last executing test programs:
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.10.26' (ED25519) to the list of known hosts.
[ 74.682871][ T29] audit: type=1400 audit(1719927854.394:87): avc: denied { mounton } for pid=5071 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1925 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1
[ 74.691667][ T5071] cgroup: Unknown subsys name 'net'
[ 74.705695][ T29] audit: type=1400 audit(1719927854.404:88): avc: denied { mount } for pid=5071 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 74.733843][ T29] audit: type=1400 audit(1719927854.434:89): avc: denied { unmount } for pid=5071 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 74.915676][ T5071] cgroup: Unknown subsys name 'rlimit'
[ 75.046850][ T29] audit: type=1400 audit(1719927854.764:90): avc: denied { setattr } for pid=5071 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=733 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 75.071239][ T29] audit: type=1400 audit(1719927854.764:91): avc: denied { create } for pid=5071 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 75.111183][ T29] audit: type=1400 audit(1719927854.764:92): avc: denied { write } for pid=5071 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 75.133588][ T29] audit: type=1400 audit(1719927854.764:93): avc: denied { read } for pid=5071 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 75.154156][ T29] audit: type=1400 audit(1719927854.784:94): avc: denied { mounton } for pid=5071 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1
[ 75.179303][ T29] audit: type=1400 audit(1719927854.784:95): avc: denied { mount } for pid=5071 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1
[ 75.194644][ T5073] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped).
Setting up swapspace version 1, size = 127995904 bytes
[ 75.203058][ T29] audit: type=1400 audit(1719927854.814:96): avc: denied { read } for pid=4748 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1
[ 76.588892][ T5071] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 77.306279][ T53] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 77.317461][ T5091] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 77.331004][ T5094] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 77.332263][ T5091] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[ 77.339323][ T5094] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 77.347525][ T5091] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 77.356750][ T5094] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 77.360422][ T5091] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[ 77.376372][ T5094] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 77.377067][ T5091] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[ 77.383986][ T5094] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 77.393123][ T5091] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[ 77.398544][ T5094] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[ 77.405847][ T5091] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[ 77.414845][ T5094] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[ 77.420679][ T5091] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[ 77.427221][ T5094] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[ 77.434488][ T5091] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3
[ 77.448189][ T4478] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[ 77.456551][ T5096] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[ 77.465872][ T5096] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3
