Warning: Permanently added '10.128.1.55' (ED25519) to the list of known hosts.
2025/11/17 03:26:18 parsed 1 programs
[ 120.592334][ T6160] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 124.010727][ T50] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 124.018745][ T50] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 124.052887][ T1328] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 124.060784][ T1328] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 125.034752][ T5147] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 125.052214][ T5147] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 125.062141][ T5147] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 125.071833][ T5147] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 125.082315][ T5147] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 125.089640][ T5147] ==================================================================
[ 125.097810][ T5147] BUG: KASAN: slab-use-after-free in hci_cmd_work+0x5d0/0x7b0
[ 125.105303][ T5147] Read of size 2 at addr ffff88807b396cb8 by task kworker/u9:1/5147
[ 125.113291][ T5147]
[ 125.115767][ T5147] CPU: 1 UID: 0 PID: 5147 Comm: kworker/u9:1 Not tainted syzkaller #0 PREEMPT(full)
[ 125.115790][ T5147] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 125.115802][ T5147] Workqueue: hci0 hci_cmd_work
[ 125.115839][ T5147] Call Trace:
[ 125.115848][ T5147]
[ 125.115856][ T5147] dump_stack_lvl+0x189/0x250
[ 125.115880][ T5147] ? __virt_addr_valid+0x1c8/0x5c0
[ 125.115897][ T5147] ? rcu_is_watching+0x15/0xb0
[ 125.115912][ T5147] ? __pfx_dump_stack_lvl+0x10/0x10
[ 125.115933][ T5147] ? rcu_is_watching+0x15/0xb0
[ 125.115947][ T5147] ? lock_release+0x4b/0x3d0
[ 125.115966][ T5147] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 125.115984][ T5147] ? __virt_addr_valid+0x1c8/0x5c0
[ 125.116000][ T5147] ? __virt_addr_valid+0x4a5/0x5c0
[ 125.116017][ T5147] print_report+0xca/0x240
[ 125.116036][ T5147] ? hci_cmd_work+0x5d0/0x7b0
[ 125.116054][ T5147] kasan_report+0x118/0x150
[ 125.116074][ T5147] ? hci_cmd_work+0x5d0/0x7b0
[ 125.116096][ T5147] hci_cmd_work+0x5d0/0x7b0
[ 125.116116][ T5147] ? process_one_work+0x868/0x15e0
[ 125.116135][ T5147] process_one_work+0x93a/0x15e0
[ 125.116154][ T5147] ? __lock_acquire+0xab9/0xd20
[ 125.116181][ T5147] ? __pfx_process_one_work+0x10/0x10
[ 125.116204][ T5147] ? assign_work+0x3a1/0x410
[ 125.116224][ T5147] worker_thread+0x9b0/0xee0
[ 125.116254][ T5147] kthread+0x711/0x8a0
[ 125.116271][ T5147] ? __pfx_worker_thread+0x10/0x10
[ 125.116290][ T5147] ? __pfx_kthread+0x10/0x10
[ 125.116306][ T5147] ? _raw_spin_unlock_irq+0x23/0x50
[ 125.116322][ T5147] ? lockdep_hardirqs_on+0x9c/0x150
[ 125.116340][ T5147] ? __pfx_kthread+0x10/0x10
[ 125.116355][ T5147] ret_from_fork+0x599/0xb30
[ 125.116376][ T5147] ? __pfx_ret_from_fork+0x10/0x10
[ 125.116399][ T5147] ? __switch_to_asm+0x39/0x70
[ 125.116415][ T5147] ? __switch_to_asm+0x33/0x70
[ 125.116429][ T5147] ? __pfx_kthread+0x10/0x10
[ 125.116445][ T5147] ret_from_fork_asm+0x1a/0x30
[ 125.116468][ T5147]
[ 125.116481][ T5147]
[ 125.307826][ T5147] Allocated by task 5869:
[ 125.312166][ T5147] kasan_save_track+0x3e/0x80
[ 125.316934][ T5147] __kasan_slab_alloc+0x6c/0x80
[ 125.321833][ T5147] kmem_cache_alloc_node_noprof+0x43c/0x710
