last executing test programs:
1.222158814s ago: executing program 3 (id=561):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/bluetooth/6lowpan_control', 0x2, 0x0)
1.220861843s ago: executing program 0 (id=566):
eventfd(0x0)
1.162853689s ago: executing program 3 (id=569):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/tlk_device', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/tlk_device', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/tlk_device', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/tlk_device', 0x800, 0x0)
1.162649773s ago: executing program 0 (id=570):
socket$inet_udp(0x2, 0x2, 0x0)
1.162029861s ago: executing program 0 (id=572):
syz_open_dev$dri(&(0x7f0000000040), 0x0, 0x0)
syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x1)
syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x2)
syz_open_dev$dri(&(0x7f0000000100), 0x0, 0x800)
syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x0)
syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x1)
syz_open_dev$dri(&(0x7f00000001c0), 0x1, 0x2)
syz_open_dev$dri(&(0x7f0000000200), 0x1, 0x800)
syz_open_dev$dri(&(0x7f0000000240), 0x2, 0x0)
syz_open_dev$dri(&(0x7f0000000280), 0x2, 0x1)
syz_open_dev$dri(&(0x7f00000002c0), 0x2, 0x2)
syz_open_dev$dri(&(0x7f0000000300), 0x2, 0x800)
syz_open_dev$dri(&(0x7f0000000340), 0x3, 0x0)
syz_open_dev$dri(&(0x7f0000000380), 0x3, 0x1)
syz_open_dev$dri(&(0x7f00000003c0), 0x3, 0x2)
syz_open_dev$dri(&(0x7f0000000400), 0x3, 0x800)
syz_open_dev$dri(&(0x7f0000000440), 0x4, 0x0)
syz_open_dev$dri(&(0x7f0000000480), 0x4, 0x1)
syz_open_dev$dri(&(0x7f00000004c0), 0x4, 0x2)
syz_open_dev$dri(&(0x7f0000000500), 0x4, 0x800)
1.16172411s ago: executing program 3 (id=575):
io_getevents(0x0, 0x0, 0x0, &(0x7f0000000000), 0x0)
1.10568064s ago: executing program 3 (id=577):
poll(&(0x7f0000000000), 0x0, 0x0)
1.099610977s ago: executing program 3 (id=579):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/fs/smackfs/ambient', 0x2, 0x0)
1.046082698s ago: executing program 0 (id=581):
setuid(0x0)
1.045953522s ago: executing program 3 (id=582):
pause()
1.045855616s ago: executing program 0 (id=583):
sync()
1.030257335s ago: executing program 2 (id=584):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm_plock', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm_plock', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm_plock', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm_plock', 0x800, 0x0)
957.962926ms ago: executing program 2 (id=588):
lsm_list_modules(&(0x7f0000000000), &(0x7f0000000000), 0x0)
957.804684ms ago: executing program 2 (id=589):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/binder', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/binder', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/binder', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/binder', 0x800, 0x0)
957.758175ms ago: executing program 1 (id=590):
timer_delete(0x0)
957.701875ms ago: executing program 1 (id=591):
munmap(0x0, 0x0)
951.89446ms ago: executing program 2 (id=592):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qrtr-tun', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qrtr-tun', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/qrtr-tun', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/qrtr-tun', 0x800, 0x0)
943.442471ms ago: executing program 1 (id=593):
socket$inet_icmp(0x2, 0x2, 0x1)
890.136044ms ago: executing program 2 (id=594):
epoll_create1(0x0)
890.009044ms ago: executing program 1 (id=595):
setgid(0x0)
889.912893ms ago: executing program 2 (id=596):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm', 0x800, 0x0)
889.774489ms ago: executing program 1 (id=597):
clone3(&(0x7f0000000000), 0x0)
exit(0x0)
318.071054ms ago: executing program 1 (id=599):
mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
0s ago: executing program 0 (id=600):
mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.1.90' (ED25519) to the list of known hosts.
syzkaller login: [ 67.231225][ T5812] cgroup: Unknown subsys name 'net'
[ 67.385936][ T5812] cgroup: Unknown subsys name 'cpuset'
[ 67.394651][ T5812] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 68.857323][ T5812] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 71.467348][ T1296] ieee802154 phy0 wpan0: encryption failed: -22
[ 71.473855][ T1296] ieee802154 phy1 wpan1: encryption failed: -22
[ 82.665687][ T6248] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[ 83.238108][ T6299] mmap: syz.2.454 (6299) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst.
