[ 447.746159][ T2813] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 447.833381][ T2813] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 447.904876][ T2813] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 447.976615][ T2813] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 448.765429][ T2813] hsr_slave_0: left promiscuous mode
[ 448.772495][ T2813] hsr_slave_1: left promiscuous mode
[ 448.779491][ T2813] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 448.786895][ T2813] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 448.796368][ T2813] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 448.804236][ T2813] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 448.814008][ T2813] bridge_slave_1: left allmulticast mode
[ 448.820082][ T2813] bridge_slave_1: left promiscuous mode
[ 448.825867][ T2813] bridge0: port 2(bridge_slave_1) entered disabled state
[ 448.836191][ T2813] bridge_slave_0: left allmulticast mode
[ 448.841985][ T2813] bridge_slave_0: left promiscuous mode
[ 448.847846][ T2813] bridge0: port 1(bridge_slave_0) entered disabled state
[ 448.862562][ T2813] veth1_macvtap: left promiscuous mode
[ 448.868921][ T2813] veth0_macvtap: left promiscuous mode
[ 448.874640][ T2813] veth1_vlan: left promiscuous mode
[ 448.880643][ T2813] veth0_vlan: left promiscuous mode
[ 449.112839][ T2813] team0 (unregistering): Port device team_slave_1 removed
[ 449.126949][ T2813] team0 (unregistering): Port device team_slave_0 removed
[ 449.140457][ T2813] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 449.160614][ T2813] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 449.220374][ T2813] bond0 (unregistering): Released all slaves
Warning: Permanently added '10.128.10.9' (ED25519) to the list of known hosts.
[ 451.978296][ T7449] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 451.985662][ T7449] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 451.993392][ T7449] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 452.001118][ T7449] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 452.009019][ T7449] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 453.859091][ T8] ==================================================================
[ 453.867204][ T8] BUG: KASAN: slab-out-of-bounds in l2cap_chan_del+0xa0b/0xa70
[ 453.875016][ T8] Read of size 8 at addr ffff888068778718 by task kworker/0:0/8
[ 453.882662][ T8]
[ 453.884997][ T8] CPU: 0 PID: 8 Comm: kworker/0:0 Not tainted 6.5.0-rc6-next-20230818-syzkaller-dirty #0
[ 453.894817][ T8] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
[ 453.904983][ T8] Workqueue: events l2cap_chan_timeout
[ 453.910487][ T8] Call Trace:
[ 453.913868][ T8]
[ 453.916911][ T8] dump_stack_lvl+0xd9/0x1b0
[ 453.921577][ T8] print_report+0xc4/0x620
[ 453.926046][ T8] ? __virt_addr_valid+0x5e/0x2d0
[ 453.931158][ T8] ? __phys_addr+0xc6/0x140
[ 453.935659][ T8] kasan_report+0xda/0x110
[ 453.940073][ T8] ? l2cap_chan_del+0xa0b/0xa70
[ 453.944913][ T8] ? l2cap_chan_del+0xa0b/0xa70
[ 453.949799][ T8] l2cap_chan_del+0xa0b/0xa70
[ 453.954460][ T8] ? mutex_lock_io_nested+0x11a0/0x11a0
[ 453.960080][ T8] l2cap_chan_close+0xff/0xa20
[ 453.965016][ T8] ? __l2cap_ecred_conn_rsp_defer+0x790/0x790
[ 453.971070][ T8] ? lock_sync+0x190/0x190
[ 453.975494][ T8] ? reacquire_held_locks+0x4b0/0x4b0
[ 453.980864][ T8] ? __schedule+0xee9/0x59f0
[ 453.985448][ T8] l2cap_chan_timeout+0x17d/0x2f0
[ 453.990462][ T8] process_one_work+0x887/0x15d0
[ 453.995402][ T8] ? lock_sync+0x190/0x190
[ 453.999820][ T8] ? init_worker_pool+0x770/0x770
[ 454.004832][ T8] ? assign_work+0x1a0/0x240
[ 454.009415][ T8] worker_thread+0x8bb/0x1290
[ 454.014082][ T8] ? process_one_work+0x15d0/0x15d0
