last executing test programs:
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.0.41' (ED25519) to the list of known hosts.
[ 71.158885][ T5816] cgroup: Unknown subsys name 'net'
[ 71.262642][ T5816] cgroup: Unknown subsys name 'cpuset'
[ 71.271524][ T5816] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 72.783112][ T5816] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 74.776353][ T5828] ==================================================================
[ 74.784445][ T5828] BUG: KASAN: slab-use-after-free in hci_cmd_work+0x5d0/0x7b0
[ 74.791916][ T5828] Read of size 2 at addr ffff888060aa7538 by task kworker/u9:2/5828
[ 74.799879][ T5828]
[ 74.802203][ T5828] CPU: 1 UID: 0 PID: 5828 Comm: kworker/u9:2 Not tainted syzkaller #0 PREEMPT(full)
[ 74.802218][ T5828] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 74.802227][ T5828] Workqueue: hci0 hci_cmd_work
[ 74.802254][ T5828] Call Trace:
[ 74.802262][ T5828]
[ 74.802268][ T5828] dump_stack_lvl+0x189/0x250
[ 74.802284][ T5828] ? __virt_addr_valid+0x1c8/0x5c0
[ 74.802302][ T5828] ? rcu_is_watching+0x15/0xb0
[ 74.802317][ T5828] ? __pfx_dump_stack_lvl+0x10/0x10
[ 74.802331][ T5828] ? rcu_is_watching+0x15/0xb0
[ 74.802346][ T5828] ? lock_release+0x4b/0x3d0
[ 74.802358][ T5828] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 74.802375][ T5828] ? __virt_addr_valid+0x1c8/0x5c0
[ 74.802390][ T5828] ? __virt_addr_valid+0x4a5/0x5c0
[ 74.802407][ T5828] print_report+0xca/0x240
[ 74.802423][ T5828] ? hci_cmd_work+0x5d0/0x7b0
[ 74.802439][ T5828] kasan_report+0x118/0x150
[ 74.802454][ T5828] ? hci_cmd_work+0x5d0/0x7b0
[ 74.802473][ T5828] hci_cmd_work+0x5d0/0x7b0
[ 74.802491][ T5828] ? process_one_work+0x868/0x15e0
[ 74.802503][ T5828] process_one_work+0x93a/0x15e0
[ 74.802515][ T5828] ? __lock_acquire+0xab9/0xd20
[ 74.802534][ T5828] ? __pfx_process_one_work+0x10/0x10
[ 74.802549][ T5828] ? assign_work+0x3a1/0x410
[ 74.802562][ T5828] worker_thread+0x9b0/0xee0
[ 74.802583][ T5828] kthread+0x711/0x8a0
[ 74.802600][ T5828] ? __pfx_worker_thread+0x10/0x10
[ 74.802612][ T5828] ? __pfx_kthread+0x10/0x10
[ 74.802628][ T5828] ? _raw_spin_unlock_irq+0x23/0x50
[ 74.802642][ T5828] ? lockdep_hardirqs_on+0x9c/0x150
[ 74.802657][ T5828] ? __pfx_kthread+0x10/0x10
[ 74.802672][ T5828] ret_from_fork+0x599/0xb30
[ 74.802686][ T5828] ? __pfx_ret_from_fork+0x10/0x10
[ 74.802701][ T5828] ? __switch_to_asm+0x39/0x70
[ 74.802716][ T5828] ? __switch_to_asm+0x33/0x70
[ 74.802731][ T5828] ? __pfx_kthread+0x10/0x10
[ 74.802746][ T5828] ret_from_fork_asm+0x1a/0x30
[ 74.802767][ T5828]
[ 74.802772][ T5828]
[ 74.991817][ T5828] Allocated by task 52:
[ 74.995982][ T5828] kasan_save_track+0x3e/0x80
[ 75.000650][ T5828] __kasan_slab_alloc+0x6c/0x80
[ 75.005483][ T5828] kmem_cache_alloc_node_noprof+0x43c/0x710
[ 75.011361][ T5828] __alloc_skb+0x112/0x2d0
[ 75.015760][ T5828] hci_cmd_sync_alloc+0x3d/0x3b0
[ 75.020682][ T5828] __hci_cmd_sync_sk+0x1a7/0xc70
[ 75.025602][ T5828] hci_reset_sync+0x4a/0x140
[ 75.030185][ T5828] hci_dev_open_sync+0xec5/0x2dc0
[ 75.035191][ T5828] hci_power_on+0x1b4/0x720
