Warning: Permanently added '[localhost]:6134' (ED25519) to the list of known hosts.
2024/08/05 21:27:23 ignoring optional flag "sandboxArg"="0"
2024/08/05 21:27:23 parsed 1 programs
[ 88.799995][ T39] audit: type=1400 audit(1722893243.419:132): avc: denied { getattr } for pid=5460 comm="syz-execprog" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 88.808333][ T39] audit: type=1400 audit(1722893243.419:133): avc: denied { read } for pid=5460 comm="syz-execprog" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 88.816749][ T39] audit: type=1400 audit(1722893243.419:134): avc: denied { open } for pid=5460 comm="syz-execprog" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 88.894497][ T39] audit: type=1400 audit(1722893243.519:135): avc: denied { unlink } for pid=5467 comm="syz-executor" name="swap-file" dev="sda1" ino=1931 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t"
[ 90.436650][ T5467] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
2024/08/05 21:27:25 executed programs: 0
[ 90.492341][ T68] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 90.496949][ T68] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 90.500946][ T68] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 90.505063][ T68] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 90.508607][ T68] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 90.513736][ T68] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 90.531478][ T39] audit: type=1400 audit(1722893245.149:136): avc: denied { mounton } for pid=5473 comm="syz-executor.0" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1
[ 90.660324][ T5473] chnl_net:caif_netlink_parms(): no params data found
[ 90.782128][ T5473] bridge0: port 1(bridge_slave_0) entered blocking state
[ 90.785574][ T5473] bridge0: port 1(bridge_slave_0) entered disabled state
[ 90.789243][ T5473] bridge_slave_0: entered allmulticast mode
[ 90.793966][ T5473] bridge_slave_0: entered promiscuous mode
[ 90.799513][ T5473] bridge0: port 2(bridge_slave_1) entered blocking state
[ 90.802769][ T5473] bridge0: port 2(bridge_slave_1) entered disabled state
[ 90.805704][ T5473] bridge_slave_1: entered allmulticast mode
[ 90.809336][ T5473] bridge_slave_1: entered promiscuous mode
[ 90.865514][ T5473] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 90.871617][ T5473] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 90.928675][ T5473] team0: Port device team_slave_0 added
[ 90.940450][ T5473] team0: Port device team_slave_1 added
[ 90.995595][ T5473] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 90.998588][ T5473] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 91.010188][ T5473] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 91.020558][ T5473] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 91.023757][ T5473] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 91.040187][ T5473] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 91.118540][ T5473] hsr_slave_0: entered promiscuous mode
[ 91.121729][ T5473] hsr_slave_1: entered promiscuous mode
[ 91.837223][ T5473] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 91.850327][ T5473] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 91.860257][ T5473] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 91.866172][ T5473] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 91.945257][ T5473] 8021q: adding VLAN 0 to HW filter on device bond0
[ 91.964047][ T5473] 8021q: adding VLAN 0 to HW filter on device team0
[ 91.972006][ T8] bridge0: port 1(bridge_slave_0) entered blocking state
