last executing test programs:
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.0.97' (ED25519) to the list of known hosts.
[ 79.782265][ T5815] cgroup: Unknown subsys name 'net'
[ 79.904444][ T5815] cgroup: Unknown subsys name 'cpuset'
[ 79.912471][ T5815] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 81.247497][ T5815] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 83.271046][ T5839] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 83.279139][ T5839] ==================================================================
[ 83.282719][ T5841] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[ 83.287682][ T5839] BUG: KASAN: slab-use-after-free in hci_cmd_work+0x5d0/0x7b0
[ 83.296643][ T5841] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 83.302923][ T5839] Read of size 2 at addr ffff888060a772b8 by task kworker/u9:4/5839
[ 83.302948][ T5839]
[ 83.302961][ T5839] CPU: 0 UID: 0 PID: 5839 Comm: kworker/u9:4 Not tainted syzkaller #0 PREEMPT(full)
[ 83.302979][ T5839] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
[ 83.302990][ T5839] Workqueue: hci3 hci_cmd_work
[ 83.303020][ T5839] Call Trace:
[ 83.303029][ T5839]
[ 83.303038][ T5839] dump_stack_lvl+0x189/0x250
[ 83.303063][ T5839] ? __virt_addr_valid+0x1c8/0x5c0
[ 83.303086][ T5839] ? rcu_is_watching+0x15/0xb0
[ 83.303106][ T5839] ? __pfx_dump_stack_lvl+0x10/0x10
[ 83.303123][ T5839] ? rcu_is_watching+0x15/0xb0
[ 83.303143][ T5839] ? lock_release+0x4b/0x3d0
[ 83.303160][ T5839] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 83.303182][ T5839] ? __virt_addr_valid+0x1c8/0x5c0
[ 83.303203][ T5839] ? __virt_addr_valid+0x4a5/0x5c0
[ 83.303226][ T5839] print_report+0xca/0x240
[ 83.303256][ T5839] ? hci_cmd_work+0x5d0/0x7b0
[ 83.303277][ T5839] kasan_report+0x118/0x150
[ 83.303296][ T5839] ? hci_cmd_work+0x5d0/0x7b0
[ 83.303321][ T5839] hci_cmd_work+0x5d0/0x7b0
[ 83.303346][ T5839] ? process_one_work+0x868/0x15e0
[ 83.303363][ T5839] process_one_work+0x93a/0x15e0
[ 83.303378][ T5839] ? __lock_acquire+0xab9/0xd20
[ 83.303403][ T5839] ? __pfx_process_one_work+0x10/0x10
[ 83.303423][ T5839] ? assign_work+0x3a1/0x410
[ 83.303440][ T5839] worker_thread+0x9b0/0xee0
[ 83.303467][ T5839] kthread+0x711/0x8a0
[ 83.303489][ T5839] ? __pfx_worker_thread+0x10/0x10
[ 83.303507][ T5839] ? __pfx_kthread+0x10/0x10
[ 83.303528][ T5839] ? _raw_spin_unlock_irq+0x23/0x50
[ 83.303548][ T5839] ? lockdep_hardirqs_on+0x9c/0x150
[ 83.303567][ T5839] ? __pfx_kthread+0x10/0x10
[ 83.303588][ T5839] ret_from_fork+0x599/0xb30
[ 83.303606][ T5839] ? __pfx_ret_from_fork+0x10/0x10
[ 83.303625][ T5839] ? __switch_to_asm+0x39/0x70
[ 83.303646][ T5839] ? __switch_to_asm+0x33/0x70
[ 83.303666][ T5839] ? __pfx_kthread+0x10/0x10
[ 83.303686][ T5839] ret_from_fork_asm+0x1a/0x30
[ 83.303714][ T5839]
[ 83.303720][ T5839]
[ 83.311746][ T5841] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 83.318723][ T5839] Allocated by task 5831:
[ 83.322897][ T5841] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 83.330602][ T5839] kasan_save_track+0x3e/0x80
[ 83.330633][ T5839] __kasan_slab_alloc+0x6c/0x80
[ 83.330648][ T5839] kmem_cache_alloc_node_noprof+0x43c/0x710
[ 83.330672][ T5839] __alloc_skb+0x112/0x2d0
