last executing test programs:
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.0.68' (ED25519) to the list of known hosts.
[ 86.616846][ T5816] cgroup: Unknown subsys name 'net'
[ 86.781720][ T5816] cgroup: Unknown subsys name 'cpuset'
[ 86.791145][ T5816] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 88.485992][ T5816] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 91.237203][ T5835] ==================================================================
[ 91.245320][ T5835] BUG: KASAN: slab-use-after-free in hci_cmd_work+0x5d0/0x7b0
[ 91.252811][ T5835] Read of size 2 at addr ffff88805f9332b8 by task kworker/u9:3/5835
[ 91.260826][ T5835]
[ 91.263310][ T5835] CPU: 1 UID: 0 PID: 5835 Comm: kworker/u9:3 Not tainted syzkaller #0 PREEMPT(full)
[ 91.263335][ T5835] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 91.263348][ T5835] Workqueue: hci0 hci_cmd_work
[ 91.263395][ T5835] Call Trace:
[ 91.263406][ T5835]
[ 91.263415][ T5835] dump_stack_lvl+0x189/0x250
[ 91.263442][ T5835] ? __virt_addr_valid+0x1c8/0x5c0
[ 91.263470][ T5835] ? rcu_is_watching+0x15/0xb0
[ 91.263497][ T5835] ? __pfx_dump_stack_lvl+0x10/0x10
[ 91.263521][ T5835] ? rcu_is_watching+0x15/0xb0
[ 91.263546][ T5835] ? lock_release+0x4b/0x3d0
[ 91.263567][ T5835] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 91.263595][ T5835] ? __virt_addr_valid+0x1c8/0x5c0
[ 91.263622][ T5835] ? __virt_addr_valid+0x4a5/0x5c0
[ 91.263651][ T5835] print_report+0xca/0x240
[ 91.263678][ T5835] ? hci_cmd_work+0x5d0/0x7b0
[ 91.263707][ T5835] kasan_report+0x118/0x150
[ 91.263738][ T5835] ? hci_cmd_work+0x5d0/0x7b0
[ 91.263770][ T5835] hci_cmd_work+0x5d0/0x7b0
[ 91.263801][ T5835] ? process_one_work+0x868/0x15e0
[ 91.263822][ T5835] process_one_work+0x93a/0x15e0
[ 91.263842][ T5835] ? __lock_acquire+0xab9/0xd20
[ 91.263872][ T5835] ? __pfx_process_one_work+0x10/0x10
[ 91.263897][ T5835] ? assign_work+0x3a1/0x410
[ 91.263919][ T5835] worker_thread+0x9b0/0xee0
[ 91.263953][ T5835] kthread+0x711/0x8a0
[ 91.263980][ T5835] ? __pfx_worker_thread+0x10/0x10
[ 91.264010][ T5835] ? __pfx_kthread+0x10/0x10
[ 91.264036][ T5835] ? _raw_spin_unlock_irq+0x23/0x50
[ 91.264061][ T5835] ? lockdep_hardirqs_on+0x9c/0x150
[ 91.264087][ T5835] ? __pfx_kthread+0x10/0x10
[ 91.264112][ T5835] ret_from_fork+0x599/0xb30
[ 91.264133][ T5835] ? __pfx_ret_from_fork+0x10/0x10
[ 91.264158][ T5835] ? __switch_to_asm+0x39/0x70
[ 91.264184][ T5835] ? __switch_to_asm+0x33/0x70
[ 91.264209][ T5835] ? __pfx_kthread+0x10/0x10
[ 91.264235][ T5835] ret_from_fork_asm+0x1a/0x30
[ 91.264272][ T5835]
[ 91.264279][ T5835]
[ 91.303534][ T5841] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 91.304693][ T5835] Allocated by task 5150:
[ 91.304708][ T5835] kasan_save_track+0x3e/0x80
[ 91.311608][ T5841] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 91.314698][ T5835] __kasan_slab_alloc+0x6c/0x80
[ 91.320712][ T5841] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[ 91.324057][ T5835] kmem_cache_alloc_node_noprof+0x43c/0x710
[ 91.331075][ T5841] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[ 91.334545][ T5835] __alloc_skb+0x112/0x2d0
[ 91.340924][ T5841] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[ 91.344107][ T5835] hci_cmd_sync_alloc+0x3d/0x3b0
[ 91.358276][ T5841] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[ 91.362498][ T5835] __hci_cmd_sync_sk+0x1a7/0xc70
[ 91.369813][ T5841] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[ 91.372608][ T5835] hci_reset_sync+0x4a/0x140
