last executing test programs:
3.459672271s ago: executing program 1 (id=296):
exit_group(0x0)
3.39988959s ago: executing program 1 (id=299):
process_vm_readv(0x0, &(0x7f0000000000), 0x0, &(0x7f0000000000), 0x0, 0x0)
3.399333585s ago: executing program 1 (id=302):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptp1', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptp1', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptp1', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptp1', 0x800, 0x0)
3.379241547s ago: executing program 1 (id=304):
chdir(&(0x7f0000000000))
3.315553289s ago: executing program 1 (id=309):
rt_sigreturn()
715.522981ms ago: executing program 2 (id=520):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/damon/kdamond_pid', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/damon/kdamond_pid', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/damon/kdamond_pid', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/damon/kdamond_pid', 0x800, 0x0)
710.56857ms ago: executing program 2 (id=524):
removexattr(&(0x7f0000000000), &(0x7f0000000000))
676.698549ms ago: executing program 2 (id=526):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/commit_pending_bools', 0x1, 0x0)
603.728606ms ago: executing program 2 (id=532):
socket$l2tp(0x2, 0x2, 0x73)
603.54465ms ago: executing program 2 (id=534):
dup(0xffffffffffffffff)
589.369552ms ago: executing program 2 (id=536):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/enforce', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/enforce', 0x800, 0x0)
320.550814ms ago: executing program 0 (id=548):
socket$phonet(0x23, 0x2, 0x1)
319.26334ms ago: executing program 3 (id=550):
msgrcv(0x0, &(0x7f0000000000), 0x0, 0x0, 0x0)
308.116522ms ago: executing program 3 (id=553):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse', 0x2, 0x0)
299.693687ms ago: executing program 0 (id=554):
memfd_secret(0x0)
247.850786ms ago: executing program 3 (id=555):
syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0)
syz_open_dev$sndctrl(&(0x7f0000000080), 0x0, 0x1)
syz_open_dev$sndctrl(&(0x7f00000000c0), 0x0, 0x2)
syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x800)
syz_open_dev$sndctrl(&(0x7f0000000140), 0x1, 0x0)
syz_open_dev$sndctrl(&(0x7f0000000180), 0x1, 0x1)
syz_open_dev$sndctrl(&(0x7f00000001c0), 0x1, 0x2)
syz_open_dev$sndctrl(&(0x7f0000000200), 0x1, 0x800)
syz_open_dev$sndctrl(&(0x7f0000000240), 0x2, 0x0)
syz_open_dev$sndctrl(&(0x7f0000000280), 0x2, 0x1)
syz_open_dev$sndctrl(&(0x7f00000002c0), 0x2, 0x2)
syz_open_dev$sndctrl(&(0x7f0000000300), 0x2, 0x800)
syz_open_dev$sndctrl(&(0x7f0000000340), 0x3, 0x0)
syz_open_dev$sndctrl(&(0x7f0000000380), 0x3, 0x1)
syz_open_dev$sndctrl(&(0x7f00000003c0), 0x3, 0x2)
syz_open_dev$sndctrl(&(0x7f0000000400), 0x3, 0x800)
syz_open_dev$sndctrl(&(0x7f0000000440), 0x4, 0x0)
syz_open_dev$sndctrl(&(0x7f0000000480), 0x4, 0x1)
syz_open_dev$sndctrl(&(0x7f00000004c0), 0x4, 0x2)
syz_open_dev$sndctrl(&(0x7f0000000500), 0x4, 0x800)
247.672651ms ago: executing program 0 (id=556):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vmci', 0x2, 0x0)
225.363302ms ago: executing program 4 (id=558):
times(&(0x7f0000000000))
222.021981ms ago: executing program 0 (id=559):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sev', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sev', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sev', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sev', 0x800, 0x0)
167.92251ms ago: executing program 3 (id=560):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/virtual_nci', 0x2, 0x0)
167.467656ms ago: executing program 4 (id=561):
socket$xdp(0x2c, 0x3, 0x0)
167.019012ms ago: executing program 0 (id=562):
rt_sigtimedwait(&(0x7f0000000000), 0x0, &(0x7f0000000000), 0x0)
160.475599ms ago: executing program 4 (id=563):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ttyprintk', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyprintk', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ttyprintk', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ttyprintk', 0x800, 0x0)
144.968098ms ago: executing program 1 (id=564):
socket$inet_tcp(0x2, 0x1, 0x0)
83.886755ms ago: executing program 0 (id=565):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp1', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp1', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dsp1', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp1', 0x800, 0x0)
83.772946ms ago: executing program 3 (id=566):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/reclaim', 0x1, 0x0)
83.680523ms ago: executing program 4 (id=567):
semtimedop(0x0, &(0x7f0000000000), 0x0, &(0x7f0000000000))
80.334971ms ago: executing program 4 (id=568):
faccessat2(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0)
74.380635ms ago: executing program 3 (id=569):
mbind(0x0, 0x0, 0x0, &(0x7f0000000000), 0x0, 0x0)
0s ago: executing program 4 (id=570):
fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0)
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.0.74' (ED25519) to the list of known hosts.
