last executing test programs:
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.1.248' (ED25519) to the list of known hosts.
[ 67.190362][ T5812] cgroup: Unknown subsys name 'net'
[ 67.362722][ T5812] cgroup: Unknown subsys name 'cpuset'
[ 67.371279][ T5812] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 68.748298][ T5812] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 70.852029][ T5836] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[ 70.852205][ T5833] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 70.869258][ T5833] ==================================================================
[ 70.877366][ T5833] BUG: KASAN: slab-use-after-free in hci_cmd_work+0x5d0/0x7b0
[ 70.884822][ T5833] Read of size 2 at addr ffff88806043aa38 by task kworker/u9:3/5833
[ 70.892878][ T5833]
[ 70.895216][ T5833] CPU: 0 UID: 0 PID: 5833 Comm: kworker/u9:3 Not tainted syzkaller #0 PREEMPT(full)
[ 70.895233][ T5833] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 70.895243][ T5833] Workqueue: hci1 hci_cmd_work
[ 70.895269][ T5833] Call Trace:
[ 70.895277][ T5833]
[ 70.895283][ T5833] dump_stack_lvl+0x189/0x250
[ 70.895302][ T5833] ? __virt_addr_valid+0x1c8/0x5c0
[ 70.895315][ T5833] ? rcu_is_watching+0x15/0xb0
[ 70.895326][ T5833] ? __pfx_dump_stack_lvl+0x10/0x10
[ 70.895343][ T5833] ? rcu_is_watching+0x15/0xb0
[ 70.895353][ T5833] ? lock_release+0x4b/0x3d0
[ 70.895368][ T5833] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 70.895383][ T5833] ? __virt_addr_valid+0x1c8/0x5c0
[ 70.895395][ T5833] ? __virt_addr_valid+0x4a5/0x5c0
[ 70.895408][ T5833] print_report+0xca/0x240
[ 70.895424][ T5833] ? hci_cmd_work+0x5d0/0x7b0
[ 70.895437][ T5833] kasan_report+0x118/0x150
[ 70.895454][ T5833] ? hci_cmd_work+0x5d0/0x7b0
[ 70.895471][ T5833] hci_cmd_work+0x5d0/0x7b0
[ 70.895487][ T5833] ? process_one_work+0x868/0x15e0
[ 70.895502][ T5833] process_one_work+0x93a/0x15e0
[ 70.895516][ T5833] ? __lock_acquire+0xab9/0xd20
[ 70.895538][ T5833] ? __pfx_process_one_work+0x10/0x10
[ 70.895555][ T5833] ? assign_work+0x3a1/0x410
[ 70.895575][ T5833] worker_thread+0x9b0/0xee0
[ 70.895599][ T5833] kthread+0x711/0x8a0
[ 70.895612][ T5833] ? __pfx_worker_thread+0x10/0x10
[ 70.895627][ T5833] ? __pfx_kthread+0x10/0x10
[ 70.895639][ T5833] ? _raw_spin_unlock_irq+0x23/0x50
[ 70.895651][ T5833] ? lockdep_hardirqs_on+0x9c/0x150
[ 70.895665][ T5833] ? __pfx_kthread+0x10/0x10
[ 70.895676][ T5833] ret_from_fork+0x599/0xb30
[ 70.895693][ T5833] ? __pfx_ret_from_fork+0x10/0x10
[ 70.895711][ T5833] ? __switch_to_asm+0x39/0x70
[ 70.895722][ T5833] ? __switch_to_asm+0x33/0x70
[ 70.895733][ T5833] ? __pfx_kthread+0x10/0x10
[ 70.895745][ T5833] ret_from_fork_asm+0x1a/0x30
[ 70.895762][ T5833]
[ 70.895767][ T5833]
[ 71.084985][ T5833] Allocated by task 5147:
[ 71.089297][ T5833] kasan_save_track+0x3e/0x80
[ 71.093970][ T5833] __kasan_slab_alloc+0x6c/0x80
[ 71.098805][ T5833] kmem_cache_alloc_node_noprof+0x43c/0x710
[ 71.104682][ T5833] __alloc_skb+0x112/0x2d0
[ 71.109088][ T5833] hci_cmd_sync_alloc+0x3d/0x3b0
[ 71.114010][ T5833] __hci_cmd_sync_sk+0x1a7/0xc70
