last executing test programs:
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.1.252' (ED25519) to the list of known hosts.
[ 82.657873][ T5815] cgroup: Unknown subsys name 'net'
[ 82.790319][ T5815] cgroup: Unknown subsys name 'cpuset'
[ 82.799781][ T5815] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 84.481173][ T5815] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 87.572473][ T5830] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 87.581625][ T5830] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 87.590204][ T5830] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 87.590969][ T5834] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 87.605145][ T5834] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 87.615348][ T5833] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 87.622918][ T5834] ==================================================================
[ 87.631013][ T5834] BUG: KASAN: slab-use-after-free in hci_cmd_work+0x5d0/0x7b0
[ 87.638500][ T5834] Read of size 2 at addr ffff88805cb5a678 by task kworker/u9:4/5834
[ 87.646472][ T5834]
[ 87.648798][ T5834] CPU: 1 UID: 0 PID: 5834 Comm: kworker/u9:4 Not tainted syzkaller #0 PREEMPT(full)
[ 87.648814][ T5834] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 87.648822][ T5834] Workqueue: hci2 hci_cmd_work
[ 87.648854][ T5834] Call Trace:
[ 87.648860][ T5834]
[ 87.648865][ T5834] dump_stack_lvl+0x189/0x250
[ 87.648883][ T5834] ? __virt_addr_valid+0x1c8/0x5c0
[ 87.648895][ T5834] ? rcu_is_watching+0x15/0xb0
[ 87.648905][ T5834] ? __pfx_dump_stack_lvl+0x10/0x10
[ 87.648920][ T5834] ? rcu_is_watching+0x15/0xb0
[ 87.648929][ T5834] ? lock_release+0x4b/0x3d0
[ 87.648943][ T5834] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 87.648955][ T5834] ? __virt_addr_valid+0x1c8/0x5c0
[ 87.648966][ T5834] ? __virt_addr_valid+0x4a5/0x5c0
[ 87.648977][ T5834] print_report+0xca/0x240
[ 87.648992][ T5834] ? hci_cmd_work+0x5d0/0x7b0
[ 87.649004][ T5834] kasan_report+0x118/0x150
[ 87.649018][ T5834] ? hci_cmd_work+0x5d0/0x7b0
[ 87.649033][ T5834] hci_cmd_work+0x5d0/0x7b0
[ 87.649047][ T5834] ? process_one_work+0x868/0x15e0
[ 87.649060][ T5834] process_one_work+0x93a/0x15e0
[ 87.649073][ T5834] ? __lock_acquire+0xab9/0xd20
[ 87.649091][ T5834] ? __pfx_process_one_work+0x10/0x10
[ 87.649106][ T5834] ? assign_work+0x3a1/0x410
[ 87.649120][ T5834] worker_thread+0x9b0/0xee0
[ 87.649140][ T5834] kthread+0x711/0x8a0
[ 87.649151][ T5834] ? __pfx_worker_thread+0x10/0x10
[ 87.649165][ T5834] ? __pfx_kthread+0x10/0x10
[ 87.649175][ T5834] ? _raw_spin_unlock_irq+0x23/0x50
[ 87.649186][ T5834] ? lockdep_hardirqs_on+0x9c/0x150
[ 87.649198][ T5834] ? __pfx_kthread+0x10/0x10
[ 87.649208][ T5834] ret_from_fork+0x599/0xb30
[ 87.649222][ T5834] ? __pfx_ret_from_fork+0x10/0x10
[ 87.649238][ T5834] ? __switch_to_asm+0x39/0x70
[ 87.649248][ T5834] ? __switch_to_asm+0x33/0x70
[ 87.649258][ T5834] ? __pfx_kthread+0x10/0x10
[ 87.649268][ T5834] ret_from_fork_asm+0x1a/0x30
[ 87.649282][ T5834]
[ 87.649286][ T5834]
[ 87.656493][ T5840] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[ 87.658808][ T5834] Allocated by task 5830:
[ 87.658821][ T5834] kasan_save_track+0x3e/0x80
[ 87.658850][ T5834] __kasan_slab_alloc+0x6c/0x80
[ 87.671075][ T5840] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[ 87.673660][ T5834] kmem_cache_alloc_node_noprof+0x43c/0x710
