last executing test programs:

kernel console output (not intermixed with test programs):

Warning: Permanently added '10.128.10.26' (ED25519) to the list of known hosts.
[   74.682871][   T29] audit: type=1400 audit(1719927854.394:87): avc:  denied  { mounton } for  pid=5071 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1925 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1
[   74.691667][ T5071] cgroup: Unknown subsys name 'net'
[   74.705695][   T29] audit: type=1400 audit(1719927854.404:88): avc:  denied  { mount } for  pid=5071 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[   74.733843][   T29] audit: type=1400 audit(1719927854.434:89): avc:  denied  { unmount } for  pid=5071 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[   74.915676][ T5071] cgroup: Unknown subsys name 'rlimit'
[   75.046850][   T29] audit: type=1400 audit(1719927854.764:90): avc:  denied  { setattr } for  pid=5071 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=733 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[   75.071239][   T29] audit: type=1400 audit(1719927854.764:91): avc:  denied  { create } for  pid=5071 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[   75.111183][   T29] audit: type=1400 audit(1719927854.764:92): avc:  denied  { write } for  pid=5071 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[   75.133588][   T29] audit: type=1400 audit(1719927854.764:93): avc:  denied  { read } for  pid=5071 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[   75.154156][   T29] audit: type=1400 audit(1719927854.784:94): avc:  denied  { mounton } for  pid=5071 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1
[   75.179303][   T29] audit: type=1400 audit(1719927854.784:95): avc:  denied  { mount } for  pid=5071 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1
[   75.194644][ T5073] SELinux:  Context root:object_r:swapfile_t is not valid (left unmapped).
Setting up swapspace version 1, size = 127995904 bytes
[   75.203058][   T29] audit: type=1400 audit(1719927854.814:96): avc:  denied  { read } for  pid=4748 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1
[   76.588892][ T5071] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   77.306279][   T53] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   77.317461][ T5091] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   77.331004][ T5094] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   77.332263][ T5091] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   77.339323][ T5094] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   77.347525][ T5091] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   77.356750][ T5094] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   77.360422][ T5091] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   77.376372][ T5094] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[   77.377067][ T5091] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[   77.383986][ T5094] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   77.393123][ T5091] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[   77.398544][ T5094] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[   77.405847][ T5091] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[   77.414845][ T5094] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   77.420679][ T5091] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[   77.427221][ T5094] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[   77.434488][ T5091] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3
[   77.448189][ T4478] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[   77.456551][ T5096] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   77.465872][ T5096] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3
