Warning: Permanently added '10.128.0.142' (ED25519) to the list of known hosts.
2025/11/14 17:08:03 ignoring optional flag "type"="gce"
2025/11/14 17:08:04 parsed 1 programs
2025/11/14 17:08:06 executed programs: 0
[ 111.436191][ T6016] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 111.490175][ T52] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 111.498180][ T52] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 111.506033][ T52] ==================================================================
[ 111.514118][ T52] BUG: KASAN: slab-use-after-free in hci_cmd_work+0x5d0/0x7b0
[ 111.521854][ T52] Read of size 2 at addr ffff8880755d0b78 by task kworker/u9:0/52
[ 111.529831][ T52]
[ 111.532180][ T52] CPU: 1 UID: 0 PID: 52 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT(full)
[ 111.532195][ T52] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 111.532203][ T52] Workqueue: hci0 hci_cmd_work
[ 111.532220][ T52] Call Trace:
[ 111.532227][ T52]
[ 111.532232][ T52] dump_stack_lvl+0x189/0x250
[ 111.532251][ T52] ? __virt_addr_valid+0x1c8/0x5c0
[ 111.532262][ T52] ? rcu_is_watching+0x15/0xb0
[ 111.532273][ T52] ? __pfx_dump_stack_lvl+0x10/0x10
[ 111.532288][ T52] ? rcu_is_watching+0x15/0xb0
[ 111.532297][ T52] ? lock_release+0x4b/0x3d0
[ 111.532311][ T52] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 111.532323][ T52] ? __virt_addr_valid+0x1c8/0x5c0
[ 111.532334][ T52] ? __virt_addr_valid+0x4a5/0x5c0
[ 111.532346][ T52] print_report+0xca/0x240
[ 111.532360][ T52] ? hci_cmd_work+0x5d0/0x7b0
[ 111.532373][ T52] kasan_report+0x118/0x150
[ 111.532388][ T52] ? hci_cmd_work+0x5d0/0x7b0
[ 111.532402][ T52] hci_cmd_work+0x5d0/0x7b0
[ 111.532417][ T52] ? process_one_work+0x868/0x15e0
[ 111.532430][ T52] process_one_work+0x93a/0x15e0
[ 111.532464][ T52] ? __lock_acquire+0xab9/0xd20
[ 111.532483][ T52] ? __pfx_process_one_work+0x10/0x10
[ 111.532498][ T52] ? assign_work+0x3a1/0x410
[ 111.532512][ T52] worker_thread+0x9b0/0xee0
[ 111.532532][ T52] kthread+0x711/0x8a0
[ 111.532543][ T52] ? __pfx_worker_thread+0x10/0x10
[ 111.532557][ T52] ? __pfx_kthread+0x10/0x10
[ 111.532567][ T52] ? _raw_spin_unlock_irq+0x23/0x50
[ 111.532578][ T52] ? lockdep_hardirqs_on+0x9c/0x150
[ 111.532591][ T52] ? __pfx_kthread+0x10/0x10
[ 111.532601][ T52] ret_from_fork+0x599/0xb30
[ 111.532616][ T52] ? __pfx_ret_from_fork+0x10/0x10
[ 111.532632][ T52] ? __switch_to_asm+0x39/0x70
[ 111.532642][ T52] ? __switch_to_asm+0x33/0x70
[ 111.532652][ T52] ? __pfx_kthread+0x10/0x10
[ 111.532662][ T52] ret_from_fork_asm+0x1a/0x30
[ 111.532677][ T52]
[ 111.532681][ T52]
[ 111.725946][ T52] Allocated by task 5145:
[ 111.730283][ T52] kasan_save_track+0x3e/0x80
[ 111.735310][ T52] __kasan_slab_alloc+0x6c/0x80
[ 111.740163][ T52] kmem_cache_alloc_node_noprof+0x43c/0x710
[ 111.746059][ T52] __alloc_skb+0x112/0x2d0
[ 111.750526][ T52] hci_cmd_sync_alloc+0x3d/0x3b0
[ 111.755567][ T52] __hci_cmd_sync_sk+0x1a7/0xc70
[ 111.760502][ T52] hci_dev_open_sync+0x163e/0x2dc0