[ 72.533003][ T5819] cgroup: Unknown subsys name 'net'
[ 72.664393][ T5819] cgroup: Unknown subsys name 'cpuset'
[ 72.673707][ T5819] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 74.154124][ T5819] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 76.834205][ T5903] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[ 77.262842][ T5959] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[ 82.483735][ T52] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 82.492749][ T52] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 82.500601][ T52] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 82.511043][ T52] ==================================================================
[ 82.519231][ T52] BUG: KASAN: slab-use-after-free in hci_cmd_work+0x5d0/0x7b0
[ 82.526883][ T52] Read of size 2 at addr ffff88802a8c68f8 by task kworker/u9:0/52
[ 82.534966][ T52]
[ 82.537500][ T52] CPU: 0 UID: 0 PID: 52 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT(full)
[ 82.537520][ T52] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 82.537529][ T52] Workqueue: hci0 hci_cmd_work
[ 82.537556][ T52] Call Trace:
[ 82.537561][ T52]
[ 82.537568][ T52] dump_stack_lvl+0x189/0x250
[ 82.537590][ T52] ? __virt_addr_valid+0x1c8/0x5c0
[ 82.537609][ T52] ? rcu_is_watching+0x15/0xb0
[ 82.537622][ T52] ? __pfx_dump_stack_lvl+0x10/0x10
[ 82.537639][ T52] ? rcu_is_watching+0x15/0xb0
[ 82.537651][ T52] ? lock_release+0x4b/0x3d0
[ 82.537669][ T52] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 82.537686][ T52] ? __virt_addr_valid+0x1c8/0x5c0
[ 82.537698][ T52] ? __virt_addr_valid+0x4a5/0x5c0
[ 82.537712][ T52] print_report+0xca/0x240
[ 82.537729][ T52] ? hci_cmd_work+0x5d0/0x7b0
[ 82.537746][ T52] kasan_report+0x118/0x150
[ 82.537766][ T52] ? hci_cmd_work+0x5d0/0x7b0
[ 82.537786][ T52] hci_cmd_work+0x5d0/0x7b0
[ 82.537812][ T52] ? process_one_work+0x868/0x15e0
[ 82.537829][ T52] process_one_work+0x93a/0x15e0
[ 82.537844][ T52] ? __lock_acquire+0xab9/0xd20
[ 82.537866][ T52] ? __pfx_process_one_work+0x10/0x10
[ 82.537883][ T52] ? assign_work+0x3a1/0x410
[ 82.537900][ T52] worker_thread+0x9b0/0xee0
[ 82.537924][ T52] kthread+0x711/0x8a0
[ 82.537937][ T52] ? __pfx_worker_thread+0x10/0x10
[ 82.537952][ T52] ? __pfx_kthread+0x10/0x10
[ 82.537965][ T52] ? _raw_spin_unlock_irq+0x23/0x50
[ 82.537979][ T52] ? lockdep_hardirqs_on+0x9c/0x150
[ 82.537995][ T52] ? __pfx_kthread+0x10/0x10
[ 82.538007][ T52] ret_from_fork+0x599/0xb30
[ 82.538024][ T52] ? __pfx_ret_from_fork+0x10/0x10
[ 82.538042][ T52] ? __switch_to_asm+0x39/0x70
[ 82.538054][ T52] ? __switch_to_asm+0x33/0x70
[ 82.538066][ T52] ? __pfx_kthread+0x10/0x10
[ 82.538077][ T52] ret_from_fork_asm+0x1a/0x30
[ 82.538095][ T52]
[ 82.538101][ T52]
[ 82.731485][ T52] Allocated by task 5152:
[ 82.735818][ T52] kasan_save_track+0x3e/0x80
[ 82.740500][ T52] __kasan_slab_alloc+0x6c/0x80
[ 82.745382][ T52] kmem_cache_alloc_node_noprof+0x43c/0x710
[ 82.751445][ T52] __alloc_skb+0x112/0x2d0
[ 82.756073][ T52] hci_cmd_sync_alloc+0x3d/0x3b0
[ 82.761276][ T52] __hci_cmd_sync_sk+0x1a7/0xc70
[ 82.766228][ T52] hci_dev_open_sync+0x1756/0x2dc0
