last executing test programs:
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.0.191' (ED25519) to the list of known hosts.
[ 65.689075][ T5818] cgroup: Unknown subsys name 'net'
[ 65.818183][ T5818] cgroup: Unknown subsys name 'cpuset'
[ 65.827426][ T5818] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 67.280702][ T5818] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 69.255990][ T5154] ==================================================================
[ 69.264108][ T5154] BUG: KASAN: slab-use-after-free in hci_cmd_work+0x5d0/0x7b0
[ 69.271566][ T5154] Read of size 2 at addr ffff88805e1a4678 by task kworker/u9:1/5154
[ 69.279537][ T5154]
[ 69.281876][ T5154] CPU: 1 UID: 0 PID: 5154 Comm: kworker/u9:1 Not tainted syzkaller #0 PREEMPT(full)
[ 69.281888][ T5154] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 69.281896][ T5154] Workqueue: hci0 hci_cmd_work
[ 69.281920][ T5154] Call Trace:
[ 69.281929][ T5154]
[ 69.281935][ T5154] dump_stack_lvl+0x189/0x250
[ 69.281953][ T5154] ? __virt_addr_valid+0x1c8/0x5c0
[ 69.281966][ T5154] ? rcu_is_watching+0x15/0xb0
[ 69.281979][ T5154] ? __pfx_dump_stack_lvl+0x10/0x10
[ 69.281989][ T5154] ? rcu_is_watching+0x15/0xb0
[ 69.282000][ T5154] ? lock_release+0x4b/0x3d0
[ 69.282010][ T5154] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 69.282022][ T5154] ? __virt_addr_valid+0x1c8/0x5c0
[ 69.282035][ T5154] ? __virt_addr_valid+0x4a5/0x5c0
[ 69.282047][ T5154] print_report+0xca/0x240
[ 69.282060][ T5154] ? hci_cmd_work+0x5d0/0x7b0
[ 69.282072][ T5154] kasan_report+0x118/0x150
[ 69.282084][ T5154] ? hci_cmd_work+0x5d0/0x7b0
[ 69.282098][ T5154] hci_cmd_work+0x5d0/0x7b0
[ 69.282113][ T5154] ? process_one_work+0x868/0x15e0
[ 69.282122][ T5154] process_one_work+0x93a/0x15e0
[ 69.282131][ T5154] ? __lock_acquire+0xab9/0xd20
[ 69.282145][ T5154] ? __pfx_process_one_work+0x10/0x10
[ 69.282156][ T5154] ? assign_work+0x3a1/0x410
[ 69.282165][ T5154] worker_thread+0x9b0/0xee0
[ 69.282180][ T5154] kthread+0x711/0x8a0
[ 69.282193][ T5154] ? __pfx_worker_thread+0x10/0x10
[ 69.282202][ T5154] ? __pfx_kthread+0x10/0x10
[ 69.282214][ T5154] ? _raw_spin_unlock_irq+0x23/0x50
[ 69.282225][ T5154] ? lockdep_hardirqs_on+0x9c/0x150
[ 69.282237][ T5154] ? __pfx_kthread+0x10/0x10
[ 69.282249][ T5154] ret_from_fork+0x599/0xb30
[ 69.282259][ T5154] ? __pfx_ret_from_fork+0x10/0x10
[ 69.282269][ T5154] ? __switch_to_asm+0x39/0x70
[ 69.282281][ T5154] ? __switch_to_asm+0x33/0x70
[ 69.282293][ T5154] ? __pfx_kthread+0x10/0x10
[ 69.282304][ T5154] ret_from_fork_asm+0x1a/0x30
[ 69.282320][ T5154]
[ 69.282324][ T5154]
[ 69.471505][ T5154] Allocated by task 52:
[ 69.475643][ T5154] kasan_save_track+0x3e/0x80
[ 69.480313][ T5154] __kasan_slab_alloc+0x6c/0x80
[ 69.485212][ T5154] kmem_cache_alloc_node_noprof+0x43c/0x710
[ 69.491100][ T5154] __alloc_skb+0x112/0x2d0
[ 69.495503][ T5154] hci_cmd_sync_alloc+0x3d/0x3b0
[ 69.500431][ T5154] __hci_cmd_sync_sk+0x1a7/0xc70
[ 69.505359][ T5154] hci_reset_sync+0x4a/0x140
[ 69.509951][ T5154] hci_dev_open_sync+0xec5/0x2dc0
[ 69.514981][ T5154] hci_power_on+0x1b4/0x720
