[ 453.834263][ T48] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 453.882875][ T48] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 453.922274][ T48] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 453.976218][ T48] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 454.796870][ T48] hsr_slave_0: left promiscuous mode
[ 454.803109][ T48] hsr_slave_1: left promiscuous mode
[ 454.810506][ T48] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 454.818028][ T48] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 454.827264][ T48] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 454.839179][ T48] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 454.847837][ T48] bridge_slave_1: left allmulticast mode
[ 454.853508][ T48] bridge_slave_1: left promiscuous mode
[ 454.860027][ T48] bridge0: port 2(bridge_slave_1) entered disabled state
[ 454.869691][ T48] bridge_slave_0: left allmulticast mode
[ 454.875360][ T48] bridge_slave_0: left promiscuous mode
[ 454.882012][ T48] bridge0: port 1(bridge_slave_0) entered disabled state
[ 454.895185][ T48] veth1_macvtap: left promiscuous mode
[ 454.901292][ T48] veth0_macvtap: left promiscuous mode
[ 454.907074][ T48] veth1_vlan: left promiscuous mode
[ 454.913181][ T48] veth0_vlan: left promiscuous mode
[ 455.071831][ T48] team0 (unregistering): Port device team_slave_1 removed
[ 455.083971][ T48] team0 (unregistering): Port device team_slave_0 removed
[ 455.098855][ T48] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 455.116860][ T48] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 455.175796][ T48] bond0 (unregistering): Released all slaves
Warning: Permanently added '10.128.0.97' (ED25519) to the list of known hosts.
[ 457.491216][ T5049] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 457.499129][ T5049] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 457.506456][ T5049] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 457.514529][ T5049] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 457.522336][ T5049] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 457.529660][ T5049] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 459.068392][ T48] ==================================================================
[ 459.076494][ T48] BUG: KASAN: use-after-free in hci_cmd_sync_queue+0x31/0xa0
[ 459.084020][ T48] Read of size 8 at addr ffff88806a2f00a8 by task kworker/u4:3/48
[ 459.091822][ T48]
[ 459.094152][ T48] CPU: 0 PID: 48 Comm: kworker/u4:3 Not tainted 6.5.0-rc6-next-20230818-syzkaller-dirty #0
[ 459.104137][ T48] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
[ 459.114201][ T48] Workqueue: events_unbound hci_conn_timeout
[ 459.120257][ T48] Call Trace:
[ 459.123558][ T48]
[ 459.126494][ T48] dump_stack_lvl+0xd9/0x1b0
[ 459.131238][ T48] print_report+0xc4/0x620
[ 459.135794][ T48] ? __virt_addr_valid+0x5e/0x2d0
[ 459.140833][ T48] ? __phys_addr+0xc6/0x140
[ 459.145339][ T48] kasan_report+0xda/0x110
[ 459.149759][ T48] ? hci_cmd_sync_queue+0x31/0xa0
[ 459.154797][ T48] ? hci_cmd_sync_queue+0x31/0xa0
[ 459.159852][ T48] ? hci_get_route+0x510/0x510
[ 459.164822][ T48] kasan_check_range+0xef/0x190
[ 459.169691][ T48] ? hci_get_route+0x510/0x510
[ 459.174560][ T48] hci_cmd_sync_queue+0x31/0xa0
[ 459.179440][ T48] hci_abort_conn+0x15b/0x330
[ 459.184133][ T48] hci_conn_timeout+0x1a9/0x210
[ 459.188989][ T48] process_one_work+0x887/0x15d0
[ 459.193971][ T48] ? lock_sync+0x190/0x190
[ 459.198441][ T48] ? init_worker_pool+0x770/0x770
[ 459.203578][ T48] ? assign_work+0x1a0/0x240
[ 459.208194][ T48] worker_thread+0x8bb/0x1290
[ 459.212897][ T48] ? process_one_work+0x15d0/0x15d0
[ 459.218195][ T48] kthread+0x33a/0x430
[ 459.222270][ T48] ? kthread_complete_and_exit+0x40/0x40
[ 459.227904][ T48] ret_from_fork+0x45/0x80
[ 459.232348][ T48] ? kthread_complete_and_exit+0x40/0x40
[ 459.237990][ T48] ret_from_fork_asm+0x11/0x20
[ 459.242961][ T48]
[ 459.246502][ T48]
[ 459.248819][ T48] The buggy address belongs to the physical page:
[ 459.255650][ T48] page:ffffea0001a8bc00 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6a2f0
[ 459.265909][ T48] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 459.273447][ T48] page_type: 0xffffffff()
[ 459.277777][ T48] raw: 00fff00000000000 ffffea0001957c08 ffffea0001a25708 0000000000000000
[ 459.286363][ T48] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 459.294937][ T48] page dumped because: kasan: bad access detected
