Warning: Permanently added '10.128.1.149' (ED25519) to the list of known hosts.
2025/11/14 21:03:44 ignoring optional flag "type"="gce"
2025/11/14 21:03:44 parsed 1 programs
2025/11/14 21:03:46 executed programs: 0
[ 99.779929][ T6016] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 99.835050][ T52] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 99.843327][ T52] ==================================================================
[ 99.851635][ T52] BUG: KASAN: slab-use-after-free in hci_cmd_work+0x5d0/0x7b0
[ 99.859612][ T52] Read of size 2 at addr ffff88802aa8e678 by task kworker/u9:0/52
[ 99.868902][ T52]
[ 99.871404][ T52] CPU: 0 UID: 0 PID: 52 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT(full)
[ 99.871420][ T52] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 99.871428][ T52] Workqueue: hci0 hci_cmd_work
[ 99.871452][ T52] Call Trace:
[ 99.871460][ T52]
[ 99.871466][ T52] dump_stack_lvl+0x189/0x250
[ 99.871483][ T52] ? __virt_addr_valid+0x1c8/0x5c0
[ 99.871494][ T52] ? rcu_is_watching+0x15/0xb0
[ 99.871503][ T52] ? __pfx_dump_stack_lvl+0x10/0x10
[ 99.871516][ T52] ? rcu_is_watching+0x15/0xb0
[ 99.871524][ T52] ? lock_release+0x4b/0x3d0
[ 99.871589][ T52] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 99.871601][ T52] ? __virt_addr_valid+0x1c8/0x5c0
[ 99.871610][ T52] ? __virt_addr_valid+0x4a5/0x5c0
[ 99.871619][ T52] print_report+0xca/0x240
[ 99.871632][ T52] ? hci_cmd_work+0x5d0/0x7b0
[ 99.871648][ T52] kasan_report+0x118/0x150
[ 99.871666][ T52] ? hci_cmd_work+0x5d0/0x7b0
[ 99.871680][ T52] hci_cmd_work+0x5d0/0x7b0
[ 99.871692][ T52] ? process_one_work+0x868/0x15e0
[ 99.871704][ T52] process_one_work+0x93a/0x15e0
[ 99.871715][ T52] ? __lock_acquire+0xab9/0xd20
[ 99.871734][ T52] ? __pfx_process_one_work+0x10/0x10
[ 99.871747][ T52] ? assign_work+0x3a1/0x410
[ 99.871759][ T52] worker_thread+0x9b0/0xee0
[ 99.871776][ T52] kthread+0x711/0x8a0
[ 99.871786][ T52] ? __pfx_worker_thread+0x10/0x10
[ 99.871798][ T52] ? __pfx_kthread+0x10/0x10
[ 99.871806][ T52] ? _raw_spin_unlock_irq+0x23/0x50
[ 99.871815][ T52] ? lockdep_hardirqs_on+0x9c/0x150
[ 99.871826][ T52] ? __pfx_kthread+0x10/0x10
[ 99.871835][ T52] ret_from_fork+0x599/0xb30
[ 99.871850][ T52] ? __pfx_ret_from_fork+0x10/0x10
[ 99.871863][ T52] ? __switch_to_asm+0x39/0x70
[ 99.871873][ T52] ? __switch_to_asm+0x33/0x70
[ 99.871881][ T52] ? __pfx_kthread+0x10/0x10
[ 99.871890][ T52] ret_from_fork_asm+0x1a/0x30
[ 99.871902][ T52]
[ 99.871906][ T52]
[ 100.079232][ T52] Allocated by task 5146:
[ 100.083900][ T52] kasan_save_track+0x3e/0x80
[ 100.089527][ T52] __kasan_slab_alloc+0x6c/0x80
[ 100.094560][ T52] kmem_cache_alloc_node_noprof+0x43c/0x710
[ 100.100975][ T52] __alloc_skb+0x112/0x2d0
[ 100.106049][ T52] hci_cmd_sync_alloc+0x3d/0x3b0
[ 100.111341][ T52] __hci_cmd_sync_sk+0x1a7/0xc70
[ 100.116363][ T52] hci_dev_open_sync+0x14b2/0x2dc0
[ 100.121813][ T52] hci_power_on+0x1b4/0x720
[ 100.126493][ T52] process_one_work+0x93a/0x15e0
