Warning: Permanently added '10.128.1.243' (ED25519) to the list of known hosts.
2025/11/17 03:39:27 parsed 1 programs
[ 118.702317][ T6198] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 121.896920][ T5914] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 121.909112][ T5914] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 121.918230][ T5914] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 121.926010][ T5914] ==================================================================
[ 121.934088][ T5914] BUG: KASAN: slab-use-after-free in hci_cmd_work+0x5d0/0x7b0
[ 121.941540][ T5914] Read of size 2 at addr ffff88802a61bdf8 by task kworker/u9:2/5914
[ 121.949690][ T5914]
[ 121.952013][ T5914] CPU: 0 UID: 0 PID: 5914 Comm: kworker/u9:2 Not tainted syzkaller #0 PREEMPT(full)
[ 121.952025][ T5914] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 121.952033][ T5914] Workqueue: hci0 hci_cmd_work
[ 121.952058][ T5914] Call Trace:
[ 121.952065][ T5914]
[ 121.952070][ T5914] dump_stack_lvl+0x189/0x250
[ 121.952085][ T5914] ? __virt_addr_valid+0x1c8/0x5c0
[ 121.952095][ T5914] ? rcu_is_watching+0x15/0xb0
[ 121.952104][ T5914] ? __pfx_dump_stack_lvl+0x10/0x10
[ 121.952117][ T5914] ? rcu_is_watching+0x15/0xb0
[ 121.952125][ T5914] ? lock_release+0x4b/0x3d0
[ 121.952136][ T5914] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 121.952147][ T5914] ? __virt_addr_valid+0x1c8/0x5c0
[ 121.952156][ T5914] ? __virt_addr_valid+0x4a5/0x5c0
[ 121.952166][ T5914] print_report+0xca/0x240
[ 121.952178][ T5914] ? hci_cmd_work+0x5d0/0x7b0
[ 121.952189][ T5914] kasan_report+0x118/0x150
[ 121.952201][ T5914] ? hci_cmd_work+0x5d0/0x7b0
[ 121.952214][ T5914] hci_cmd_work+0x5d0/0x7b0
[ 121.952225][ T5914] ? process_one_work+0x868/0x15e0
[ 121.952237][ T5914] process_one_work+0x93a/0x15e0
[ 121.952248][ T5914] ? __lock_acquire+0xab9/0xd20
[ 121.952263][ T5914] ? __pfx_process_one_work+0x10/0x10
[ 121.952276][ T5914] ? assign_work+0x3a1/0x410
[ 121.952288][ T5914] worker_thread+0x9b0/0xee0
[ 121.952305][ T5914] kthread+0x711/0x8a0
[ 121.952315][ T5914] ? __pfx_worker_thread+0x10/0x10
[ 121.952326][ T5914] ? __pfx_kthread+0x10/0x10
[ 121.952335][ T5914] ? _raw_spin_unlock_irq+0x23/0x50
[ 121.952344][ T5914] ? lockdep_hardirqs_on+0x9c/0x150
[ 121.952354][ T5914] ? __pfx_kthread+0x10/0x10
[ 121.952362][ T5914] ret_from_fork+0x599/0xb30
[ 121.952375][ T5914] ? __pfx_ret_from_fork+0x10/0x10
[ 121.952388][ T5914] ? __switch_to_asm+0x39/0x70
[ 121.952396][ T5914] ? __switch_to_asm+0x33/0x70
[ 121.952404][ T5914] ? __pfx_kthread+0x10/0x10
[ 121.952413][ T5914] ret_from_fork_asm+0x1a/0x30
[ 121.952425][ T5914]
[ 121.952429][ T5914]
[ 122.143069][ T5914] Allocated by task 5145:
[ 122.147430][ T5914] kasan_save_track+0x3e/0x80
[ 122.152130][ T5914] __kasan_slab_alloc+0x6c/0x80
[ 122.157031][ T5914] kmem_cache_alloc_node_noprof+0x43c/0x710
[ 122.162944][ T5914] __alloc_skb+0x112/0x2d0
[ 122.167370][ T5914] hci_cmd_sync_alloc+0x3d/0x3b0
[ 122.172287][ T5914] __hci_cmd_sync_sk+0x1a7/0xc70
[ 122.177288][ T5914] hci_dev_open_sync+0x1756/0x2dc0
[ 122.182483][ T5914] hci_power_on+0x1b4/0x720
[ 122.186967][ T5914] process_one_work+0x93a/0x15e0
[ 122.191912][ T5914] worker_thread+0x9b0/0xee0