[ 454.019265][ T8] kthread+0x33a/0x430
[ 454.023317][ T8] ? kthread_complete_and_exit+0x40/0x40
[ 454.028934][ T8] ret_from_fork+0x45/0x80
[ 454.033358][ T8] ? kthread_complete_and_exit+0x40/0x40
[ 454.038991][ T8] ret_from_fork_asm+0x11/0x20
[ 454.043763][ T8]
[ 454.046764][ T8]
[ 454.049066][ T8] Allocated by task 4708:
[ 454.053456][ T8] kasan_save_stack+0x33/0x50
[ 454.058228][ T8] kasan_set_track+0x25/0x30
[ 454.062927][ T8] __kasan_kmalloc+0xa2/0xb0
[ 454.067539][ T8] __kmalloc_node_track_caller+0x61/0x100
[ 454.073323][ T8] kmalloc_reserve+0xef/0x270
[ 454.078134][ T8] __alloc_skb+0x12b/0x330
[ 454.082540][ T8] alloc_skb_with_frags+0xe4/0x710
[ 454.087652][ T8] sock_alloc_send_pskb+0x7c8/0x950
[ 454.092839][ T8] unix_dgram_sendmsg+0x455/0x1c30
[ 454.098003][ T8] sock_sendmsg+0xd9/0x180
[ 454.102691][ T8] sock_write_iter+0x29b/0x3d0
[ 454.107533][ T8] do_iter_readv_writev+0x21e/0x3c0
[ 454.108002][ T7449] Bluetooth: hci0: command 0x0409 tx timeout
[ 454.112729][ T8] do_iter_write+0x17f/0x830
[ 454.123634][ T8] vfs_writev+0x221/0x700
[ 454.127962][ T8] do_writev+0x285/0x370
[ 454.132214][ T8] do_syscall_64+0x38/0xb0
[ 454.136807][ T8] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 454.142761][ T8]
[ 454.145079][ T8] Freed by task 4707:
[ 454.149039][ T8] kasan_save_stack+0x33/0x50
[ 454.153740][ T8] kasan_set_track+0x25/0x30
[ 454.158328][ T8] kasan_save_free_info+0x2b/0x40
[ 454.163338][ T8] ____kasan_slab_free+0x15b/0x1b0
[ 454.168437][ T8] slab_free_freelist_hook+0x114/0x1e0
[ 454.173886][ T8] __kmem_cache_free+0xb8/0x2f0
[ 454.178736][ T8] skb_free_head+0x110/0x1b0
[ 454.183314][ T8] skb_release_data+0x5ba/0x870
[ 454.188155][ T8] consume_skb+0xd2/0x170
[ 454.192473][ T8] __unix_dgram_recvmsg+0x814/0xe50
[ 454.197661][ T8] unix_dgram_recvmsg+0xc3/0xf0
[ 454.202592][ T8] sock_recvmsg+0xe2/0x170
[ 454.207082][ T8] sock_read_iter+0x2c3/0x3c0
[ 454.211746][ T8] do_iter_readv_writev+0x2f2/0x3c0
[ 454.217035][ T8] do_iter_read+0x315/0x870
[ 454.221522][ T8] vfs_readv+0x12d/0x1a0
[ 454.225749][ T8] do_readv+0x285/0x370
[ 454.229890][ T8] do_syscall_64+0x38/0xb0
[ 454.234476][ T8] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 454.240887][ T8]
[ 454.243202][ T8] The buggy address belongs to the object at ffff888068778400
[ 454.243202][ T8] which belongs to the cache kmalloc-cg-512 of size 512
[ 454.257501][ T8] The buggy address is located 280 bytes to the right of
[ 454.257501][ T8] allocated 512-byte region [ffff888068778400, ffff888068778600)
[ 454.272515][ T8]
[ 454.274910][ T8] The buggy address belongs to the physical page:
[ 454.281566][ T8] page:ffffea0001a1de00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x68778
[ 454.291871][ T8] head:ffffea0001a1de00 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 454.300954][ T8] memcg:ffff88801937bc01
[ 454.305168][ T8] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 454.313238][ T8] page_type: 0xffffffff()
[ 454.317637][ T8] raw: 00fff00000000840 ffff888012c4f140 dead000000000122 0000000000000000
[ 454.326490][ T8] raw: 0000000000000000 0000000000100010 00000001ffffffff ffff88801937bc01
[ 454.335167][ T8] page dumped because: kasan: bad access detected
[ 454.341567][ T8] page_owner tracks the page as allocated
[ 454.347258][ T8] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 4708, tgid 4708 (dhcpcd), ts 448399025420, free_ts 448388778101
[ 454.369729][ T8] post_alloc_hook+0x2cf/0x340
[ 454.374615][ T8] get_page_from_freelist+0x10d7/0x31b0
[ 454.380161][ T8] __alloc_pages+0x1d0/0x4a0
[ 454.384751][ T8] alloc_pages+0x1a9/0x270
[ 454.389167][ T8] allocate_slab+0x251/0x380
[ 454.393767][ T8] ___slab_alloc+0x8be/0x1570
[ 454.398430][ T8] __slab_alloc.constprop.0+0x56/0xa0