[ 83.864306][ T6374] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[ 85.051254][ T6449] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 85.611030][ T52] ==================================================================
[ 85.619218][ T52] BUG: KASAN: slab-use-after-free in hci_cmd_work+0x5d0/0x7b0
[ 85.626692][ T52] Read of size 2 at addr ffff8880298b47b8 by task kworker/u9:0/52
[ 85.634507][ T52]
[ 85.636856][ T52] CPU: 0 UID: 0 PID: 52 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT(full)
[ 85.636873][ T52] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 85.636884][ T52] Workqueue: hci0 hci_cmd_work
[ 85.636910][ T52] Call Trace:
[ 85.636920][ T52]
[ 85.636926][ T52] dump_stack_lvl+0x189/0x250
[ 85.636946][ T52] ? __virt_addr_valid+0x1c8/0x5c0
[ 85.636973][ T52] ? rcu_is_watching+0x15/0xb0
[ 85.636992][ T52] ? __pfx_dump_stack_lvl+0x10/0x10
[ 85.637010][ T52] ? rcu_is_watching+0x15/0xb0
[ 85.637029][ T52] ? lock_release+0x4b/0x3d0
[ 85.637044][ T52] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 85.637064][ T52] ? __virt_addr_valid+0x1c8/0x5c0
[ 85.637084][ T52] ? __virt_addr_valid+0x4a5/0x5c0
[ 85.637105][ T52] print_report+0xca/0x240
[ 85.637125][ T52] ? hci_cmd_work+0x5d0/0x7b0
[ 85.637144][ T52] kasan_report+0x118/0x150
[ 85.637161][ T52] ? hci_cmd_work+0x5d0/0x7b0
[ 85.637182][ T52] hci_cmd_work+0x5d0/0x7b0
[ 85.637204][ T52] ? process_one_work+0x868/0x15e0
[ 85.637219][ T52] process_one_work+0x93a/0x15e0
[ 85.637235][ T52] ? __lock_acquire+0xab9/0xd20
[ 85.637259][ T52] ? __pfx_process_one_work+0x10/0x10
[ 85.637278][ T52] ? assign_work+0x3a1/0x410
[ 85.637296][ T52] worker_thread+0x9b0/0xee0
[ 85.637324][ T52] kthread+0x711/0x8a0
[ 85.637344][ T52] ? __pfx_worker_thread+0x10/0x10
[ 85.637361][ T52] ? __pfx_kthread+0x10/0x10
[ 85.637381][ T52] ? _raw_spin_unlock_irq+0x23/0x50
[ 85.637396][ T52] ? lockdep_hardirqs_on+0x9c/0x150
[ 85.637415][ T52] ? __pfx_kthread+0x10/0x10
[ 85.637434][ T52] ret_from_fork+0x599/0xb30
[ 85.637451][ T52] ? __pfx_ret_from_fork+0x10/0x10
[ 85.637470][ T52] ? __switch_to_asm+0x39/0x70
[ 85.637489][ T52] ? __switch_to_asm+0x33/0x70
[ 85.637507][ T52] ? __pfx_kthread+0x10/0x10
[ 85.637527][ T52] ret_from_fork_asm+0x1a/0x30
[ 85.637554][ T52]
[ 85.637561][ T52]
[ 85.829391][ T52] Allocated by task 5146:
[ 85.833700][ T52] kasan_save_track+0x3e/0x80
[ 85.838365][ T52] __kasan_slab_alloc+0x6c/0x80
[ 85.843188][ T52] kmem_cache_alloc_node_noprof+0x43c/0x710
[ 85.849068][ T52] __alloc_skb+0x112/0x2d0
[ 85.853467][ T52] hci_cmd_sync_alloc+0x3d/0x3b0
[ 85.858496][ T52] __hci_cmd_sync_sk+0x1a7/0xc70
[ 85.863412][ T52] hci_reset_sync+0x4a/0x140
[ 85.868015][ T52] hci_dev_open_sync+0xec5/0x2dc0
[ 85.873041][ T52] hci_power_on+0x1b4/0x720
[ 85.877545][ T52] process_one_work+0x93a/0x15e0
[ 85.882571][ T52] worker_thread+0x9b0/0xee0
[ 85.887235][ T52] kthread+0x711/0x8a0
[ 85.891285][ T52] ret_from_fork+0x599/0xb30