[ 82.771435][ T52] hci_power_on+0x1b4/0x720
[ 82.775955][ T52] process_one_work+0x93a/0x15e0
[ 82.780989][ T52] worker_thread+0x9b0/0xee0
[ 82.785669][ T52] kthread+0x711/0x8a0
[ 82.789809][ T52] ret_from_fork+0x599/0xb30
[ 82.794385][ T52] ret_from_fork_asm+0x1a/0x30
[ 82.799388][ T52]
[ 82.801691][ T52] Freed by task 6434:
[ 82.805651][ T52] kasan_save_track+0x3e/0x80
[ 82.810359][ T52] kasan_save_free_info+0x46/0x50
[ 82.815384][ T52] __kasan_slab_free+0x5c/0x80
[ 82.820260][ T52] kmem_cache_free+0x197/0x640
[ 82.825315][ T52] vhci_read+0x49a/0x5b0
[ 82.829930][ T52] vfs_read+0x200/0xa30
[ 82.834181][ T52] ksys_read+0x145/0x250
[ 82.838863][ T52] do_syscall_64+0xfa/0xfa0
[ 82.843471][ T52] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 82.849509][ T52]
[ 82.851827][ T52] The buggy address belongs to the object at ffff88802a8c68c0
[ 82.851827][ T52] which belongs to the cache skbuff_head_cache of size 240
[ 82.866915][ T52] The buggy address is located 56 bytes inside of
[ 82.866915][ T52] freed 240-byte region [ffff88802a8c68c0, ffff88802a8c69b0)
[ 82.881230][ T52]
[ 82.883635][ T52] The buggy address belongs to the physical page:
[ 82.890175][ T52] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2a8c6
[ 82.899296][ T52] anon flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 82.907209][ T52] page_type: f5(slab)
[ 82.911212][ T52] raw: 00fff00000000000 ffff888140aefa00 0000000000000000 dead000000000001
[ 82.919897][ T52] raw: 0000000000000000 00000000000c000c 00000000f5000000 0000000000000000
[ 82.928746][ T52] page dumped because: kasan: bad access detected
[ 82.935587][ T52] page_owner tracks the page as allocated
[ 82.941368][ T52] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5206, tgid 5206 (udevd), ts 28230174604, free_ts 28209938018
[ 82.960540][ T52] post_alloc_hook+0x240/0x2a0
[ 82.965396][ T52] get_page_from_freelist+0x2365/0x2440
[ 82.971019][ T52] __alloc_frozen_pages_noprof+0x181/0x370
[ 82.976837][ T52] alloc_pages_mpol+0x232/0x4a0
[ 82.981689][ T52] allocate_slab+0x86/0x3b0
[ 82.986494][ T52] ___slab_alloc+0xf56/0x1990
[ 82.991319][ T52] __slab_alloc+0x65/0x100
[ 82.995896][ T52] kmem_cache_alloc_node_noprof+0x4ce/0x710
[ 83.001847][ T52] __alloc_skb+0x112/0x2d0
[ 83.006250][ T52] netlink_sendmsg+0x5c6/0xb30
[ 83.011104][ T52] __sock_sendmsg+0x21c/0x270
[ 83.015768][ T52] ____sys_sendmsg+0x505/0x870
[ 83.020525][ T52] ___sys_sendmsg+0x21f/0x2a0
[ 83.025200][ T52] __x64_sys_sendmsg+0x19b/0x260
[ 83.030136][ T52] do_syscall_64+0xfa/0xfa0
[ 83.034712][ T52] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 83.040587][ T52] page last free pid 5203 tgid 5203 stack trace:
[ 83.046891][ T52] __free_frozen_pages+0xbc8/0xd30
[ 83.051993][ T52] __put_partials+0x146/0x170
[ 83.056760][ T52] put_cpu_partial+0x1f2/0x2e0
[ 83.061532][ T52] __slab_free+0x288/0x2a0
[ 83.065961][ T52] qlist_free_all+0x97/0x100
[ 83.070647][ T52] kasan_quarantine_reduce+0x148/0x160
[ 83.076310][ T52] __kasan_slab_alloc+0x22/0x80
[ 83.081147][ T52] __kmalloc_cache_noprof+0x37c/0x700
[ 83.086698][ T52] kernfs_fop_open+0x397/0xca0