[ 83.330688][ T5839] hci_cmd_sync_alloc+0x3d/0x3b0
[ 83.330711][ T5839] __hci_cmd_sync_sk+0x1a7/0xc70
[ 83.330732][ T5839] hci_reset_sync+0x4a/0x140
[ 83.575514][ T5839] hci_dev_open_sync+0xec5/0x2dc0
[ 83.580723][ T5839] hci_power_on+0x1b4/0x720
[ 83.585756][ T5839] process_one_work+0x93a/0x15e0
[ 83.590967][ T5839] worker_thread+0x9b0/0xee0
[ 83.595915][ T5839] kthread+0x711/0x8a0
[ 83.600956][ T5839] ret_from_fork+0x599/0xb30
[ 83.606083][ T5839] ret_from_fork_asm+0x1a/0x30
[ 83.611048][ T5839]
[ 83.613606][ T5839] Freed by task 5833:
[ 83.617792][ T5839] kasan_save_track+0x3e/0x80
[ 83.622670][ T5839] kasan_save_free_info+0x46/0x50
[ 83.627908][ T5839] __kasan_slab_free+0x5c/0x80
[ 83.633430][ T5839] kmem_cache_free+0x197/0x640
[ 83.639273][ T5839] vhci_read+0x49a/0x5b0
[ 83.644181][ T5839] vfs_read+0x200/0xa30
[ 83.648877][ T5839] ksys_read+0x145/0x250
[ 83.653412][ T5839] do_syscall_64+0xfa/0xfa0
[ 83.658030][ T5839] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 83.664157][ T5839]
[ 83.666488][ T5839] The buggy address belongs to the object at ffff888060a77280
[ 83.666488][ T5839] which belongs to the cache skbuff_head_cache of size 240
[ 83.682456][ T5839] The buggy address is located 56 bytes inside of
[ 83.682456][ T5839] freed 240-byte region [ffff888060a77280, ffff888060a77370)
[ 83.696541][ T5839]
[ 83.698873][ T5839] The buggy address belongs to the physical page:
[ 83.705713][ T5839] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x60a77
[ 83.714650][ T5839] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 83.721934][ T5839] page_type: f5(slab)
[ 83.725916][ T5839] raw: 00fff00000000000 ffff8881412d4a00 dead000000000122 0000000000000000
[ 83.734762][ T5839] raw: 0000000000000000 00000000000c000c 00000000f5000000 0000000000000000
[ 83.743516][ T5839] page dumped because: kasan: bad access detected
[ 83.750010][ T5839] page_owner tracks the page as allocated
[ 83.755995][ T5839] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5831, tgid 5831 (kworker/u9:2), ts 83239715209, free_ts 83230927841
[ 83.775737][ T5839] post_alloc_hook+0x240/0x2a0
[ 83.780607][ T5839] get_page_from_freelist+0x2365/0x2440
[ 83.786238][ T5839] __alloc_frozen_pages_noprof+0x181/0x370
[ 83.792052][ T5839] alloc_pages_mpol+0x232/0x4a0
[ 83.796907][ T5839] allocate_slab+0x86/0x3b0
[ 83.801443][ T5839] ___slab_alloc+0xf56/0x1990
[ 83.806119][ T5839] __slab_alloc+0x65/0x100
[ 83.810802][ T5839] kmem_cache_alloc_noprof+0x40f/0x700
[ 83.816448][ T5839] skb_clone+0x212/0x3a0
[ 83.820781][ T5839] hci_cmd_work+0xe2/0x7b0
[ 83.825222][ T5839] process_one_work+0x93a/0x15e0
[ 83.830245][ T5839] worker_thread+0x9b0/0xee0
[ 83.834920][ T5839] kthread+0x711/0x8a0
[ 83.839076][ T5839] ret_from_fork+0x599/0xb30
[ 83.843673][ T5839] ret_from_fork_asm+0x1a/0x30
[ 83.848442][ T5839] page last free pid 5830 tgid 5830 stack trace:
[ 83.855119][ T5839] __free_frozen_pages+0xbc8/0xd30
[ 83.860260][ T5839] __kasan_populate_vmalloc+0x137/0x1d0
[ 83.866011][ T5839] alloc_vmap_area+0xdca/0x1500
[ 83.870958][ T5839] __get_vm_area_node+0x1f8/0x300
[ 83.875996][ T5839] __vmalloc_node_range_noprof+0x371/0x16a0
[ 83.881988][ T5839] __vmalloc_node_noprof+0xc2/0x110
[ 83.887203][ T5839] dup_task_struct+0x3d4/0x830
