last executing test programs:
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.1.113' (ED25519) to the list of known hosts.
[ 84.170431][ T5812] cgroup: Unknown subsys name 'net'
[ 84.323550][ T5812] cgroup: Unknown subsys name 'cpuset'
[ 84.332910][ T5812] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 86.011034][ T5812] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 88.232878][ T5839] ==================================================================
[ 88.241034][ T5839] BUG: KASAN: slab-use-after-free in hci_cmd_work+0x5d0/0x7b0
[ 88.242051][ T5835] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[ 88.248654][ T5839] Read of size 2 at addr ffff888053761b78 by task kworker/u9:6/5839
[ 88.248675][ T5839]
[ 88.248706][ T5839] CPU: 0 UID: 0 PID: 5839 Comm: kworker/u9:6 Not tainted syzkaller #0 PREEMPT(full)
[ 88.248729][ T5839] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 88.248742][ T5839] Workqueue: hci3 hci_cmd_work
[ 88.248777][ T5839] Call Trace:
[ 88.248787][ T5839]
[ 88.248798][ T5839] dump_stack_lvl+0x189/0x250
[ 88.248834][ T5839] ? __virt_addr_valid+0x1c8/0x5c0
[ 88.248857][ T5839] ? rcu_is_watching+0x15/0xb0
[ 88.248879][ T5839] ? __pfx_dump_stack_lvl+0x10/0x10
[ 88.248910][ T5839] ? rcu_is_watching+0x15/0xb0
[ 88.248930][ T5839] ? lock_release+0x4b/0x3d0
[ 88.248960][ T5839] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 88.248984][ T5839] ? __virt_addr_valid+0x1c8/0x5c0
[ 88.249007][ T5839] ? __virt_addr_valid+0x4a5/0x5c0
[ 88.249030][ T5839] print_report+0xca/0x240
[ 88.249060][ T5839] ? hci_cmd_work+0x5d0/0x7b0
[ 88.249084][ T5839] kasan_report+0x118/0x150
[ 88.249113][ T5839] ? hci_cmd_work+0x5d0/0x7b0
[ 88.249144][ T5839] hci_cmd_work+0x5d0/0x7b0
[ 88.249174][ T5839] ? process_one_work+0x868/0x15e0
[ 88.249202][ T5839] process_one_work+0x93a/0x15e0
[ 88.249228][ T5839] ? __lock_acquire+0xab9/0xd20
[ 88.249267][ T5839] ? __pfx_process_one_work+0x10/0x10
[ 88.249309][ T5839] ? assign_work+0x3a1/0x410
[ 88.249339][ T5839] worker_thread+0x9b0/0xee0
[ 88.249381][ T5839] kthread+0x711/0x8a0
[ 88.249405][ T5839] ? __pfx_worker_thread+0x10/0x10
[ 88.249434][ T5839] ? __pfx_kthread+0x10/0x10
[ 88.249454][ T5839] ? _raw_spin_unlock_irq+0x23/0x50
[ 88.249476][ T5839] ? lockdep_hardirqs_on+0x9c/0x150
[ 88.249501][ T5839] ? __pfx_kthread+0x10/0x10
[ 88.249521][ T5839] ret_from_fork+0x599/0xb30
[ 88.249550][ T5839] ? __pfx_ret_from_fork+0x10/0x10
[ 88.249583][ T5839] ? __switch_to_asm+0x39/0x70
[ 88.249604][ T5839] ? __switch_to_asm+0x33/0x70
[ 88.249623][ T5839] ? __pfx_kthread+0x10/0x10
[ 88.249644][ T5839] ret_from_fork_asm+0x1a/0x30
[ 88.249676][ T5839]
[ 88.249685][ T5839]
[ 88.260679][ T5835] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[ 88.263693][ T5839] Allocated by task 5145:
[ 88.263708][ T5839] kasan_save_track+0x3e/0x80
[ 88.266839][ T5835] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[ 88.275506][ T5839] __kasan_slab_alloc+0x6c/0x80
[ 88.275535][ T5839] kmem_cache_alloc_node_noprof+0x43c/0x710
[ 88.275552][ T5839] __alloc_skb+0x112/0x2d0
[ 88.275580][ T5839] hci_cmd_sync_alloc+0x3d/0x3b0
[ 88.499457][ T5839] __hci_cmd_sync_sk+0x1a7/0xc70