[ 83.091461][ T52] do_dentry_open+0x7ce/0x1420
[ 83.096229][ T52] vfs_open+0x3b/0x340
[ 83.100385][ T52] path_openat+0x33ce/0x3d90
[ 83.105138][ T52] do_filp_open+0x1fa/0x410
[ 83.109640][ T52] do_sys_openat2+0x121/0x1c0
[ 83.114296][ T52] __x64_sys_openat+0x138/0x170
[ 83.119300][ T52] do_syscall_64+0xfa/0xfa0
[ 83.123825][ T52]
[ 83.126132][ T52] Memory state around the buggy address:
[ 83.131765][ T52] ffff88802a8c6780: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 83.139827][ T52] ffff88802a8c6800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 83.148092][ T52] >ffff88802a8c6880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 83.156310][ T52] ^
[ 83.164306][ T52] ffff88802a8c6900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 83.172361][ T52] ffff88802a8c6980: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[ 83.180416][ T52] ==================================================================
[ 83.200835][ T52] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 83.208167][ T52] CPU: 0 UID: 0 PID: 52 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT(full)
[ 83.217702][ T52] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 83.227836][ T52] Workqueue: hci0 hci_cmd_work
[ 83.232600][ T52] Call Trace:
[ 83.235872][ T52]
[ 83.238783][ T52] dump_stack_lvl+0x99/0x250
[ 83.243459][ T52] ? __asan_memcpy+0x40/0x70
[ 83.248034][ T52] ? __pfx_dump_stack_lvl+0x10/0x10
[ 83.253574][ T52] ? __pfx__printk+0x10/0x10
[ 83.258175][ T52] vpanic+0x237/0x6d0
[ 83.262283][ T52] ? __pfx_vpanic+0x10/0x10
[ 83.266871][ T52] ? preempt_schedule+0xae/0xc0
[ 83.271710][ T52] ? __pfx_preempt_schedule+0x10/0x10
[ 83.277068][ T52] panic+0xb9/0xc0
[ 83.280884][ T52] ? __pfx_panic+0x10/0x10
[ 83.285470][ T52] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 83.291364][ T52] ? is_module_address+0x17/0xf0
[ 83.296344][ T52] ? hci_cmd_work+0x5d0/0x7b0
[ 83.301045][ T52] check_panic_on_warn+0x89/0xb0
[ 83.306005][ T52] ? hci_cmd_work+0x5d0/0x7b0
[ 83.310771][ T52] end_report+0x6f/0x160
[ 83.315013][ T52] kasan_report+0x129/0x150
[ 83.319524][ T52] ? hci_cmd_work+0x5d0/0x7b0
[ 83.324231][ T52] hci_cmd_work+0x5d0/0x7b0
[ 83.329000][ T52] ? process_one_work+0x868/0x15e0
[ 83.334194][ T52] process_one_work+0x93a/0x15e0
[ 83.339291][ T52] ? __lock_acquire+0xab9/0xd20
[ 83.344224][ T52] ? __pfx_process_one_work+0x10/0x10
[ 83.349597][ T52] ? assign_work+0x3a1/0x410
[ 83.354217][ T52] worker_thread+0x9b0/0xee0
[ 83.358806][ T52] kthread+0x711/0x8a0
[ 83.363048][ T52] ? __pfx_worker_thread+0x10/0x10
[ 83.368147][ T52] ? __pfx_kthread+0x10/0x10
[ 83.372719][ T52] ? _raw_spin_unlock_irq+0x23/0x50
[ 83.377915][ T52] ? lockdep_hardirqs_on+0x9c/0x150
[ 83.383194][ T52] ? __pfx_kthread+0x10/0x10
[ 83.387785][ T52] ret_from_fork+0x599/0xb30
[ 83.392381][ T52] ? __pfx_ret_from_fork+0x10/0x10
[ 83.397511][ T52] ? __switch_to_asm+0x39/0x70
[ 83.402263][ T52] ? __switch_to_asm+0x33/0x70
[ 83.407010][ T52] ? __pfx_kthread+0x10/0x10
[ 83.411676][ T52] ret_from_fork_asm+0x1a/0x30
[ 83.416606][ T52]
[ 83.419903][ T52] Kernel Offset: disabled
[ 83.424306][ T52] Rebooting in 86400 seconds..