last executing test programs:
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.0.230' (ED25519) to the list of known hosts.
[ 68.138456][ T5810] cgroup: Unknown subsys name 'net'
[ 68.298157][ T5810] cgroup: Unknown subsys name 'cpuset'
[ 68.306956][ T5810] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 69.730082][ T5810] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 71.330674][ T1297] ieee802154 phy0 wpan0: encryption failed: -22
[ 71.337141][ T1297] ieee802154 phy1 wpan1: encryption failed: -22
[ 72.978634][ T5823] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 72.987526][ T5823] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 72.988480][ T5826] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 72.995461][ T5823] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[ 73.010276][ T5826] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 73.015972][ T5823] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[ 73.025547][ T5823] ==================================================================
[ 73.033624][ T5823] BUG: KASAN: slab-use-after-free in hci_cmd_work+0x5d0/0x7b0
[ 73.041082][ T5823] Read of size 2 at addr ffff888061fa12b8 by task kworker/u9:2/5823
[ 73.049045][ T5823]
[ 73.051377][ T5823] CPU: 1 UID: 0 PID: 5823 Comm: kworker/u9:2 Not tainted syzkaller #0 PREEMPT(full)
[ 73.051394][ T5823] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 73.051404][ T5823] Workqueue: hci0 hci_cmd_work
[ 73.051429][ T5823] Call Trace:
[ 73.051436][ T5823]
[ 73.051441][ T5823] dump_stack_lvl+0x189/0x250
[ 73.051461][ T5823] ? __virt_addr_valid+0x1c8/0x5c0
[ 73.051474][ T5823] ? rcu_is_watching+0x15/0xb0
[ 73.051485][ T5823] ? __pfx_dump_stack_lvl+0x10/0x10
[ 73.051501][ T5823] ? rcu_is_watching+0x15/0xb0
[ 73.051512][ T5823] ? lock_release+0x4b/0x3d0
[ 73.051527][ T5823] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 73.051541][ T5823] ? __virt_addr_valid+0x1c8/0x5c0
[ 73.051553][ T5823] ? __virt_addr_valid+0x4a5/0x5c0
[ 73.051565][ T5823] print_report+0xca/0x240
[ 73.051581][ T5823] ? hci_cmd_work+0x5d0/0x7b0
[ 73.051595][ T5823] kasan_report+0x118/0x150
[ 73.051611][ T5823] ? hci_cmd_work+0x5d0/0x7b0
[ 73.051627][ T5823] hci_cmd_work+0x5d0/0x7b0
[ 73.051643][ T5823] ? process_one_work+0x868/0x15e0
[ 73.051658][ T5823] process_one_work+0x93a/0x15e0
[ 73.051677][ T5823] ? __lock_acquire+0xab9/0xd20
[ 73.051698][ T5823] ? __pfx_process_one_work+0x10/0x10
[ 73.051716][ T5823] ? assign_work+0x3a1/0x410
[ 73.051731][ T5823] worker_thread+0x9b0/0xee0
[ 73.051754][ T5823] kthread+0x711/0x8a0
[ 73.051767][ T5823] ? __pfx_worker_thread+0x10/0x10
[ 73.051782][ T5823] ? __pfx_kthread+0x10/0x10
[ 73.051793][ T5823] ? _raw_spin_unlock_irq+0x23/0x50
[ 73.051805][ T5823] ? lockdep_hardirqs_on+0x9c/0x150
[ 73.051819][ T5823] ? __pfx_kthread+0x10/0x10
[ 73.051830][ T5823] ret_from_fork+0x599/0xb30
[ 73.051846][ T5823] ? __pfx_ret_from_fork+0x10/0x10
[ 73.051864][ T5823] ? __switch_to_asm+0x39/0x70
[ 73.051875][ T5823] ? __switch_to_asm+0x33/0x70
[ 73.051886][ T5823] ? __pfx_kthread+0x10/0x10
[ 73.051898][ T5823] ret_from_fork_asm+0x1a/0x30
[ 73.051915][ T5823]
[ 73.051920][ T5823]
[ 73.241130][ T5823] Allocated by task 52:
[ 73.245268][ T5823] kasan_save_track+0x3e/0x80