[ 69.519479][ T5154] process_one_work+0x93a/0x15e0
[ 69.524410][ T5154] worker_thread+0x9b0/0xee0
[ 69.528993][ T5154] kthread+0x711/0x8a0
[ 69.533050][ T5154] ret_from_fork+0x599/0xb30
[ 69.537626][ T5154] ret_from_fork_asm+0x1a/0x30
[ 69.542385][ T5154]
[ 69.544698][ T5154] Freed by task 5831:
[ 69.548666][ T5154] kasan_save_track+0x3e/0x80
[ 69.553326][ T5154] kasan_save_free_info+0x46/0x50
[ 69.558339][ T5154] __kasan_slab_free+0x5c/0x80
[ 69.563086][ T5154] kmem_cache_free+0x197/0x640
[ 69.567834][ T5154] vhci_read+0x49a/0x5b0
[ 69.572067][ T5154] vfs_read+0x200/0xa30
[ 69.576208][ T5154] ksys_read+0x145/0x250
[ 69.580437][ T5154] do_syscall_64+0xfa/0xfa0
[ 69.584937][ T5154] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 69.590816][ T5154]
[ 69.593125][ T5154] The buggy address belongs to the object at ffff88805e1a4640
[ 69.593125][ T5154] which belongs to the cache skbuff_head_cache of size 240
[ 69.607689][ T5154] The buggy address is located 56 bytes inside of
[ 69.607689][ T5154] freed 240-byte region [ffff88805e1a4640, ffff88805e1a4730)
[ 69.621386][ T5154]
[ 69.623700][ T5154] The buggy address belongs to the physical page:
[ 69.630113][ T5154] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5e1a4
[ 69.638868][ T5154] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 69.645976][ T5154] page_type: f5(slab)
[ 69.650020][ T5154] raw: 00fff00000000000 ffff88801eadaa00 dead000000000122 0000000000000000
[ 69.658606][ T5154] raw: 0000000000000000 00000000000c000c 00000000f5000000 0000000000000000
[ 69.667177][ T5154] page dumped because: kasan: bad access detected
[ 69.673593][ T5154] page_owner tracks the page as allocated
[ 69.679291][ T5154] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5828, tgid 5828 (syz-executor), ts 69218565239, free_ts 21831829917
[ 69.698553][ T5154] post_alloc_hook+0x240/0x2a0
[ 69.703316][ T5154] get_page_from_freelist+0x2365/0x2440
[ 69.708849][ T5154] __alloc_frozen_pages_noprof+0x181/0x370
[ 69.714678][ T5154] alloc_pages_mpol+0x232/0x4a0
[ 69.719532][ T5154] allocate_slab+0x86/0x3b0
[ 69.724033][ T5154] ___slab_alloc+0xf56/0x1990
[ 69.728698][ T5154] __slab_alloc+0x65/0x100
[ 69.733099][ T5154] kmem_cache_alloc_node_noprof+0x4ce/0x710
[ 69.738982][ T5154] __alloc_skb+0x112/0x2d0
[ 69.743392][ T5154] hci_sock_dev_event+0x15c/0x630
[ 69.748410][ T5154] hci_register_dev+0x6be/0x8b0
[ 69.753244][ T5154] vhci_create_device+0x39c/0x650
[ 69.758259][ T5154] vhci_write+0x3ce/0x4a0
[ 69.762586][ T5154] vfs_write+0x5c9/0xb30
[ 69.766811][ T5154] ksys_write+0x145/0x250
[ 69.771124][ T5154] do_syscall_64+0xfa/0xfa0
[ 69.775619][ T5154] page last free pid 1 tgid 1 stack trace:
[ 69.781407][ T5154] __free_frozen_pages+0xbc8/0xd30
[ 69.786506][ T5154] free_contig_range+0x1bd/0x4a0
[ 69.791434][ T5154] destroy_args+0x69/0x660
[ 69.795848][ T5154] debug_vm_pgtable+0x38f/0x3a0
[ 69.800685][ T5154] do_one_initcall+0x1fb/0x870
[ 69.805475][ T5154] do_initcall_level+0x104/0x190
[ 69.810400][ T5154] do_initcalls+0x59/0xa0
[ 69.814725][ T5154] kernel_init_freeable+0x334/0x4b0