[ 85.895851][ T52] ret_from_fork_asm+0x1a/0x30
[ 85.900599][ T52]
[ 85.902902][ T52] Freed by task 6466:
[ 85.906864][ T52] kasan_save_track+0x3e/0x80
[ 85.911527][ T52] kasan_save_free_info+0x46/0x50
[ 85.916538][ T52] __kasan_slab_free+0x5c/0x80
[ 85.921430][ T52] kmem_cache_free+0x197/0x640
[ 85.926364][ T52] vhci_read+0x49a/0x5b0
[ 85.930632][ T52] vfs_read+0x200/0xa30
[ 85.934777][ T52] ksys_read+0x145/0x250
[ 85.939022][ T52] do_syscall_64+0xfa/0xfa0
[ 85.943512][ T52] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.949386][ T52]
[ 85.951688][ T52] The buggy address belongs to the object at ffff8880298b4780
[ 85.951688][ T52] which belongs to the cache skbuff_head_cache of size 240
[ 85.966247][ T52] The buggy address is located 56 bytes inside of
[ 85.966247][ T52] freed 240-byte region [ffff8880298b4780, ffff8880298b4870)
[ 85.979949][ T52]
[ 85.982351][ T52] The buggy address belongs to the physical page:
[ 85.988780][ T52] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x298b4
[ 85.997559][ T52] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 86.004686][ T52] page_type: f5(slab)
[ 86.008648][ T52] raw: 00fff00000000000 ffff888140a83a00 ffffea0000a62800 dead000000000004
[ 86.017221][ T52] raw: 0000000000000000 00000000000c000c 00000000f5000000 0000000000000000
[ 86.025779][ T52] page dumped because: kasan: bad access detected
[ 86.032217][ T52] page_owner tracks the page as allocated
[ 86.037924][ T52] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5204, tgid 5204 (udevd), ts 26856381311, free_ts 26853873462
[ 86.056586][ T52] post_alloc_hook+0x240/0x2a0
[ 86.061352][ T52] get_page_from_freelist+0x2365/0x2440
[ 86.066879][ T52] __alloc_frozen_pages_noprof+0x181/0x370
[ 86.072689][ T52] alloc_pages_mpol+0x232/0x4a0
[ 86.077521][ T52] allocate_slab+0x86/0x3b0
[ 86.082177][ T52] ___slab_alloc+0xf56/0x1990
[ 86.086835][ T52] __slab_alloc+0x65/0x100
[ 86.091246][ T52] kmem_cache_alloc_node_noprof+0x4ce/0x710
[ 86.097131][ T52] __alloc_skb+0x112/0x2d0
[ 86.101541][ T52] alloc_skb_with_frags+0xca/0x890
[ 86.106631][ T52] sock_alloc_send_pskb+0x84d/0x980
[ 86.111809][ T52] unix_dgram_sendmsg+0x461/0x1850
[ 86.116916][ T52] __sock_sendmsg+0x21c/0x270
[ 86.121579][ T52] sock_write_iter+0x279/0x360
[ 86.126496][ T52] vfs_write+0x5c9/0xb30
[ 86.130721][ T52] ksys_write+0x145/0x250
[ 86.135030][ T52] page last free pid 5197 tgid 5197 stack trace:
[ 86.141328][ T52] __free_frozen_pages+0xbc8/0xd30
[ 86.146506][ T52] __put_partials+0x146/0x170
[ 86.151161][ T52] put_cpu_partial+0x1f2/0x2e0
[ 86.155953][ T52] __slab_free+0x288/0x2a0
[ 86.160348][ T52] qlist_free_all+0x97/0x100
[ 86.164925][ T52] kasan_quarantine_reduce+0x148/0x160
[ 86.170377][ T52] __kasan_slab_alloc+0x22/0x80
[ 86.175215][ T52] kmem_cache_alloc_noprof+0x37d/0x700
[ 86.180741][ T52] getname_flags+0xb8/0x540
[ 86.185227][ T52] do_sys_openat2+0xbc/0x1c0
[ 86.189947][ T52] __x64_sys_openat+0x138/0x170