[ 111.765612][ T52] hci_power_on+0x1b4/0x720
[ 111.770117][ T52] process_one_work+0x93a/0x15e0
[ 111.775277][ T52] worker_thread+0x9b0/0xee0
[ 111.780006][ T52] kthread+0x711/0x8a0
[ 111.784089][ T52] ret_from_fork+0x599/0xb30
[ 111.788795][ T52] ret_from_fork_asm+0x1a/0x30
[ 111.793659][ T52]
[ 111.796078][ T52] Freed by task 6024:
[ 111.800061][ T52] kasan_save_track+0x3e/0x80
[ 111.804746][ T52] kasan_save_free_info+0x46/0x50
[ 111.809898][ T52] __kasan_slab_free+0x5c/0x80
[ 111.814735][ T52] kmem_cache_free+0x197/0x640
[ 111.819603][ T52] vhci_read+0x49a/0x5b0
[ 111.823947][ T52] vfs_read+0x200/0xa30
[ 111.828279][ T52] ksys_read+0x145/0x250
[ 111.832692][ T52] do_syscall_64+0xfa/0xfa0
[ 111.837195][ T52] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 111.843106][ T52]
[ 111.845431][ T52] The buggy address belongs to the object at ffff8880755d0b40
[ 111.845431][ T52] which belongs to the cache skbuff_head_cache of size 240
[ 111.859998][ T52] The buggy address is located 56 bytes inside of
[ 111.859998][ T52] freed 240-byte region [ffff8880755d0b40, ffff8880755d0c30)
[ 111.873801][ T52]
[ 111.876305][ T52] The buggy address belongs to the physical page:
[ 111.882802][ T52] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x755d0
[ 111.891764][ T52] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 111.898960][ T52] page_type: f5(slab)
[ 111.903122][ T52] raw: 00fff00000000000 ffff888140443dc0 dead000000000122 0000000000000000
[ 111.911714][ T52] raw: 0000000000000000 00000000800c000c 00000000f5000000 0000000000000000
[ 111.920559][ T52] page dumped because: kasan: bad access detected
[ 111.927141][ T52] page_owner tracks the page as allocated
[ 111.932858][ T52] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 6024, tgid 6023 (syz-executor.0), ts 111489846497, free_ts 111152735686
[ 111.952572][ T52] post_alloc_hook+0x240/0x2a0
[ 111.957344][ T52] get_page_from_freelist+0x2365/0x2440
[ 111.962988][ T52] __alloc_frozen_pages_noprof+0x181/0x370
[ 111.968969][ T52] alloc_pages_mpol+0x232/0x4a0
[ 111.973825][ T52] allocate_slab+0x86/0x3b0
[ 111.978331][ T52] ___slab_alloc+0xf56/0x1990
[ 111.983107][ T52] __slab_alloc+0x65/0x100
[ 111.987703][ T52] kmem_cache_alloc_node_noprof+0x4ce/0x710
[ 111.993691][ T52] __alloc_skb+0x112/0x2d0
[ 111.998109][ T52] vhci_write+0xbe/0x4a0
[ 112.002444][ T52] do_iter_readv_writev+0x623/0x8c0
[ 112.007734][ T52] vfs_writev+0x31a/0x960
[ 112.012155][ T52] do_writev+0x14d/0x2d0
[ 112.016492][ T52] do_syscall_64+0xfa/0xfa0
[ 112.020995][ T52] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 112.026902][ T52] page last free pid 6007 tgid 6007 stack trace:
[ 112.033309][ T52] __free_frozen_pages+0xbc8/0xd30
[ 112.038419][ T52] tlb_finish_mmu+0x112/0x1d0
[ 112.043111][ T52] exit_mmap+0x439/0xb40
[ 112.047546][ T52] __mmput+0x118/0x430
[ 112.051635][ T52] exit_mm+0x1da/0x2c0
[ 112.055721][ T52] do_exit+0x650/0x2300
[ 112.059884][ T52] do_group_exit+0x21c/0x2d0
[ 112.064529][ T52] __x64_sys_exit_group+0x3f/0x40
