program:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e1f0a"], 0x22)
syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="0200300c000800"], 0x11)
ioctl$FS_IOC_SET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x40086602, 0x0)
syz_emit_vhci(&(0x7f0000000080)=ANY=[@ANYBLOB="0405"], 0x7)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="4c00000002060108000034e4000000000000000805000400030000000900020073797a3100000000050005000200000014000300686173683a69702c706f72742c6970000500010007"], 0x4c}, 0x1, 0x0, 0x0, 0x20044095}, 0x8042)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="602996000906030043198fde67e23c1eff74f200000900020073797a3100000000050001000700000038000780060004404e210000050007006cf000010c000208000140e00000be7400148008000140ffffffff00"], 0x60}, 0x1, 0x0, 0x0, 0x10004893}, 0x80)
syz_usb_connect(0x0, 0x3f, 0x0, 0x0)
r3 = syz_open_dev$vim2m(&(0x7f0000000180), 0x20a, 0x2)
ioctl$vim2m_VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1})
ioctl$vim2m_VIDIOC_STREAMON(r3, 0x40045612, &(0x7f0000000080)=0x2)
ioctl$vim2m_VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f00000001c0)={0x7, 0x2, 0x1, 0x0, 0xf})
r4 = syz_open_dev$video4linux(&(0x7f0000000040), 0x5, 0x0)
ioctl$VIDIOC_SUBDEV_G_CROP(r4, 0xc038563b, &(0x7f0000000140)={0x2000000, 0x1000000, {0x1eb, 0xff, 0x9, 0xffff8000}})
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000400)={0x14, 0x9, 0x6, 0x3, 0x0, 0x0, {0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x10004893}, 0x80)
syz_emit_vhci(&(0x7f0000000100)=@HCI_EVENT_PKT={0x4, @hci_ev_role_change={{0x12, 0x8}}}, 0xb)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r6 = socket$inet_udp(0x2, 0x2, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="7800000010000304000000000000000000007400", @ANYRES32=0x0, @ANYBLOB="00000000600000005800128008000100677470004c00028008000100", @ANYRES32=r6], 0x78}}, 0x0)
bind$inet(r6, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
r7 = socket$kcm(0x2, 0x3, 0x2)
ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast})
write$tun(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="0800e7ff06000000000016000000456f003000660000401190780a010102ac1414144e204e20001c907802ff000100d2f731874499ae02050000"], 0x3e)
[ 105.209939][ T5300] Bluetooth: hci0: command tx timeout
[ 105.581548][ T5324] syzkaller1: entered promiscuous mode
[ 105.584934][ T5324] syzkaller1: entered allmulticast mode
[ 107.256740][ T4664] Bluetooth: hci0: command tx timeout
[ 107.335911][ T5300] ==================================================================
[ 107.340748][ T5300] BUG: KASAN: slab-use-after-free in hci_conn_drop+0x34/0x2a0
[ 107.345260][ T5300] Write of size 4 at addr ffff8880125c0010 by task kworker/u5:2/5300
[ 107.349124][ T5300]
[ 107.350271][ T5300] CPU: 0 UID: 0 PID: 5300 Comm: kworker/u5:2 Not tainted syzkaller #0 PREEMPT(full)
[ 107.350286][ T5300] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 107.350295][ T5300] Workqueue: hci0 hci_cmd_sync_work
[ 107.350323][ T5300] Call Trace:
[ 107.350333][ T5300]
[ 107.350341][ T5300] dump_stack_lvl+0xe8/0x150
[ 107.350358][ T5300] print_report+0xba/0x230
[ 107.350372][ T5300] ? hci_conn_drop+0x34/0x2a0
[ 107.350384][ T5300] kasan_report+0x117/0x150
[ 107.350398][ T5300] ? hci_conn_drop+0x34/0x2a0
[ 107.350410][ T5300] kasan_check_range+0x264/0x2c0
[ 107.350420][ T5300] hci_conn_drop+0x34/0x2a0
[ 107.350430][ T5300] ? __pfx_le_read_features_complete+0x10/0x10
[ 107.350447][ T5300] hci_cmd_sync_work+0x262/0x400
[ 107.350461][ T5300] ? process_scheduled_works+0xa25/0x1830
[ 107.350483][ T5300] process_scheduled_works+0xb02/0x1830
[ 107.350503][ T5300] ? __pfx_process_scheduled_works+0x10/0x10
[ 107.350517][ T5300] ? assign_work+0x3d5/0x5e0