[ 87.678470][ T5840] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[ 87.680009][ T5834] __alloc_skb+0x112/0x2d0
[ 87.680039][ T5834] hci_cmd_sync_alloc+0x3d/0x3b0
[ 87.686382][ T5840] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[ 87.690244][ T5834] __hci_cmd_sync_sk+0x1a7/0xc70
[ 87.690277][ T5834] hci_reset_sync+0x4a/0x140
[ 87.690292][ T5834] hci_dev_open_sync+0xec5/0x2dc0
[ 87.690306][ T5834] hci_power_on+0x1b4/0x720
[ 87.690337][ T5834] process_one_work+0x93a/0x15e0
[ 87.697925][ T5840] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[ 87.701553][ T5834] worker_thread+0x9b0/0xee0
[ 87.707663][ T5840] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[ 87.710905][ T5834] kthread+0x711/0x8a0
[ 87.717259][ T5840] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[ 87.721371][ T5834] ret_from_fork+0x599/0xb30
[ 87.958304][ T5834] ret_from_fork_asm+0x1a/0x30
[ 87.963074][ T5834]
[ 87.965405][ T5834] Freed by task 5838:
[ 87.969383][ T5834] kasan_save_track+0x3e/0x80
[ 87.974060][ T5834] kasan_save_free_info+0x46/0x50
[ 87.979101][ T5834] __kasan_slab_free+0x5c/0x80
[ 87.983963][ T5834] kmem_cache_free+0x197/0x640
[ 87.988814][ T5834] vhci_read+0x49a/0x5b0
[ 87.993071][ T5834] vfs_read+0x200/0xa30
[ 87.997258][ T5834] ksys_read+0x145/0x250
[ 88.001501][ T5834] do_syscall_64+0xfa/0xfa0
[ 88.006007][ T5834] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 88.011981][ T5834]
[ 88.014323][ T5834] The buggy address belongs to the object at ffff88805cb5a640
[ 88.014323][ T5834] which belongs to the cache skbuff_head_cache of size 240
[ 88.028984][ T5834] The buggy address is located 56 bytes inside of
[ 88.028984][ T5834] freed 240-byte region [ffff88805cb5a640, ffff88805cb5a730)
[ 88.042775][ T5834]
[ 88.045096][ T5834] The buggy address belongs to the physical page:
[ 88.051594][ T5834] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5cb5a
[ 88.060353][ T5834] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 88.067547][ T5834] page_type: f5(slab)
[ 88.071535][ T5834] raw: 00fff00000000000 ffff888140ec5000 dead000000000122 0000000000000000
[ 88.080183][ T5834] raw: 0000000000000000 00000000000c000c 00000000f5000000 0000000000000000
[ 88.089028][ T5834] page dumped because: kasan: bad access detected
[ 88.095454][ T5834] page_owner tracks the page as allocated
[ 88.101161][ T5834] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5188, tgid 5188 (klogd), ts 87599500456, free_ts 27733040122
[ 88.119909][ T5834] post_alloc_hook+0x240/0x2a0
[ 88.124760][ T5834] get_page_from_freelist+0x2365/0x2440
[ 88.130399][ T5834] __alloc_frozen_pages_noprof+0x181/0x370
[ 88.136220][ T5834] alloc_pages_mpol+0x232/0x4a0
[ 88.141193][ T5834] allocate_slab+0x86/0x3b0
[ 88.145805][ T5834] ___slab_alloc+0xf56/0x1990
[ 88.150955][ T5834] __slab_alloc+0x65/0x100
[ 88.155428][ T5834] kmem_cache_alloc_node_noprof+0x4ce/0x710
[ 88.161322][ T5834] __alloc_skb+0x112/0x2d0
[ 88.165752][ T5834] alloc_skb_with_frags+0xca/0x890
[ 88.170949][ T5834] sock_alloc_send_pskb+0x84d/0x980
[ 88.176321][ T5834] unix_dgram_sendmsg+0x461/0x1850
[ 88.181699][ T5834] __sock_sendmsg+0x21c/0x270
[ 88.186469][ T5834] __sys_sendto+0x3bd/0x520
[ 88.190976][ T5834] __x64_sys_sendto+0xde/0x100
[ 88.195743][ T5834] do_syscall_64+0xfa/0xfa0
[ 88.200256][ T5834] page last free pid 1 tgid 1 stack trace:
[ 88.206161][ T5834] __free_frozen_pages+0xbc8/0xd30