[ 125.327731][ T5147] __alloc_skb+0x112/0x2d0
[ 125.332166][ T5147] hci_cmd_sync_alloc+0x3d/0x3b0
[ 125.337221][ T5147] __hci_cmd_sync_sk+0x1a7/0xc70
[ 125.342152][ T5147] hci_read_current_iac_lap_sync+0x2c/0x120
[ 125.348142][ T5147] hci_dev_open_sync+0x24ad/0x2dc0
[ 125.353274][ T5147] hci_power_on+0x1b4/0x720
[ 125.357812][ T5147] process_one_work+0x93a/0x15e0
[ 125.362736][ T5147] worker_thread+0x9b0/0xee0
[ 125.367421][ T5147] kthread+0x711/0x8a0
[ 125.371584][ T5147] ret_from_fork+0x599/0xb30
[ 125.376245][ T5147] ret_from_fork_asm+0x1a/0x30
[ 125.381084][ T5147]
[ 125.383394][ T5147] Freed by task 6210:
[ 125.387352][ T5147] kasan_save_track+0x3e/0x80
[ 125.392097][ T5147] kasan_save_free_info+0x46/0x50
[ 125.397108][ T5147] __kasan_slab_free+0x5c/0x80
[ 125.401876][ T5147] kmem_cache_free+0x197/0x640
[ 125.406708][ T5147] vhci_read+0x49a/0x5b0
[ 125.410951][ T5147] vfs_read+0x200/0xa30
[ 125.415191][ T5147] ksys_read+0x145/0x250
[ 125.419509][ T5147] do_syscall_64+0xfa/0xfa0
[ 125.424005][ T5147] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 125.430003][ T5147]
[ 125.432331][ T5147] The buggy address belongs to the object at ffff88807b396c80
[ 125.432331][ T5147] which belongs to the cache skbuff_head_cache of size 240
[ 125.446989][ T5147] The buggy address is located 56 bytes inside of
[ 125.446989][ T5147] freed 240-byte region [ffff88807b396c80, ffff88807b396d70)
[ 125.461044][ T5147]
[ 125.463368][ T5147] The buggy address belongs to the physical page:
[ 125.469769][ T5147] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7b396
[ 125.478608][ T5147] anon flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 125.486150][ T5147] page_type: f5(slab)
[ 125.490113][ T5147] raw: 00fff00000000000 ffff8881412a9000 0000000000000000 dead000000000001
[ 125.498698][ T5147] raw: 0000000000000000 00000000000c000c 00000000f5000000 0000000000000000
[ 125.507271][ T5147] page dumped because: kasan: bad access detected
[ 125.513674][ T5147] page_owner tracks the page as allocated
[ 125.519373][ T5147] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5491, tgid 5491 (dhcpcd), ts 62309763028, free_ts 22615162376
[ 125.538202][ T5147] post_alloc_hook+0x240/0x2a0
[ 125.542988][ T5147] get_page_from_freelist+0x2365/0x2440
[ 125.548530][ T5147] __alloc_frozen_pages_noprof+0x181/0x370
[ 125.554413][ T5147] alloc_pages_mpol+0x232/0x4a0
[ 125.559249][ T5147] allocate_slab+0x86/0x3b0
[ 125.563781][ T5147] ___slab_alloc+0xf56/0x1990
[ 125.568461][ T5147] __slab_alloc+0x65/0x100
[ 125.572916][ T5147] kmem_cache_alloc_node_noprof+0x4ce/0x710
[ 125.578795][ T5147] __alloc_skb+0x112/0x2d0
[ 125.583202][ T5147] alloc_skb_with_frags+0xca/0x890
[ 125.588332][ T5147] sock_alloc_send_pskb+0x84d/0x980
[ 125.593978][ T5147] unix_dgram_sendmsg+0x461/0x1850
[ 125.599080][ T5147] __sock_sendmsg+0x21c/0x270
[ 125.603937][ T5147] sock_write_iter+0x279/0x360
[ 125.608697][ T5147] vfs_write+0x5c9/0xb30
[ 125.613012][ T5147] ksys_write+0x145/0x250
[ 125.617349][ T5147] page last free pid 1 tgid 1 stack trace:
[ 125.623226][ T5147] __free_frozen_pages+0xbc8/0xd30
[ 125.628323][ T5147] free_contig_range+0x1bd/0x4a0
[ 125.633246][ T5147] destroy_args+0x69/0x660
[ 125.637648][ T5147] debug_vm_pgtable+0x38f/0x3a0
[ 125.642582][ T5147] do_one_initcall+0x1fb/0x870