[ 75.039678][ T5828] process_one_work+0x93a/0x15e0
[ 75.044601][ T5828] worker_thread+0x9b0/0xee0
[ 75.049172][ T5828] kthread+0x711/0x8a0
[ 75.053221][ T5828] ret_from_fork+0x599/0xb30
[ 75.057790][ T5828] ret_from_fork_asm+0x1a/0x30
[ 75.062540][ T5828]
[ 75.064847][ T5828] Freed by task 5830:
[ 75.068800][ T5828] kasan_save_track+0x3e/0x80
[ 75.073457][ T5828] kasan_save_free_info+0x46/0x50
[ 75.078464][ T5828] __kasan_slab_free+0x5c/0x80
[ 75.083205][ T5828] kmem_cache_free+0x197/0x640
[ 75.087946][ T5828] vhci_read+0x49a/0x5b0
[ 75.092171][ T5828] vfs_read+0x200/0xa30
[ 75.096305][ T5828] ksys_read+0x145/0x250
[ 75.100528][ T5828] do_syscall_64+0xfa/0xfa0
[ 75.105033][ T5828] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 75.110919][ T5828]
[ 75.113227][ T5828] The buggy address belongs to the object at ffff888060aa7500
[ 75.113227][ T5828] which belongs to the cache skbuff_head_cache of size 240
[ 75.127796][ T5828] The buggy address is located 56 bytes inside of
[ 75.127796][ T5828] freed 240-byte region [ffff888060aa7500, ffff888060aa75f0)
[ 75.141499][ T5828]
[ 75.143816][ T5828] The buggy address belongs to the physical page:
[ 75.150230][ T5828] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x60aa7
[ 75.158973][ T5828] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 75.166085][ T5828] page_type: f5(slab)
[ 75.170059][ T5828] raw: 00fff00000000000 ffff888141aafa00 dead000000000122 0000000000000000
[ 75.178634][ T5828] raw: 0000000000000000 00000000000c000c 00000000f5000000 0000000000000000
[ 75.187207][ T5828] page dumped because: kasan: bad access detected
[ 75.193610][ T5828] page_owner tracks the page as allocated
[ 75.199303][ T5828] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5827, tgid 5827 (syz-executor), ts 74761284312, free_ts 21989639287
[ 75.218562][ T5828] post_alloc_hook+0x240/0x2a0
[ 75.223321][ T5828] get_page_from_freelist+0x2365/0x2440
[ 75.228850][ T5828] __alloc_frozen_pages_noprof+0x181/0x370
[ 75.234664][ T5828] alloc_pages_mpol+0x232/0x4a0
[ 75.239519][ T5828] allocate_slab+0x86/0x3b0
[ 75.244009][ T5828] ___slab_alloc+0xf56/0x1990
[ 75.248671][ T5828] __slab_alloc+0x65/0x100
[ 75.253069][ T5828] kmem_cache_alloc_noprof+0x40f/0x700
[ 75.258511][ T5828] skb_clone+0x212/0x3a0
[ 75.262737][ T5828] netlink_broadcast_filtered+0x6ae/0x1000
[ 75.268526][ T5828] netlink_broadcast+0x37/0x50
[ 75.273272][ T5828] kobject_uevent_net_broadcast+0x378/0x560
[ 75.279154][ T5828] kobject_uevent_env+0x55c/0x9f0
[ 75.284161][ T5828] device_add+0x557/0xb80
[ 75.288474][ T5828] hci_register_dev+0x36c/0x8b0
[ 75.293303][ T5828] vhci_create_device+0x39c/0x650
[ 75.298304][ T5828] page last free pid 1 tgid 1 stack trace:
[ 75.304099][ T5828] __free_frozen_pages+0xbc8/0xd30
[ 75.309191][ T5828] free_contig_range+0x1bd/0x4a0
[ 75.314118][ T5828] destroy_args+0x69/0x660
[ 75.318530][ T5828] debug_vm_pgtable+0x38f/0x3a0
[ 75.323357][ T5828] do_one_initcall+0x1fb/0x870
[ 75.328109][ T5828] do_initcall_level+0x104/0x190
[ 75.333031][ T5828] do_initcalls+0x59/0xa0
[ 75.337365][ T5828] kernel_init_freeable+0x334/0x4b0