[ 91.974942][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 91.985698][ T66] bridge0: port 2(bridge_slave_1) entered blocking state
[ 91.988991][ T66] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 92.180177][ T5473] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 92.217288][ T5473] veth0_vlan: entered promiscuous mode
[ 92.225015][ T5473] veth1_vlan: entered promiscuous mode
[ 92.246593][ T5473] veth0_macvtap: entered promiscuous mode
[ 92.252476][ T5473] veth1_macvtap: entered promiscuous mode
[ 92.267390][ T5473] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 92.277342][ T5473] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 92.285042][ T5473] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 92.288241][ T5473] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 92.290439][ T5473] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 92.293949][ T5473] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 92.358838][ T1161] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 92.362426][ T1161] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 92.383313][ T45] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 92.386888][ T45] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 92.445678][ T39] audit: type=1400 audit(1722893247.069:137): avc: denied { connect } for pid=5533 comm="syz-executor.0" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1
[ 92.596118][ T4764] Bluetooth: hci0: command tx timeout
[ 92.690164][ T5535] loop0: detected capacity change from 0 to 32768
[ 92.695010][ T39] audit: type=1400 audit(1722893247.319:138): avc: denied { mounton } for pid=5533 comm="syz-executor.0" path="/syzkaller-testdir4136961144/syzkaller.fOugAw/0/file0" dev="sda1" ino=1939 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1
[ 92.700216][ T5535] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop0 (7:0) scanned by syz-executor.0 (5535)
[ 92.725131][ T5535] BTRFS info (device loop0): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[ 92.729492][ T5535] BTRFS info (device loop0): using sha256 (sha256-ni) checksum algorithm
[ 92.734962][ T5535] BTRFS info (device loop0): using free-space-tree
[ 92.801465][ T39] audit: type=1400 audit(1722893247.419:139): avc: denied { mount } for pid=5533 comm="syz-executor.0" name="/" dev="loop0" ino=256 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1
[ 92.811216][ T39] audit: type=1400 audit(1722893247.419:140): avc: denied { mounton } for pid=5533 comm="syz-executor.0" path="/syzkaller-testdir4136961144/syzkaller.fOugAw/0/file0" dev="loop0" ino=256 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1
[ 92.823279][ T39] audit: type=1400 audit(1722893247.439:141): avc: denied { unmount } for pid=5473 comm="syz-executor.0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1
[ 92.873326][ T9] cfg80211: failed to load regulatory.db
[ 92.881580][ T5473] BTRFS info (device loop0): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[ 95.491083][ T45] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
2024/08/05 21:27:30 executed programs: 2
[ 95.569165][ T68] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 95.573536][ T68] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 95.577764][ T68] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 95.581757][ T68] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 95.585435][ T68] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 95.588731][ T68] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 95.741388][ T5612] chnl_net:caif_netlink_parms(): no params data found
