last executing test programs:
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.0.209' (ED25519) to the list of known hosts.
[ 70.453809][ T5812] cgroup: Unknown subsys name 'net'
[ 70.600191][ T5812] cgroup: Unknown subsys name 'cpuset'
[ 70.609307][ T5812] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 71.341874][ T1299] ieee802154 phy0 wpan0: encryption failed: -22
[ 71.348429][ T1299] ieee802154 phy1 wpan1: encryption failed: -22
[ 72.048054][ T5812] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 74.032570][ T5825] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 74.052304][ T5825] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 74.068286][ T52] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 74.075589][ T52] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 74.086375][ T5830] ==================================================================
[ 74.094469][ T5830] BUG: KASAN: slab-use-after-free in hci_cmd_work+0x5d0/0x7b0
[ 74.101921][ T5830] Read of size 2 at addr ffff888060572a38 by task kworker/u9:3/5830
[ 74.109895][ T5830]
[ 74.112228][ T5830] CPU: 1 UID: 0 PID: 5830 Comm: kworker/u9:3 Not tainted syzkaller #0 PREEMPT(full)
[ 74.112244][ T5830] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 74.112253][ T5830] Workqueue: hci0 hci_cmd_work
[ 74.112279][ T5830] Call Trace:
[ 74.112287][ T5830]
[ 74.112294][ T5830] dump_stack_lvl+0x189/0x250
[ 74.112313][ T5830] ? __virt_addr_valid+0x1c8/0x5c0
[ 74.112326][ T5830] ? rcu_is_watching+0x15/0xb0
[ 74.112338][ T5830] ? __pfx_dump_stack_lvl+0x10/0x10
[ 74.112354][ T5830] ? rcu_is_watching+0x15/0xb0
[ 74.112365][ T5830] ? lock_release+0x4b/0x3d0
[ 74.112379][ T5830] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 74.112394][ T5830] ? __virt_addr_valid+0x1c8/0x5c0
[ 74.112406][ T5830] ? __virt_addr_valid+0x4a5/0x5c0
[ 74.112419][ T5830] print_report+0xca/0x240
[ 74.112434][ T5830] ? hci_cmd_work+0x5d0/0x7b0
[ 74.112448][ T5830] kasan_report+0x118/0x150
[ 74.112464][ T5830] ? hci_cmd_work+0x5d0/0x7b0
[ 74.112481][ T5830] hci_cmd_work+0x5d0/0x7b0
[ 74.112497][ T5830] ? process_one_work+0x868/0x15e0
[ 74.112512][ T5830] process_one_work+0x93a/0x15e0
[ 74.112527][ T5830] ? __lock_acquire+0xab9/0xd20
[ 74.112548][ T5830] ? __pfx_process_one_work+0x10/0x10
[ 74.112565][ T5830] ? assign_work+0x3a1/0x410
[ 74.112581][ T5830] worker_thread+0x9b0/0xee0
[ 74.112604][ T5830] kthread+0x711/0x8a0
[ 74.112617][ T5830] ? __pfx_worker_thread+0x10/0x10
[ 74.112632][ T5830] ? __pfx_kthread+0x10/0x10
[ 74.112643][ T5830] ? _raw_spin_unlock_irq+0x23/0x50
[ 74.112655][ T5830] ? lockdep_hardirqs_on+0x9c/0x150
[ 74.112669][ T5830] ? __pfx_kthread+0x10/0x10
[ 74.112680][ T5830] ret_from_fork+0x599/0xb30
[ 74.112696][ T5830] ? __pfx_ret_from_fork+0x10/0x10
[ 74.112714][ T5830] ? __switch_to_asm+0x39/0x70
[ 74.112726][ T5830] ? __switch_to_asm+0x33/0x70
[ 74.112741][ T5830] ? __pfx_kthread+0x10/0x10
[ 74.112753][ T5830] ret_from_fork_asm+0x1a/0x30
[ 74.112770][ T5830]
[ 74.112775][ T5830]
[ 74.301693][ T5830] Allocated by task 5146:
[ 74.306007][ T5830] kasan_save_track+0x3e/0x80
[ 74.310669][ T5830] __kasan_slab_alloc+0x6c/0x80
[ 74.315503][ T5830] kmem_cache_alloc_node_noprof+0x43c/0x710