[ 73.249935][ T5823] __kasan_slab_alloc+0x6c/0x80
[ 73.254770][ T5823] kmem_cache_alloc_node_noprof+0x43c/0x710
[ 73.260641][ T5823] __alloc_skb+0x112/0x2d0
[ 73.265044][ T5823] hci_cmd_sync_alloc+0x3d/0x3b0
[ 73.269966][ T5823] __hci_cmd_sync_sk+0x1a7/0xc70
[ 73.274888][ T5823] hci_dev_open_sync+0x163e/0x2dc0
[ 73.279979][ T5823] hci_power_on+0x1b4/0x720
[ 73.284480][ T5823] process_one_work+0x93a/0x15e0
[ 73.289411][ T5823] worker_thread+0x9b0/0xee0
[ 73.293984][ T5823] kthread+0x711/0x8a0
[ 73.298038][ T5823] ret_from_fork+0x599/0xb30
[ 73.302615][ T5823] ret_from_fork_asm+0x1a/0x30
[ 73.307361][ T5823]
[ 73.309668][ T5823] Freed by task 5825:
[ 73.313627][ T5823] kasan_save_track+0x3e/0x80
[ 73.318285][ T5823] kasan_save_free_info+0x46/0x50
[ 73.323295][ T5823] __kasan_slab_free+0x5c/0x80
[ 73.328039][ T5823] kmem_cache_free+0x197/0x640
[ 73.332788][ T5823] vhci_read+0x49a/0x5b0
[ 73.337017][ T5823] vfs_read+0x200/0xa30
[ 73.341154][ T5823] ksys_read+0x145/0x250
[ 73.345385][ T5823] do_syscall_64+0xfa/0xfa0
[ 73.349869][ T5823] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 73.355742][ T5823]
[ 73.358050][ T5823] The buggy address belongs to the object at ffff888061fa1280
[ 73.358050][ T5823] which belongs to the cache skbuff_head_cache of size 240
[ 73.372602][ T5823] The buggy address is located 56 bytes inside of
[ 73.372602][ T5823] freed 240-byte region [ffff888061fa1280, ffff888061fa1370)
[ 73.386290][ T5823]
[ 73.388597][ T5823] The buggy address belongs to the physical page:
[ 73.395001][ T5823] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x61fa1
[ 73.403746][ T5823] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 73.410835][ T5823] page_type: f5(slab)
[ 73.414801][ T5823] raw: 00fff00000000000 ffff888140eb0a00 dead000000000122 0000000000000000
[ 73.423367][ T5823] raw: 0000000000000000 00000000800c000c 00000000f5000000 0000000000000000
[ 73.431927][ T5823] page dumped because: kasan: bad access detected
[ 73.438324][ T5823] page_owner tracks the page as allocated
[ 73.444014][ T5823] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5823, tgid 5823 (kworker/u9:2), ts 73015935241, free_ts 20705827583
[ 73.463272][ T5823] post_alloc_hook+0x240/0x2a0
[ 73.468021][ T5823] get_page_from_freelist+0x2365/0x2440
[ 73.473553][ T5823] __alloc_frozen_pages_noprof+0x181/0x370
[ 73.479424][ T5823] alloc_pages_mpol+0x232/0x4a0
[ 73.484255][ T5823] allocate_slab+0x86/0x3b0
[ 73.488742][ T5823] ___slab_alloc+0xf56/0x1990
[ 73.493401][ T5823] __slab_alloc+0x65/0x100
[ 73.497802][ T5823] kmem_cache_alloc_noprof+0x40f/0x700
[ 73.503243][ T5823] skb_clone+0x212/0x3a0
[ 73.507486][ T5823] hci_event_packet+0x1a6/0x1260
[ 73.512408][ T5823] hci_rx_work+0x45d/0xfc0
[ 73.516805][ T5823] process_one_work+0x93a/0x15e0
[ 73.521732][ T5823] worker_thread+0x9b0/0xee0
[ 73.526306][ T5823] kthread+0x711/0x8a0
[ 73.530391][ T5823] ret_from_fork+0x599/0xb30
[ 73.535057][ T5823] ret_from_fork_asm+0x1a/0x30
[ 73.539801][ T5823] page last free pid 1 tgid 1 stack trace:
[ 73.545582][ T5823] __free_frozen_pages+0xbc8/0xd30
[ 73.550678][ T5823] free_contig_range+0x1bd/0x4a0
[ 73.555601][ T5823] destroy_args+0x69/0x660
[ 73.560004][ T5823] debug_vm_pgtable+0x38f/0x3a0
