last executing test programs:
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.1.157' (ED25519) to the list of known hosts.
[ 83.809774][ T5818] cgroup: Unknown subsys name 'net'
[ 83.922297][ T5818] cgroup: Unknown subsys name 'cpuset'
[ 83.932303][ T5818] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 85.598389][ T5818] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 89.301935][ T5152] ==================================================================
[ 89.310056][ T5152] BUG: KASAN: slab-use-after-free in hci_cmd_work+0x5d0/0x7b0
[ 89.317539][ T5152] Read of size 2 at addr ffff8880731a2a38 by task kworker/u9:1/5152
[ 89.325522][ T5152]
[ 89.327868][ T5152] CPU: 1 UID: 0 PID: 5152 Comm: kworker/u9:1 Not tainted syzkaller #0 PREEMPT(full)
[ 89.327885][ T5152] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 89.327896][ T5152] Workqueue: hci0 hci_cmd_work
[ 89.327928][ T5152] Call Trace:
[ 89.327939][ T5152]
[ 89.327945][ T5152] dump_stack_lvl+0x189/0x250
[ 89.327965][ T5152] ? __virt_addr_valid+0x1c8/0x5c0
[ 89.327986][ T5152] ? rcu_is_watching+0x15/0xb0
[ 89.328005][ T5152] ? __pfx_dump_stack_lvl+0x10/0x10
[ 89.328023][ T5152] ? rcu_is_watching+0x15/0xb0
[ 89.328041][ T5152] ? lock_release+0x4b/0x3d0
[ 89.328059][ T5152] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 89.328085][ T5152] ? __virt_addr_valid+0x1c8/0x5c0
[ 89.328111][ T5152] ? __virt_addr_valid+0x4a5/0x5c0
[ 89.328139][ T5152] print_report+0xca/0x240
[ 89.328166][ T5152] ? hci_cmd_work+0x5d0/0x7b0
[ 89.328194][ T5152] kasan_report+0x118/0x150
[ 89.328216][ T5152] ? hci_cmd_work+0x5d0/0x7b0
[ 89.328249][ T5152] hci_cmd_work+0x5d0/0x7b0
[ 89.328281][ T5152] ? process_one_work+0x868/0x15e0
[ 89.328300][ T5152] process_one_work+0x93a/0x15e0
[ 89.328321][ T5152] ? __lock_acquire+0xab9/0xd20
[ 89.328349][ T5152] ? __pfx_process_one_work+0x10/0x10
[ 89.328371][ T5152] ? assign_work+0x3a1/0x410
[ 89.328390][ T5152] worker_thread+0x9b0/0xee0
[ 89.328421][ T5152] kthread+0x711/0x8a0
[ 89.328449][ T5152] ? __pfx_worker_thread+0x10/0x10
[ 89.328469][ T5152] ? __pfx_kthread+0x10/0x10
[ 89.328495][ T5152] ? _raw_spin_unlock_irq+0x23/0x50
[ 89.328539][ T5152] ? lockdep_hardirqs_on+0x9c/0x150
[ 89.328566][ T5152] ? __pfx_kthread+0x10/0x10
[ 89.328592][ T5152] ret_from_fork+0x599/0xb30
[ 89.328622][ T5152] ? __pfx_ret_from_fork+0x10/0x10
[ 89.328647][ T5152] ? __switch_to_asm+0x39/0x70
[ 89.328674][ T5152] ? __switch_to_asm+0x33/0x70
[ 89.328701][ T5152] ? __pfx_kthread+0x10/0x10
[ 89.328727][ T5152] ret_from_fork_asm+0x1a/0x30
[ 89.328764][ T5152]
[ 89.328771][ T5152]
[ 89.519560][ T5152] Allocated by task 52:
[ 89.523721][ T5152] kasan_save_track+0x3e/0x80
[ 89.528407][ T5152] __kasan_slab_alloc+0x6c/0x80
[ 89.533262][ T5152] kmem_cache_alloc_node_noprof+0x43c/0x710
[ 89.539164][ T5152] __alloc_skb+0x112/0x2d0
[ 89.543581][ T5152] hci_cmd_sync_alloc+0x3d/0x3b0
[ 89.548537][ T5152] __hci_cmd_sync_sk+0x1a7/0xc70
[ 89.553491][ T5152] hci_reset_sync+0x4a/0x140
[ 89.558088][ T5152] hci_dev_open_sync+0xec5/0x2dc0