[ 74.321378][ T5830] __alloc_skb+0x112/0x2d0
[ 74.325781][ T5830] hci_cmd_sync_alloc+0x3d/0x3b0
[ 74.330700][ T5830] __hci_cmd_sync_sk+0x1a7/0xc70
[ 74.335703][ T5830] hci_read_buffer_size_sync+0x2c/0x120
[ 74.341242][ T5830] hci_dev_open_sync+0x2057/0x2dc0
[ 74.346349][ T5830] hci_power_on+0x1b4/0x720
[ 74.350843][ T5830] process_one_work+0x93a/0x15e0
[ 74.355818][ T5830] worker_thread+0x9b0/0xee0
[ 74.360445][ T5830] kthread+0x711/0x8a0
[ 74.364519][ T5830] ret_from_fork+0x599/0xb30
[ 74.369093][ T5830] ret_from_fork_asm+0x1a/0x30
[ 74.373839][ T5830]
[ 74.376142][ T5830] Freed by task 5826:
[ 74.380100][ T5830] kasan_save_track+0x3e/0x80
[ 74.384760][ T5830] kasan_save_free_info+0x46/0x50
[ 74.389775][ T5830] __kasan_slab_free+0x5c/0x80
[ 74.394520][ T5830] kmem_cache_free+0x197/0x640
[ 74.399263][ T5830] vhci_read+0x49a/0x5b0
[ 74.403507][ T5830] vfs_read+0x200/0xa30
[ 74.407649][ T5830] ksys_read+0x145/0x250
[ 74.411868][ T5830] do_syscall_64+0xfa/0xfa0
[ 74.416353][ T5830] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 74.422226][ T5830]
[ 74.424556][ T5830] The buggy address belongs to the object at ffff888060572a00
[ 74.424556][ T5830] which belongs to the cache skbuff_head_cache of size 240
[ 74.439107][ T5830] The buggy address is located 56 bytes inside of
[ 74.439107][ T5830] freed 240-byte region [ffff888060572a00, ffff888060572af0)
[ 74.452799][ T5830]
[ 74.455118][ T5830] The buggy address belongs to the physical page:
[ 74.461529][ T5830] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x60572
[ 74.470281][ T5830] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 74.477381][ T5830] page_type: f5(slab)
[ 74.481347][ T5830] raw: 00fff00000000000 ffff88801de96a00 dead000000000122 0000000000000000
[ 74.489914][ T5830] raw: 0000000000000000 00000000800c000c 00000000f5000000 0000000000000000
[ 74.498472][ T5830] page dumped because: kasan: bad access detected
[ 74.504871][ T5830] page_owner tracks the page as allocated
[ 74.510563][ T5830] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5830, tgid 5830 (kworker/u9:3), ts 74084530051, free_ts 21193362872
[ 74.529824][ T5830] post_alloc_hook+0x240/0x2a0
[ 74.534579][ T5830] get_page_from_freelist+0x2365/0x2440
[ 74.540107][ T5830] __alloc_frozen_pages_noprof+0x181/0x370
[ 74.545923][ T5830] alloc_pages_mpol+0x232/0x4a0
[ 74.550759][ T5830] allocate_slab+0x86/0x3b0
[ 74.555245][ T5830] ___slab_alloc+0xf56/0x1990
[ 74.559903][ T5830] __slab_alloc+0x65/0x100
[ 74.564299][ T5830] kmem_cache_alloc_noprof+0x40f/0x700
[ 74.569737][ T5830] skb_clone+0x212/0x3a0
[ 74.573963][ T5830] hci_cmd_work+0x2f7/0x7b0
[ 74.578450][ T5830] process_one_work+0x93a/0x15e0
[ 74.583374][ T5830] worker_thread+0x9b0/0xee0
[ 74.587946][ T5830] kthread+0x711/0x8a0
[ 74.591998][ T5830] ret_from_fork+0x599/0xb30
[ 74.596571][ T5830] ret_from_fork_asm+0x1a/0x30
[ 74.601317][ T5830] page last free pid 1 tgid 1 stack trace:
[ 74.607099][ T5830] __free_frozen_pages+0xbc8/0xd30
[ 74.612205][ T5830] free_contig_range+0x1bd/0x4a0
[ 74.617145][ T5830] destroy_args+0x69/0x660
[ 74.621645][ T5830] debug_vm_pgtable+0x38f/0x3a0
[ 74.626573][ T5830] do_one_initcall+0x1fb/0x870