[ 122.196565][ T5914] kthread+0x711/0x8a0
[ 122.200671][ T5914] ret_from_fork+0x599/0xb30
[ 122.205351][ T5914] ret_from_fork_asm+0x1a/0x30
[ 122.210098][ T5914]
[ 122.212403][ T5914] Freed by task 6226:
[ 122.216446][ T5914] kasan_save_track+0x3e/0x80
[ 122.221106][ T5914] kasan_save_free_info+0x46/0x50
[ 122.226137][ T5914] __kasan_slab_free+0x5c/0x80
[ 122.230926][ T5914] kmem_cache_free+0x197/0x640
[ 122.235666][ T5914] vhci_read+0x49a/0x5b0
[ 122.239918][ T5914] vfs_read+0x200/0xa30
[ 122.244224][ T5914] ksys_read+0x145/0x250
[ 122.248438][ T5914] do_syscall_64+0xfa/0xfa0
[ 122.252920][ T5914] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 122.258786][ T5914]
[ 122.261098][ T5914] The buggy address belongs to the object at ffff88802a61bdc0
[ 122.261098][ T5914] which belongs to the cache skbuff_head_cache of size 240
[ 122.275829][ T5914] The buggy address is located 56 bytes inside of
[ 122.275829][ T5914] freed 240-byte region [ffff88802a61bdc0, ffff88802a61beb0)
[ 122.289695][ T5914]
[ 122.291999][ T5914] The buggy address belongs to the physical page:
[ 122.298395][ T5914] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2a61b
[ 122.307142][ T5914] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 122.314228][ T5914] page_type: f5(slab)
[ 122.318191][ T5914] raw: 00fff00000000000 ffff888140affa00 ffffea00009f6f40 dead000000000002
[ 122.326860][ T5914] raw: 0000000000000000 00000000000c000c 00000000f5000000 0000000000000000
[ 122.335418][ T5914] page dumped because: kasan: bad access detected
[ 122.341821][ T5914] page_owner tracks the page as allocated
[ 122.347523][ T5914] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5201, tgid 5201 (udevd), ts 26697571062, free_ts 26677023089
[ 122.366179][ T5914] post_alloc_hook+0x240/0x2a0
[ 122.370937][ T5914] get_page_from_freelist+0x2365/0x2440
[ 122.376479][ T5914] __alloc_frozen_pages_noprof+0x181/0x370
[ 122.382278][ T5914] alloc_pages_mpol+0x232/0x4a0
[ 122.387200][ T5914] allocate_slab+0x86/0x3b0
[ 122.391693][ T5914] ___slab_alloc+0xf56/0x1990
[ 122.396369][ T5914] __slab_alloc+0x65/0x100
[ 122.400883][ T5914] kmem_cache_alloc_node_noprof+0x4ce/0x710
[ 122.406774][ T5914] __alloc_skb+0x112/0x2d0
[ 122.411266][ T5914] netlink_sendmsg+0x5c6/0xb30
[ 122.416102][ T5914] __sock_sendmsg+0x21c/0x270
[ 122.420753][ T5914] ____sys_sendmsg+0x505/0x870
[ 122.425578][ T5914] ___sys_sendmsg+0x21f/0x2a0
[ 122.430331][ T5914] __x64_sys_sendmsg+0x19b/0x260
[ 122.435243][ T5914] do_syscall_64+0xfa/0xfa0
[ 122.439807][ T5914] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 122.445673][ T5914] page last free pid 5196 tgid 5196 stack trace:
[ 122.452068][ T5914] __free_frozen_pages+0xbc8/0xd30
[ 122.457158][ T5914] __put_partials+0x146/0x170
[ 122.461812][ T5914] put_cpu_partial+0x1f2/0x2e0
[ 122.466558][ T5914] __slab_free+0x288/0x2a0
[ 122.470953][ T5914] qlist_free_all+0x97/0x100
[ 122.475518][ T5914] kasan_quarantine_reduce+0x148/0x160
[ 122.480952][ T5914] __kasan_slab_alloc+0x22/0x80
[ 122.485780][ T5914] __kmalloc_noprof+0x3cf/0x800
[ 122.490781][ T5914] tomoyo_encode+0x28b/0x550
[ 122.495347][ T5914] tomoyo_realpath_from_path+0x58d/0x5d0
[ 122.501127][ T5914] tomoyo_check_open_permission+0x1c1/0x3b0