[ 95.851060][ T5612] bridge0: port 1(bridge_slave_0) entered blocking state
[ 95.854537][ T5612] bridge0: port 1(bridge_slave_0) entered disabled state
[ 95.857590][ T5612] bridge_slave_0: entered allmulticast mode
[ 95.861298][ T5612] bridge_slave_0: entered promiscuous mode
[ 95.867410][ T5612] bridge0: port 2(bridge_slave_1) entered blocking state
[ 95.870656][ T5612] bridge0: port 2(bridge_slave_1) entered disabled state
[ 95.873624][ T5612] bridge_slave_1: entered allmulticast mode
[ 95.880318][ T5612] bridge_slave_1: entered promiscuous mode
[ 95.930799][ T5612] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 95.937882][ T5612] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 95.997353][ T5612] team0: Port device team_slave_0 added
[ 96.004364][ T5612] team0: Port device team_slave_1 added
[ 96.059035][ T5612] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 96.062662][ T5612] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 96.072796][ T5612] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 96.078443][ T5612] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 96.081347][ T5612] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 96.091718][ T5612] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 96.154024][ T5612] hsr_slave_0: entered promiscuous mode
[ 96.157288][ T5612] hsr_slave_1: entered promiscuous mode
[ 96.160387][ T5612] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 96.165701][ T5612] Cannot create hsr debugfs directory
[ 97.632425][ T4764] Bluetooth: hci0: command tx timeout
[ 98.285062][ T45] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 98.343841][ T45] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 98.407044][ T45] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 98.549974][ T45] bridge_slave_1: left allmulticast mode
[ 98.552485][ T45] bridge_slave_1: left promiscuous mode
[ 98.555349][ T45] bridge0: port 2(bridge_slave_1) entered disabled state
[ 98.560857][ T45] bridge_slave_0: left allmulticast mode
[ 98.563487][ T45] bridge_slave_0: left promiscuous mode
[ 98.566134][ T45] bridge0: port 1(bridge_slave_0) entered disabled state
[ 98.834103][ T45] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 98.839883][ T45] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 98.846043][ T45] bond0 (unregistering): Released all slaves
[ 99.268832][ T45] hsr_slave_0: left promiscuous mode
[ 99.276099][ T45] hsr_slave_1: left promiscuous mode
[ 99.280458][ T45] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 99.290469][ T45] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 99.299246][ T45] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 99.304912][ T45] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 99.341798][ T45] veth1_macvtap: left promiscuous mode
[ 99.344342][ T45] veth0_macvtap: left promiscuous mode
[ 99.346978][ T45] veth1_vlan: left promiscuous mode
[ 99.349527][ T45] veth0_vlan: left promiscuous mode
[ 99.711781][ T4764] Bluetooth: hci0: command tx timeout
[ 99.974166][ T45] team0 (unregistering): Port device team_slave_1 removed
[ 100.026843][ T45] team0 (unregistering): Port device team_slave_0 removed
[ 100.480136][ T5612] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 100.489334][ T5612] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 100.497916][ T5612] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 100.508785][ T5612] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 100.591054][ T5612] 8021q: adding VLAN 0 to HW filter on device bond0