[ 100.131863][ T52] worker_thread+0x9b0/0xee0
[ 100.136453][ T52] kthread+0x711/0x8a0
[ 100.140615][ T52] ret_from_fork+0x599/0xb30
[ 100.145326][ T52] ret_from_fork_asm+0x1a/0x30
[ 100.150076][ T52]
[ 100.152393][ T52] Freed by task 6024:
[ 100.156549][ T52] kasan_save_track+0x3e/0x80
[ 100.161575][ T52] kasan_save_free_info+0x46/0x50
[ 100.166661][ T52] __kasan_slab_free+0x5c/0x80
[ 100.172111][ T52] kmem_cache_free+0x197/0x640
[ 100.177873][ T52] vhci_read+0x49a/0x5b0
[ 100.182745][ T52] vfs_read+0x200/0xa30
[ 100.187111][ T52] ksys_read+0x145/0x250
[ 100.191971][ T52] do_syscall_64+0xfa/0xfa0
[ 100.196677][ T52] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 100.203166][ T52]
[ 100.205660][ T52] The buggy address belongs to the object at ffff88802aa8e640
[ 100.205660][ T52] which belongs to the cache skbuff_head_cache of size 240
[ 100.221031][ T52] The buggy address is located 56 bytes inside of
[ 100.221031][ T52] freed 240-byte region [ffff88802aa8e640, ffff88802aa8e730)
[ 100.235548][ T52]
[ 100.238033][ T52] The buggy address belongs to the physical page:
[ 100.244871][ T52] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2aa8e
[ 100.253998][ T52] anon flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 100.262143][ T52] page_type: f5(slab)
[ 100.266909][ T52] raw: 00fff00000000000 ffff88801eea48c0 0000000000000000 dead000000000001
[ 100.276018][ T52] raw: 0000000000000000 00000000000c000c 00000000f5000000 0000000000000000
[ 100.285673][ T52] page dumped because: kasan: bad access detected
[ 100.293242][ T52] page_owner tracks the page as allocated
[ 100.299589][ T52] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5491, tgid 5491 (dhcpcd), ts 56134941286, free_ts 55514546160
[ 100.321760][ T52] post_alloc_hook+0x240/0x2a0
[ 100.327182][ T52] get_page_from_freelist+0x2365/0x2440
[ 100.333531][ T52] __alloc_frozen_pages_noprof+0x181/0x370
[ 100.340731][ T52] alloc_pages_mpol+0x232/0x4a0
[ 100.345767][ T52] allocate_slab+0x86/0x3b0
[ 100.350714][ T52] ___slab_alloc+0xf56/0x1990
[ 100.355729][ T52] __slab_alloc+0x65/0x100
[ 100.360568][ T52] kmem_cache_alloc_node_noprof+0x4ce/0x710
[ 100.366984][ T52] __alloc_skb+0x112/0x2d0
[ 100.372657][ T52] alloc_skb_with_frags+0xca/0x890
[ 100.378255][ T52] sock_alloc_send_pskb+0x84d/0x980
[ 100.383992][ T52] unix_dgram_sendmsg+0x461/0x1850
[ 100.389383][ T52] __sock_sendmsg+0x21c/0x270
[ 100.394782][ T52] __sys_sendto+0x3bd/0x520
[ 100.399650][ T52] __x64_sys_sendto+0xde/0x100
[ 100.405387][ T52] do_syscall_64+0xfa/0xfa0
[ 100.410336][ T52] page last free pid 23 tgid 23 stack trace:
[ 100.416803][ T52] __free_frozen_pages+0xbc8/0xd30
[ 100.422375][ T52] tlb_remove_table_rcu+0x85/0x100
[ 100.427661][ T52] rcu_core+0xcab/0x1770
[ 100.432500][ T52] handle_softirqs+0x27d/0x880
[ 100.437527][ T52] run_ksoftirqd+0x9b/0x100
[ 100.443195][ T52] smpboot_thread_fn+0x542/0xa60
[ 100.448593][ T52] kthread+0x711/0x8a0