[   77.469271][ T5094] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   77.473522][ T5096] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   77.482690][ T5094] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[   77.489813][ T5096] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[   77.502946][ T5096] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   77.513704][ T5096] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3
[   77.522919][ T5087] ==================================================================
[   77.523430][ T5093] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   77.531000][ T5087] BUG: KASAN: slab-use-after-free in kfree_skb_reason+0x36/0x210
[   77.545784][ T5087] Read of size 4 at addr ffff888064debae4 by task syz-executor/5087
[   77.553837][ T5087] 
[   77.556170][ T5087] CPU: 1 PID: 5087 Comm: syz-executor Not tainted 6.10.0-rc6-syzkaller-00051-g1dfe225e9af5 #0
[   77.566404][ T5087] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
[   77.576470][ T5087] Call Trace:
[   77.579748][ T5087]  <TASK>
[   77.582688][ T5087]  dump_stack_lvl+0x116/0x1f0
[   77.587400][ T5087]  print_report+0xc3/0x620
[   77.591832][ T5087]  ? __virt_addr_valid+0x5e/0x580
[   77.596944][ T5087]  ? __phys_addr+0xc6/0x150
[   77.601471][ T5087]  kasan_report+0xd9/0x110
[   77.605917][ T5087]  ? kfree_skb_reason+0x36/0x210
[   77.610867][ T5087]  ? kfree_skb_reason+0x36/0x210
[   77.615839][ T5087]  kasan_check_range+0xef/0x1a0
[   77.620710][ T5087]  kfree_skb_reason+0x36/0x210
[   77.625573][ T5087]  __hci_req_sync+0x61d/0x980
[   77.630355][ T5087]  ? __pfx___hci_req_sync+0x10/0x10
[   77.635558][ T5087]  ? __mutex_lock+0x1a6/0x9c0
[   77.640236][ T5087]  ? __pfx_autoremove_wake_function+0x10/0x10
[   77.646313][ T5087]  ? hci_req_sync+0x3f/0xd0
[   77.650815][ T5087]  ? __pfx___might_resched+0x10/0x10
[   77.656106][ T5087]  hci_req_sync+0x97/0xd0
[   77.660527][ T5087]  ? __pfx_hci_scan_req+0x10/0x10
[   77.665553][ T5087]  hci_dev_cmd+0x634/0x960
[   77.669982][ T5087]  ? cap_capable+0x1cf/0x240
[   77.674586][ T5087]  ? __pfx_hci_dev_cmd+0x10/0x10
[   77.679538][ T5087]  ? security_capable+0x98/0xd0
[   77.684574][ T5087]  hci_sock_ioctl+0x4f3/0x880
[   77.689253][ T5087]  ? __pfx_hci_sock_ioctl+0x10/0x10
[   77.694463][ T5087]  sock_do_ioctl+0x116/0x280
[   77.699053][ T5087]  ? __pfx_sock_do_ioctl+0x10/0x10
[   77.704161][ T5087]  ? ioctl_has_perm.constprop.0.isra.0+0x2f9/0x470
[   77.710664][ T5087]  ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10
[   77.717517][ T5087]  sock_ioctl+0x22e/0x6c0
[   77.721843][ T5087]  ? __pfx_sock_ioctl+0x10/0x10
[   77.726692][ T5087]  ? selinux_file_ioctl+0x180/0x270
[   77.731893][ T5087]  ? selinux_file_ioctl+0xb4/0x270
[   77.737002][ T5087]  ? __pfx_sock_ioctl+0x10/0x10
[   77.741851][ T5087]  __x64_sys_ioctl+0x193/0x220
[   77.746622][ T5087]  do_syscall_64+0xcd/0x250
[   77.751149][ T5087]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   77.757057][ T5087] RIP: 0033:0x7f0cb2775b1b
[   77.761478][ T5087] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
[   77.781105][ T5087] RSP: 002b:00007ffc3fcd8b20 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[   77.789605][ T5087] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f0cb2775b1b
[   77.797571][ T5087] RDX: 00007ffc3fcd8b98 RSI: 00000000400448dd RDI: 0000000000000003
[   77.805535][ T5087] RBP: 000055555b2414a8 R08: 0000000000000000 R09: 0000000000000000
[   77.813500][ T5087] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000004
[   77.821473][ T5087] R13: 0000000000000004 R14: 0000000000000009 R15: 0000000000000009
[   77.829441][ T5087]  </TASK>
[   77.832452][ T5087] 
[   77.834788][ T5087] Allocated by task 5096:
[   77.839102][ T5087]  kasan_save_stack+0x33/0x60
[   77.843784][ T5087]  kasan_save_track+0x14/0x30
[   77.848460][ T5087]  __kasan_slab_alloc+0x89/0x90
[   77.853312][ T5087]  kmem_cache_alloc_noprof+0x121/0x2f0
