last executing test programs:
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.0.94' (ED25519) to the list of known hosts.
[ 66.021010][ T5819] cgroup: Unknown subsys name 'net'
[ 66.189330][ T5819] cgroup: Unknown subsys name 'cpuset'
[ 66.198207][ T5819] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 67.565277][ T5819] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 70.896928][ T5152] ==================================================================
[ 70.905039][ T5152] BUG: KASAN: slab-use-after-free in hci_cmd_work+0x5d0/0x7b0
[ 70.912496][ T5152] Read of size 2 at addr ffff888060a57038 by task kworker/u9:1/5152
[ 70.920463][ T5152]
[ 70.922797][ T5152] CPU: 1 UID: 0 PID: 5152 Comm: kworker/u9:1 Not tainted syzkaller #0 PREEMPT(full)
[ 70.922812][ T5152] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 70.922821][ T5152] Workqueue: hci0 hci_cmd_work
[ 70.922849][ T5152] Call Trace:
[ 70.922858][ T5152]
[ 70.922863][ T5152] dump_stack_lvl+0x189/0x250
[ 70.922880][ T5152] ? __virt_addr_valid+0x1c8/0x5c0
[ 70.922897][ T5152] ? rcu_is_watching+0x15/0xb0
[ 70.922913][ T5152] ? __pfx_dump_stack_lvl+0x10/0x10
[ 70.922927][ T5152] ? rcu_is_watching+0x15/0xb0
[ 70.922942][ T5152] ? lock_release+0x4b/0x3d0
[ 70.922954][ T5152] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 70.922970][ T5152] ? __virt_addr_valid+0x1c8/0x5c0
[ 70.922986][ T5152] ? __virt_addr_valid+0x4a5/0x5c0
[ 70.923003][ T5152] print_report+0xca/0x240
[ 70.923019][ T5152] ? hci_cmd_work+0x5d0/0x7b0
[ 70.923035][ T5152] kasan_report+0x118/0x150
[ 70.923056][ T5152] ? hci_cmd_work+0x5d0/0x7b0
[ 70.923075][ T5152] hci_cmd_work+0x5d0/0x7b0
[ 70.923093][ T5152] ? process_one_work+0x868/0x15e0
[ 70.923106][ T5152] process_one_work+0x93a/0x15e0
[ 70.923117][ T5152] ? __lock_acquire+0xab9/0xd20
[ 70.923136][ T5152] ? __pfx_process_one_work+0x10/0x10
[ 70.923150][ T5152] ? assign_work+0x3a1/0x410
[ 70.923163][ T5152] worker_thread+0x9b0/0xee0
[ 70.923183][ T5152] kthread+0x711/0x8a0
[ 70.923200][ T5152] ? __pfx_worker_thread+0x10/0x10
[ 70.923212][ T5152] ? __pfx_kthread+0x10/0x10
[ 70.923228][ T5152] ? _raw_spin_unlock_irq+0x23/0x50
[ 70.923242][ T5152] ? lockdep_hardirqs_on+0x9c/0x150
[ 70.923257][ T5152] ? __pfx_kthread+0x10/0x10
[ 70.923272][ T5152] ret_from_fork+0x599/0xb30
[ 70.923285][ T5152] ? __pfx_ret_from_fork+0x10/0x10
[ 70.923300][ T5152] ? __switch_to_asm+0x39/0x70
[ 70.923316][ T5152] ? __switch_to_asm+0x33/0x70
[ 70.923331][ T5152] ? __pfx_kthread+0x10/0x10
[ 70.923346][ T5152] ret_from_fork_asm+0x1a/0x30
[ 70.923367][ T5152]
[ 70.923371][ T5152]
[ 71.112237][ T5152] Allocated by task 53:
[ 71.116369][ T5152] kasan_save_track+0x3e/0x80
[ 71.121026][ T5152] __kasan_slab_alloc+0x6c/0x80
[ 71.125860][ T5152] kmem_cache_alloc_node_noprof+0x43c/0x710
[ 71.131749][ T5152] __alloc_skb+0x112/0x2d0
[ 71.136145][ T5152] hci_cmd_sync_alloc+0x3d/0x3b0
[ 71.141066][ T5152] __hci_cmd_sync_sk+0x1a7/0xc70
[ 71.145984][ T5152] hci_reset_sync+0x4a/0x140
[ 71.150555][ T5152] hci_dev_open_sync+0xec5/0x2dc0
[ 71.155559][ T5152] hci_power_on+0x1b4/0x720