[ 100.606118][ T5612] 8021q: adding VLAN 0 to HW filter on device team0
[ 100.615589][ T66] bridge0: port 1(bridge_slave_0) entered blocking state
[ 100.618906][ T66] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 100.630550][ T832] bridge0: port 2(bridge_slave_1) entered blocking state
[ 100.633455][ T832] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 100.677993][ T5612] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 100.807254][ T5612] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 100.856428][ T5612] veth0_vlan: entered promiscuous mode
[ 100.867493][ T5612] veth1_vlan: entered promiscuous mode
[ 100.896860][ T5612] veth0_macvtap: entered promiscuous mode
[ 100.905994][ T5612] veth1_macvtap: entered promiscuous mode
[ 100.926554][ T5612] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 100.937698][ T5612] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 100.945610][ T5612] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 100.949510][ T5612] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 100.953577][ T5612] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 100.957523][ T5612] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 101.017512][ T1161] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 101.020800][ T1161] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 101.043649][ T1161] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 101.046820][ T1161] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 101.320950][ T5655] loop0: detected capacity change from 0 to 32768
[ 101.331983][ T5655] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop0 (7:0) scanned by syz-executor.0 (5655)
[ 101.343168][ T5655] BTRFS info (device loop0): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[ 101.348227][ T5655] BTRFS info (device loop0): using sha256 (sha256-ni) checksum algorithm
[ 101.352562][ T5655] BTRFS info (device loop0): using free-space-tree
2024/08/05 21:27:36 executed programs: 4
[ 101.439373][ T5612] BTRFS info (device loop0): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[ 101.616443][ T5656] ==================================================================
[ 101.622264][ T5656] BUG: KASAN: slab-use-after-free in device_for_each_child+0x17a/0x190
[ 101.625650][ T5656] Read of size 8 at addr ffff888020ab1308 by task kbnepd bnep0/5656
[ 101.641523][ T5656]
[ 101.643154][ T5656] CPU: 0 UID: 0 PID: 5656 Comm: kbnepd bnep0 Not tainted 6.11.0-rc2-syzkaller-gc813111d19e6 #0
[ 101.647957][ T5656] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 101.652735][ T5656] Call Trace:
[ 101.657537][ T5656]
[ 101.658822][ T5656] dump_stack_lvl+0x116/0x1f0
[ 101.668562][ T5656] print_report+0xc3/0x620
[ 101.670563][ T5656] ? __virt_addr_valid+0x5e/0x590
[ 101.672778][ T5656] ? __phys_addr+0xc6/0x150
[ 101.674588][ T5656] kasan_report+0xd9/0x110
[ 101.676338][ T5656] ? device_for_each_child+0x17a/0x190
[ 101.678484][ T5656] ? device_for_each_child+0x17a/0x190
[ 101.680596][ T5656] ? __pfx_dev_memalloc_noio+0x10/0x10
[ 101.692789][ T5656] device_for_each_child+0x17a/0x190
[ 101.695321][ T5656] ? __pfx_device_for_each_child+0x10/0x10
[ 101.697908][ T5656] pm_runtime_set_memalloc_noio+0xf2/0x180
[ 101.700484][ T5656] netdev_unregister_kobject+0x1ed/0x270
[ 101.702955][ T5656] unregister_netdevice_many_notify+0x103b/0x1e40
[ 101.705799][ T5656] ? __pfx_unregister_netdevice_many_notify+0x10/0x10
[ 101.709500][ T5656] ? trace_contention_end+0xea/0x140
[ 101.711859][ T5656] ? __mutex_lock+0x1a6/0x9c0