[   77.858781][ T5087]  skb_clone+0x190/0x3f0
[   77.863022][ T5087]  hci_cmd_work+0x66a/0x710
[   77.867523][ T5087]  process_one_work+0x9c5/0x1b40
[   77.872466][ T5087]  worker_thread+0x6c8/0xf30
[   77.877047][ T5087]  kthread+0x2c1/0x3a0
[   77.881112][ T5087]  ret_from_fork+0x45/0x80
[   77.885548][ T5087]  ret_from_fork_asm+0x1a/0x30
[   77.890316][ T5087] 
[   77.892633][ T5087] Freed by task 5093:
[   77.897128][ T5087]  kasan_save_stack+0x33/0x60
[   77.901807][ T5087]  kasan_save_track+0x14/0x30
[   77.906572][ T5087]  kasan_save_free_info+0x3b/0x60
[   77.911597][ T5087]  poison_slab_object+0xf7/0x160
[   77.916539][ T5087]  __kasan_slab_free+0x32/0x50
[   77.921391][ T5087]  kmem_cache_free+0x12f/0x3a0
[   77.926158][ T5087]  kfree_skbmem+0x10e/0x200
[   77.930657][ T5087]  kfree_skb_reason+0x138/0x210
[   77.935602][ T5087]  hci_req_sync_complete+0x16c/0x270
[   77.940908][ T5087]  hci_event_packet+0x963/0x1170
[   77.945842][ T5087]  hci_rx_work+0x2c4/0x1610
[   77.950339][ T5087]  process_one_work+0x9c5/0x1b40
[   77.955272][ T5087]  worker_thread+0x6c8/0xf30
[   77.959854][ T5087]  kthread+0x2c1/0x3a0
[   77.963923][ T5087]  ret_from_fork+0x45/0x80
[   77.968430][ T5087]  ret_from_fork_asm+0x1a/0x30
[   77.973194][ T5087] 
[   77.975508][ T5087] The buggy address belongs to the object at ffff888064deba00
[   77.975508][ T5087]  which belongs to the cache skbuff_head_cache of size 240
[   77.990082][ T5087] The buggy address is located 228 bytes inside of
[   77.990082][ T5087]  freed 240-byte region [ffff888064deba00, ffff888064debaf0)
[   78.003870][ T5087] 
[   78.006181][ T5087] The buggy address belongs to the physical page:
[   78.012612][ T5087] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x64deb
[   78.021409][ T5087] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[   78.028547][ T5087] page_type: 0xffffefff(slab)
[   78.033236][ T5087] raw: 00fff00000000000 ffff8880192a6780 dead000000000122 0000000000000000
[   78.041815][ T5087] raw: 0000000000000000 00000000800c000c 00000001ffffefff 0000000000000000
[   78.050475][ T5087] page dumped because: kasan: bad access detected
[   78.056886][ T5087] page_owner tracks the page as allocated
[   78.062597][ T5087] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5096, tgid 5096 (kworker/u9:8), ts 77513660138, free_ts 26475657177
[   78.081881][ T5087]  post_alloc_hook+0x2d1/0x350
[   78.086660][ T5087]  get_page_from_freelist+0x1353/0x2e50
[   78.092211][ T5087]  __alloc_pages_noprof+0x22b/0x2460
[   78.097507][ T5087]  alloc_slab_page+0x56/0x110
[   78.102181][ T5087]  new_slab+0x84/0x260
[   78.106249][ T5087]  ___slab_alloc+0xdac/0x1870
[   78.110928][ T5087]  __slab_alloc.constprop.0+0x56/0xb0
[   78.116306][ T5087]  kmem_cache_alloc_noprof+0x2a7/0x2f0
[   78.121768][ T5087]  skb_clone+0x190/0x3f0
[   78.126009][ T5087]  hci_event_packet+0x2ce/0x1170
[   78.130956][ T5087]  hci_rx_work+0x2c4/0x1610
[   78.135506][ T5087]  process_one_work+0x9c5/0x1b40
[   78.140443][ T5087]  worker_thread+0x6c8/0xf30
[   78.145023][ T5087]  kthread+0x2c1/0x3a0
[   78.149110][ T5087]  ret_from_fork+0x45/0x80
[   78.153526][ T5087]  ret_from_fork_asm+0x1a/0x30
[   78.158293][ T5087] page last free pid 1 tgid 1 stack trace:
[   78.164084][ T5087]  free_unref_page+0x64a/0xe40
[   78.168933][ T5087]  free_contig_range+0xb6/0x1a0
[   78.173785][ T5087]  destroy_args+0xa4e/0xe20
[   78.178290][ T5087]  debug_vm_pgtable+0x1705/0x3280
[   78.183322][ T5087]  do_one_initcall+0x128/0x700
[   78.188176][ T5087]  kernel_init_freeable+0x69d/0xca0
[   78.193377][ T5087]  kernel_init+0x1c/0x2b0
[   78.197709][ T5087]  ret_from_fork+0x45/0x80
[   78.202267][ T5087]  ret_from_fork_asm+0x1a/0x30
[   78.207033][ T5087] 
[   78.209345][ T5087] Memory state around the buggy address:
[   78.215071][ T5087]  ffff888064deb980: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[   78.223258][ T5087]  ffff888064deba00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   78.231348][ T5087] >ffff888064deba80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[   78.239589][ T5087]                                                        ^
[   78.246788][ T5087]  ffff888064debb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   78.254852][ T5087]  ffff888064debb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   78.262903][ T5087] ==================================================================
[   78.293680][ T5087] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   78.300928][ T5087] CPU: 0 PID: 5087 Comm: syz-executor Not tainted 6.10.0-rc6-syzkaller-00051-g1dfe225e9af5 #0
[   78.311200][ T5087] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
[   78.321381][ T5087] Call Trace:
[   78.324683][ T5087]  <TASK>
[   78.327634][ T5087]  dump_stack_lvl+0x3d/0x1f0
[   78.332257][ T5087]  panic+0x6f5/0x7a0
[   78.336288][ T5087]  ? __pfx_panic+0x10/0x10
[   78.340739][ T5087]  ? irqentry_exit+0x3b/0x90
[   78.345542][ T5087]  ? lockdep_hardirqs_on+0x7c/0x110
[   78.350772][ T5087]  ? preempt_schedule_thunk+0x1a/0x30
[   78.356353][ T5087]  ? preempt_schedule_common+0x44/0xc0
[   78.361841][ T5087]  ? check_panic_on_warn+0x1f/0xb0
[   78.367078][ T5087]  check_panic_on_warn+0xab/0xb0
[   78.372033][ T5087]  end_report+0x117/0x180
[   78.376377][ T5087]  kasan_report+0xe9/0x110
[   78.380800][ T5087]  ? kfree_skb_reason+0x36/0x210
[   78.385743][ T5087]  ? kfree_skb_reason+0x36/0x210
[   78.390687][ T5087]  kasan_check_range+0xef/0x1a0
[   78.395538][ T5087]  kfree_skb_reason+0x36/0x210
[   78.400320][ T5087]  __hci_req_sync+0x61d/0x980
[   78.405013][ T5087]  ? __pfx___hci_req_sync+0x10/0x10
[   78.410210][ T5087]  ? __mutex_lock+0x1a6/0x9c0
[   78.414886][ T5087]  ? __pfx_autoremove_wake_function+0x10/0x10
[   78.420961][ T5087]  ? hci_req_sync+0x3f/0xd0
[   78.425549][ T5087]  ? __pfx___might_resched+0x10/0x10
[   78.430858][ T5087]  hci_req_sync+0x97/0xd0
[   78.435186][ T5087]  ? __pfx_hci_scan_req+0x10/0x10
[   78.440208][ T5087]  hci_dev_cmd+0x634/0x960
[   78.444628][ T5087]  ? cap_capable+0x1cf/0x240
[   78.449222][ T5087]  ? __pfx_hci_dev_cmd+0x10/0x10
[   78.454162][ T5087]  ? security_capable+0x98/0xd0
[   78.459020][ T5087]  hci_sock_ioctl+0x4f3/0x880
[   78.463698][ T5087]  ? __pfx_hci_sock_ioctl+0x10/0x10
[   78.468913][ T5087]  sock_do_ioctl+0x116/0x280
[   78.473518][ T5087]  ? __pfx_sock_do_ioctl+0x10/0x10
[   78.478624][ T5087]  ? ioctl_has_perm.constprop.0.isra.0+0x2f9/0x470
[   78.485124][ T5087]  ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10
[   78.491978][ T5087]  sock_ioctl+0x22e/0x6c0
[   78.496305][ T5087]  ? __pfx_sock_ioctl+0x10/0x10
[   78.501165][ T5087]  ? selinux_file_ioctl+0x180/0x270
[   78.506363][ T5087]  ? selinux_file_ioctl+0xb4/0x270
[   78.511470][ T5087]  ? __pfx_sock_ioctl+0x10/0x10
[   78.516318][ T5087]  __x64_sys_ioctl+0x193/0x220
[   78.521080][ T5087]  do_syscall_64+0xcd/0x250
[   78.525617][ T5087]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   78.531530][ T5087] RIP: 0033:0x7f0cb2775b1b
[   78.535944][ T5087] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
[   78.555553][ T5087] RSP: 002b:00007ffc3fcd8b20 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[   78.563967][ T5087] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f0cb2775b1b
[   78.571948][ T5087] RDX: 00007ffc3fcd8b98 RSI: 00000000400448dd RDI: 0000000000000003
[   78.579934][ T5087] RBP: 000055555b2414a8 R08: 0000000000000000 R09: 0000000000000000
[   78.587902][ T5087] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000004
[   78.595872][ T5087] R13: 0000000000000004 R14: 0000000000000009 R15: 0000000000000009
[   78.603931][ T5087]  </TASK>
[   78.607181][ T5087] Kernel Offset: disabled
[   78.611492][ T5087] Rebooting in 86400 seconds..