[ 88.211279][ T5834] free_contig_range+0x1bd/0x4a0
[ 88.216306][ T5834] destroy_args+0x69/0x660
[ 88.220815][ T5834] debug_vm_pgtable+0x38f/0x3a0
[ 88.225666][ T5834] do_one_initcall+0x1fb/0x870
[ 88.230513][ T5834] do_initcall_level+0x104/0x190
[ 88.235453][ T5834] do_initcalls+0x59/0xa0
[ 88.239781][ T5834] kernel_init_freeable+0x334/0x4b0
[ 88.244990][ T5834] kernel_init+0x1d/0x1d0
[ 88.249432][ T5834] ret_from_fork+0x599/0xb30
[ 88.254030][ T5834] ret_from_fork_asm+0x1a/0x30
[ 88.258884][ T5834]
[ 88.261208][ T5834] Memory state around the buggy address:
[ 88.267102][ T5834] ffff88805cb5a500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 88.275180][ T5834] ffff88805cb5a580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 88.283434][ T5834] >ffff88805cb5a600: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 88.291499][ T5834] ^
[ 88.299602][ T5834] ffff88805cb5a680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 88.307749][ T5834] ffff88805cb5a700: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[ 88.315812][ T5834] ==================================================================
[ 88.325280][ T5834] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 88.332590][ T5834] CPU: 1 UID: 0 PID: 5834 Comm: kworker/u9:4 Not tainted syzkaller #0 PREEMPT(full)
[ 88.342161][ T5834] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 88.354937][ T5834] Workqueue: hci2 hci_cmd_work
[ 88.359802][ T5834] Call Trace:
[ 88.363113][ T5834]
[ 88.366249][ T5834] dump_stack_lvl+0x99/0x250
[ 88.370877][ T5834] ? __asan_memcpy+0x40/0x70
[ 88.375546][ T5834] ? __pfx_dump_stack_lvl+0x10/0x10
[ 88.380883][ T5834] ? __pfx__printk+0x10/0x10
[ 88.385631][ T5834] vpanic+0x237/0x6d0
[ 88.389647][ T5834] ? __pfx_vpanic+0x10/0x10
[ 88.394174][ T5834] ? preempt_schedule+0xae/0xc0
[ 88.399054][ T5834] ? __pfx_preempt_schedule+0x10/0x10
[ 88.404572][ T5834] panic+0xb9/0xc0
[ 88.408414][ T5834] ? __pfx_panic+0x10/0x10
[ 88.412956][ T5834] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 88.418884][ T5834] ? is_module_address+0x17/0xf0
[ 88.423944][ T5834] ? hci_cmd_work+0x5d0/0x7b0
[ 88.428650][ T5834] check_panic_on_warn+0x89/0xb0
[ 88.433616][ T5834] ? hci_cmd_work+0x5d0/0x7b0
[ 88.438321][ T5834] end_report+0x6f/0x160
[ 88.442601][ T5834] kasan_report+0x129/0x150
[ 88.447171][ T5834] ? hci_cmd_work+0x5d0/0x7b0
[ 88.451973][ T5834] hci_cmd_work+0x5d0/0x7b0
[ 88.456523][ T5834] ? process_one_work+0x868/0x15e0
[ 88.461670][ T5834] process_one_work+0x93a/0x15e0
[ 88.466648][ T5834] ? __lock_acquire+0xab9/0xd20
[ 88.471656][ T5834] ? __pfx_process_one_work+0x10/0x10
[ 88.477246][ T5834] ? assign_work+0x3a1/0x410
[ 88.481877][ T5834] worker_thread+0x9b0/0xee0
[ 88.486515][ T5834] kthread+0x711/0x8a0
[ 88.490616][ T5834] ? __pfx_worker_thread+0x10/0x10
[ 88.495849][ T5834] ? __pfx_kthread+0x10/0x10
[ 88.500481][ T5834] ? _raw_spin_unlock_irq+0x23/0x50
[ 88.505891][ T5834] ? lockdep_hardirqs_on+0x9c/0x150
[ 88.511128][ T5834] ? __pfx_kthread+0x10/0x10
[ 88.515754][ T5834] ret_from_fork+0x599/0xb30
[ 88.520394][ T5834] ? __pfx_ret_from_fork+0x10/0x10
[ 88.525547][ T5834] ? __switch_to_asm+0x39/0x70
[ 88.530347][ T5834] ? __switch_to_asm+0x33/0x70
[ 88.535154][ T5834] ? __pfx_kthread+0x10/0x10
[ 88.539784][ T5834] ret_from_fork_asm+0x1a/0x30
[ 88.544696][ T5834]
[ 88.547918][ T5834] Kernel Offset: disabled
[ 88.552569][ T5834] Rebooting in 86400 seconds..