[ 459.301364][ T48] page_owner tracks the page as freed
[ 459.306721][ T48] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x5c2cc0(GFP_USER|__GFP_NOWARN|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_ACCOUNT), pid 4708, tgid 4708 (dhcpcd), ts 454062019777, free_ts 454066820991
[ 459.327123][ T48] post_alloc_hook+0x2cf/0x340
[ 459.331906][ T48] get_page_from_freelist+0x10d7/0x31b0
[ 459.337444][ T48] __alloc_pages+0x1d0/0x4a0
[ 459.342030][ T48] __kmalloc_large_node+0x87/0x1c0
[ 459.347233][ T48] __kmalloc_node_track_caller.cold+0x5/0xdd
[ 459.353235][ T48] kmalloc_reserve+0xef/0x270
[ 459.357999][ T48] __alloc_skb+0x12b/0x330
[ 459.362411][ T48] alloc_skb_with_frags+0xe4/0x710
[ 459.367547][ T48] sock_alloc_send_pskb+0x7c8/0x950
[ 459.372841][ T48] unix_dgram_sendmsg+0x455/0x1c30
[ 459.378043][ T48] sock_sendmsg+0xd9/0x180
[ 459.382494][ T48] sock_write_iter+0x29b/0x3d0
[ 459.387263][ T48] do_iter_readv_writev+0x21e/0x3c0
[ 459.392486][ T48] do_iter_write+0x17f/0x830
[ 459.397072][ T48] vfs_writev+0x221/0x700
[ 459.401419][ T48] do_writev+0x285/0x370
[ 459.405680][ T48] page last free stack trace:
[ 459.410428][ T48] free_unref_page_prepare+0x476/0xa40
[ 459.415902][ T48] free_unref_page+0x33/0x3b0
[ 459.420595][ T48] skb_free_head+0x110/0x1b0
[ 459.425188][ T48] skb_release_data+0x5ba/0x870
[ 459.430129][ T48] consume_skb+0xd2/0x170
[ 459.434462][ T48] __unix_dgram_recvmsg+0x814/0xe50
[ 459.439676][ T48] unix_dgram_recvmsg+0xc3/0xf0
[ 459.444938][ T48] sock_recvmsg+0xe2/0x170
[ 459.449364][ T48] sock_read_iter+0x2c3/0x3c0
[ 459.454146][ T48] do_iter_readv_writev+0x2f2/0x3c0
[ 459.459439][ T48] do_iter_read+0x315/0x870
[ 459.463938][ T48] vfs_readv+0x12d/0x1a0
[ 459.468177][ T48] do_readv+0x285/0x370
[ 459.472335][ T48] do_syscall_64+0x38/0xb0
[ 459.476863][ T48] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 459.482800][ T48]
[ 459.485113][ T48] Memory state around the buggy address:
[ 459.490730][ T48] ffff88806a2eff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 459.498783][ T48] ffff88806a2f0000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 459.507034][ T48] >ffff88806a2f0080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 459.515179][ T48] ^
[ 459.520547][ T48] ffff88806a2f0100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 459.528611][ T48] ffff88806a2f0180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 459.536663][ T48] ==================================================================
[ 459.557578][ T7447] Bluetooth: hci0: command 0x0409 tx timeout
[ 459.563707][ T48] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 459.570912][ T48] CPU: 0 PID: 48 Comm: kworker/u4:3 Not tainted 6.5.0-rc6-next-20230818-syzkaller-dirty #0
[ 459.580910][ T48] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
[ 459.590993][ T48] Workqueue: events_unbound hci_conn_timeout
[ 459.597011][ T48] Call Trace:
[ 459.600570][ T48]
[ 459.603512][ T48] dump_stack_lvl+0xd9/0x1b0
[ 459.608130][ T48] panic+0x6a6/0x750
[ 459.612052][ T48] ? panic_smp_self_stop+0xa0/0xa0
[ 459.617197][ T48] ? preempt_schedule_thunk+0x1a/0x30
[ 459.622605][ T48] ? preempt_schedule_common+0x45/0xc0
[ 459.628266][ T48] check_panic_on_warn+0xab/0xb0
[ 459.633324][ T48] end_report+0x108/0x150
[ 459.637691][ T48] kasan_report+0xea/0x110
[ 459.642130][ T48] ? hci_cmd_sync_queue+0x31/0xa0
[ 459.647175][ T48] ? hci_cmd_sync_queue+0x31/0xa0
[ 459.652228][ T48] ? hci_get_route+0x510/0x510
[ 459.657126][ T48] kasan_check_range+0xef/0x190
[ 459.662003][ T48] ? hci_get_route+0x510/0x510
[ 459.666917][ T48] hci_cmd_sync_queue+0x31/0xa0
[ 459.671787][ T48] hci_abort_conn+0x15b/0x330
[ 459.676468][ T48] hci_conn_timeout+0x1a9/0x210
[ 459.681324][ T48] process_one_work+0x887/0x15d0
[ 459.686270][ T48] ? lock_sync+0x190/0x190
[ 459.690799][ T48] ? init_worker_pool+0x770/0x770
[ 459.695826][ T48] ? assign_work+0x1a0/0x240
[ 459.700506][ T48] worker_thread+0x8bb/0x1290
[ 459.705187][ T48] ? process_one_work+0x15d0/0x15d0
[ 459.710390][ T48] kthread+0x33a/0x430
[ 459.714575][ T48] ? kthread_complete_and_exit+0x40/0x40
[ 459.720334][ T48] ret_from_fork+0x45/0x80
[ 459.724765][ T48] ? kthread_complete_and_exit+0x40/0x40
[ 459.730419][ T48] ret_from_fork_asm+0x11/0x20
[ 459.735296][ T48]
[ 459.738598][ T48] Kernel Offset: disabled
[ 459.742916][ T48] Rebooting in 86400 seconds..