[  453.968662][   T78] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  454.017669][   T78] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  454.080578][   T78] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  454.150774][   T78] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  454.940839][   T78] hsr_slave_0: left promiscuous mode
[  454.948395][   T78] hsr_slave_1: left promiscuous mode
[  454.956069][   T78] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  454.967932][   T78] batman_adv: batadv0: Removing interface: batadv_slave_0
[  454.977578][   T78] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  454.985652][   T78] batman_adv: batadv0: Removing interface: batadv_slave_1
[  454.995681][   T78] bridge_slave_1: left allmulticast mode
[  455.001970][   T78] bridge_slave_1: left promiscuous mode
[  455.008488][   T78] bridge0: port 2(bridge_slave_1) entered disabled state
[  455.018839][   T78] bridge_slave_0: left allmulticast mode
[  455.024789][   T78] bridge_slave_0: left promiscuous mode
[  455.030753][   T78] bridge0: port 1(bridge_slave_0) entered disabled state
[  455.044588][   T78] veth1_macvtap: left promiscuous mode
[  455.050430][   T78] veth0_macvtap: left promiscuous mode
[  455.057190][   T78] veth1_vlan: left promiscuous mode
[  455.063054][   T78] veth0_vlan: left promiscuous mode
[  455.289177][   T78] team0 (unregistering): Port device team_slave_1 removed
[  455.301737][   T78] team0 (unregistering): Port device team_slave_0 removed
[  455.316620][   T78] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  455.330681][   T78] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  455.390381][   T78] bond0 (unregistering): Released all slaves
Warning: Permanently added '10.128.1.19' (ED25519) to the list of known hosts.
[  456.769618][   T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  456.779033][   T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  456.788198][   T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  456.796856][   T51] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[  456.804821][   T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  458.822244][ T4448] Bluetooth: hci0: command 0x0409 tx timeout
[  459.062461][   T23] ==================================================================
[  459.071980][   T23] BUG: KASAN: slab-use-after-free in l2cap_chan_del+0xa0b/0xa70
[  459.079882][   T23] Read of size 8 at addr ffff888073cb0718 by task kworker/1:0/23
[  459.087596][   T23] 
[  459.089996][   T23] CPU: 1 PID: 23 Comm: kworker/1:0 Not tainted 6.5.0-rc6-next-20230818-syzkaller-dirty #0
[  459.100939][   T23] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
[  459.111256][   T23] Workqueue: events l2cap_chan_timeout
[  459.116826][   T23] Call Trace:
[  459.120278][   T23]  <TASK>
[  459.123385][   T23]  dump_stack_lvl+0xd9/0x1b0
[  459.128013][   T23]  print_report+0xc4/0x620
[  459.132858][   T23]  ? __virt_addr_valid+0x5e/0x2d0
[  459.138138][   T23]  ? __phys_addr+0xc6/0x140
[  459.143854][   T23]  kasan_report+0xda/0x110
[  459.148522][   T23]  ? l2cap_chan_del+0xa0b/0xa70
[  459.154236][   T23]  ? l2cap_chan_del+0xa0b/0xa70