[ 100.454047][ T52] ret_from_fork+0x599/0xb30
[ 100.459343][ T52] ret_from_fork_asm+0x1a/0x30
[ 100.465723][ T52]
[ 100.468569][ T52] Memory state around the buggy address:
[ 100.474584][ T52] ffff88802aa8e500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 100.483516][ T52] ffff88802aa8e580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 100.492097][ T52] >ffff88802aa8e600: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 100.500413][ T52] ^
[ 100.508467][ T52] ffff88802aa8e680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 100.516780][ T52] ffff88802aa8e700: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[ 100.525084][ T52] ==================================================================
[ 100.534646][ T52] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 100.542206][ T52] CPU: 0 UID: 0 PID: 52 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT(full)
[ 100.551823][ T52] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 100.563000][ T52] Workqueue: hci0 hci_cmd_work
[ 100.567766][ T52] Call Trace:
[ 100.571730][ T52]
[ 100.574742][ T52] dump_stack_lvl+0x99/0x250
[ 100.580104][ T52] ? __asan_memcpy+0x40/0x70
[ 100.584850][ T52] ? __pfx_dump_stack_lvl+0x10/0x10
[ 100.590380][ T52] ? __pfx__printk+0x10/0x10
[ 100.595085][ T52] vpanic+0x237/0x6d0
[ 100.599322][ T52] ? __pfx_vpanic+0x10/0x10
[ 100.604077][ T52] ? preempt_schedule+0xae/0xc0
[ 100.609351][ T52] ? __pfx_preempt_schedule+0x10/0x10
[ 100.615057][ T52] panic+0xb9/0xc0
[ 100.619037][ T52] ? __pfx_panic+0x10/0x10
[ 100.623822][ T52] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 100.630153][ T52] ? is_module_address+0x17/0xf0
[ 100.635698][ T52] ? hci_cmd_work+0x5d0/0x7b0
[ 100.640694][ T52] check_panic_on_warn+0x89/0xb0
[ 100.646589][ T52] ? hci_cmd_work+0x5d0/0x7b0
[ 100.651699][ T52] end_report+0x6f/0x160
[ 100.656111][ T52] kasan_report+0x129/0x150
[ 100.660953][ T52] ? hci_cmd_work+0x5d0/0x7b0
[ 100.667293][ T52] hci_cmd_work+0x5d0/0x7b0
[ 100.672171][ T52] ? process_one_work+0x868/0x15e0
[ 100.677458][ T52] process_one_work+0x93a/0x15e0
[ 100.682824][ T52] ? __lock_acquire+0xab9/0xd20
[ 100.688025][ T52] ? __pfx_process_one_work+0x10/0x10
[ 100.693687][ T52] ? assign_work+0x3a1/0x410
[ 100.698544][ T52] worker_thread+0x9b0/0xee0
[ 100.703568][ T52] kthread+0x711/0x8a0
[ 100.708081][ T52] ? __pfx_worker_thread+0x10/0x10
[ 100.713698][ T52] ? __pfx_kthread+0x10/0x10
[ 100.718545][ T52] ? _raw_spin_unlock_irq+0x23/0x50
[ 100.723903][ T52] ? lockdep_hardirqs_on+0x9c/0x150
[ 100.729296][ T52] ? __pfx_kthread+0x10/0x10
[ 100.734565][ T52] ret_from_fork+0x599/0xb30
[ 100.739143][ T52] ? __pfx_ret_from_fork+0x10/0x10
[ 100.744597][ T52] ? __switch_to_asm+0x39/0x70
[ 100.749434][ T52] ? __switch_to_asm+0x33/0x70
[ 100.754352][ T52] ? __pfx_kthread+0x10/0x10
[ 100.759624][ T52] ret_from_fork_asm+0x1a/0x30
[ 100.764742][ T52]
[ 100.768321][ T52] Kernel Offset: disabled
[ 100.772725][ T52] Rebooting in 86400 seconds..