[ 77.469271][ T5094] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[ 77.473522][ T5096] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[ 77.482690][ T5094] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[ 77.489813][ T5096] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[ 77.502946][ T5096] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[ 77.513704][ T5096] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3
[ 77.522919][ T5087] ==================================================================
[ 77.523430][ T5093] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[ 77.531000][ T5087] BUG: KASAN: slab-use-after-free in kfree_skb_reason+0x36/0x210
[ 77.545784][ T5087] Read of size 4 at addr ffff888064debae4 by task syz-executor/5087
[ 77.553837][ T5087]
[ 77.556170][ T5087] CPU: 1 PID: 5087 Comm: syz-executor Not tainted 6.10.0-rc6-syzkaller-00051-g1dfe225e9af5 #0
[ 77.566404][ T5087] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
[ 77.576470][ T5087] Call Trace:
[ 77.579748][ T5087] <TASK>
[ 77.582688][ T5087] dump_stack_lvl+0x116/0x1f0
[ 77.587400][ T5087] print_report+0xc3/0x620
[ 77.591832][ T5087] ? __virt_addr_valid+0x5e/0x580
[ 77.596944][ T5087] ? __phys_addr+0xc6/0x150
[ 77.601471][ T5087] kasan_report+0xd9/0x110
[ 77.605917][ T5087] ? kfree_skb_reason+0x36/0x210
[ 77.610867][ T5087] ? kfree_skb_reason+0x36/0x210
[ 77.615839][ T5087] kasan_check_range+0xef/0x1a0
[ 77.620710][ T5087] kfree_skb_reason+0x36/0x210
[ 77.625573][ T5087] __hci_req_sync+0x61d/0x980
[ 77.630355][ T5087] ? __pfx___hci_req_sync+0x10/0x10
[ 77.635558][ T5087] ? __mutex_lock+0x1a6/0x9c0
[ 77.640236][ T5087] ? __pfx_autoremove_wake_function+0x10/0x10
[ 77.646313][ T5087] ? hci_req_sync+0x3f/0xd0
[ 77.650815][ T5087] ? __pfx___might_resched+0x10/0x10
[ 77.656106][ T5087] hci_req_sync+0x97/0xd0
[ 77.660527][ T5087] ? __pfx_hci_scan_req+0x10/0x10
[ 77.665553][ T5087] hci_dev_cmd+0x634/0x960
[ 77.669982][ T5087] ? cap_capable+0x1cf/0x240
[ 77.674586][ T5087] ? __pfx_hci_dev_cmd+0x10/0x10
[ 77.679538][ T5087] ? security_capable+0x98/0xd0
[ 77.684574][ T5087] hci_sock_ioctl+0x4f3/0x880
[ 77.689253][ T5087] ? __pfx_hci_sock_ioctl+0x10/0x10
[ 77.694463][ T5087] sock_do_ioctl+0x116/0x280
[ 77.699053][ T5087] ? __pfx_sock_do_ioctl+0x10/0x10
[ 77.704161][ T5087] ? ioctl_has_perm.constprop.0.isra.0+0x2f9/0x470
[ 77.710664][ T5087] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10
[ 77.717517][ T5087] sock_ioctl+0x22e/0x6c0
[ 77.721843][ T5087] ? __pfx_sock_ioctl+0x10/0x10
[ 77.726692][ T5087] ? selinux_file_ioctl+0x180/0x270
[ 77.731893][ T5087] ? selinux_file_ioctl+0xb4/0x270
[ 77.737002][ T5087] ? __pfx_sock_ioctl+0x10/0x10
[ 77.741851][ T5087] __x64_sys_ioctl+0x193/0x220
[ 77.746622][ T5087] do_syscall_64+0xcd/0x250
[ 77.751149][ T5087] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 77.757057][ T5087] RIP: 0033:0x7f0cb2775b1b
[ 77.761478][ T5087] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
[ 77.781105][ T5087] RSP: 002b:00007ffc3fcd8b20 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 77.789605][ T5087] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f0cb2775b1b
[ 77.797571][ T5087] RDX: 00007ffc3fcd8b98 RSI: 00000000400448dd RDI: 0000000000000003
[ 77.805535][ T5087] RBP: 000055555b2414a8 R08: 0000000000000000 R09: 0000000000000000
[ 77.813500][ T5087] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000004
[ 77.821473][ T5087] R13: 0000000000000004 R14: 0000000000000009 R15: 0000000000000009
[ 77.829441][ T5087] </TASK>
[ 77.832452][ T5087]
[ 77.834788][ T5087] Allocated by task 5096:
[ 77.839102][ T5087] kasan_save_stack+0x33/0x60
[ 77.843784][ T5087] kasan_save_track+0x14/0x30
[ 77.848460][ T5087] __kasan_slab_alloc+0x89/0x90
[ 77.853312][ T5087] kmem_cache_alloc_noprof+0x121/0x2f0