[  459.159535][   T23]  l2cap_chan_del+0xa0b/0xa70
[  459.164812][   T23]  ? mutex_lock_io_nested+0x11a0/0x11a0
[  459.170523][   T23]  l2cap_chan_close+0xff/0xa20
[  459.175749][   T23]  ? __l2cap_ecred_conn_rsp_defer+0x790/0x790
[  459.182623][   T23]  ? lock_sync+0x190/0x190
[  459.187727][   T23]  ? reacquire_held_locks+0x4b0/0x4b0
[  459.193464][   T23]  ? do_raw_spin_lock+0x12e/0x2b0
[  459.198513][   T23]  l2cap_chan_timeout+0x17d/0x2f0
[  459.203637][   T23]  process_one_work+0x887/0x15d0
[  459.208592][   T23]  ? l2cap_chan_close+0xa20/0xa20
[  459.213606][   T23]  ? init_worker_pool+0x770/0x770
[  459.218775][   T23]  ? assign_work+0x1a0/0x240
[  459.223486][   T23]  worker_thread+0x8bb/0x1290
[  459.228264][   T23]  ? process_one_work+0x15d0/0x15d0
[  459.233754][   T23]  kthread+0x33a/0x430
[  459.238968][   T23]  ? kthread_complete_and_exit+0x40/0x40
[  459.245227][   T23]  ret_from_fork+0x45/0x80
[  459.249858][   T23]  ? kthread_complete_and_exit+0x40/0x40
[  459.255682][   T23]  ret_from_fork_asm+0x11/0x20
[  459.260476][   T23]  </TASK>
[  459.263491][   T23] 
[  459.265915][   T23] Allocated by task 78:
[  459.270049][   T23]  kasan_save_stack+0x33/0x50
[  459.274746][   T23]  kasan_set_track+0x25/0x30
[  459.279332][   T23]  __kasan_slab_alloc+0x81/0x90
[  459.284796][   T23]  kmem_cache_alloc_node+0x185/0x3f0
[  459.290443][   T23]  kmalloc_reserve+0x167/0x270
[  459.295339][   T23]  pskb_expand_head+0x236/0x1170
[  459.300463][   T23]  netlink_trim+0x1eb/0x240
[  459.305152][   T23]  netlink_broadcast_filtered+0xc5/0xf00
[  459.310879][   T23]  netlink_broadcast+0x39/0x50
[  459.315646][   T23]  devlink_trap_notify+0x1a9/0x240
[  459.320828][   T23]  devlink_trap_unregister+0x127/0x3a0
[  459.326301][   T23]  devl_traps_unregister+0x233/0x2f0
[  459.331595][   T23]  nsim_dev_traps_exit+0x53/0x170
[  459.336710][   T23]  nsim_dev_reload_destroy+0x1e0/0x560
[  459.342371][   T23]  nsim_dev_reload_down+0x6e/0xd0
[  459.347771][   T23]  devlink_reload+0x11c/0x450
[  459.352464][   T23]  devlink_pernet_pre_exit+0x1ce/0x2a0
[  459.357943][   T23]  cleanup_net+0x46c/0xb20
[  459.362507][   T23]  process_one_work+0x887/0x15d0
[  459.367546][   T23]  worker_thread+0x8bb/0x1290
[  459.372229][   T23]  kthread+0x33a/0x430
[  459.376293][   T23]  ret_from_fork+0x45/0x80
[  459.380879][   T23]  ret_from_fork_asm+0x11/0x20
[  459.385918][   T23] 
[  459.388245][   T23] Freed by task 78:
[  459.392393][   T23]  kasan_save_stack+0x33/0x50
[  459.397087][   T23]  kasan_set_track+0x25/0x30
[  459.401846][   T23]  kasan_save_free_info+0x2b/0x40
[  459.406876][   T23]  ____kasan_slab_free+0x15b/0x1b0
[  459.412248][   T23]  slab_free_freelist_hook+0x114/0x1e0
[  459.417798][   T23]  kmem_cache_free+0xf0/0x480
[  459.422553][   T23]  skb_free_head+0x17f/0x1b0
[  459.428376][   T23]  skb_release_data+0x5ba/0x870
[  459.433303][   T23]  consume_skb+0xd2/0x170
[  459.437885][   T23]  netlink_broadcast_filtered+0x3d4/0xf00
[  459.443795][   T23]  netlink_broadcast+0x39/0x50
[  459.448874][   T23]  devlink_trap_notify+0x1a9/0x240
[  459.454005][   T23]  devlink_trap_unregister+0x127/0x3a0
[  459.460244][   T23]  devl_traps_unregister+0x233/0x2f0