[ 86.194828][ T52] do_syscall_64+0xfa/0xfa0
[ 86.199337][ T52] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.205212][ T52]
[ 86.207517][ T52] Memory state around the buggy address:
[ 86.213129][ T52] ffff8880298b4680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 86.221253][ T52] ffff8880298b4700: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[ 86.229309][ T52] >ffff8880298b4780: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 86.237453][ T52] ^
[ 86.243346][ T52] ffff8880298b4800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 86.251393][ T52] ffff8880298b4880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 86.259534][ T52] ==================================================================
[ 86.272799][ T52] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 86.280038][ T52] CPU: 0 UID: 0 PID: 52 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT(full)
[ 86.289418][ T52] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 86.299476][ T52] Workqueue: hci0 hci_cmd_work
[ 86.304552][ T52] Call Trace:
[ 86.307831][ T52]
[ 86.310843][ T52] dump_stack_lvl+0x99/0x250
[ 86.315431][ T52] ? __asan_memcpy+0x40/0x70
[ 86.320033][ T52] ? __pfx_dump_stack_lvl+0x10/0x10
[ 86.325225][ T52] ? __pfx__printk+0x10/0x10
[ 86.329799][ T52] vpanic+0x237/0x6d0
[ 86.333766][ T52] ? __pfx_vpanic+0x10/0x10
[ 86.338334][ T52] ? preempt_schedule+0xae/0xc0
[ 86.343175][ T52] ? __pfx_preempt_schedule+0x10/0x10
[ 86.348529][ T52] panic+0xb9/0xc0
[ 86.352318][ T52] ? __pfx_panic+0x10/0x10
[ 86.356719][ T52] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 86.362594][ T52] ? is_module_address+0x17/0xf0
[ 86.367598][ T52] ? hci_cmd_work+0x5d0/0x7b0
[ 86.372266][ T52] check_panic_on_warn+0x89/0xb0
[ 86.377393][ T52] ? hci_cmd_work+0x5d0/0x7b0
[ 86.382172][ T52] end_report+0x6f/0x160
[ 86.386500][ T52] kasan_report+0x129/0x150
[ 86.390995][ T52] ? hci_cmd_work+0x5d0/0x7b0
[ 86.395669][ T52] hci_cmd_work+0x5d0/0x7b0
[ 86.400160][ T52] ? process_one_work+0x868/0x15e0
[ 86.405257][ T52] process_one_work+0x93a/0x15e0
[ 86.410195][ T52] ? __lock_acquire+0xab9/0xd20
[ 86.415060][ T52] ? __pfx_process_one_work+0x10/0x10
[ 86.420501][ T52] ? assign_work+0x3a1/0x410
[ 86.425073][ T52] worker_thread+0x9b0/0xee0
[ 86.429654][ T52] kthread+0x711/0x8a0
[ 86.433721][ T52] ? __pfx_worker_thread+0x10/0x10
[ 86.438813][ T52] ? __pfx_kthread+0x10/0x10
[ 86.443390][ T52] ? _raw_spin_unlock_irq+0x23/0x50
[ 86.448714][ T52] ? lockdep_hardirqs_on+0x9c/0x150
[ 86.454001][ T52] ? __pfx_kthread+0x10/0x10
[ 86.458685][ T52] ret_from_fork+0x599/0xb30
[ 86.463273][ T52] ? __pfx_ret_from_fork+0x10/0x10
[ 86.468391][ T52] ? __switch_to_asm+0x39/0x70
[ 86.473153][ T52] ? __switch_to_asm+0x33/0x70
[ 86.477909][ T52] ? __pfx_kthread+0x10/0x10
[ 86.482498][ T52] ret_from_fork_asm+0x1a/0x30
[ 86.487257][ T52]
[ 86.490575][ T52] Kernel Offset: disabled
[ 86.494885][ T52] Rebooting in 86400 seconds..