last executing test programs:
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.0.153' (ED25519) to the list of known hosts.
[ 74.243118][ T5813] cgroup: Unknown subsys name 'net'
[ 74.370800][ T5813] cgroup: Unknown subsys name 'cpuset'
[ 74.379558][ T5813] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 75.749697][ T5813] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 78.868689][ T5826] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 78.888079][ T5826] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 78.921396][ T52] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 78.940470][ T52] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 78.951873][ T52] ==================================================================
[ 78.960915][ T52] BUG: KASAN: slab-use-after-free in hci_cmd_work+0x5d0/0x7b0
[ 78.969074][ T52] Read of size 2 at addr ffff88805e815a38 by task kworker/u9:0/52
[ 78.976969][ T52]
[ 78.979315][ T52] CPU: 1 UID: 0 PID: 52 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT(full)
[ 78.979332][ T52] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 78.979341][ T52] Workqueue: hci1 hci_cmd_work
[ 78.979369][ T52] Call Trace:
[ 78.979377][ T52]
[ 78.979384][ T52] dump_stack_lvl+0x189/0x250
[ 78.979403][ T52] ? __virt_addr_valid+0x1c8/0x5c0
[ 78.979416][ T52] ? rcu_is_watching+0x15/0xb0
[ 78.979428][ T52] ? __pfx_dump_stack_lvl+0x10/0x10
[ 78.979444][ T52] ? rcu_is_watching+0x15/0xb0
[ 78.979455][ T52] ? lock_release+0x4b/0x3d0
[ 78.979470][ T52] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 78.979485][ T52] ? __virt_addr_valid+0x1c8/0x5c0
[ 78.979497][ T52] ? __virt_addr_valid+0x4a5/0x5c0
[ 78.979510][ T52] print_report+0xca/0x240
[ 78.979526][ T52] ? hci_cmd_work+0x5d0/0x7b0
[ 78.979539][ T52] kasan_report+0x118/0x150
[ 78.979560][ T52] ? hci_cmd_work+0x5d0/0x7b0
[ 78.979577][ T52] hci_cmd_work+0x5d0/0x7b0
[ 78.979592][ T52] ? process_one_work+0x868/0x15e0
[ 78.979607][ T52] process_one_work+0x93a/0x15e0
[ 78.979621][ T52] ? __lock_acquire+0xab9/0xd20
[ 78.979642][ T52] ? __pfx_process_one_work+0x10/0x10
[ 78.979659][ T52] ? assign_work+0x3a1/0x410
[ 78.979675][ T52] worker_thread+0x9b0/0xee0
[ 78.979698][ T52] kthread+0x711/0x8a0
[ 78.979712][ T52] ? __pfx_worker_thread+0x10/0x10
[ 78.979727][ T52] ? __pfx_kthread+0x10/0x10
[ 78.979738][ T52] ? _raw_spin_unlock_irq+0x23/0x50
[ 78.979750][ T52] ? lockdep_hardirqs_on+0x9c/0x150
[ 78.979764][ T52] ? __pfx_kthread+0x10/0x10
[ 78.979775][ T52] ret_from_fork+0x599/0xb30
[ 78.979797][ T52] ? __pfx_ret_from_fork+0x10/0x10
[ 78.979815][ T52] ? __switch_to_asm+0x39/0x70
[ 78.979827][ T52] ? __switch_to_asm+0x33/0x70
[ 78.979838][ T52] ? __pfx_kthread+0x10/0x10
[ 78.979849][ T52] ret_from_fork_asm+0x1a/0x30
[ 78.979866][ T52]
[ 78.979871][ T52]
[ 79.176967][ T52] Allocated by task 5826:
[ 79.181491][ T52] kasan_save_track+0x3e/0x80
[ 79.186274][ T52] __kasan_slab_alloc+0x6c/0x80
[ 79.191136][ T52] kmem_cache_alloc_node_noprof+0x43c/0x710
[ 79.197057][ T52] __alloc_skb+0x112/0x2d0