[ 89.563116][ T5152] hci_power_on+0x1b4/0x720
[ 89.567626][ T5152] process_one_work+0x93a/0x15e0
[ 89.572565][ T5152] worker_thread+0x9b0/0xee0
[ 89.577160][ T5152] kthread+0x711/0x8a0
[ 89.581236][ T5152] ret_from_fork+0x599/0xb30
[ 89.585827][ T5152] ret_from_fork_asm+0x1a/0x30
[ 89.590607][ T5152]
[ 89.592931][ T5152] Freed by task 5829:
[ 89.596906][ T5152] kasan_save_track+0x3e/0x80
[ 89.601590][ T5152] kasan_save_free_info+0x46/0x50
[ 89.606623][ T5152] __kasan_slab_free+0x5c/0x80
[ 89.611388][ T5152] kmem_cache_free+0x197/0x640
[ 89.616151][ T5152] vhci_read+0x49a/0x5b0
[ 89.620405][ T5152] vfs_read+0x200/0xa30
[ 89.624562][ T5152] ksys_read+0x145/0x250
[ 89.628805][ T5152] do_syscall_64+0xfa/0xfa0
[ 89.633341][ T5152] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 89.639234][ T5152]
[ 89.641571][ T5152] The buggy address belongs to the object at ffff8880731a2a00
[ 89.641571][ T5152] which belongs to the cache skbuff_head_cache of size 240
[ 89.656148][ T5152] The buggy address is located 56 bytes inside of
[ 89.656148][ T5152] freed 240-byte region [ffff8880731a2a00, ffff8880731a2af0)
[ 89.669869][ T5152]
[ 89.672200][ T5152] The buggy address belongs to the physical page:
[ 89.678619][ T5152] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x731a2
[ 89.687380][ T5152] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 89.694493][ T5152] page_type: f5(slab)
[ 89.698477][ T5152] raw: 00fff00000000000 ffff888140ab98c0 dead000000000122 0000000000000000
[ 89.707064][ T5152] raw: 0000000000000000 00000000000c000c 00000000f5000000 0000000000000000
[ 89.715640][ T5152] page dumped because: kasan: bad access detected
[ 89.722070][ T5152] page_owner tracks the page as allocated
[ 89.727782][ T5152] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5827, tgid 5827 (dhcpcd), ts 89278835862, free_ts 84067302463
[ 89.746538][ T5152] post_alloc_hook+0x240/0x2a0
[ 89.751335][ T5152] get_page_from_freelist+0x2365/0x2440
[ 89.756884][ T5152] __alloc_frozen_pages_noprof+0x181/0x370
[ 89.762810][ T5152] alloc_pages_mpol+0x232/0x4a0
[ 89.767680][ T5152] allocate_slab+0x86/0x3b0
[ 89.772195][ T5152] ___slab_alloc+0xf56/0x1990
[ 89.776878][ T5152] __slab_alloc+0x65/0x100
[ 89.781300][ T5152] kmem_cache_alloc_node_noprof+0x4ce/0x710
[ 89.787206][ T5152] __alloc_skb+0x112/0x2d0
[ 89.791624][ T5152] alloc_skb_with_frags+0xca/0x890
[ 89.796775][ T5152] sock_alloc_send_pskb+0x84d/0x980
[ 89.801981][ T5152] unix_dgram_sendmsg+0x461/0x1850
[ 89.807100][ T5152] __sock_sendmsg+0x21c/0x270
[ 89.811802][ T5152] sock_write_iter+0x279/0x360
[ 89.816583][ T5152] vfs_write+0x5c9/0xb30
[ 89.820917][ T5152] ksys_write+0x145/0x250
[ 89.825246][ T5152] page last free pid 5818 tgid 5818 stack trace:
[ 89.831581][ T5152] __free_frozen_pages+0xbc8/0xd30
[ 89.836691][ T5152] vfree+0x25a/0x400
[ 89.840619][ T5152] kcov_close+0x28/0x50
[ 89.844784][ T5152] __fput+0x44c/0xa70
[ 89.848775][ T5152] fput_close_sync+0x113/0x220
[ 89.853547][ T5152] __x64_sys_close+0x7f/0x110