[ 107.350530][ T5300] worker_thread+0xa50/0xfc0
[ 107.350549][ T5300] kthread+0x388/0x470
[ 107.350561][ T5300] ? __pfx_worker_thread+0x10/0x10
[ 107.350573][ T5300] ? __pfx_kthread+0x10/0x10
[ 107.350583][ T5300] ret_from_fork+0x51e/0xb90
[ 107.350597][ T5300] ? __pfx_ret_from_fork+0x10/0x10
[ 107.350617][ T5300] ? __switch_to+0xc7d/0x1450
[ 107.350630][ T5300] ? __pfx_kthread+0x10/0x10
[ 107.350639][ T5300] ret_from_fork_asm+0x1a/0x30
[ 107.350658][ T5300]
[ 107.350662][ T5300]
[ 107.419675][ T5300] Allocated by task 5300:
[ 107.421901][ T5300] kasan_save_track+0x3e/0x80
[ 107.424225][ T5300] __kasan_kmalloc+0x93/0xb0
[ 107.426414][ T5300] __kmalloc_cache_noprof+0x31c/0x660
[ 107.428995][ T5300] __hci_conn_add+0x3c4/0x1e00
[ 107.431440][ T5300] le_conn_complete_evt+0x706/0x1430
[ 107.434576][ T5300] hci_le_enh_conn_complete_evt+0x189/0x490
[ 107.437360][ T5300] hci_event_packet+0x7af/0x12c0
[ 107.439756][ T5300] hci_rx_work+0x3ee/0x1030
[ 107.442095][ T5300] process_scheduled_works+0xb02/0x1830
[ 107.444610][ T5300] worker_thread+0xa50/0xfc0
[ 107.446980][ T5300] kthread+0x388/0x470
[ 107.449198][ T5300] ret_from_fork+0x51e/0xb90
[ 107.451986][ T5300] ret_from_fork_asm+0x1a/0x30
[ 107.454480][ T5300]
[ 107.455564][ T5300] Freed by task 4664:
[ 107.457488][ T5300] kasan_save_track+0x3e/0x80
[ 107.459640][ T5300] kasan_save_free_info+0x46/0x50
[ 107.461922][ T5300] __kasan_slab_free+0x5c/0x80
[ 107.464142][ T5300] kfree+0x1c1/0x630
[ 107.466083][ T5300] device_release+0x9e/0x1d0
[ 107.468506][ T5300] kobject_put+0x228/0x560
[ 107.470974][ T5300] hci_conn_del+0xc36/0x1230
[ 107.473144][ T5300] hci_disconn_complete_evt+0x64e/0x950
[ 107.475759][ T5300] hci_event_packet+0x805/0x12c0
[ 107.478151][ T5300] hci_rx_work+0x3ee/0x1030
[ 107.480740][ T5300] process_scheduled_works+0xb02/0x1830
[ 107.484090][ T5300] worker_thread+0xa50/0xfc0
[ 107.486561][ T5300] kthread+0x388/0x470
[ 107.488535][ T5300] ret_from_fork+0x51e/0xb90
[ 107.490614][ T5300] ret_from_fork_asm+0x1a/0x30
[ 107.492758][ T5300]
[ 107.493985][ T5300] The buggy address belongs to the object at ffff8880125c0000
[ 107.493985][ T5300] which belongs to the cache kmalloc-8k of size 8192
[ 107.500933][ T5300] The buggy address is located 16 bytes inside of
[ 107.500933][ T5300] freed 8192-byte region [ffff8880125c0000, ffff8880125c2000)
[ 107.506789][ T5300]
[ 107.507975][ T5300] The buggy address belongs to the physical page:
[ 107.510888][ T5300] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x125c0
[ 107.516601][ T5300] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 107.520620][ T5300] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 107.523869][ T5300] page_type: f5(slab)
[ 107.525709][ T5300] raw: 00fff00000000040 ffff88801ac42280 dead000000000100 dead000000000122
[ 107.529322][ T5300] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
[ 107.532913][ T5300] head: 00fff00000000040 ffff88801ac42280 dead000000000100 dead000000000122
[ 107.537089][ T5300] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
[ 107.541462][ T5300] head: 00fff00000000003 ffffea0000497001 00000000ffffffff 00000000ffffffff
[ 107.545312][ T5300] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 107.549007][ T5300] page dumped because: kasan: bad access detected
[ 107.551848][ T5300] page_owner tracks the page as allocated
[ 107.554667][ T5300] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4690, tgid 4690 (init), ts 37290912443, free_ts 36519980540
[ 107.563717][ T5300] post_alloc_hook+0x231/0x280
[ 107.565762][ T5300] get_page_from_freelist+0x24dc/0x2580
[ 107.568285][ T5300] __alloc_frozen_pages_noprof+0x18d/0x380
[ 107.571200][ T5300] allocate_slab+0x77/0x660