[ 79.201467][ T52] hci_cmd_sync_alloc+0x3d/0x3b0
[ 79.206407][ T52] __hci_cmd_sync_sk+0x1a7/0xc70
[ 79.211514][ T52] hci_dev_open_sync+0x14b2/0x2dc0
[ 79.217176][ T52] hci_power_on+0x1b4/0x720
[ 79.222195][ T52] process_one_work+0x93a/0x15e0
[ 79.227221][ T52] worker_thread+0x9b0/0xee0
[ 79.231943][ T52] kthread+0x711/0x8a0
[ 79.236040][ T52] ret_from_fork+0x599/0xb30
[ 79.240649][ T52] ret_from_fork_asm+0x1a/0x30
[ 79.245423][ T52]
[ 79.247732][ T52] Freed by task 5830:
[ 79.251791][ T52] kasan_save_track+0x3e/0x80
[ 79.256459][ T52] kasan_save_free_info+0x46/0x50
[ 79.261570][ T52] __kasan_slab_free+0x5c/0x80
[ 79.266321][ T52] kmem_cache_free+0x197/0x640
[ 79.271097][ T52] vhci_read+0x49a/0x5b0
[ 79.275346][ T52] vfs_read+0x200/0xa30
[ 79.279505][ T52] ksys_read+0x145/0x250
[ 79.283732][ T52] do_syscall_64+0xfa/0xfa0
[ 79.288235][ T52] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 79.294282][ T52]
[ 79.296590][ T52] The buggy address belongs to the object at ffff88805e815a00
[ 79.296590][ T52] which belongs to the cache skbuff_head_cache of size 240
[ 79.311243][ T52] The buggy address is located 56 bytes inside of
[ 79.311243][ T52] freed 240-byte region [ffff88805e815a00, ffff88805e815af0)
[ 79.325393][ T52]
[ 79.327733][ T52] The buggy address belongs to the physical page:
[ 79.334498][ T52] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5e815
[ 79.343574][ T52] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 79.350968][ T52] page_type: f5(slab)
[ 79.354946][ T52] raw: 00fff00000000000 ffff888140421a00 dead000000000122 0000000000000000
[ 79.363515][ T52] raw: 0000000000000000 00000000000c000c 00000000f5000000 0000000000000000
[ 79.372086][ T52] page dumped because: kasan: bad access detected
[ 79.378540][ T52] page_owner tracks the page as allocated
[ 79.384521][ T52] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5829, tgid 5829 (kworker/u9:3), ts 78930238039, free_ts 24653071104
[ 79.404139][ T52] post_alloc_hook+0x240/0x2a0
[ 79.408986][ T52] get_page_from_freelist+0x2365/0x2440
[ 79.414848][ T52] __alloc_frozen_pages_noprof+0x181/0x370
[ 79.422229][ T52] alloc_pages_mpol+0x232/0x4a0
[ 79.427300][ T52] allocate_slab+0x86/0x3b0
[ 79.431994][ T52] ___slab_alloc+0xf56/0x1990
[ 79.437024][ T52] __slab_alloc+0x65/0x100
[ 79.441452][ T52] kmem_cache_alloc_noprof+0x40f/0x700
[ 79.447348][ T52] skb_clone+0x212/0x3a0
[ 79.452129][ T52] hci_cmd_work+0xe2/0x7b0
[ 79.456884][ T52] process_one_work+0x93a/0x15e0
[ 79.461933][ T52] worker_thread+0x9b0/0xee0
[ 79.466512][ T52] kthread+0x711/0x8a0
[ 79.470566][ T52] ret_from_fork+0x599/0xb30
[ 79.475232][ T52] ret_from_fork_asm+0x1a/0x30
[ 79.479984][ T52] page last free pid 1 tgid 1 stack trace:
[ 79.485775][ T52] __free_frozen_pages+0xbc8/0xd30
[ 79.490879][ T52] free_contig_range+0x1bd/0x4a0
[ 79.495816][ T52] destroy_args+0x69/0x660
[ 79.500223][ T52] debug_vm_pgtable+0x38f/0x3a0
[ 79.505159][ T52] do_one_initcall+0x1fb/0x870
[ 79.510017][ T52] do_initcall_level+0x104/0x190
[ 79.515476][ T52] do_initcalls+0x59/0xa0