[ 454.403792][ T8] __kmem_cache_alloc_node+0x137/0x350
[ 454.409331][ T8] __kmalloc_node_track_caller+0x50/0x100
[ 454.415118][ T8] kmalloc_reserve+0xef/0x270
[ 454.419783][ T8] __alloc_skb+0x12b/0x330
[ 454.424185][ T8] alloc_skb_with_frags+0xe4/0x710
[ 454.429370][ T8] sock_alloc_send_pskb+0x7c8/0x950
[ 454.434635][ T8] unix_dgram_sendmsg+0x455/0x1c30
[ 454.439739][ T8] sock_sendmsg+0xd9/0x180
[ 454.444138][ T8] sock_write_iter+0x29b/0x3d0
[ 454.448897][ T8] page last free stack trace:
[ 454.453569][ T8] free_unref_page_prepare+0x476/0xa40
[ 454.459040][ T8] free_unref_page+0x33/0x3b0
[ 454.463718][ T8] skb_free_head+0x110/0x1b0
[ 454.468326][ T8] skb_release_data+0x5ba/0x870
[ 454.473170][ T8] consume_skb+0xd2/0x170
[ 454.477506][ T8] __unix_dgram_recvmsg+0x814/0xe50
[ 454.482799][ T8] unix_dgram_recvmsg+0xc3/0xf0
[ 454.487652][ T8] sock_recvmsg+0xe2/0x170
[ 454.492061][ T8] sock_read_iter+0x2c3/0x3c0
[ 454.496812][ T8] do_iter_readv_writev+0x2f2/0x3c0
[ 454.502002][ T8] do_iter_read+0x315/0x870
[ 454.506577][ T8] vfs_readv+0x12d/0x1a0
[ 454.510832][ T8] do_readv+0x285/0x370
[ 454.514973][ T8] do_syscall_64+0x38/0xb0
[ 454.519379][ T8] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 454.525359][ T8]
[ 454.527665][ T8] Memory state around the buggy address:
[ 454.533276][ T8] ffff888068778600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 454.541335][ T8] ffff888068778680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 454.549553][ T8] >ffff888068778700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 454.557686][ T8] ^
[ 454.562703][ T8] ffff888068778780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 454.570783][ T8] ffff888068778800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 454.578914][ T8] ==================================================================
[ 454.588341][ T8] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 454.595554][ T8] CPU: 0 PID: 8 Comm: kworker/0:0 Not tainted 6.5.0-rc6-next-20230818-syzkaller-dirty #0
[ 454.605451][ T8] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
[ 454.615520][ T8] Workqueue: events l2cap_chan_timeout
[ 454.620995][ T8] Call Trace:
[ 454.624285][ T8]
[ 454.627250][ T8] dump_stack_lvl+0xd9/0x1b0
[ 454.631862][ T8] panic+0x6a6/0x750
[ 454.635785][ T8] ? panic_smp_self_stop+0xa0/0xa0
[ 454.640909][ T8] ? preempt_schedule_thunk+0x1a/0x30
[ 454.646296][ T8] ? preempt_schedule_common+0x45/0xc0
[ 454.651767][ T8] check_panic_on_warn+0xab/0xb0
[ 454.656794][ T8] end_report+0x108/0x150
[ 454.661122][ T8] kasan_report+0xea/0x110
[ 454.665620][ T8] ? l2cap_chan_del+0xa0b/0xa70
[ 454.670601][ T8] ? l2cap_chan_del+0xa0b/0xa70
[ 454.675569][ T8] l2cap_chan_del+0xa0b/0xa70
[ 454.680766][ T8] ? mutex_lock_io_nested+0x11a0/0x11a0
[ 454.686444][ T8] l2cap_chan_close+0xff/0xa20
[ 454.691239][ T8] ? __l2cap_ecred_conn_rsp_defer+0x790/0x790
[ 454.697508][ T8] ? lock_sync+0x190/0x190
[ 454.701928][ T8] ? reacquire_held_locks+0x4b0/0x4b0
[ 454.707313][ T8] ? __schedule+0xee9/0x59f0
[ 454.711909][ T8] l2cap_chan_timeout+0x17d/0x2f0
[ 454.716951][ T8] process_one_work+0x887/0x15d0
[ 454.721892][ T8] ? lock_sync+0x190/0x190
[ 454.727003][ T8] ? init_worker_pool+0x770/0x770
[ 454.732056][ T8] ? assign_work+0x1a0/0x240
[ 454.736848][ T8] worker_thread+0x8bb/0x1290
[ 454.741635][ T8] ? process_one_work+0x15d0/0x15d0
[ 454.746834][ T8] kthread+0x33a/0x430
[ 454.751629][ T8] ? kthread_complete_and_exit+0x40/0x40
[ 454.757374][ T8] ret_from_fork+0x45/0x80
[ 454.762340][ T8] ? kthread_complete_and_exit+0x40/0x40
[ 454.768362][ T8] ret_from_fork_asm+0x11/0x20
[ 454.773523][ T8]
[ 454.776762][ T8] Kernel Offset: disabled
[ 454.781076][ T8] Rebooting in 86400 seconds..