[ 101.713911][ T5656] ? unregister_netdev+0x12/0x30
[ 101.716157][ T5656] unregister_netdevice_queue+0x307/0x3f0
[ 101.718783][ T5656] ? __pfx_unregister_netdevice_queue+0x10/0x10
[ 101.721386][ T5656] ? down_write+0x14e/0x200
[ 101.723234][ T5656] ? __pfx_down_write+0x10/0x10
[ 101.725190][ T5656] unregister_netdev+0x1c/0x30
[ 101.727239][ T5656] bnep_session+0x2210/0x2d60
[ 101.729171][ T5656] ? __schedule+0xe3f/0x5490
[ 101.731047][ T5656] ? __pfx___lock_acquire+0x10/0x10
[ 101.733170][ T5656] ? __pfx_bnep_session+0x10/0x10
[ 101.734866][ T5656] ? __kthread_parkme+0xb7/0x220
[ 101.737077][ T5656] ? __pfx_lock_release+0x10/0x10
[ 101.739351][ T5656] ? __pfx_woken_wake_function+0x10/0x10
[ 101.741666][ T5656] ? lockdep_hardirqs_on+0x7c/0x110
[ 101.743707][ T5656] ? __kthread_parkme+0x148/0x220
[ 101.745682][ T5656] ? __pfx_bnep_session+0x10/0x10
[ 101.747919][ T5656] kthread+0x2c1/0x3a0
[ 101.749731][ T5656] ? _raw_spin_unlock_irq+0x23/0x50
[ 101.752041][ T5656] ? __pfx_kthread+0x10/0x10
[ 101.754094][ T5656] ret_from_fork+0x45/0x80
[ 101.756087][ T5656] ? __pfx_kthread+0x10/0x10
[ 101.758169][ T5656] ret_from_fork_asm+0x1a/0x30
[ 101.760133][ T5656]
[ 101.761386][ T5656]
[ 101.762360][ T5656] Allocated by task 5612:
[ 101.764413][ T5656] kasan_save_stack+0x33/0x60
[ 101.766538][ T5656] kasan_save_track+0x14/0x30
[ 101.769276][ T5656] __kasan_kmalloc+0xaa/0xb0
[ 101.771436][ T5656] __kmalloc_noprof+0x1e8/0x400
[ 101.773683][ T5656] hci_alloc_dev_priv+0x1d/0x2820
[ 101.776198][ T5656] __vhci_create_device+0xf0/0x7e0
[ 101.779123][ T5656] vhci_write+0x2c9/0x480
[ 101.781092][ T5656] vfs_write+0x6b6/0x1140
[ 101.783116][ T5656] ksys_write+0x12f/0x260
[ 101.785062][ T5656] do_syscall_64+0xcd/0x250
[ 101.787120][ T5656] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 101.789760][ T5656]
[ 101.790861][ T5656] Freed by task 5612:
[ 101.792683][ T5656] kasan_save_stack+0x33/0x60
[ 101.794817][ T5656] kasan_save_track+0x14/0x30
[ 101.796939][ T5656] kasan_save_free_info+0x3b/0x60
[ 101.802200][ T5656] poison_slab_object+0xf7/0x160
[ 101.804516][ T5656] __kasan_slab_free+0x32/0x50
[ 101.819564][ T5656] kfree+0x12a/0x3b0
[ 101.821204][ T5656] hci_release_dev+0x4d9/0x600
[ 101.824223][ T5656] bt_host_release+0x6a/0xb0
[ 101.827259][ T5656] device_release+0xa1/0x240
[ 101.829728][ T5656] kobject_put+0x1fa/0x5b0
[ 101.831572][ T5656] put_device+0x1f/0x30
[ 101.833352][ T5656] vhci_release+0x87/0x100
[ 101.835265][ T5656] __fput+0x408/0xbb0
[ 101.836945][ T5656] task_work_run+0x14e/0x250
[ 101.838830][ T5656] do_exit+0xaa3/0x2bb0
[ 101.840421][ T5656] do_group_exit+0xd3/0x2a0
[ 101.842164][ T5656] __x64_sys_exit_group+0x3e/0x50
[ 101.844128][ T5656] x64_sys_call+0x14a9/0x16a0
[ 101.845921][ T5656] do_syscall_64+0xcd/0x250
[ 101.847648][ T5656] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 101.850230][ T5656]
[ 101.851282][ T5656] Last potentially related work creation:
[ 101.853532][ T5656] kasan_save_stack+0x33/0x60
[ 101.855394][ T5656] __kasan_record_aux_stack+0xba/0xd0
[ 101.857683][ T5656] insert_work+0x36/0x230
[ 101.859537][ T5656] __queue_work+0x97e/0x1070
[ 101.861495][ T5656] queue_work_on+0x11a/0x140
[ 101.863449][ T5656] l2cap_chan_send+0xb86/0x2a30
[ 101.865489][ T5656] l2cap_sock_sendmsg+0x228/0x300
[ 101.867531][ T5656] sock_sendmsg+0x3cb/0x470
[ 101.869424][ T5656] bnep_session+0x12fb/0x2d60
[ 101.871235][ T5656] kthread+0x2c1/0x3a0
[ 101.872922][ T5656] ret_from_fork+0x45/0x80
[ 101.874749][ T5656] ret_from_fork_asm+0x1a/0x30
[ 101.876725][ T5656]
[ 101.877683][ T5656] Second to last potentially related work creation:
[ 101.880359][ T5656] kasan_save_stack+0x33/0x60
[ 101.882807][ T5656] __kasan_record_aux_stack+0xba/0xd0
[ 101.885138][ T5656] insert_work+0x36/0x230
[ 101.887099][ T5656] __queue_work+0x97e/0x1070
[ 101.889015][ T5656] queue_work_on+0x11a/0x140
[ 101.890982][ T5656] l2cap_chan_send+0xb86/0x2a30
[ 101.893055][ T5656] l2cap_sock_sendmsg+0x228/0x300
[ 101.895264][ T5656] sock_sendmsg+0x3cb/0x470
[ 101.897152][ T5656] bnep_session+0x12fb/0x2d60
[ 101.899477][ T5656] kthread+0x2c1/0x3a0
[ 101.901210][ T5656] ret_from_fork+0x45/0x80
[ 101.903021][ T5656] ret_from_fork_asm+0x1a/0x30
[ 101.905145][ T5656]
[ 101.906172][ T5656] The buggy address belongs to the object at ffff888020ab0000
[ 101.906172][ T5656] which belongs to the cache kmalloc-8k of size 8192
[ 101.912743][ T5656] The buggy address is located 4872 bytes inside of
[ 101.912743][ T5656] freed 8192-byte region [ffff888020ab0000, ffff888020ab2000)
[ 101.918903][ T5656]
[ 101.919855][ T5656] The buggy address belongs to the physical page:
[ 101.922736][ T5656] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x20ab0
[ 101.928352][ T5656] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 101.933165][ T5656] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 101.936393][ T5656] page_type: 0xfdffffff(slab)
[ 101.938635][ T5656] raw: 00fff00000000040 ffff888015843180 dead000000000122 0000000000000000
[ 101.942121][ T5656] raw: 0000000000000000 0000000000020002 00000001fdffffff 0000000000000000
[ 101.946510][ T5656] head: 00fff00000000040 ffff888015843180 dead000000000122 0000000000000000
[ 101.951340][ T5656] head: 0000000000000000 0000000000020002 00000001fdffffff 0000000000000000
[ 101.956774][ T5656] head: 00fff00000000003 ffffea000082ac01 ffffffffffffffff 0000000000000000
[ 101.960338][ T5656] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
[ 101.964035][ T5656] page dumped because: kasan: bad access detected
[ 101.966746][ T5656] page_owner tracks the page as allocated
[ 101.969436][ T5656] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 5612, tgid 5612 (syz-executor.0), ts 95565661018, free_ts 95519277216
[ 101.979650][ T5656] post_alloc_hook+0x2d1/0x350
[ 101.981907][ T5656] get_page_from_freelist+0x1351/0x2e50
[ 101.984255][ T5656] __alloc_pages_noprof+0x22b/0x2460
[ 101.986597][ T5656] alloc_slab_page+0x4e/0xf0
[ 101.988704][ T5656] new_slab+0x84/0x260
[ 101.990551][ T5656] ___slab_alloc+0xdac/0x1870
[ 101.992569][ T5656] __slab_alloc.constprop.0+0x56/0xb0
[ 101.994839][ T5656] __kmalloc_noprof+0x367/0x400
[ 101.997048][ T5656] hci_alloc_dev_priv+0x1d/0x2820
[ 101.999180][ T5656] __vhci_create_device+0xf0/0x7e0
[ 102.001319][ T5656] vhci_write+0x2c9/0x480
[ 102.003121][ T5656] vfs_write+0x6b6/0x1140
[ 102.004965][ T5656] ksys_write+0x12f/0x260
[ 102.006815][ T5656] do_syscall_64+0xcd/0x250
[ 102.008732][ T5656] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.011433][ T5656] page last free pid 5456 tgid 5456 stack trace:
[ 102.014136][ T5656] free_unref_page+0x64a/0xe40
[ 102.016250][ T5656] qlist_free_all+0x4e/0x140
[ 102.018443][ T5656] kasan_quarantine_reduce+0x192/0x1e0
[ 102.020780][ T5656] __kasan_slab_alloc+0x69/0x90
[ 102.022848][ T5656] kmem_cache_alloc_node_noprof+0x153/0x310
[ 102.025317][ T5656] __alloc_skb+0x2b1/0x380
[ 102.027425][ T5656] tcp_stream_alloc_skb+0x34/0x570
[ 102.029809][ T5656] tcp_sendmsg_locked+0xecc/0x3550
[ 102.032839][ T5656] tcp_sendmsg+0x2e/0x50
[ 102.035574][ T5656] inet_sendmsg+0xb9/0x140
[ 102.038839][ T5656] sock_write_iter+0x4b8/0x5c0