[  459.465611][   T23]  nsim_dev_traps_exit+0x53/0x170
[  459.470726][   T23]  nsim_dev_reload_destroy+0x1e0/0x560
[  459.476542][   T23]  nsim_dev_reload_down+0x6e/0xd0
[  459.482110][   T23]  devlink_reload+0x11c/0x450
[  459.486915][   T23]  devlink_pernet_pre_exit+0x1ce/0x2a0
[  459.492506][   T23]  cleanup_net+0x46c/0xb20
[  459.497808][   T23]  process_one_work+0x887/0x15d0
[  459.502937][   T23]  worker_thread+0x8bb/0x1290
[  459.507633][   T23]  kthread+0x33a/0x430
[  459.511772][   T23]  ret_from_fork+0x45/0x80
[  459.516542][   T23]  ret_from_fork_asm+0x11/0x20
[  459.521418][   T23] 
[  459.523734][   T23] The buggy address belongs to the object at ffff888073cb0600
[  459.523734][   T23]  which belongs to the cache skbuff_small_head of size 640
[  459.538565][   T23] The buggy address is located 280 bytes inside of
[  459.538565][   T23]  freed 640-byte region [ffff888073cb0600, ffff888073cb0880)
[  459.553318][   T23] 
[  459.555713][   T23] The buggy address belongs to the physical page:
[  459.562295][   T23] page:ffffea0001cf2c00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x73cb0
[  459.572860][   T23] head:ffffea0001cf2c00 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  459.581959][   T23] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[  459.590010][   T23] page_type: 0xffffffff()
[  459.594327][   T23] raw: 00fff00000000840 ffff888019a6a8c0 dead000000000122 0000000000000000
[  459.603482][   T23] raw: 0000000000000000 0000000000150015 00000001ffffffff 0000000000000000
[  459.612329][   T23] page dumped because: kasan: bad access detected
[  459.619180][   T23] page_owner tracks the page as allocated
[  459.625155][   T23] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d28c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 78, tgid 78 (kworker/u4:5), ts 454224323940, free_ts 453753622092
[  459.649232][   T23]  post_alloc_hook+0x2cf/0x340
[  459.654096][   T23]  get_page_from_freelist+0x10d7/0x31b0
[  459.659993][   T23]  __alloc_pages+0x1d0/0x4a0
[  459.664766][   T23]  alloc_pages+0x1a9/0x270
[  459.669303][   T23]  allocate_slab+0x251/0x380
[  459.674081][   T23]  ___slab_alloc+0x8be/0x1570
[  459.678845][   T23]  __slab_alloc.constprop.0+0x56/0xa0
[  459.684303][   T23]  kmem_cache_alloc_node+0x137/0x3f0
[  459.689603][   T23]  kmalloc_reserve+0x167/0x270
[  459.694476][   T23]  pskb_expand_head+0x236/0x1170
[  459.699603][   T23]  netlink_trim+0x1eb/0x240
[  459.704368][   T23]  netlink_broadcast_filtered+0xc5/0xf00
[  459.710084][   T23]  netlink_broadcast+0x39/0x50
[  459.714857][   T23]  devlink_trap_notify+0x1a9/0x240
[  459.719961][   T23]  devlink_trap_unregister+0x127/0x3a0
[  459.725668][   T23]  devl_traps_unregister+0x233/0x2f0
[  459.731136][   T23] page last free stack trace:
[  459.735913][   T23]  free_unref_page_prepare+0x476/0xa40
[  459.741464][   T23]  free_unref_page+0x33/0x3b0
[  459.746339][   T23]  __stack_depot_save+0x193/0x510
[  459.751507][   T23]  kasan_save_stack+0x43/0x50
[  459.756203][   T23]  kasan_set_track+0x25/0x30
[  459.761250][   T23]  __kasan_kmalloc+0xa2/0xb0
[  459.765849][   T23]  nf_nat_masq_schedule.part.0+0x290/0x610
[  459.771826][   T23]  masq_device_event+0xee/0x120