[ 89.858234][ T5152] do_syscall_64+0xfa/0xfa0
[ 89.862755][ T5152] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 89.868673][ T5152]
[ 89.871010][ T5152] Memory state around the buggy address:
[ 89.876669][ T5152] ffff8880731a2900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 89.884847][ T5152] ffff8880731a2980: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[ 89.892921][ T5152] >ffff8880731a2a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 89.901001][ T5152] ^
[ 89.907066][ T5152] ffff8880731a2a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 89.915128][ T5152] ffff8880731a2b00: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 89.923276][ T5152] ==================================================================
[ 89.932336][ T5152] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 89.939589][ T5152] CPU: 1 UID: 0 PID: 5152 Comm: kworker/u9:1 Not tainted syzkaller #0 PREEMPT(full)
[ 89.949109][ T5152] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 89.959282][ T5152] Workqueue: hci0 hci_cmd_work
[ 89.964077][ T5152] Call Trace:
[ 89.967359][ T5152]
[ 89.970295][ T5152] dump_stack_lvl+0x99/0x250
[ 89.974901][ T5152] ? __asan_memcpy+0x40/0x70
[ 89.979506][ T5152] ? __pfx_dump_stack_lvl+0x10/0x10
[ 89.984804][ T5152] ? __pfx__printk+0x10/0x10
[ 89.989414][ T5152] vpanic+0x237/0x6d0
[ 89.993439][ T5152] ? __pfx_vpanic+0x10/0x10
[ 89.997990][ T5152] ? preempt_schedule+0xae/0xc0
[ 90.002870][ T5152] ? __pfx_preempt_schedule+0x10/0x10
[ 90.008264][ T5152] panic+0xb9/0xc0
[ 90.011991][ T5152] ? __pfx_panic+0x10/0x10
[ 90.016415][ T5152] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 90.022324][ T5152] ? is_module_address+0x17/0xf0
[ 90.027270][ T5152] ? hci_cmd_work+0x5d0/0x7b0
[ 90.031962][ T5152] check_panic_on_warn+0x89/0xb0
[ 90.036913][ T5152] ? hci_cmd_work+0x5d0/0x7b0
[ 90.041603][ T5152] end_report+0x6f/0x160
[ 90.045859][ T5152] kasan_report+0x129/0x150
[ 90.050567][ T5152] ? hci_cmd_work+0x5d0/0x7b0
[ 90.055611][ T5152] hci_cmd_work+0x5d0/0x7b0
[ 90.060127][ T5152] ? process_one_work+0x868/0x15e0
[ 90.065246][ T5152] process_one_work+0x93a/0x15e0
[ 90.070184][ T5152] ? __lock_acquire+0xab9/0xd20
[ 90.075066][ T5152] ? __pfx_process_one_work+0x10/0x10
[ 90.080461][ T5152] ? assign_work+0x3a1/0x410
[ 90.085071][ T5152] worker_thread+0x9b0/0xee0
[ 90.089677][ T5152] kthread+0x711/0x8a0
[ 90.093862][ T5152] ? __pfx_worker_thread+0x10/0x10
[ 90.098977][ T5152] ? __pfx_kthread+0x10/0x10
[ 90.103669][ T5152] ? _raw_spin_unlock_irq+0x23/0x50
[ 90.108878][ T5152] ? lockdep_hardirqs_on+0x9c/0x150
[ 90.114105][ T5152] ? __pfx_kthread+0x10/0x10
[ 90.118718][ T5152] ret_from_fork+0x599/0xb30
[ 90.123333][ T5152] ? __pfx_ret_from_fork+0x10/0x10
[ 90.128476][ T5152] ? __switch_to_asm+0x39/0x70
[ 90.133266][ T5152] ? __switch_to_asm+0x33/0x70
[ 90.138057][ T5152] ? __pfx_kthread+0x10/0x10
[ 90.142703][ T5152] ret_from_fork_asm+0x1a/0x30
[ 90.147496][ T5152]
[ 90.151039][ T5152] Kernel Offset: disabled
[ 90.155376][ T5152] Rebooting in 86400 seconds..