[ 74.631350][ T5830] do_initcall_level+0x104/0x190
[ 74.636274][ T5830] do_initcalls+0x59/0xa0
[ 74.640759][ T5830] kernel_init_freeable+0x334/0x4b0
[ 74.645946][ T5830] kernel_init+0x1d/0x1d0
[ 74.650263][ T5830] ret_from_fork+0x599/0xb30
[ 74.654838][ T5830] ret_from_fork_asm+0x1a/0x30
[ 74.659582][ T5830]
[ 74.661886][ T5830] Memory state around the buggy address:
[ 74.667493][ T5830] ffff888060572900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 74.675533][ T5830] ffff888060572980: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[ 74.683572][ T5830] >ffff888060572a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 74.691695][ T5830] ^
[ 74.697567][ T5830] ffff888060572a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 74.705697][ T5830] ffff888060572b00: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
[ 74.713732][ T5830] ==================================================================
[ 74.723926][ T5830] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 74.731151][ T5830] CPU: 1 UID: 0 PID: 5830 Comm: kworker/u9:3 Not tainted syzkaller #0 PREEMPT(full)
[ 74.740600][ T5830] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 74.750642][ T5830] Workqueue: hci0 hci_cmd_work
[ 74.755406][ T5830] Call Trace:
[ 74.758678][ T5830]
[ 74.761593][ T5830] dump_stack_lvl+0x99/0x250
[ 74.766174][ T5830] ? __asan_memcpy+0x40/0x70
[ 74.770750][ T5830] ? __pfx_dump_stack_lvl+0x10/0x10
[ 74.775938][ T5830] ? __pfx__printk+0x10/0x10
[ 74.780516][ T5830] vpanic+0x237/0x6d0
[ 74.784482][ T5830] ? __pfx_vpanic+0x10/0x10
[ 74.788963][ T5830] ? preempt_schedule+0xae/0xc0
[ 74.793796][ T5830] ? __pfx_preempt_schedule+0x10/0x10
[ 74.799163][ T5830] panic+0xb9/0xc0
[ 74.802891][ T5830] ? __pfx_panic+0x10/0x10
[ 74.807305][ T5830] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 74.813210][ T5830] ? is_module_address+0x17/0xf0
[ 74.818161][ T5830] ? hci_cmd_work+0x5d0/0x7b0
[ 74.822828][ T5830] check_panic_on_warn+0x89/0xb0
[ 74.827753][ T5830] ? hci_cmd_work+0x5d0/0x7b0
[ 74.832416][ T5830] end_report+0x6f/0x160
[ 74.836646][ T5830] kasan_report+0x129/0x150
[ 74.841138][ T5830] ? hci_cmd_work+0x5d0/0x7b0
[ 74.845801][ T5830] hci_cmd_work+0x5d0/0x7b0
[ 74.850317][ T5830] ? process_one_work+0x868/0x15e0
[ 74.855444][ T5830] process_one_work+0x93a/0x15e0
[ 74.860377][ T5830] ? __lock_acquire+0xab9/0xd20
[ 74.865226][ T5830] ? __pfx_process_one_work+0x10/0x10
[ 74.870590][ T5830] ? assign_work+0x3a1/0x410
[ 74.875166][ T5830] worker_thread+0x9b0/0xee0
[ 74.879749][ T5830] kthread+0x711/0x8a0
[ 74.883799][ T5830] ? __pfx_worker_thread+0x10/0x10
[ 74.888894][ T5830] ? __pfx_kthread+0x10/0x10
[ 74.893479][ T5830] ? _raw_spin_unlock_irq+0x23/0x50
[ 74.898661][ T5830] ? lockdep_hardirqs_on+0x9c/0x150
[ 74.903851][ T5830] ? __pfx_kthread+0x10/0x10
[ 74.908441][ T5830] ret_from_fork+0x599/0xb30
[ 74.913035][ T5830] ? __pfx_ret_from_fork+0x10/0x10
[ 74.918140][ T5830] ? __switch_to_asm+0x39/0x70
[ 74.922890][ T5830] ? __switch_to_asm+0x33/0x70
[ 74.927636][ T5830] ? __pfx_kthread+0x10/0x10
[ 74.932214][ T5830] ret_from_fork_asm+0x1a/0x30
[ 74.936969][ T5830]
[ 74.940316][ T5830] Kernel Offset: disabled
[ 74.944622][ T5830] Rebooting in 86400 seconds..