[  459.776782][   T23]  notifier_call_chain+0xb6/0x3b0
[  459.781805][   T23]  call_netdevice_notifiers_info+0xb9/0x130
[  459.788324][   T23]  dev_close_many+0x305/0x640
[  459.793134][   T23]  unregister_netdevice_many_notify+0x41b/0x1a20
[  459.800424][   T23]  unregister_netdevice_queue+0x2e5/0x3c0
[  459.806433][   T23]  __tun_detach+0x116f/0x1470
[  459.811279][   T23]  tun_chr_close+0xc8/0x240
[  459.816051][   T23]  __fput+0x3f7/0xa70
[  459.821055][   T23] 
[  459.823725][   T23] Memory state around the buggy address:
[  459.829551][   T23]  ffff888073cb0600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  459.838491][   T23]  ffff888073cb0680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  459.846820][   T23] >ffff888073cb0700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  459.855660][   T23]                             ^
[  459.861111][   T23]  ffff888073cb0780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  459.869255][   T23]  ffff888073cb0800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  459.877438][   T23] ==================================================================
[  459.886554][   T23] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  459.895076][   T23] CPU: 1 PID: 23 Comm: kworker/1:0 Not tainted 6.5.0-rc6-next-20230818-syzkaller-dirty #0
[  459.905180][   T23] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
[  459.915327][   T23] Workqueue: events l2cap_chan_timeout
[  459.921178][   T23] Call Trace:
[  459.924569][   T23]  <TASK>
[  459.927635][   T23]  dump_stack_lvl+0xd9/0x1b0
[  459.932323][   T23]  panic+0x6a6/0x750
[  459.936341][   T23]  ? panic_smp_self_stop+0xa0/0xa0
[  459.941467][   T23]  ? preempt_schedule_thunk+0x1a/0x30
[  459.947368][   T23]  ? preempt_schedule_common+0x45/0xc0
[  459.952929][   T23]  check_panic_on_warn+0xab/0xb0
[  459.958221][   T23]  end_report+0x108/0x150
[  459.962634][   T23]  kasan_report+0xea/0x110
[  459.967439][   T23]  ? l2cap_chan_del+0xa0b/0xa70
[  459.972580][   T23]  ? l2cap_chan_del+0xa0b/0xa70
[  459.977736][   T23]  l2cap_chan_del+0xa0b/0xa70
[  459.982708][   T23]  ? mutex_lock_io_nested+0x11a0/0x11a0
[  459.990067][   T23]  l2cap_chan_close+0xff/0xa20
[  459.994919][   T23]  ? __l2cap_ecred_conn_rsp_defer+0x790/0x790
[  460.001230][   T23]  ? lock_sync+0x190/0x190
[  460.005685][   T23]  ? reacquire_held_locks+0x4b0/0x4b0
[  460.011360][   T23]  ? do_raw_spin_lock+0x12e/0x2b0
[  460.016399][   T23]  l2cap_chan_timeout+0x17d/0x2f0
[  460.021441][   T23]  process_one_work+0x887/0x15d0
[  460.026390][   T23]  ? l2cap_chan_close+0xa20/0xa20
[  460.031784][   T23]  ? init_worker_pool+0x770/0x770
[  460.036944][   T23]  ? assign_work+0x1a0/0x240
[  460.041580][   T23]  worker_thread+0x8bb/0x1290
[  460.046444][   T23]  ? process_one_work+0x15d0/0x15d0
[  460.051733][   T23]  kthread+0x33a/0x430
[  460.055911][   T23]  ? kthread_complete_and_exit+0x40/0x40
[  460.061674][   T23]  ret_from_fork+0x45/0x80
[  460.066288][   T23]  ? kthread_complete_and_exit+0x40/0x40
[  460.072677][   T23]  ret_from_fork_asm+0x11/0x20
[  460.077559][   T23]  </TASK>
[  460.081017][   T23] Kernel Offset: disabled
[  460.085479][   T23] Rebooting in 86400 seconds..