[ 88.504414][ T5839] hci_reset_sync+0x4a/0x140
[ 88.509009][ T5839] hci_dev_open_sync+0xec5/0x2dc0
[ 88.514034][ T5839] hci_power_on+0x1b4/0x720
[ 88.518552][ T5839] process_one_work+0x93a/0x15e0
[ 88.523506][ T5839] worker_thread+0x9b0/0xee0
[ 88.528130][ T5839] kthread+0x711/0x8a0
[ 88.532206][ T5839] ret_from_fork+0x599/0xb30
[ 88.536810][ T5839] ret_from_fork_asm+0x1a/0x30
[ 88.541589][ T5839]
[ 88.543918][ T5839] Freed by task 5827:
[ 88.547896][ T5839] kasan_save_track+0x3e/0x80
[ 88.552583][ T5839] kasan_save_free_info+0x46/0x50
[ 88.557618][ T5839] __kasan_slab_free+0x5c/0x80
[ 88.562388][ T5839] kmem_cache_free+0x197/0x640
[ 88.567162][ T5839] vhci_read+0x49a/0x5b0
[ 88.571408][ T5839] vfs_read+0x200/0xa30
[ 88.575576][ T5839] ksys_read+0x145/0x250
[ 88.580014][ T5839] do_syscall_64+0xfa/0xfa0
[ 88.584645][ T5839] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 88.590552][ T5839]
[ 88.592885][ T5839] The buggy address belongs to the object at ffff888053761b40
[ 88.592885][ T5839] which belongs to the cache skbuff_head_cache of size 240
[ 88.607489][ T5839] The buggy address is located 56 bytes inside of
[ 88.607489][ T5839] freed 240-byte region [ffff888053761b40, ffff888053761c30)
[ 88.621746][ T5839]
[ 88.624092][ T5839] The buggy address belongs to the physical page:
[ 88.630981][ T5839] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x53761
[ 88.639769][ T5839] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 88.646891][ T5839] page_type: f5(slab)
[ 88.650989][ T5839] raw: 00fff00000000000 ffff8881416d18c0 dead000000000122 0000000000000000
[ 88.659582][ T5839] raw: 0000000000000000 00000000000c000c 00000000f5000000 0000000000000000
[ 88.668174][ T5839] page dumped because: kasan: bad access detected
[ 88.674799][ T5839] page_owner tracks the page as allocated
[ 88.680618][ T5839] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5825, tgid 5825 (syz-executor), ts 88191914258, free_ts 29333161644
[ 88.700432][ T5839] post_alloc_hook+0x240/0x2a0
[ 88.705216][ T5839] get_page_from_freelist+0x2365/0x2440
[ 88.710786][ T5839] __alloc_frozen_pages_noprof+0x181/0x370
[ 88.716718][ T5839] alloc_pages_mpol+0x232/0x4a0
[ 88.721757][ T5839] allocate_slab+0x86/0x3b0
[ 88.726278][ T5839] ___slab_alloc+0xf56/0x1990
[ 88.730963][ T5839] __slab_alloc+0x65/0x100
[ 88.735392][ T5839] kmem_cache_alloc_node_noprof+0x4ce/0x710
[ 88.741295][ T5839] __alloc_skb+0x112/0x2d0
[ 88.745726][ T5839] hci_sock_dev_event+0x15c/0x630
[ 88.750753][ T5839] hci_register_dev+0x6be/0x8b0
[ 88.755610][ T5839] vhci_create_device+0x39c/0x650
[ 88.760646][ T5839] vhci_write+0x3ce/0x4a0
[ 88.764993][ T5839] vfs_write+0x5c9/0xb30
[ 88.769269][ T5839] ksys_write+0x145/0x250
[ 88.773624][ T5839] do_syscall_64+0xfa/0xfa0
[ 88.778138][ T5839] page last free pid 1 tgid 1 stack trace:
[ 88.783942][ T5839] __free_frozen_pages+0xbc8/0xd30
[ 88.789149][ T5839] free_contig_range+0x1bd/0x4a0
[ 88.794106][ T5839] destroy_args+0x69/0x660
[ 88.798534][ T5839] debug_vm_pgtable+0x38f/0x3a0
[ 88.803395][ T5839] do_one_initcall+0x1fb/0x870
[ 88.808161][ T5839] do_initcall_level+0x104/0x190