[ 122.507000][ T5914] security_file_open+0xb1/0x270
[ 122.511924][ T5914] do_dentry_open+0x374/0x1430
[ 122.516679][ T5914] vfs_open+0x3b/0x340
[ 122.520729][ T5914] path_openat+0x2efb/0x3860
[ 122.525303][ T5914] do_filp_open+0x1fa/0x410
[ 122.529786][ T5914]
[ 122.532095][ T5914] Memory state around the buggy address:
[ 122.537787][ T5914] ffff88802a61bc80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 122.546173][ T5914] ffff88802a61bd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 122.554216][ T5914] >ffff88802a61bd80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 122.562440][ T5914] ^
[ 122.570654][ T5914] ffff88802a61be00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 122.578690][ T5914] ffff88802a61be80: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[ 122.586727][ T5914] ==================================================================
[ 122.598622][ T5914] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 122.605847][ T5914] CPU: 0 UID: 0 PID: 5914 Comm: kworker/u9:2 Not tainted syzkaller #0 PREEMPT(full)
[ 122.615303][ T5914] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 122.625364][ T5914] Workqueue: hci0 hci_cmd_work
[ 122.630126][ T5914] Call Trace:
[ 122.633389][ T5914]
[ 122.636298][ T5914] dump_stack_lvl+0x99/0x250
[ 122.640869][ T5914] ? __asan_memcpy+0x40/0x70
[ 122.645462][ T5914] ? __pfx_dump_stack_lvl+0x10/0x10
[ 122.650644][ T5914] ? __pfx__printk+0x10/0x10
[ 122.655219][ T5914] vpanic+0x237/0x6d0
[ 122.659182][ T5914] ? __pfx_vpanic+0x10/0x10
[ 122.663690][ T5914] ? preempt_schedule+0xae/0xc0
[ 122.668518][ T5914] ? __pfx_preempt_schedule+0x10/0x10
[ 122.673871][ T5914] panic+0xb9/0xc0
[ 122.677576][ T5914] ? __pfx_panic+0x10/0x10
[ 122.681979][ T5914] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 122.687850][ T5914] ? is_module_address+0x17/0xf0
[ 122.692773][ T5914] ? hci_cmd_work+0x5d0/0x7b0
[ 122.697436][ T5914] check_panic_on_warn+0x89/0xb0
[ 122.702354][ T5914] ? hci_cmd_work+0x5d0/0x7b0
[ 122.707018][ T5914] end_report+0x6f/0x160
[ 122.711244][ T5914] kasan_report+0x129/0x150
[ 122.715744][ T5914] ? hci_cmd_work+0x5d0/0x7b0
[ 122.720413][ T5914] hci_cmd_work+0x5d0/0x7b0
[ 122.724913][ T5914] ? process_one_work+0x868/0x15e0
[ 122.730022][ T5914] process_one_work+0x93a/0x15e0
[ 122.734946][ T5914] ? __lock_acquire+0xab9/0xd20
[ 122.739786][ T5914] ? __pfx_process_one_work+0x10/0x10
[ 122.745172][ T5914] ? assign_work+0x3a1/0x410
[ 122.749747][ T5914] worker_thread+0x9b0/0xee0
[ 122.754417][ T5914] kthread+0x711/0x8a0
[ 122.758482][ T5914] ? __pfx_worker_thread+0x10/0x10
[ 122.763597][ T5914] ? __pfx_kthread+0x10/0x10
[ 122.768182][ T5914] ? _raw_spin_unlock_irq+0x23/0x50
[ 122.773467][ T5914] ? lockdep_hardirqs_on+0x9c/0x150
[ 122.778831][ T5914] ? __pfx_kthread+0x10/0x10
[ 122.783408][ T5914] ret_from_fork+0x599/0xb30
[ 122.788079][ T5914] ? __pfx_ret_from_fork+0x10/0x10
[ 122.793180][ T5914] ? __switch_to_asm+0x39/0x70
[ 122.797945][ T5914] ? __switch_to_asm+0x33/0x70
[ 122.802717][ T5914] ? __pfx_kthread+0x10/0x10
[ 122.807289][ T5914] ret_from_fork_asm+0x1a/0x30
[ 122.812228][ T5914]
[ 122.815509][ T5914] Kernel Offset: disabled
[ 122.820021][ T5914] Rebooting in 86400 seconds..