[ 79.520207][ T52] kernel_init_freeable+0x334/0x4b0
[ 79.525743][ T52] kernel_init+0x1d/0x1d0
[ 79.530305][ T52] ret_from_fork+0x599/0xb30
[ 79.535104][ T52] ret_from_fork_asm+0x1a/0x30
[ 79.539968][ T52]
[ 79.542393][ T52] Memory state around the buggy address:
[ 79.548101][ T52] ffff88805e815900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.556234][ T52] ffff88805e815980: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[ 79.564301][ T52] >ffff88805e815a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.572624][ T52] ^
[ 79.578520][ T52] ffff88805e815a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 79.586568][ T52] ffff88805e815b00: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
[ 79.594967][ T52] ==================================================================
[ 79.603629][ T5829] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 79.604354][ T52] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 79.604383][ T52] CPU: 1 UID: 0 PID: 52 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT(full)
[ 79.604403][ T52] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 79.604414][ T52] Workqueue: hci1 hci_cmd_work
[ 79.604440][ T52] Call Trace:
[ 79.604447][ T52]
[ 79.604455][ T52] dump_stack_lvl+0x99/0x250
[ 79.604480][ T52] ? __asan_memcpy+0x40/0x70
[ 79.604496][ T52] ? __pfx_dump_stack_lvl+0x10/0x10
[ 79.604517][ T52] ? __pfx__printk+0x10/0x10
[ 79.604540][ T52] vpanic+0x237/0x6d0
[ 79.604555][ T52] ? __pfx_vpanic+0x10/0x10
[ 79.604568][ T52] ? preempt_schedule+0xae/0xc0
[ 79.604586][ T52] ? __pfx_preempt_schedule+0x10/0x10
[ 79.604605][ T52] panic+0xb9/0xc0
[ 79.604619][ T52] ? __pfx_panic+0x10/0x10
[ 79.604635][ T52] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 79.604653][ T52] ? is_module_address+0x17/0xf0
[ 79.604673][ T52] ? hci_cmd_work+0x5d0/0x7b0
[ 79.604691][ T52] check_panic_on_warn+0x89/0xb0
[ 79.604709][ T52] ? hci_cmd_work+0x5d0/0x7b0
[ 79.604726][ T52] end_report+0x6f/0x160
[ 79.604744][ T52] kasan_report+0x129/0x150
[ 79.604763][ T52] ? hci_cmd_work+0x5d0/0x7b0
[ 79.604785][ T52] hci_cmd_work+0x5d0/0x7b0
[ 79.604805][ T52] ? process_one_work+0x868/0x15e0
[ 79.604825][ T52] process_one_work+0x93a/0x15e0
[ 79.604843][ T52] ? __lock_acquire+0xab9/0xd20
[ 79.604870][ T52] ? __pfx_process_one_work+0x10/0x10
[ 79.604893][ T52] ? assign_work+0x3a1/0x410
[ 79.604914][ T52] worker_thread+0x9b0/0xee0
[ 79.604944][ T52] kthread+0x711/0x8a0
[ 79.604960][ T52] ? __pfx_worker_thread+0x10/0x10
[ 79.604986][ T52] ? __pfx_kthread+0x10/0x10
[ 79.605002][ T52] ? _raw_spin_unlock_irq+0x23/0x50
[ 79.605018][ T52] ? lockdep_hardirqs_on+0x9c/0x150
[ 79.605035][ T52] ? __pfx_kthread+0x10/0x10
[ 79.605050][ T52] ret_from_fork+0x599/0xb30
[ 79.605070][ T52] ? __pfx_ret_from_fork+0x10/0x10
[ 79.605093][ T52] ? __switch_to_asm+0x39/0x70
[ 79.605109][ T52] ? __switch_to_asm+0x33/0x70
[ 79.605124][ T52] ? __pfx_kthread+0x10/0x10
[ 79.605139][ T52] ret_from_fork_asm+0x1a/0x30
[ 79.605161][ T52]
[ 79.611275][ T52] Kernel Offset: disabled