[ 71.160127][ T5152] process_one_work+0x93a/0x15e0
[ 71.165043][ T5152] worker_thread+0x9b0/0xee0
[ 71.169613][ T5152] kthread+0x711/0x8a0
[ 71.173665][ T5152] ret_from_fork+0x599/0xb30
[ 71.178232][ T5152] ret_from_fork_asm+0x1a/0x30
[ 71.182978][ T5152]
[ 71.185281][ T5152] Freed by task 5831:
[ 71.189241][ T5152] kasan_save_track+0x3e/0x80
[ 71.193989][ T5152] kasan_save_free_info+0x46/0x50
[ 71.199171][ T5152] __kasan_slab_free+0x5c/0x80
[ 71.203911][ T5152] kmem_cache_free+0x197/0x640
[ 71.208651][ T5152] vhci_read+0x49a/0x5b0
[ 71.212879][ T5152] vfs_read+0x200/0xa30
[ 71.217011][ T5152] ksys_read+0x145/0x250
[ 71.221237][ T5152] do_syscall_64+0xfa/0xfa0
[ 71.225723][ T5152] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 71.231593][ T5152]
[ 71.233896][ T5152] The buggy address belongs to the object at ffff888060a57000
[ 71.233896][ T5152] which belongs to the cache skbuff_head_cache of size 240
[ 71.248532][ T5152] The buggy address is located 56 bytes inside of
[ 71.248532][ T5152] freed 240-byte region [ffff888060a57000, ffff888060a570f0)
[ 71.262220][ T5152]
[ 71.264530][ T5152] The buggy address belongs to the physical page:
[ 71.270940][ T5152] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x60a57
[ 71.279680][ T5152] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 71.286800][ T5152] page_type: f5(slab)
[ 71.290764][ T5152] raw: 00fff00000000000 ffff888140aa4a00 dead000000000122 0000000000000000
[ 71.299342][ T5152] raw: 0000000000000000 00000000800c000c 00000000f5000000 0000000000000000
[ 71.307985][ T5152] page dumped because: kasan: bad access detected
[ 71.314388][ T5152] page_owner tracks the page as allocated
[ 71.320079][ T5152] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 53, tgid 53 (kworker/u9:0), ts 70888278385, free_ts 21588326509
[ 71.338981][ T5152] post_alloc_hook+0x240/0x2a0
[ 71.343738][ T5152] get_page_from_freelist+0x2365/0x2440
[ 71.349264][ T5152] __alloc_frozen_pages_noprof+0x181/0x370
[ 71.355051][ T5152] alloc_pages_mpol+0x232/0x4a0
[ 71.359882][ T5152] allocate_slab+0x86/0x3b0
[ 71.364367][ T5152] ___slab_alloc+0xf56/0x1990
[ 71.369120][ T5152] __slab_alloc+0x65/0x100
[ 71.373528][ T5152] kmem_cache_alloc_node_noprof+0x4ce/0x710
[ 71.379417][ T5152] __alloc_skb+0x112/0x2d0
[ 71.383824][ T5152] hci_cmd_sync_alloc+0x3d/0x3b0
[ 71.388751][ T5152] __hci_cmd_sync_sk+0x1a7/0xc70
[ 71.393702][ T5152] hci_reset_sync+0x4a/0x140
[ 71.398282][ T5152] hci_dev_open_sync+0xec5/0x2dc0
[ 71.403285][ T5152] hci_power_on+0x1b4/0x720
[ 71.407773][ T5152] process_one_work+0x93a/0x15e0
[ 71.412714][ T5152] worker_thread+0x9b0/0xee0
[ 71.417294][ T5152] page last free pid 1 tgid 1 stack trace:
[ 71.423079][ T5152] __free_frozen_pages+0xbc8/0xd30
[ 71.428172][ T5152] free_contig_range+0x1bd/0x4a0
[ 71.433095][ T5152] destroy_args+0x69/0x660
[ 71.437502][ T5152] debug_vm_pgtable+0x38f/0x3a0
[ 71.442331][ T5152] do_one_initcall+0x1fb/0x870
[ 71.447103][ T5152] do_initcall_level+0x104/0x190
[ 71.452021][ T5152] do_initcalls+0x59/0xa0
[ 71.456332][ T5152] kernel_init_freeable+0x334/0x4b0
