last executing test programs:
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.0.210' (ED25519) to the list of known hosts.
[ 84.063287][ T5810] cgroup: Unknown subsys name 'net'
[ 84.176236][ T5810] cgroup: Unknown subsys name 'cpuset'
[ 84.185454][ T5810] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 85.688934][ T5810] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 87.754199][ T5823] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 87.767084][ T5823] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 87.775372][ T5823] ==================================================================
[ 87.784676][ T5823] BUG: KASAN: slab-use-after-free in hci_cmd_work+0x5d0/0x7b0
[ 87.795139][ T5823] Read of size 2 at addr ffff88804cda6df8 by task kworker/u9:2/5823
[ 87.804537][ T5823]
[ 87.807060][ T5823] CPU: 0 UID: 0 PID: 5823 Comm: kworker/u9:2 Not tainted syzkaller #0 PREEMPT(full)
[ 87.807085][ T5823] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 87.807097][ T5823] Workqueue: hci0 hci_cmd_work
[ 87.807128][ T5823] Call Trace:
[ 87.807136][ T5823]
[ 87.807143][ T5823] dump_stack_lvl+0x189/0x250
[ 87.807167][ T5823] ? __virt_addr_valid+0x1c8/0x5c0
[ 87.807183][ T5823] ? rcu_is_watching+0x15/0xb0
[ 87.807199][ T5823] ? __pfx_dump_stack_lvl+0x10/0x10
[ 87.807219][ T5823] ? rcu_is_watching+0x15/0xb0
[ 87.807233][ T5823] ? lock_release+0x4b/0x3d0
[ 87.807252][ T5823] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 87.807270][ T5823] ? __virt_addr_valid+0x1c8/0x5c0
[ 87.807286][ T5823] ? __virt_addr_valid+0x4a5/0x5c0
[ 87.807302][ T5823] print_report+0xca/0x240
[ 87.807322][ T5823] ? hci_cmd_work+0x5d0/0x7b0
[ 87.807339][ T5823] kasan_report+0x118/0x150
[ 87.807357][ T5823] ? hci_cmd_work+0x5d0/0x7b0
[ 87.807378][ T5823] hci_cmd_work+0x5d0/0x7b0
[ 87.807397][ T5823] ? process_one_work+0x868/0x15e0
[ 87.807413][ T5823] process_one_work+0x93a/0x15e0
[ 87.807430][ T5823] ? __lock_acquire+0xab9/0xd20
[ 87.807451][ T5823] ? __pfx_process_one_work+0x10/0x10
[ 87.807470][ T5823] ? assign_work+0x3a1/0x410
[ 87.807486][ T5823] worker_thread+0x9b0/0xee0
[ 87.807512][ T5823] kthread+0x711/0x8a0
[ 87.807526][ T5823] ? __pfx_worker_thread+0x10/0x10
[ 87.807541][ T5823] ? __pfx_kthread+0x10/0x10
[ 87.807552][ T5823] ? _raw_spin_unlock_irq+0x23/0x50
[ 87.807564][ T5823] ? lockdep_hardirqs_on+0x9c/0x150
[ 87.807578][ T5823] ? __pfx_kthread+0x10/0x10
[ 87.807589][ T5823] ret_from_fork+0x599/0xb30
[ 87.807606][ T5823] ? __pfx_ret_from_fork+0x10/0x10
[ 87.807629][ T5823] ? __switch_to_asm+0x39/0x70
[ 87.807641][ T5823] ? __switch_to_asm+0x33/0x70
[ 87.807652][ T5823] ? __pfx_kthread+0x10/0x10
[ 87.807663][ T5823] ret_from_fork_asm+0x1a/0x30
[ 87.807681][ T5823]
[ 87.807686][ T5823]
[ 88.019380][ T5823] Allocated by task 5144:
[ 88.024965][ T5823] kasan_save_track+0x3e/0x80
[ 88.030265][ T5823] __kasan_slab_alloc+0x6c/0x80
[ 88.035905][ T5823] kmem_cache_alloc_node_noprof+0x43c/0x710
[ 88.041821][ T5823] __alloc_skb+0x112/0x2d0
[ 88.046935][ T5823] hci_cmd_sync_alloc+0x3d/0x3b0
[ 88.052656][ T5823] __hci_cmd_sync_sk+0x1a7/0xc70
[ 88.058075][ T5823] hci_dev_open_sync+0x163e/0x2dc0
