [inline]
 kfree+0x196/0x430 mm/slub.c:4761
 l2cap_connect_cfm+0xcc/0x1090 net/bluetooth/l2cap_core.c:7235
 hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
 hci_conn_failed+0x287/0x400 net/bluetooth/hci_conn.c:1266
 hci_abort_conn_sync+0x56c/0x11f0 net/bluetooth/hci_sync.c:5603
 hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332
 process_one_work kernel/workqueue.c:3229 [inline]
 process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
 worker_thread+0x870/0xd30 kernel/workqueue.c:3391
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Last potentially related work creation:
 kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47
 __kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:544
 insert_work+0x3e/0x330 kernel/workqueue.c:2183
 __queue_work+0xc8b/0xf50 kernel/workqueue.c:2339
 call_timer_fn+0x187/0x650 kernel/time/timer.c:1793
 expire_timers kernel/time/timer.c:1839 [inline]
 __run_timers kernel/time/timer.c:2418 [inline]
 __run_timer_base+0x695/0x8e0 kernel/time/timer.c:2430
 run_timer_base kernel/time/timer.c:2439 [inline]
 run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2449
 handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561
 __do_softirq kernel/softirq.c:595 [inline]
 invoke_softirq kernel/softirq.c:435 [inline]
 __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702

Second to last potentially related work creation:
 kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47
 __kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:544
 insert_work+0x3e/0x330 kernel/workqueue.c:2183
 __queue_work+0xb66/0xf50 kernel/workqueue.c:2343
 queue_work_on+0x1c2/0x380 kernel/workqueue.c:2390
 queue_work include/linux/workqueue.h:662 [inline]
 l2cap_conn_ready net/bluetooth/l2cap_core.c:1640 [inline]
 l2cap_connect_cfm+0xdd5/0x1090 net/bluetooth/l2cap_core.c:7280
 hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
 hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726
 hci_event_func net/bluetooth/hci_event.c:7473 [inline]
 hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525
 hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035
 process_one_work kernel/workqueue.c:3229 [inline]
 process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
 worker_thread+0x870/0xd30 kernel/workqueue.c:3391
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

The buggy address belongs to the object at ffff8880353b0000
 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 16 bytes inside of
 freed 1024-byte region [ffff8880353b0000, ffff8880353b0400)

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x353b0
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801ac41dc0 ffffea0001ec9c00 dead000000000002
raw: 0000000000000000 0000000000100010 00000001f5000000 0000000000000000
head: 00fff00000000040 ffff88801ac41dc0 ffffea0001ec9c00 dead000000000002
head: 0000000000000000 0000000000100010 00000001f5000000 0000000000000000
head: 00fff00000000003 ffffea0000d4ec01 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 28272630773, free_ts 0
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1558
 prep_new_page mm/page_alloc.c:1566 [inline]
 get_page_from_freelist+0x365c/0x37a0 mm/page_alloc.c:3476
 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4753
 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2269
 alloc_slab_page+0x6a/0x110 mm/slub.c:2423
 allocate_slab+0x5a/0x2b0 mm/slub.c:2589
 new_slab mm/slub.c:2642 [inline]
 ___slab_alloc+0xc27/0x14a0 mm/slub.c:3830
 __slab_alloc+0x58/0xa0 mm/slub.c:3920
 __slab_alloc_node mm/slub.c:3995 [inline]
 slab_alloc_node mm/slub.c:4156 [inline]
 __do_kmalloc_node mm/slub.c:4297 [inline]
 __kmalloc_noprof+0x2e6/0x4c0 mm/slub.c:4310
 mpi_powm+0x119d/0x2420 lib/crypto/mpi/mpi-pow.c:155
 _rsa_enc crypto/rsa.c:62 [inline]
 rsa_enc+0x32c/0x480 crypto/rsa.c:141
 crypto_akcipher_encrypt include/crypto/akcipher.h:279 [inline]
 rsassa_pkcs1_verify+0x44f/0xa40 crypto/rsassa-pkcs1.c:255
 crypto_sig_verify include/crypto/sig.h:220 [inline]
 public_key_verify_signature+0x5da/0x830 crypto/asymmetric_keys/public_key.c:427
 x509_check_for_self_signed+0x324/0x420 crypto/asymmetric_keys/x509_public_key.c:125
 x509_cert_parse+0x66f/0x780 crypto/asymmetric_keys/x509_cert_parser.c:129
 x509_key_preparse+0x65/0x6a0 crypto/asymmetric_keys/x509_public_key.c:157
page_owner free stack trace missing

Memory state around the buggy address:
 ffff8880353aff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8880353aff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8880353b0000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                         ^
 ffff8880353b0080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8880353b0100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================