[ 69.819912][ T5154] kernel_init+0x1d/0x1d0
[ 69.824232][ T5154] ret_from_fork+0x599/0xb30
[ 69.828813][ T5154] ret_from_fork_asm+0x1a/0x30
[ 69.833573][ T5154]
[ 69.835879][ T5154] Memory state around the buggy address:
[ 69.841493][ T5154] ffff88805e1a4500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 69.849540][ T5154] ffff88805e1a4580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[ 69.857597][ T5154] >ffff88805e1a4600: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 69.865647][ T5154] ^
[ 69.873612][ T5154] ffff88805e1a4680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 69.881660][ T5154] ffff88805e1a4700: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[ 69.889705][ T5154] ==================================================================
[ 69.898208][ T5154] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 69.905426][ T5154] CPU: 1 UID: 0 PID: 5154 Comm: kworker/u9:1 Not tainted syzkaller #0 PREEMPT(full)
[ 69.914874][ T5154] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 69.924953][ T5154] Workqueue: hci0 hci_cmd_work
[ 69.929719][ T5154] Call Trace:
[ 69.932990][ T5154]
[ 69.935937][ T5154] dump_stack_lvl+0x99/0x250
[ 69.940523][ T5154] ? __asan_memcpy+0x40/0x70
[ 69.945139][ T5154] ? __pfx_dump_stack_lvl+0x10/0x10
[ 69.950415][ T5154] ? __pfx__printk+0x10/0x10
[ 69.955004][ T5154] vpanic+0x237/0x6d0
[ 69.958980][ T5154] ? __pfx_vpanic+0x10/0x10
[ 69.963555][ T5154] ? preempt_schedule+0xae/0xc0
[ 69.968400][ T5154] ? __pfx_preempt_schedule+0x10/0x10
[ 69.973767][ T5154] panic+0xb9/0xc0
[ 69.977485][ T5154] ? __pfx_panic+0x10/0x10
[ 69.981887][ T5154] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 69.987774][ T5154] ? is_module_address+0x17/0xf0
[ 69.992700][ T5154] ? hci_cmd_work+0x5d0/0x7b0
[ 69.997371][ T5154] check_panic_on_warn+0x89/0xb0
[ 70.002308][ T5154] ? hci_cmd_work+0x5d0/0x7b0
[ 70.006979][ T5154] end_report+0x6f/0x160
[ 70.011220][ T5154] kasan_report+0x129/0x150
[ 70.015824][ T5154] ? hci_cmd_work+0x5d0/0x7b0
[ 70.020508][ T5154] hci_cmd_work+0x5d0/0x7b0
[ 70.025011][ T5154] ? process_one_work+0x868/0x15e0
[ 70.030284][ T5154] process_one_work+0x93a/0x15e0
[ 70.035229][ T5154] ? __lock_acquire+0xab9/0xd20
[ 70.040072][ T5154] ? __pfx_process_one_work+0x10/0x10
[ 70.045453][ T5154] ? assign_work+0x3a1/0x410
[ 70.050034][ T5154] worker_thread+0x9b0/0xee0
[ 70.054619][ T5154] kthread+0x711/0x8a0
[ 70.058681][ T5154] ? __pfx_worker_thread+0x10/0x10
[ 70.063781][ T5154] ? __pfx_kthread+0x10/0x10
[ 70.068366][ T5154] ? _raw_spin_unlock_irq+0x23/0x50
[ 70.073557][ T5154] ? lockdep_hardirqs_on+0x9c/0x150
[ 70.078748][ T5154] ? __pfx_kthread+0x10/0x10
[ 70.083341][ T5154] ret_from_fork+0x599/0xb30
[ 70.087944][ T5154] ? __pfx_ret_from_fork+0x10/0x10
[ 70.093054][ T5154] ? __switch_to_asm+0x39/0x70
[ 70.097846][ T5154] ? __switch_to_asm+0x33/0x70
[ 70.102598][ T5154] ? __pfx_kthread+0x10/0x10
[ 70.107183][ T5154] ret_from_fork_asm+0x1a/0x30
[ 70.111950][ T5154]
[ 70.115319][ T5154] Kernel Offset: disabled
[ 70.119630][ T5154] Rebooting in 86400 seconds..