[ 88.063443][ T5823] hci_power_on+0x1b4/0x720
[ 88.068019][ T5823] process_one_work+0x93a/0x15e0
[ 88.073131][ T5823] worker_thread+0x9b0/0xee0
[ 88.077911][ T5823] kthread+0x711/0x8a0
[ 88.082602][ T5823] ret_from_fork+0x599/0xb30
[ 88.087647][ T5823] ret_from_fork_asm+0x1a/0x30
[ 88.093102][ T5823]
[ 88.095515][ T5823] Freed by task 5824:
[ 88.100099][ T5823] kasan_save_track+0x3e/0x80
[ 88.107233][ T5823] kasan_save_free_info+0x46/0x50
[ 88.112908][ T5823] __kasan_slab_free+0x5c/0x80
[ 88.118243][ T5823] kmem_cache_free+0x197/0x640
[ 88.123370][ T5823] vhci_read+0x49a/0x5b0
[ 88.128358][ T5823] vfs_read+0x200/0xa30
[ 88.133485][ T5823] ksys_read+0x145/0x250
[ 88.137921][ T5823] do_syscall_64+0xfa/0xfa0
[ 88.143127][ T5823] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 88.149547][ T5823]
[ 88.152065][ T5823] The buggy address belongs to the object at ffff88804cda6dc0
[ 88.152065][ T5823] which belongs to the cache skbuff_head_cache of size 240
[ 88.167363][ T5823] The buggy address is located 56 bytes inside of
[ 88.167363][ T5823] freed 240-byte region [ffff88804cda6dc0, ffff88804cda6eb0)
[ 88.183617][ T5823]
[ 88.186018][ T5823] The buggy address belongs to the physical page:
[ 88.192873][ T5823] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4cda6
[ 88.202095][ T5823] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 88.209918][ T5823] page_type: f5(slab)
[ 88.213999][ T5823] raw: 00fff00000000000 ffff88801d2a5a00 dead000000000122 0000000000000000
[ 88.223634][ T5823] raw: 0000000000000000 00000000000c000c 00000000f5000000 0000000000000000
[ 88.232928][ T5823] page dumped because: kasan: bad access detected
[ 88.240146][ T5823] page_owner tracks the page as allocated
[ 88.246571][ T5823] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5822, tgid 5822 (syz-executor), ts 87738002281, free_ts 30573812048
[ 88.269588][ T5823] post_alloc_hook+0x240/0x2a0
[ 88.275320][ T5823] get_page_from_freelist+0x2365/0x2440
[ 88.282911][ T5823] __alloc_frozen_pages_noprof+0x181/0x370
[ 88.289164][ T5823] alloc_pages_mpol+0x232/0x4a0
[ 88.294370][ T5823] allocate_slab+0x86/0x3b0
[ 88.299580][ T5823] ___slab_alloc+0xf56/0x1990
[ 88.304547][ T5823] __slab_alloc+0x65/0x100
[ 88.309231][ T5823] kmem_cache_alloc_node_noprof+0x4ce/0x710
[ 88.315641][ T5823] __alloc_skb+0x112/0x2d0
[ 88.321129][ T5823] create_monitor_ctrl_open+0x156/0x880
[ 88.328456][ T5823] hci_sock_ioctl+0x2f2/0x940
[ 88.333588][ T5823] sock_do_ioctl+0xdc/0x300
[ 88.339587][ T5823] sock_ioctl+0x576/0x790
[ 88.345315][ T5823] __se_sys_ioctl+0xfc/0x170
[ 88.351308][ T5823] do_syscall_64+0xfa/0xfa0
[ 88.356338][ T5823] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 88.363145][ T5823] page last free pid 1 tgid 1 stack trace:
[ 88.369325][ T5823] __free_frozen_pages+0xbc8/0xd30
[ 88.374845][ T5823] free_contig_range+0x1bd/0x4a0
[ 88.380859][ T5823] destroy_args+0x69/0x660
[ 88.386255][ T5823] debug_vm_pgtable+0x38f/0x3a0
[ 88.391493][ T5823] do_one_initcall+0x1fb/0x870
[ 88.396773][ T5823] do_initcall_level+0x104/0x190
[ 88.402901][ T5823] do_initcalls+0x59/0xa0