[ 88.813119][ T5839] do_initcalls+0x59/0xa0
[ 88.817465][ T5839] kernel_init_freeable+0x334/0x4b0
[ 88.822675][ T5839] kernel_init+0x1d/0x1d0
[ 88.827014][ T5839] ret_from_fork+0x599/0xb30
[ 88.831646][ T5839] ret_from_fork_asm+0x1a/0x30
[ 88.836423][ T5839]
[ 88.838748][ T5839] Memory state around the buggy address:
[ 88.844377][ T5839] ffff888053761a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 88.852879][ T5839] ffff888053761a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 88.860960][ T5839] >ffff888053761b00: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 88.869199][ T5839] ^
[ 88.877193][ T5839] ffff888053761b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 88.885343][ T5839] ffff888053761c00: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[ 88.893455][ T5839] ==================================================================
[ 88.905976][ T5839] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 88.913241][ T5839] CPU: 0 UID: 0 PID: 5839 Comm: kworker/u9:6 Not tainted syzkaller #0 PREEMPT(full)
[ 88.922726][ T5839] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 88.932896][ T5839] Workqueue: hci3 hci_cmd_work
[ 88.937707][ T5839] Call Trace:
[ 88.941014][ T5839]
[ 88.943974][ T5839] dump_stack_lvl+0x99/0x250
[ 88.948606][ T5839] ? __asan_memcpy+0x40/0x70
[ 88.953229][ T5839] ? __pfx_dump_stack_lvl+0x10/0x10
[ 88.958516][ T5839] ? __pfx__printk+0x10/0x10
[ 88.963148][ T5839] vpanic+0x237/0x6d0
[ 88.967163][ T5839] ? __pfx_vpanic+0x10/0x10
[ 88.971697][ T5839] ? preempt_schedule+0xae/0xc0
[ 88.976663][ T5839] ? __pfx_preempt_schedule+0x10/0x10
[ 88.982074][ T5839] panic+0xb9/0xc0
[ 88.985859][ T5839] ? __pfx_panic+0x10/0x10
[ 88.990308][ T5839] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 88.996243][ T5839] ? is_module_address+0x17/0xf0
[ 89.001225][ T5839] ? hci_cmd_work+0x5d0/0x7b0
[ 89.005939][ T5839] check_panic_on_warn+0x89/0xb0
[ 89.010919][ T5839] ? hci_cmd_work+0x5d0/0x7b0
[ 89.015639][ T5839] end_report+0x6f/0x160
[ 89.019927][ T5839] kasan_report+0x129/0x150
[ 89.024475][ T5839] ? hci_cmd_work+0x5d0/0x7b0
[ 89.029204][ T5839] hci_cmd_work+0x5d0/0x7b0
[ 89.033746][ T5839] ? process_one_work+0x868/0x15e0
[ 89.038907][ T5839] process_one_work+0x93a/0x15e0
[ 89.043885][ T5839] ? __lock_acquire+0xab9/0xd20
[ 89.048787][ T5839] ? __pfx_process_one_work+0x10/0x10
[ 89.054210][ T5839] ? assign_work+0x3a1/0x410
[ 89.058839][ T5839] worker_thread+0x9b0/0xee0
[ 89.063477][ T5839] kthread+0x711/0x8a0
[ 89.067664][ T5839] ? __pfx_worker_thread+0x10/0x10
[ 89.072816][ T5839] ? __pfx_kthread+0x10/0x10
[ 89.077435][ T5839] ? _raw_spin_unlock_irq+0x23/0x50
[ 89.082668][ T5839] ? lockdep_hardirqs_on+0x9c/0x150
[ 89.087901][ T5839] ? __pfx_kthread+0x10/0x10
[ 89.092530][ T5839] ret_from_fork+0x599/0xb30
[ 89.097155][ T5839] ? __pfx_ret_from_fork+0x10/0x10
[ 89.102312][ T5839] ? __switch_to_asm+0x39/0x70
[ 89.107101][ T5839] ? __switch_to_asm+0x33/0x70
[ 89.111878][ T5839] ? __pfx_kthread+0x10/0x10
[ 89.116479][ T5839] ret_from_fork_asm+0x1a/0x30
[ 89.121258][ T5839]
[ 89.124458][ T5839] Kernel Offset: disabled
[ 89.128792][ T5839] Rebooting in 86400 seconds..