[ 107.574172][ T5300] refill_objects+0x331/0x3c0
[ 107.576701][ T5300] __pcs_replace_empty_main+0x2f9/0x5e0
[ 107.579171][ T5300] __kmalloc_cache_noprof+0x392/0x660
[ 107.581534][ T5300] tomoyo_init_log+0x112e/0x1fb0
[ 107.583830][ T5300] tomoyo_supervisor+0x353/0x1570
[ 107.586069][ T5300] tomoyo_env_perm+0x151/0x1f0
[ 107.588181][ T5300] tomoyo_find_next_domain+0x15cb/0x1aa0
[ 107.590664][ T5300] tomoyo_bprm_check_security+0x11b/0x180
[ 107.593598][ T5300] security_bprm_check+0x85/0x240
[ 107.596004][ T5300] bprm_execve+0x896/0x1460
[ 107.598089][ T5300] do_execveat_common+0x50d/0x690
[ 107.600303][ T5300] __x64_sys_execve+0x97/0xc0
[ 107.602756][ T5300] page last free pid 1 tgid 1 stack trace:
[ 107.605607][ T5300] __free_frozen_pages+0xc2b/0xdb0
[ 107.608049][ T5300] free_reserved_page+0xce/0x120
[ 107.610182][ T5300] free_reserved_area+0x90/0x190
[ 107.612290][ T5300] free_kernel_image_pages+0xa2/0x100
[ 107.615255][ T5300] kernel_init+0x31/0x1d0
[ 107.617404][ T5300] ret_from_fork+0x51e/0xb90
[ 107.619589][ T5300] ret_from_fork_asm+0x1a/0x30
[ 107.621859][ T5300]
[ 107.622978][ T5300] Memory state around the buggy address:
[ 107.625770][ T5300] ffff8880125bff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 107.629770][ T5300] ffff8880125bff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 107.633306][ T5300] >ffff8880125c0000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 107.636687][ T5300] ^
[ 107.638904][ T5300] ffff8880125c0080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 107.643831][ T5300] ffff8880125c0100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 107.647923][ T5300] ==================================================================
[ 107.658172][ T5300] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 107.661885][ T5300] CPU: 0 UID: 0 PID: 5300 Comm: kworker/u5:2 Not tainted syzkaller #0 PREEMPT(full)
[ 107.666783][ T5300] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 107.671579][ T5300] Workqueue: hci0 hci_cmd_sync_work
[ 107.674002][ T5300] Call Trace:
[ 107.675596][ T5300]
[ 107.676919][ T5300] vpanic+0x56c/0xa60
[ 107.678836][ T5300] ? __pfx_vpanic+0x10/0x10
[ 107.681139][ T5300] panic+0xc5/0xd0
[ 107.683212][ T5300] ? __pfx_panic+0x10/0x10
[ 107.685731][ T5300] ? preempt_schedule_thunk+0x16/0x30
[ 107.688227][ T5300] ? preempt_schedule_thunk+0x16/0x30
[ 107.690584][ T5300] ? hci_conn_drop+0x34/0x2a0
[ 107.692698][ T5300] check_panic_on_warn+0x89/0xb0
[ 107.694958][ T5300] ? hci_conn_drop+0x34/0x2a0
[ 107.697103][ T5300] end_report+0x73/0x180
[ 107.698988][ T5300] ? hci_conn_drop+0x34/0x2a0
[ 107.701420][ T5300] kasan_report+0x128/0x150
[ 107.704355][ T5300] ? hci_conn_drop+0x34/0x2a0
[ 107.707038][ T5300] kasan_check_range+0x264/0x2c0
[ 107.709345][ T5300] hci_conn_drop+0x34/0x2a0
[ 107.711526][ T5300] ? __pfx_le_read_features_complete+0x10/0x10
[ 107.714212][ T5300] hci_cmd_sync_work+0x262/0x400
[ 107.716470][ T5300] ? process_scheduled_works+0xa25/0x1830
[ 107.719131][ T5300] process_scheduled_works+0xb02/0x1830
[ 107.722448][ T5300] ? __pfx_process_scheduled_works+0x10/0x10
[ 107.726283][ T5300] ? assign_work+0x3d5/0x5e0
[ 107.728872][ T5300] worker_thread+0xa50/0xfc0
[ 107.731182][ T5300] kthread+0x388/0x470
[ 107.733065][ T5300] ? __pfx_worker_thread+0x10/0x10
[ 107.735840][ T5300] ? __pfx_kthread+0x10/0x10
[ 107.738658][ T5300] ret_from_fork+0x51e/0xb90
[ 107.742526][ T5300] ? __pfx_ret_from_fork+0x10/0x10
[ 107.745474][ T5300] ? __switch_to+0xc7d/0x1450
[ 107.747751][ T5300] ? __pfx_kthread+0x10/0x10
[ 107.749954][ T5300] ret_from_fork_asm+0x1a/0x30
[ 107.752121][ T5300]
[ 107.753943][ T5300] Kernel Offset: disabled
[ 107.756173][ T5300] Rebooting in 86400 seconds..