[ 88.407404][ T5823] kernel_init_freeable+0x334/0x4b0
[ 88.413470][ T5823] kernel_init+0x1d/0x1d0
[ 88.418008][ T5823] ret_from_fork+0x599/0xb30
[ 88.422603][ T5823] ret_from_fork_asm+0x1a/0x30
[ 88.427869][ T5823]
[ 88.430252][ T5823] Memory state around the buggy address:
[ 88.436683][ T5823] ffff88804cda6c80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 88.446146][ T5823] ffff88804cda6d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 88.454705][ T5823] >ffff88804cda6d80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 88.464549][ T5823] ^
[ 88.474103][ T5823] ffff88804cda6e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 88.483324][ T5823] ffff88804cda6e80: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[ 88.492285][ T5823] ==================================================================
[ 88.501523][ T5823] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 88.509351][ T5823] CPU: 0 UID: 0 PID: 5823 Comm: kworker/u9:2 Not tainted syzkaller #0 PREEMPT(full)
[ 88.519343][ T5823] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 88.530275][ T5823] Workqueue: hci0 hci_cmd_work
[ 88.535139][ T5823] Call Trace:
[ 88.539128][ T5823]
[ 88.543287][ T5823] dump_stack_lvl+0x99/0x250
[ 88.548466][ T5823] ? __asan_memcpy+0x40/0x70
[ 88.553574][ T5823] ? __pfx_dump_stack_lvl+0x10/0x10
[ 88.558953][ T5823] ? __pfx__printk+0x10/0x10
[ 88.563930][ T5823] vpanic+0x237/0x6d0
[ 88.568136][ T5823] ? __pfx_vpanic+0x10/0x10
[ 88.573353][ T5823] ? preempt_schedule+0xae/0xc0
[ 88.578767][ T5823] ? __pfx_preempt_schedule+0x10/0x10
[ 88.585796][ T5823] panic+0xb9/0xc0
[ 88.589647][ T5823] ? __pfx_panic+0x10/0x10
[ 88.594162][ T5823] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 88.601637][ T5823] ? is_module_address+0x17/0xf0
[ 88.606681][ T5823] ? hci_cmd_work+0x5d0/0x7b0
[ 88.612322][ T5823] check_panic_on_warn+0x89/0xb0
[ 88.618452][ T5823] ? hci_cmd_work+0x5d0/0x7b0
[ 88.623415][ T5823] end_report+0x6f/0x160
[ 88.628188][ T5823] kasan_report+0x129/0x150
[ 88.632971][ T5823] ? hci_cmd_work+0x5d0/0x7b0
[ 88.638494][ T5823] hci_cmd_work+0x5d0/0x7b0
[ 88.643772][ T5823] ? process_one_work+0x868/0x15e0
[ 88.649522][ T5823] process_one_work+0x93a/0x15e0
[ 88.654712][ T5823] ? __lock_acquire+0xab9/0xd20
[ 88.660251][ T5823] ? __pfx_process_one_work+0x10/0x10
[ 88.667066][ T5823] ? assign_work+0x3a1/0x410
[ 88.671842][ T5823] worker_thread+0x9b0/0xee0
[ 88.676882][ T5823] kthread+0x711/0x8a0
[ 88.682780][ T5823] ? __pfx_worker_thread+0x10/0x10
[ 88.688203][ T5823] ? __pfx_kthread+0x10/0x10
[ 88.692987][ T5823] ? _raw_spin_unlock_irq+0x23/0x50
[ 88.699087][ T5823] ? lockdep_hardirqs_on+0x9c/0x150
[ 88.704677][ T5823] ? __pfx_kthread+0x10/0x10
[ 88.709638][ T5823] ret_from_fork+0x599/0xb30
[ 88.715113][ T5823] ? __pfx_ret_from_fork+0x10/0x10
[ 88.720982][ T5823] ? __switch_to_asm+0x39/0x70
[ 88.726636][ T5823] ? __switch_to_asm+0x33/0x70
[ 88.732076][ T5823] ? __pfx_kthread+0x10/0x10
[ 88.736674][ T5823] ret_from_fork_asm+0x1a/0x30
[ 88.742162][ T5823]
[ 88.745324][ T5823] Kernel Offset: disabled
[ 88.749646][ T5823] Rebooting in 86400 seconds..