[ 77.858781][ T5087] skb_clone+0x190/0x3f0
[ 77.863022][ T5087] hci_cmd_work+0x66a/0x710
[ 77.867523][ T5087] process_one_work+0x9c5/0x1b40
[ 77.872466][ T5087] worker_thread+0x6c8/0xf30
[ 77.877047][ T5087] kthread+0x2c1/0x3a0
[ 77.881112][ T5087] ret_from_fork+0x45/0x80
[ 77.885548][ T5087] ret_from_fork_asm+0x1a/0x30
[ 77.890316][ T5087]
[ 77.892633][ T5087] Freed by task 5093:
[ 77.897128][ T5087] kasan_save_stack+0x33/0x60
[ 77.901807][ T5087] kasan_save_track+0x14/0x30
[ 77.906572][ T5087] kasan_save_free_info+0x3b/0x60
[ 77.911597][ T5087] poison_slab_object+0xf7/0x160
[ 77.916539][ T5087] __kasan_slab_free+0x32/0x50
[ 77.921391][ T5087] kmem_cache_free+0x12f/0x3a0
[ 77.926158][ T5087] kfree_skbmem+0x10e/0x200
[ 77.930657][ T5087] kfree_skb_reason+0x138/0x210
[ 77.935602][ T5087] hci_req_sync_complete+0x16c/0x270
[ 77.940908][ T5087] hci_event_packet+0x963/0x1170
[ 77.945842][ T5087] hci_rx_work+0x2c4/0x1610
[ 77.950339][ T5087] process_one_work+0x9c5/0x1b40
[ 77.955272][ T5087] worker_thread+0x6c8/0xf30
[ 77.959854][ T5087] kthread+0x2c1/0x3a0
[ 77.963923][ T5087] ret_from_fork+0x45/0x80
[ 77.968430][ T5087] ret_from_fork_asm+0x1a/0x30
[ 77.973194][ T5087]
[ 77.975508][ T5087] The buggy address belongs to the object at ffff888064deba00
[ 77.975508][ T5087] which belongs to the cache skbuff_head_cache of size 240
[ 77.990082][ T5087] The buggy address is located 228 bytes inside of
[ 77.990082][ T5087] freed 240-byte region [ffff888064deba00, ffff888064debaf0)
[ 78.003870][ T5087]
[ 78.006181][ T5087] The buggy address belongs to the physical page:
[ 78.012612][ T5087] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x64deb
[ 78.021409][ T5087] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 78.028547][ T5087] page_type: 0xffffefff(slab)
[ 78.033236][ T5087] raw: 00fff00000000000 ffff8880192a6780 dead000000000122 0000000000000000
[ 78.041815][ T5087] raw: 0000000000000000 00000000800c000c 00000001ffffefff 0000000000000000
[ 78.050475][ T5087] page dumped because: kasan: bad access detected
[ 78.056886][ T5087] page_owner tracks the page as allocated
[ 78.062597][ T5087] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5096, tgid 5096 (kworker/u9:8), ts 77513660138, free_ts 26475657177
[ 78.081881][ T5087] post_alloc_hook+0x2d1/0x350
[ 78.086660][ T5087] get_page_from_freelist+0x1353/0x2e50
[ 78.092211][ T5087] __alloc_pages_noprof+0x22b/0x2460
[ 78.097507][ T5087] alloc_slab_page+0x56/0x110
[ 78.102181][ T5087] new_slab+0x84/0x260
[ 78.106249][ T5087] ___slab_alloc+0xdac/0x1870
[ 78.110928][ T5087] __slab_alloc.constprop.0+0x56/0xb0
[ 78.116306][ T5087] kmem_cache_alloc_noprof+0x2a7/0x2f0
[ 78.121768][ T5087] skb_clone+0x190/0x3f0
[ 78.126009][ T5087] hci_event_packet+0x2ce/0x1170
[ 78.130956][ T5087] hci_rx_work+0x2c4/0x1610
[ 78.135506][ T5087] process_one_work+0x9c5/0x1b40
[ 78.140443][ T5087] worker_thread+0x6c8/0xf30
[ 78.145023][ T5087] kthread+0x2c1/0x3a0
[ 78.149110][ T5087] ret_from_fork+0x45/0x80
[ 78.153526][ T5087] ret_from_fork_asm+0x1a/0x30
[ 78.158293][ T5087] page last free pid 1 tgid 1 stack trace:
[ 78.164084][ T5087] free_unref_page+0x64a/0xe40
[ 78.168933][ T5087] free_contig_range+0xb6/0x1a0
[ 78.173785][ T5087] destroy_args+0xa4e/0xe20
[ 78.178290][ T5087] debug_vm_pgtable+0x1705/0x3280
[ 78.183322][ T5087] do_one_initcall+0x128/0x700
[ 78.188176][ T5087] kernel_init_freeable+0x69d/0xca0
[ 78.193377][ T5087] kernel_init+0x1c/0x2b0
[ 78.197709][ T5087] ret_from_fork+0x45/0x80
[ 78.202267][ T5087] ret_from_fork_asm+0x1a/0x30
[ 78.207033][ T5087]
[ 78.209345][ T5087] Memory state around the buggy address:
[ 78.215071][ T5087] ffff888064deb980: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[ 78.223258][ T5087] ffff888064deba00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.231348][ T5087] >ffff888064deba80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 78.239589][ T5087] ^
[ 78.246788][ T5087] ffff888064debb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 78.254852][ T5087] ffff888064debb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 78.262903][ T5087] ==================================================================
[ 78.293680][ T5087] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 78.300928][ T5087] CPU: 0 PID: 5087 Comm: syz-executor Not tainted 6.10.0-rc6-syzkaller-00051-g1dfe225e9af5 #0
[ 78.311200][ T5087] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
[ 78.321381][ T5087] Call Trace:
[ 78.324683][ T5087] <TASK>
[ 78.327634][ T5087] dump_stack_lvl+0x3d/0x1f0
[ 78.332257][ T5087] panic+0x6f5/0x7a0
[ 78.336288][ T5087] ? __pfx_panic+0x10/0x10
[ 78.340739][ T5087] ? irqentry_exit+0x3b/0x90
[ 78.345542][ T5087] ? lockdep_hardirqs_on+0x7c/0x110
[ 78.350772][ T5087] ? preempt_schedule_thunk+0x1a/0x30
[ 78.356353][ T5087] ? preempt_schedule_common+0x44/0xc0
[ 78.361841][ T5087] ? check_panic_on_warn+0x1f/0xb0
[ 78.367078][ T5087] check_panic_on_warn+0xab/0xb0
[ 78.372033][ T5087] end_report+0x117/0x180
[ 78.376377][ T5087] kasan_report+0xe9/0x110
[ 78.380800][ T5087] ? kfree_skb_reason+0x36/0x210
[ 78.385743][ T5087] ? kfree_skb_reason+0x36/0x210
[ 78.390687][ T5087] kasan_check_range+0xef/0x1a0
[ 78.395538][ T5087] kfree_skb_reason+0x36/0x210
[ 78.400320][ T5087] __hci_req_sync+0x61d/0x980
[ 78.405013][ T5087] ? __pfx___hci_req_sync+0x10/0x10
[ 78.410210][ T5087] ? __mutex_lock+0x1a6/0x9c0
[ 78.414886][ T5087] ? __pfx_autoremove_wake_function+0x10/0x10
[ 78.420961][ T5087] ? hci_req_sync+0x3f/0xd0
[ 78.425549][ T5087] ? __pfx___might_resched+0x10/0x10
[ 78.430858][ T5087] hci_req_sync+0x97/0xd0
[ 78.435186][ T5087] ? __pfx_hci_scan_req+0x10/0x10
[ 78.440208][ T5087] hci_dev_cmd+0x634/0x960
[ 78.444628][ T5087] ? cap_capable+0x1cf/0x240
[ 78.449222][ T5087] ? __pfx_hci_dev_cmd+0x10/0x10
[ 78.454162][ T5087] ? security_capable+0x98/0xd0
[ 78.459020][ T5087] hci_sock_ioctl+0x4f3/0x880
[ 78.463698][ T5087] ? __pfx_hci_sock_ioctl+0x10/0x10
[ 78.468913][ T5087] sock_do_ioctl+0x116/0x280
[ 78.473518][ T5087] ? __pfx_sock_do_ioctl+0x10/0x10
[ 78.478624][ T5087] ? ioctl_has_perm.constprop.0.isra.0+0x2f9/0x470
[ 78.485124][ T5087] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10
[ 78.491978][ T5087] sock_ioctl+0x22e/0x6c0
[ 78.496305][ T5087] ? __pfx_sock_ioctl+0x10/0x10
[ 78.501165][ T5087] ? selinux_file_ioctl+0x180/0x270
[ 78.506363][ T5087] ? selinux_file_ioctl+0xb4/0x270
[ 78.511470][ T5087] ? __pfx_sock_ioctl+0x10/0x10
[ 78.516318][ T5087] __x64_sys_ioctl+0x193/0x220
[ 78.521080][ T5087] do_syscall_64+0xcd/0x250
[ 78.525617][ T5087] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 78.531530][ T5087] RIP: 0033:0x7f0cb2775b1b
[ 78.535944][ T5087] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
[ 78.555553][ T5087] RSP: 002b:00007ffc3fcd8b20 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 78.563967][ T5087] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f0cb2775b1b
[ 78.571948][ T5087] RDX: 00007ffc3fcd8b98 RSI: 00000000400448dd RDI: 0000000000000003
[ 78.579934][ T5087] RBP: 000055555b2414a8 R08: 0000000000000000 R09: 0000000000000000
[ 78.587902][ T5087] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000004
[ 78.595872][ T5087] R13: 0000000000000004 R14: 0000000000000009 R15: 0000000000000009
[ 78.603931][ T5087] </TASK>
[ 78.607181][ T5087] Kernel Offset: disabled
[ 78.611492][ T5087] Rebooting in 86400 seconds..