[ 102.040927][ T5656] vfs_write+0x6b6/0x1140
[ 102.042825][ T5656] ksys_write+0x1f8/0x260
[ 102.044655][ T5656] do_syscall_64+0xcd/0x250
[ 102.046758][ T5656] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.049349][ T5656]
[ 102.050415][ T5656] Memory state around the buggy address:
[ 102.052790][ T5656] ffff888020ab1200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 102.056144][ T5656] ffff888020ab1280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 102.059916][ T5656] >ffff888020ab1300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 102.063310][ T5656] ^
[ 102.065161][ T5656] ffff888020ab1380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 102.068444][ T5656] ffff888020ab1400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 102.071837][ T5656] ==================================================================
[ 102.076950][ T5656] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 102.080412][ T5656] CPU: 0 UID: 0 PID: 5656 Comm: kbnepd bnep0 Not tainted 6.11.0-rc2-syzkaller-gc813111d19e6 #0
[ 102.084769][ T5656] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 102.091533][ T5656] Call Trace:
[ 102.093322][ T5656]
[ 102.095056][ T5656] dump_stack_lvl+0x3d/0x1f0
[ 102.097704][ T5656] panic+0x6f5/0x7a0
[ 102.099384][ T5656] ? __pfx_panic+0x10/0x10
[ 102.101307][ T5656] ? preempt_schedule_thunk+0x1a/0x30
[ 102.103735][ T5656] ? preempt_schedule_common+0x44/0xc0
[ 102.106083][ T5656] ? check_panic_on_warn+0x1f/0xb0
[ 102.108207][ T5656] check_panic_on_warn+0xab/0xb0
[ 102.111242][ T5656] end_report+0x117/0x180
[ 102.113079][ T5656] kasan_report+0xe9/0x110
[ 102.115027][ T5656] ? device_for_each_child+0x17a/0x190
[ 102.117466][ T5656] ? device_for_each_child+0x17a/0x190
[ 102.119798][ T5656] ? __pfx_dev_memalloc_noio+0x10/0x10
[ 102.122165][ T5656] device_for_each_child+0x17a/0x190
[ 102.124491][ T5656] ? __pfx_device_for_each_child+0x10/0x10
[ 102.127380][ T5656] pm_runtime_set_memalloc_noio+0xf2/0x180
[ 102.129817][ T5656] netdev_unregister_kobject+0x1ed/0x270
[ 102.132788][ T5656] unregister_netdevice_many_notify+0x103b/0x1e40
[ 102.137729][ T5656] ? __pfx_unregister_netdevice_many_notify+0x10/0x10
[ 102.140306][ T5656] ? trace_contention_end+0xea/0x140
[ 102.142964][ T5656] ? __mutex_lock+0x1a6/0x9c0
[ 102.145432][ T5656] ? unregister_netdev+0x12/0x30
[ 102.147564][ T5656] unregister_netdevice_queue+0x307/0x3f0
[ 102.150536][ T5656] ? __pfx_unregister_netdevice_queue+0x10/0x10
[ 102.155125][ T5656] ? down_write+0x14e/0x200
[ 102.157175][ T5656] ? __pfx_down_write+0x10/0x10
[ 102.159252][ T5656] unregister_netdev+0x1c/0x30
[ 102.161073][ T5656] bnep_session+0x2210/0x2d60
[ 102.162996][ T5656] ? __schedule+0xe3f/0x5490
[ 102.164887][ T5656] ? __pfx___lock_acquire+0x10/0x10
[ 102.167033][ T5656] ? __pfx_bnep_session+0x10/0x10
[ 102.169367][ T5656] ? __kthread_parkme+0xb7/0x220
[ 102.171627][ T5656] ? __pfx_lock_release+0x10/0x10
[ 102.174130][ T5656] ? __pfx_woken_wake_function+0x10/0x10
[ 102.177072][ T5656] ? lockdep_hardirqs_on+0x7c/0x110
[ 102.179191][ T5656] ? __kthread_parkme+0x148/0x220
[ 102.181220][ T5656] ? __pfx_bnep_session+0x10/0x10
[ 102.183408][ T5656] kthread+0x2c1/0x3a0
[ 102.185141][ T5656] ? _raw_spin_unlock_irq+0x23/0x50
[ 102.187649][ T5656] ? __pfx_kthread+0x10/0x10
[ 102.189678][ T5656] ret_from_fork+0x45/0x80
[ 102.191566][ T5656] ? __pfx_kthread+0x10/0x10
[ 102.193550][ T5656] ret_from_fork_asm+0x1a/0x30
[ 102.195579][ T5656]
[ 102.197700][ T5656] Kernel Offset: disabled
[ 102.199576][ T5656] Rebooting in 86400 seconds..