[ 71.118951][ T5833] hci_dev_open_sync+0x14b2/0x2dc0
[ 71.124065][ T5833] hci_power_on+0x1b4/0x720
[ 71.128569][ T5833] process_one_work+0x93a/0x15e0
[ 71.133496][ T5833] worker_thread+0x9b0/0xee0
[ 71.138177][ T5833] kthread+0x711/0x8a0
[ 71.142248][ T5833] ret_from_fork+0x599/0xb30
[ 71.146833][ T5833] ret_from_fork_asm+0x1a/0x30
[ 71.151586][ T5833]
[ 71.153895][ T5833] Freed by task 5825:
[ 71.157857][ T5833] kasan_save_track+0x3e/0x80
[ 71.162530][ T5833] kasan_save_free_info+0x46/0x50
[ 71.167544][ T5833] __kasan_slab_free+0x5c/0x80
[ 71.172292][ T5833] kmem_cache_free+0x197/0x640
[ 71.177042][ T5833] vhci_read+0x49a/0x5b0
[ 71.181272][ T5833] vfs_read+0x200/0xa30
[ 71.185408][ T5833] ksys_read+0x145/0x250
[ 71.189630][ T5833] do_syscall_64+0xfa/0xfa0
[ 71.194119][ T5833] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 71.199995][ T5833]
[ 71.202310][ T5833] The buggy address belongs to the object at ffff88806043aa00
[ 71.202310][ T5833] which belongs to the cache skbuff_head_cache of size 240
[ 71.216865][ T5833] The buggy address is located 56 bytes inside of
[ 71.216865][ T5833] freed 240-byte region [ffff88806043aa00, ffff88806043aaf0)
[ 71.230555][ T5833]
[ 71.232867][ T5833] The buggy address belongs to the physical page:
[ 71.239268][ T5833] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6043a
[ 71.248018][ T5833] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 71.255115][ T5833] page_type: f5(slab)
[ 71.259080][ T5833] raw: 00fff00000000000 ffff88801deb3a00 dead000000000122 0000000000000000
[ 71.267670][ T5833] raw: 0000000000000000 00000000000c000c 00000000f5000000 0000000000000000
[ 71.276246][ T5833] page dumped because: kasan: bad access detected
[ 71.282655][ T5833] page_owner tracks the page as allocated
[ 71.288352][ T5833] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 52, tgid 52 (kworker/u9:0), ts 70829740244, free_ts 21958158768
[ 71.307261][ T5833] post_alloc_hook+0x240/0x2a0
[ 71.312019][ T5833] get_page_from_freelist+0x2365/0x2440
[ 71.317549][ T5833] __alloc_frozen_pages_noprof+0x181/0x370
[ 71.323339][ T5833] alloc_pages_mpol+0x232/0x4a0
[ 71.328174][ T5833] allocate_slab+0x86/0x3b0
[ 71.332682][ T5833] ___slab_alloc+0xf56/0x1990
[ 71.337352][ T5833] __slab_alloc+0x65/0x100
[ 71.341792][ T5833] kmem_cache_alloc_noprof+0x40f/0x700
[ 71.347247][ T5833] skb_clone+0x212/0x3a0
[ 71.351476][ T5833] hci_cmd_work+0xe2/0x7b0
[ 71.355902][ T5833] process_one_work+0x93a/0x15e0
[ 71.360848][ T5833] worker_thread+0x9b0/0xee0
[ 71.365422][ T5833] kthread+0x711/0x8a0
[ 71.369473][ T5833] ret_from_fork+0x599/0xb30
[ 71.374046][ T5833] ret_from_fork_asm+0x1a/0x30
[ 71.378817][ T5833] page last free pid 1 tgid 1 stack trace:
[ 71.384599][ T5833] __free_frozen_pages+0xbc8/0xd30
[ 71.390222][ T5833] free_contig_range+0x1bd/0x4a0
[ 71.395153][ T5833] destroy_args+0x69/0x660
[ 71.399555][ T5833] debug_vm_pgtable+0x38f/0x3a0
[ 71.404473][ T5833] do_one_initcall+0x1fb/0x870
[ 71.409220][ T5833] do_initcall_level+0x104/0x190
[ 71.414151][ T5833] do_initcalls+0x59/0xa0
[ 71.418487][ T5833] kernel_init_freeable+0x334/0x4b0