[ 73.564839][ T5823] do_one_initcall+0x1fb/0x870
[ 73.569582][ T5823] do_initcall_level+0x104/0x190
[ 73.574516][ T5823] do_initcalls+0x59/0xa0
[ 73.578848][ T5823] kernel_init_freeable+0x334/0x4b0
[ 73.584049][ T5823] kernel_init+0x1d/0x1d0
[ 73.588382][ T5823] ret_from_fork+0x599/0xb30
[ 73.592977][ T5823] ret_from_fork_asm+0x1a/0x30
[ 73.597733][ T5823]
[ 73.600044][ T5823] Memory state around the buggy address:
[ 73.605657][ T5823] ffff888061fa1180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 73.613702][ T5823] ffff888061fa1200: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[ 73.621749][ T5823] >ffff888061fa1280: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 73.629790][ T5823] ^
[ 73.635663][ T5823] ffff888061fa1300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 73.643705][ T5823] ffff888061fa1380: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
[ 73.651743][ T5823] ==================================================================
[ 73.661075][ T5823] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 73.668293][ T5823] CPU: 1 UID: 0 PID: 5823 Comm: kworker/u9:2 Not tainted syzkaller #0 PREEMPT(full)
[ 73.677833][ T5823] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 73.687880][ T5823] Workqueue: hci0 hci_cmd_work
[ 73.692642][ T5823] Call Trace:
[ 73.695905][ T5823]
[ 73.698826][ T5823] dump_stack_lvl+0x99/0x250
[ 73.703422][ T5823] ? __asan_memcpy+0x40/0x70
[ 73.707994][ T5823] ? __pfx_dump_stack_lvl+0x10/0x10
[ 73.713182][ T5823] ? __pfx__printk+0x10/0x10
[ 73.717765][ T5823] vpanic+0x237/0x6d0
[ 73.721731][ T5823] ? __pfx_vpanic+0x10/0x10
[ 73.726218][ T5823] ? preempt_schedule+0xae/0xc0
[ 73.731083][ T5823] ? __pfx_preempt_schedule+0x10/0x10
[ 73.736444][ T5823] panic+0xb9/0xc0
[ 73.740148][ T5823] ? __pfx_panic+0x10/0x10
[ 73.744547][ T5823] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 73.750426][ T5823] ? is_module_address+0x17/0xf0
[ 73.755353][ T5823] ? hci_cmd_work+0x5d0/0x7b0
[ 73.760017][ T5823] check_panic_on_warn+0x89/0xb0
[ 73.764940][ T5823] ? hci_cmd_work+0x5d0/0x7b0
[ 73.769611][ T5823] end_report+0x6f/0x160
[ 73.773844][ T5823] kasan_report+0x129/0x150
[ 73.778335][ T5823] ? hci_cmd_work+0x5d0/0x7b0
[ 73.783001][ T5823] hci_cmd_work+0x5d0/0x7b0
[ 73.787488][ T5823] ? process_one_work+0x868/0x15e0
[ 73.792586][ T5823] process_one_work+0x93a/0x15e0
[ 73.797515][ T5823] ? __lock_acquire+0xab9/0xd20
[ 73.802357][ T5823] ? __pfx_process_one_work+0x10/0x10
[ 73.807725][ T5823] ? assign_work+0x3a1/0x410
[ 73.812303][ T5823] worker_thread+0x9b0/0xee0
[ 73.816887][ T5823] kthread+0x711/0x8a0
[ 73.820947][ T5823] ? __pfx_worker_thread+0x10/0x10
[ 73.826040][ T5823] ? __pfx_kthread+0x10/0x10
[ 73.830610][ T5823] ? _raw_spin_unlock_irq+0x23/0x50
[ 73.835790][ T5823] ? lockdep_hardirqs_on+0x9c/0x150
[ 73.840974][ T5823] ? __pfx_kthread+0x10/0x10
[ 73.845547][ T5823] ret_from_fork+0x599/0xb30
[ 73.850123][ T5823] ? __pfx_ret_from_fork+0x10/0x10
[ 73.855222][ T5823] ? __switch_to_asm+0x39/0x70
[ 73.859969][ T5823] ? __switch_to_asm+0x33/0x70
[ 73.864721][ T5823] ? __pfx_kthread+0x10/0x10
[ 73.869295][ T5823] ret_from_fork_asm+0x1a/0x30
[ 73.874048][ T5823]
[ 73.877400][ T5823] Kernel Offset: disabled
[ 73.881722][ T5823] Rebooting in 86400 seconds..