[ 112.069551][ T52] __pfx_syscall_get_nr+0x0/0x10
[ 112.074495][ T52] do_syscall_64+0xfa/0xfa0
[ 112.079001][ T52] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 112.085079][ T52]
[ 112.087402][ T52] Memory state around the buggy address:
[ 112.093033][ T52] ffff8880755d0a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 112.101187][ T52] ffff8880755d0a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 112.109243][ T52] >ffff8880755d0b00: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 112.117395][ T52] ^
[ 112.125372][ T52] ffff8880755d0b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 112.133610][ T52] ffff8880755d0c00: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[ 112.141939][ T52] ==================================================================
[ 112.150205][ T52] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 112.157859][ T52] CPU: 1 UID: 0 PID: 52 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT(full)
[ 112.167516][ T52] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 112.177778][ T52] Workqueue: hci0 hci_cmd_work
[ 112.182565][ T52] Call Trace:
[ 112.186023][ T52]
[ 112.188956][ T52] dump_stack_lvl+0x99/0x250
[ 112.193577][ T52] ? __asan_memcpy+0x40/0x70
[ 112.198250][ T52] ? __pfx_dump_stack_lvl+0x10/0x10
[ 112.203488][ T52] ? __pfx__printk+0x10/0x10
[ 112.208091][ T52] vpanic+0x237/0x6d0
[ 112.212076][ T52] ? __pfx_vpanic+0x10/0x10
[ 112.216664][ T52] ? preempt_schedule+0xae/0xc0
[ 112.221663][ T52] ? __pfx_preempt_schedule+0x10/0x10
[ 112.227043][ T52] panic+0xb9/0xc0
[ 112.231049][ T52] ? __pfx_panic+0x10/0x10
[ 112.235575][ T52] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 112.241586][ T52] ? is_module_address+0x17/0xf0
[ 112.246907][ T52] ? hci_cmd_work+0x5d0/0x7b0
[ 112.251603][ T52] check_panic_on_warn+0x89/0xb0
[ 112.256548][ T52] ? hci_cmd_work+0x5d0/0x7b0
[ 112.261242][ T52] end_report+0x6f/0x160
[ 112.265575][ T52] kasan_report+0x129/0x150
[ 112.270091][ T52] ? hci_cmd_work+0x5d0/0x7b0
[ 112.274873][ T52] hci_cmd_work+0x5d0/0x7b0
[ 112.279380][ T52] ? process_one_work+0x868/0x15e0
[ 112.284550][ T52] process_one_work+0x93a/0x15e0
[ 112.289490][ T52] ? __lock_acquire+0xab9/0xd20
[ 112.294607][ T52] ? __pfx_process_one_work+0x10/0x10
[ 112.300089][ T52] ? assign_work+0x3a1/0x410
[ 112.304771][ T52] worker_thread+0x9b0/0xee0
[ 112.309544][ T52] kthread+0x711/0x8a0
[ 112.313614][ T52] ? __pfx_worker_thread+0x10/0x10
[ 112.318740][ T52] ? __pfx_kthread+0x10/0x10
[ 112.323335][ T52] ? _raw_spin_unlock_irq+0x23/0x50
[ 112.328542][ T52] ? lockdep_hardirqs_on+0x9c/0x150
[ 112.333915][ T52] ? __pfx_kthread+0x10/0x10
[ 112.338539][ T52] ret_from_fork+0x599/0xb30
[ 112.343524][ T52] ? __pfx_ret_from_fork+0x10/0x10
[ 112.348740][ T52] ? __switch_to_asm+0x39/0x70
[ 112.353684][ T52] ? __switch_to_asm+0x33/0x70
[ 112.358464][ T52] ? __pfx_kthread+0x10/0x10
[ 112.363074][ T52] ret_from_fork_asm+0x1a/0x30
[ 112.367863][ T52]
[ 112.371282][ T52] Kernel Offset: disabled
[ 112.375598][ T52] Rebooting in 86400 seconds..