[ 75.342546][ T5828] kernel_init+0x1d/0x1d0
[ 75.346856][ T5828] ret_from_fork+0x599/0xb30
[ 75.351434][ T5828] ret_from_fork_asm+0x1a/0x30
[ 75.356188][ T5828]
[ 75.358522][ T5828] Memory state around the buggy address:
[ 75.364129][ T5828] ffff888060aa7400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[ 75.372175][ T5828] ffff888060aa7480: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[ 75.380216][ T5828] >ffff888060aa7500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 75.388256][ T5828] ^
[ 75.394213][ T5828] ffff888060aa7580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 75.402254][ T5828] ffff888060aa7600: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 75.410293][ T5828] ==================================================================
[ 75.420063][ T5828] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 75.427291][ T5828] CPU: 1 UID: 0 PID: 5828 Comm: kworker/u9:2 Not tainted syzkaller #0 PREEMPT(full)
[ 75.436757][ T5828] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 75.446818][ T5828] Workqueue: hci0 hci_cmd_work
[ 75.451594][ T5828] Call Trace:
[ 75.454859][ T5828]
[ 75.457774][ T5828] dump_stack_lvl+0x99/0x250
[ 75.462357][ T5828] ? __asan_memcpy+0x40/0x70
[ 75.466945][ T5828] ? __pfx_dump_stack_lvl+0x10/0x10
[ 75.472139][ T5828] ? __pfx__printk+0x10/0x10
[ 75.476736][ T5828] vpanic+0x237/0x6d0
[ 75.480717][ T5828] ? __pfx_vpanic+0x10/0x10
[ 75.485221][ T5828] ? preempt_schedule+0xae/0xc0
[ 75.490078][ T5828] ? __pfx_preempt_schedule+0x10/0x10
[ 75.495451][ T5828] panic+0xb9/0xc0
[ 75.499158][ T5828] ? __pfx_panic+0x10/0x10
[ 75.503573][ T5828] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 75.509455][ T5828] ? is_module_address+0x17/0xf0
[ 75.514407][ T5828] ? hci_cmd_work+0x5d0/0x7b0
[ 75.519072][ T5828] check_panic_on_warn+0x89/0xb0
[ 75.524004][ T5828] ? hci_cmd_work+0x5d0/0x7b0
[ 75.528667][ T5828] end_report+0x6f/0x160
[ 75.532892][ T5828] kasan_report+0x129/0x150
[ 75.537380][ T5828] ? hci_cmd_work+0x5d0/0x7b0
[ 75.542046][ T5828] hci_cmd_work+0x5d0/0x7b0
[ 75.546538][ T5828] ? process_one_work+0x868/0x15e0
[ 75.551630][ T5828] process_one_work+0x93a/0x15e0
[ 75.556550][ T5828] ? __lock_acquire+0xab9/0xd20
[ 75.561390][ T5828] ? __pfx_process_one_work+0x10/0x10
[ 75.566746][ T5828] ? assign_work+0x3a1/0x410
[ 75.571332][ T5828] worker_thread+0x9b0/0xee0
[ 75.575941][ T5828] kthread+0x711/0x8a0
[ 75.580013][ T5828] ? __pfx_worker_thread+0x10/0x10
[ 75.585115][ T5828] ? __pfx_kthread+0x10/0x10
[ 75.589696][ T5828] ? _raw_spin_unlock_irq+0x23/0x50
[ 75.594896][ T5828] ? lockdep_hardirqs_on+0x9c/0x150
[ 75.600096][ T5828] ? __pfx_kthread+0x10/0x10
[ 75.604701][ T5828] ret_from_fork+0x599/0xb30
[ 75.609283][ T5828] ? __pfx_ret_from_fork+0x10/0x10
[ 75.614384][ T5828] ? __switch_to_asm+0x39/0x70
[ 75.619134][ T5828] ? __switch_to_asm+0x33/0x70
[ 75.623885][ T5828] ? __pfx_kthread+0x10/0x10
[ 75.628462][ T5828] ret_from_fork_asm+0x1a/0x30
[ 75.633233][ T5828]
[ 75.636385][ T5828] Kernel Offset: disabled
[ 75.640695][ T5828] Rebooting in 86400 seconds..