[ 91.378600][ T5841] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[ 91.382927][ T5835] hci_dev_open_sync+0xec5/0x2dc0
[ 91.389187][ T5841] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[ 91.392226][ T5835] hci_power_on+0x1b4/0x720
[ 91.397663][ T5841] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[ 91.401577][ T5835] process_one_work+0x93a/0x15e0
[ 91.411056][ T5841] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[ 91.411495][ T5835] worker_thread+0x9b0/0xee0
[ 91.418515][ T5841] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[ 91.421321][ T5835] kthread+0x711/0x8a0
[ 91.427145][ T5841] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[ 91.431103][ T5835] ret_from_fork+0x599/0xb30
[ 91.431130][ T5835] ret_from_fork_asm+0x1a/0x30
[ 91.431157][ T5835]
[ 91.431163][ T5835] Freed by task 5829:
[ 91.431173][ T5835] kasan_save_track+0x3e/0x80
[ 91.431190][ T5835] kasan_save_free_info+0x46/0x50
[ 91.443632][ T5841] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[ 91.445392][ T5835] __kasan_slab_free+0x5c/0x80
[ 91.474331][ T5841] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[ 91.478705][ T5835] kmem_cache_free+0x197/0x640
[ 91.478732][ T5835] vhci_read+0x49a/0x5b0
[ 91.478759][ T5835] vfs_read+0x200/0xa30
[ 91.478774][ T5835] ksys_read+0x145/0x250
[ 91.478788][ T5835] do_syscall_64+0xfa/0xfa0
[ 91.478815][ T5835] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 91.680454][ T5835]
[ 91.682804][ T5835] The buggy address belongs to the object at ffff88805f933280
[ 91.682804][ T5835] which belongs to the cache skbuff_head_cache of size 240
[ 91.697407][ T5835] The buggy address is located 56 bytes inside of
[ 91.697407][ T5835] freed 240-byte region [ffff88805f933280, ffff88805f933370)
[ 91.711369][ T5835]
[ 91.713727][ T5835] The buggy address belongs to the physical page:
[ 91.720266][ T5835] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5f933
[ 91.729172][ T5835] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 91.736337][ T5835] page_type: f5(slab)
[ 91.740441][ T5835] raw: 00fff00000000000 ffff888140421a00 dead000000000122 0000000000000000
[ 91.749058][ T5835] raw: 0000000000000000 00000000000c000c 00000000f5000000 0000000000000000
[ 91.757759][ T5835] page dumped because: kasan: bad access detected
[ 91.764384][ T5835] page_owner tracks the page as allocated
[ 91.770129][ T5835] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5825, tgid 5825 (syz-executor), ts 91201281354, free_ts 31624780846
[ 91.789528][ T5835] post_alloc_hook+0x240/0x2a0
[ 91.794348][ T5835] get_page_from_freelist+0x2365/0x2440
[ 91.799930][ T5835] __alloc_frozen_pages_noprof+0x181/0x370
[ 91.805768][ T5835] alloc_pages_mpol+0x232/0x4a0
[ 91.810651][ T5835] allocate_slab+0x86/0x3b0
[ 91.815188][ T5835] ___slab_alloc+0xf56/0x1990
[ 91.819894][ T5835] __slab_alloc+0x65/0x100
[ 91.824341][ T5835] kmem_cache_alloc_noprof+0x40f/0x700
[ 91.829841][ T5835] skb_clone+0x212/0x3a0
[ 91.834120][ T5835] netlink_broadcast_filtered+0x6ae/0x1000
[ 91.839962][ T5835] netlink_broadcast+0x37/0x50
[ 91.844750][ T5835] kobject_uevent_net_broadcast+0x378/0x560
[ 91.850692][ T5835] kobject_uevent_env+0x55c/0x9f0
[ 91.855743][ T5835] device_add+0x557/0xb80
[ 91.860104][ T5835] rfkill_register+0x17a/0x8e0
[ 91.864901][ T5835] hci_register_dev+0x3f2/0x8b0
[ 91.869909][ T5835] page last free pid 1 tgid 1 stack trace:
[ 91.875826][ T5835] __free_frozen_pages+0xbc8/0xd30
[ 91.880973][ T5835] free_contig_range+0x1bd/0x4a0
[ 91.885973][ T5835] destroy_args+0x69/0x660
[ 91.890445][ T5835] debug_vm_pgtable+0x38f/0x3a0
[ 91.895330][ T5835] do_one_initcall+0x1fb/0x870
[ 91.900203][ T5835] do_initcall_level+0x104/0x190
[ 91.905178][ T5835] do_initcalls+0x59/0xa0
[ 91.909549][ T5835] kernel_init_freeable+0x334/0x4b0
[ 91.914790][ T5835] kernel_init+0x1d/0x1d0
[ 91.919158][ T5835] ret_from_fork+0x599/0xb30
[ 91.923781][ T5835] ret_from_fork_asm+0x1a/0x30
[ 91.928751][ T5835]
[ 91.931097][ T5835] Memory state around the buggy address:
[ 91.936778][ T5835] ffff88805f933180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 91.944871][ T5835] ffff88805f933200: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[ 91.952976][ T5835] >ffff88805f933280: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 91.961076][ T5835] ^
[ 91.967000][ T5835] ffff88805f933300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 91.975088][ T5835] ffff88805f933380: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 91.983158][ T5835] ==================================================================
[ 91.991780][ T5835] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 91.999022][ T5835] CPU: 1 UID: 0 PID: 5835 Comm: kworker/u9:3 Not tainted syzkaller #0 PREEMPT(full)
[ 92.008595][ T5835] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 92.018668][ T5835] Workqueue: hci0 hci_cmd_work
[ 92.023461][ T5835] Call Trace:
[ 92.026747][ T5835]
[ 92.029695][ T5835] dump_stack_lvl+0x99/0x250
[ 92.034307][ T5835] ? __asan_memcpy+0x40/0x70
[ 92.038913][ T5835] ? __pfx_dump_stack_lvl+0x10/0x10
[ 92.044132][ T5835] ? __pfx__printk+0x10/0x10
[ 92.048746][ T5835] vpanic+0x237/0x6d0
[ 92.052744][ T5835] ? __pfx_vpanic+0x10/0x10
[ 92.057252][ T5835] ? preempt_schedule+0xae/0xc0
[ 92.062120][ T5835] ? __pfx_preempt_schedule+0x10/0x10
[ 92.067518][ T5835] panic+0xb9/0xc0
[ 92.071248][ T5835] ? __pfx_panic+0x10/0x10
[ 92.075670][ T5835] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 92.081582][ T5835] ? is_module_address+0x17/0xf0
[ 92.086531][ T5835] ? hci_cmd_work+0x5d0/0x7b0
[ 92.091224][ T5835] check_panic_on_warn+0x89/0xb0
[ 92.096187][ T5835] ? hci_cmd_work+0x5d0/0x7b0
[ 92.100981][ T5835] end_report+0x6f/0x160
[ 92.105247][ T5835] kasan_report+0x129/0x150
[ 92.109765][ T5835] ? hci_cmd_work+0x5d0/0x7b0
[ 92.114471][ T5835] hci_cmd_work+0x5d0/0x7b0
[ 92.119018][ T5835] ? process_one_work+0x868/0x15e0
[ 92.124226][ T5835] process_one_work+0x93a/0x15e0
[ 92.129179][ T5835] ? __lock_acquire+0xab9/0xd20
[ 92.134045][ T5835] ? __pfx_process_one_work+0x10/0x10
[ 92.139428][ T5835] ? assign_work+0x3a1/0x410
[ 92.144037][ T5835] worker_thread+0x9b0/0xee0
[ 92.148678][ T5835] kthread+0x711/0x8a0
[ 92.152776][ T5835] ? __pfx_worker_thread+0x10/0x10
[ 92.157912][ T5835] ? __pfx_kthread+0x10/0x10
[ 92.162626][ T5835] ? _raw_spin_unlock_irq+0x23/0x50
[ 92.167847][ T5835] ? lockdep_hardirqs_on+0x9c/0x150
[ 92.173239][ T5835] ? __pfx_kthread+0x10/0x10
[ 92.177843][ T5835] ret_from_fork+0x599/0xb30
[ 92.182551][ T5835] ? __pfx_ret_from_fork+0x10/0x10
[ 92.187680][ T5835] ? __switch_to_asm+0x39/0x70
[ 92.192545][ T5835] ? __switch_to_asm+0x33/0x70
[ 92.197323][ T5835] ? __pfx_kthread+0x10/0x10
[ 92.201931][ T5835] ret_from_fork_asm+0x1a/0x30
[ 92.206727][ T5835]
[ 92.210383][ T5835] Kernel Offset: disabled
[ 92.214920][ T5835] Rebooting in 86400 seconds..