[ 125.647325][ T5147] do_initcall_level+0x104/0x190
[ 125.652258][ T5147] do_initcalls+0x59/0xa0
[ 125.656657][ T5147] kernel_init_freeable+0x334/0x4b0
[ 125.661845][ T5147] kernel_init+0x1d/0x1d0
[ 125.666161][ T5147] ret_from_fork+0x599/0xb30
[ 125.670736][ T5147] ret_from_fork_asm+0x1a/0x30
[ 125.675577][ T5147]
[ 125.677990][ T5147] Memory state around the buggy address:
[ 125.683624][ T5147] ffff88807b396b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 125.691676][ T5147] ffff88807b396c00: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[ 125.699918][ T5147] >ffff88807b396c80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 125.707967][ T5147] ^
[ 125.713848][ T5147] ffff88807b396d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 125.721905][ T5147] ffff88807b396d80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 125.729964][ T5147] ==================================================================
[ 125.739904][ T5147] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 125.747224][ T5147] CPU: 1 UID: 0 PID: 5147 Comm: kworker/u9:1 Not tainted syzkaller #0 PREEMPT(full)
[ 125.756783][ T5147] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 125.766836][ T5147] Workqueue: hci0 hci_cmd_work
[ 125.771620][ T5147] Call Trace:
[ 125.774909][ T5147]
[ 125.777894][ T5147] dump_stack_lvl+0x99/0x250
[ 125.782647][ T5147] ? __asan_memcpy+0x40/0x70
[ 125.787271][ T5147] ? __pfx_dump_stack_lvl+0x10/0x10
[ 125.792642][ T5147] ? __pfx__printk+0x10/0x10
[ 125.797275][ T5147] vpanic+0x237/0x6d0
[ 125.801345][ T5147] ? __pfx_vpanic+0x10/0x10
[ 125.805917][ T5147] ? preempt_schedule+0xae/0xc0
[ 125.810778][ T5147] ? __pfx_preempt_schedule+0x10/0x10
[ 125.816573][ T5147] panic+0xb9/0xc0
[ 125.820292][ T5147] ? __pfx_panic+0x10/0x10
[ 125.824702][ T5147] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 125.830581][ T5147] ? is_module_address+0x17/0xf0
[ 125.835504][ T5147] ? hci_cmd_work+0x5d0/0x7b0
[ 125.840166][ T5147] check_panic_on_warn+0x89/0xb0
[ 125.845097][ T5147] ? hci_cmd_work+0x5d0/0x7b0
[ 125.849939][ T5147] end_report+0x6f/0x160
[ 125.854256][ T5147] kasan_report+0x129/0x150
[ 125.858745][ T5147] ? hci_cmd_work+0x5d0/0x7b0
[ 125.863427][ T5147] hci_cmd_work+0x5d0/0x7b0
[ 125.867945][ T5147] ? process_one_work+0x868/0x15e0
[ 125.873069][ T5147] process_one_work+0x93a/0x15e0
[ 125.878022][ T5147] ? __lock_acquire+0xab9/0xd20
[ 125.883107][ T5147] ? __pfx_process_one_work+0x10/0x10
[ 125.888486][ T5147] ? assign_work+0x3a1/0x410
[ 125.893075][ T5147] worker_thread+0x9b0/0xee0
[ 125.897691][ T5147] kthread+0x711/0x8a0
[ 125.901752][ T5147] ? __pfx_worker_thread+0x10/0x10
[ 125.906846][ T5147] ? __pfx_kthread+0x10/0x10
[ 125.911417][ T5147] ? _raw_spin_unlock_irq+0x23/0x50
[ 125.916598][ T5147] ? lockdep_hardirqs_on+0x9c/0x150
[ 125.921786][ T5147] ? __pfx_kthread+0x10/0x10
[ 125.926361][ T5147] ret_from_fork+0x599/0xb30
[ 125.930938][ T5147] ? __pfx_ret_from_fork+0x10/0x10
[ 125.936131][ T5147] ? __switch_to_asm+0x39/0x70
[ 125.940882][ T5147] ? __switch_to_asm+0x33/0x70
[ 125.945715][ T5147] ? __pfx_kthread+0x10/0x10
[ 125.950297][ T5147] ret_from_fork_asm+0x1a/0x30
[ 125.955140][ T5147]
[ 125.958471][ T5147] Kernel Offset: disabled
[ 125.962957][ T5147] Rebooting in 86400 seconds..