[ 71.423668][ T5833] kernel_init+0x1d/0x1d0
[ 71.427983][ T5833] ret_from_fork+0x599/0xb30
[ 71.432555][ T5833] ret_from_fork_asm+0x1a/0x30
[ 71.437300][ T5833]
[ 71.439605][ T5833] Memory state around the buggy address:
[ 71.445211][ T5833] ffff88806043a900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 71.453250][ T5833] ffff88806043a980: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[ 71.461380][ T5833] >ffff88806043aa00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 71.469418][ T5833] ^
[ 71.475288][ T5833] ffff88806043aa80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 71.483326][ T5833] ffff88806043ab00: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
[ 71.491365][ T5833] ==================================================================
[ 71.505198][ T1299] ieee802154 phy0 wpan0: encryption failed: -22
[ 71.505347][ T5833] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 71.505369][ T5833] CPU: 0 UID: 0 PID: 5833 Comm: kworker/u9:3 Not tainted syzkaller #0 PREEMPT(full)
[ 71.505389][ T5833] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 71.505400][ T5833] Workqueue: hci1 hci_cmd_work
[ 71.505424][ T5833] Call Trace:
[ 71.505433][ T5833]
[ 71.505439][ T5833] dump_stack_lvl+0x99/0x250
[ 71.505462][ T5833] ? __asan_memcpy+0x40/0x70
[ 71.505479][ T5833] ? __pfx_dump_stack_lvl+0x10/0x10
[ 71.505499][ T5833] ? __pfx__printk+0x10/0x10
[ 71.505522][ T5833] vpanic+0x237/0x6d0
[ 71.505537][ T5833] ? __pfx_vpanic+0x10/0x10
[ 71.505550][ T5833] ? preempt_schedule+0xae/0xc0
[ 71.505567][ T5833] ? __pfx_preempt_schedule+0x10/0x10
[ 71.505587][ T5833] panic+0xb9/0xc0
[ 71.505600][ T5833] ? __pfx_panic+0x10/0x10
[ 71.505616][ T5833] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 71.505634][ T5833] ? is_module_address+0x17/0xf0
[ 71.505654][ T5833] ? hci_cmd_work+0x5d0/0x7b0
[ 71.505672][ T5833] check_panic_on_warn+0x89/0xb0
[ 71.505690][ T5833] ? hci_cmd_work+0x5d0/0x7b0
[ 71.505708][ T5833] end_report+0x6f/0x160
[ 71.505727][ T5833] kasan_report+0x129/0x150
[ 71.505746][ T5833] ? hci_cmd_work+0x5d0/0x7b0
[ 71.505768][ T5833] hci_cmd_work+0x5d0/0x7b0
[ 71.505787][ T5833] ? process_one_work+0x868/0x15e0
[ 71.505807][ T5833] process_one_work+0x93a/0x15e0
[ 71.505826][ T5833] ? __lock_acquire+0xab9/0xd20
[ 71.505853][ T5833] ? __pfx_process_one_work+0x10/0x10
[ 71.505877][ T5833] ? assign_work+0x3a1/0x410
[ 71.505897][ T5833] worker_thread+0x9b0/0xee0
[ 71.505927][ T5833] kthread+0x711/0x8a0
[ 71.505943][ T5833] ? __pfx_worker_thread+0x10/0x10
[ 71.505963][ T5833] ? __pfx_kthread+0x10/0x10
[ 71.505978][ T5833] ? _raw_spin_unlock_irq+0x23/0x50
[ 71.505994][ T5833] ? lockdep_hardirqs_on+0x9c/0x150
[ 71.506018][ T5833] ? __pfx_kthread+0x10/0x10
[ 71.506034][ T5833] ret_from_fork+0x599/0xb30
[ 71.506054][ T5833] ? __pfx_ret_from_fork+0x10/0x10
[ 71.506077][ T5833] ? __switch_to_asm+0x39/0x70
[ 71.506092][ T5833] ? __switch_to_asm+0x33/0x70
[ 71.506107][ T5833] ? __pfx_kthread+0x10/0x10
[ 71.506122][ T5833] ret_from_fork_asm+0x1a/0x30
[ 71.506145][ T5833]
[ 71.511991][ T5833] Kernel Offset: disabled