[ 71.461510][ T5152] kernel_init+0x1d/0x1d0
[ 71.465825][ T5152] ret_from_fork+0x599/0xb30
[ 71.470402][ T5152] ret_from_fork_asm+0x1a/0x30
[ 71.475152][ T5152]
[ 71.477457][ T5152] Memory state around the buggy address:
[ 71.483063][ T5152] ffff888060a56f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 71.491113][ T5152] ffff888060a56f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 71.499157][ T5152] >ffff888060a57000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 71.507196][ T5152] ^
[ 71.513065][ T5152] ffff888060a57080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 71.521106][ T5152] ffff888060a57100: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 71.529159][ T5152] ==================================================================
[ 71.538442][ T5152] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 71.545661][ T5152] CPU: 1 UID: 0 PID: 5152 Comm: kworker/u9:1 Not tainted syzkaller #0 PREEMPT(full)
[ 71.555106][ T5152] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 71.565154][ T5152] Workqueue: hci0 hci_cmd_work
[ 71.570009][ T5152] Call Trace:
[ 71.573280][ T5152]
[ 71.576210][ T5152] dump_stack_lvl+0x99/0x250
[ 71.580808][ T5152] ? __asan_memcpy+0x40/0x70
[ 71.585394][ T5152] ? __pfx_dump_stack_lvl+0x10/0x10
[ 71.590580][ T5152] ? __pfx__printk+0x10/0x10
[ 71.595160][ T5152] vpanic+0x237/0x6d0
[ 71.599123][ T5152] ? __pfx_vpanic+0x10/0x10
[ 71.603611][ T5152] ? preempt_schedule+0xae/0xc0
[ 71.608446][ T5152] ? __pfx_preempt_schedule+0x10/0x10
[ 71.613806][ T5152] panic+0xb9/0xc0
[ 71.617508][ T5152] ? __pfx_panic+0x10/0x10
[ 71.621915][ T5152] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 71.627792][ T5152] ? is_module_address+0x17/0xf0
[ 71.632711][ T5152] ? hci_cmd_work+0x5d0/0x7b0
[ 71.637374][ T5152] check_panic_on_warn+0x89/0xb0
[ 71.642305][ T5152] ? hci_cmd_work+0x5d0/0x7b0
[ 71.646968][ T5152] end_report+0x6f/0x160
[ 71.651196][ T5152] kasan_report+0x129/0x150
[ 71.655678][ T5152] ? hci_cmd_work+0x5d0/0x7b0
[ 71.660341][ T5152] hci_cmd_work+0x5d0/0x7b0
[ 71.664832][ T5152] ? process_one_work+0x868/0x15e0
[ 71.669924][ T5152] process_one_work+0x93a/0x15e0
[ 71.674840][ T5152] ? __lock_acquire+0xab9/0xd20
[ 71.679682][ T5152] ? __pfx_process_one_work+0x10/0x10
[ 71.685038][ T5152] ? assign_work+0x3a1/0x410
[ 71.689608][ T5152] worker_thread+0x9b0/0xee0
[ 71.694325][ T5152] kthread+0x711/0x8a0
[ 71.698377][ T5152] ? __pfx_worker_thread+0x10/0x10
[ 71.703470][ T5152] ? __pfx_kthread+0x10/0x10
[ 71.708045][ T5152] ? _raw_spin_unlock_irq+0x23/0x50
[ 71.713225][ T5152] ? lockdep_hardirqs_on+0x9c/0x150
[ 71.718407][ T5152] ? __pfx_kthread+0x10/0x10
[ 71.722982][ T5152] ret_from_fork+0x599/0xb30
[ 71.727555][ T5152] ? __pfx_ret_from_fork+0x10/0x10
[ 71.732652][ T5152] ? __switch_to_asm+0x39/0x70
[ 71.737401][ T5152] ? __switch_to_asm+0x33/0x70
[ 71.742150][ T5152] ? __pfx_kthread+0x10/0x10
[ 71.746734][ T5152] ret_from_fork_asm+0x1a/0x30
[ 71.751487][ T5152]
[ 71.754846][ T5152] Kernel Offset: disabled
[ 71.759153][ T5152] Rebooting in 86400 seconds..