[ 83.892226][ T5839] copy_process+0x4ea/0x3930
[ 83.896991][ T5839] kernel_clone+0x21e/0x850
[ 83.901668][ T5839] __se_sys_clone3+0x256/0x2d0
[ 83.906434][ T5839] do_syscall_64+0xfa/0xfa0
[ 83.911027][ T5839] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 83.917009][ T5839]
[ 83.919333][ T5839] Memory state around the buggy address:
[ 83.925051][ T5839] ffff888060a77180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 83.933431][ T5839] ffff888060a77200: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[ 83.941662][ T5839] >ffff888060a77280: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 83.949725][ T5839] ^
[ 83.955616][ T5839] ffff888060a77300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 83.964283][ T5839] ffff888060a77380: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[ 83.972527][ T5839] ==================================================================
[ 83.983037][ T5839] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 83.990730][ T5839] CPU: 0 UID: 0 PID: 5839 Comm: kworker/u9:4 Not tainted syzkaller #0 PREEMPT(full)
[ 84.001444][ T5839] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
[ 84.011729][ T5839] Workqueue: hci3 hci_cmd_work
[ 84.016555][ T5839] Call Trace:
[ 84.020213][ T5839]
[ 84.023789][ T5839] dump_stack_lvl+0x99/0x250
[ 84.028848][ T5839] ? __asan_memcpy+0x40/0x70
[ 84.034169][ T5839] ? __pfx_dump_stack_lvl+0x10/0x10
[ 84.039529][ T5839] ? __pfx__printk+0x10/0x10
[ 84.044321][ T5839] vpanic+0x237/0x6d0
[ 84.048433][ T5839] ? __pfx_vpanic+0x10/0x10
[ 84.052978][ T5839] ? preempt_schedule+0xae/0xc0
[ 84.058058][ T5839] ? __pfx_preempt_schedule+0x10/0x10
[ 84.063913][ T5839] panic+0xb9/0xc0
[ 84.067758][ T5839] ? __pfx_panic+0x10/0x10
[ 84.072215][ T5839] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 84.078239][ T5839] ? is_module_address+0x17/0xf0
[ 84.083304][ T5839] ? hci_cmd_work+0x5d0/0x7b0
[ 84.088431][ T5839] check_panic_on_warn+0x89/0xb0
[ 84.093673][ T5839] ? hci_cmd_work+0x5d0/0x7b0
[ 84.098483][ T5839] end_report+0x6f/0x160
[ 84.103120][ T5839] kasan_report+0x129/0x150
[ 84.108102][ T5839] ? hci_cmd_work+0x5d0/0x7b0
[ 84.112836][ T5839] hci_cmd_work+0x5d0/0x7b0
[ 84.117562][ T5839] ? process_one_work+0x868/0x15e0
[ 84.122708][ T5839] process_one_work+0x93a/0x15e0
[ 84.127686][ T5839] ? __lock_acquire+0xab9/0xd20
[ 84.132884][ T5839] ? __pfx_process_one_work+0x10/0x10
[ 84.138395][ T5839] ? assign_work+0x3a1/0x410
[ 84.143028][ T5839] worker_thread+0x9b0/0xee0
[ 84.148019][ T5839] kthread+0x711/0x8a0
[ 84.152217][ T5839] ? __pfx_worker_thread+0x10/0x10
[ 84.158201][ T5839] ? __pfx_kthread+0x10/0x10
[ 84.163357][ T5839] ? _raw_spin_unlock_irq+0x23/0x50
[ 84.168779][ T5839] ? lockdep_hardirqs_on+0x9c/0x150
[ 84.174021][ T5839] ? __pfx_kthread+0x10/0x10
[ 84.178743][ T5839] ret_from_fork+0x599/0xb30
[ 84.183978][ T5839] ? __pfx_ret_from_fork+0x10/0x10
[ 84.189396][ T5839] ? __switch_to_asm+0x39/0x70
[ 84.194292][ T5839] ? __switch_to_asm+0x33/0x70
[ 84.199176][ T5839] ? __pfx_kthread+0x10/0x10
[ 84.204115][ T5839] ret_from_fork_asm+0x1a/0x30
[ 84.209457][ T5839]
[ 84.212663][ T5839] Kernel Offset: disabled
[ 84.217232][ T5839] Rebooting in 86400 seconds..