last executing test programs:
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.0.133' (ED25519) to the list of known hosts.
[ 81.826252][ T5815] cgroup: Unknown subsys name 'net'
[ 81.973313][ T5815] cgroup: Unknown subsys name 'cpuset'
[ 81.982271][ T5815] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 83.445231][ T5815] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 86.584303][ T5832] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 86.601635][ T5841] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 86.609757][ T5832] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[ 86.614404][ T5841] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 86.626151][ T5832] ==================================================================
[ 86.627189][ T5841] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 86.635956][ T5832] BUG: KASAN: slab-use-after-free in hci_cmd_work+0x5d0/0x7b0
[ 86.635993][ T5832] Read of size 2 at addr ffff8880605a8538 by task kworker/u9:2/5832
[ 86.636005][ T5832]
[ 86.636036][ T5832] CPU: 0 UID: 0 PID: 5832 Comm: kworker/u9:2 Not tainted syzkaller #0 PREEMPT(full)
[ 86.636051][ T5832] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 86.636061][ T5832] Workqueue: hci2 hci_cmd_work
[ 86.636088][ T5832] Call Trace:
[ 86.636099][ T5832]
[ 86.636106][ T5832] dump_stack_lvl+0x189/0x250
[ 86.636123][ T5832] ? __virt_addr_valid+0x1c8/0x5c0
[ 86.636141][ T5832] ? rcu_is_watching+0x15/0xb0
[ 86.636157][ T5832] ? __pfx_dump_stack_lvl+0x10/0x10
[ 86.636172][ T5832] ? rcu_is_watching+0x15/0xb0
[ 86.636186][ T5832] ? lock_release+0x4b/0x3d0
[ 86.636199][ T5832] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 86.636216][ T5832] ? __virt_addr_valid+0x1c8/0x5c0
[ 86.636232][ T5832] ? __virt_addr_valid+0x4a5/0x5c0
[ 86.636250][ T5832] print_report+0xca/0x240
[ 86.636267][ T5832] ? hci_cmd_work+0x5d0/0x7b0
[ 86.636285][ T5832] kasan_report+0x118/0x150
[ 86.636301][ T5832] ? hci_cmd_work+0x5d0/0x7b0
[ 86.636371][ T5832] hci_cmd_work+0x5d0/0x7b0
[ 86.636390][ T5832] ? process_one_work+0x868/0x15e0
[ 86.636404][ T5832] process_one_work+0x93a/0x15e0
[ 86.636417][ T5832] ? __lock_acquire+0xab9/0xd20
[ 86.636439][ T5832] ? __pfx_process_one_work+0x10/0x10
[ 86.636457][ T5832] ? assign_work+0x3a1/0x410
[ 86.636473][ T5832] worker_thread+0x9b0/0xee0
[ 86.636497][ T5832] kthread+0x711/0x8a0
[ 86.636516][ T5832] ? __pfx_worker_thread+0x10/0x10
[ 86.636532][ T5832] ? __pfx_kthread+0x10/0x10
[ 86.636550][ T5832] ? _raw_spin_unlock_irq+0x23/0x50
[ 86.636568][ T5832] ? lockdep_hardirqs_on+0x9c/0x150
[ 86.636585][ T5832] ? __pfx_kthread+0x10/0x10
[ 86.636602][ T5832] ret_from_fork+0x599/0xb30
[ 86.636618][ T5832] ? __pfx_ret_from_fork+0x10/0x10
[ 86.636634][ T5832] ? __switch_to_asm+0x39/0x70
[ 86.636652][ T5832] ? __switch_to_asm+0x33/0x70
[ 86.636669][ T5832] ? __pfx_kthread+0x10/0x10
[ 86.636689][ T5832] ret_from_fork_asm+0x1a/0x30
[ 86.636715][ T5832]
[ 86.636721][ T5832]
[ 86.670222][ T5844] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 86.673454][ T5832] Allocated by task 5839:
[ 86.685888][ T5844] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 86.689572][ T5832] kasan_save_track+0x3e/0x80
[ 86.689599][ T5832] __kasan_slab_alloc+0x6c/0x80
[ 86.689611][ T5832] kmem_cache_alloc_node_noprof+0x43c/0x710
[ 86.689630][ T5832] __alloc_skb+0x112/0x2d0
[ 86.689642][ T5832] hci_cmd_sync_alloc+0x3d/0x3b0
[ 86.689661][ T5832] __hci_cmd_sync_sk+0x1a7/0xc70
[ 86.689678][ T5832] hci_dev_open_sync+0x14b2/0x2dc0
[ 86.689694][ T5832] hci_power_on+0x1b4/0x720
[ 86.689706][ T5832] process_one_work+0x93a/0x15e0
[ 86.689720][ T5832] worker_thread+0x9b0/0xee0
[ 86.689736][ T5832] kthread+0x711/0x8a0
[ 86.689751][ T5832] ret_from_fork+0x599/0xb30
[ 86.689764][ T5832] ret_from_fork_asm+0x1a/0x30
[ 86.689781][ T5832]
[ 86.689785][ T5832] Freed by task 5838:
[ 86.689792][ T5832] kasan_save_track+0x3e/0x80
[ 86.689803][ T5832] kasan_save_free_info+0x46/0x50
[ 86.689818][ T5832] __kasan_slab_free+0x5c/0x80
[ 86.689829][ T5832] kmem_cache_free+0x197/0x640
[ 86.689839][ T5832] vhci_read+0x49a/0x5b0
[ 86.689855][ T5832] vfs_read+0x200/0xa30
[ 86.689864][ T5832] ksys_read+0x145/0x250
[ 86.689873][ T5832] do_syscall_64+0xfa/0xfa0
[ 86.689889][ T5832] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.689900][ T5832]
[ 86.689903][ T5832] The buggy address belongs to the object at ffff8880605a8500
[ 86.689903][ T5832] which belongs to the cache skbuff_head_cache of size 240
[ 86.689914][ T5832] The buggy address is located 56 bytes inside of
[ 86.689914][ T5832] freed 240-byte region [ffff8880605a8500, ffff8880605a85f0)
[ 86.689926][ T5832]
[ 86.689931][ T5832] The buggy address belongs to the physical page:
[ 86.689958][ T5832] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x605a8
[ 86.689972][ T5832] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 86.689987][ T5832] page_type: f5(slab)
[ 86.689999][ T5832] raw: 00fff00000000000 ffff88801eeac8c0 dead000000000122 0000000000000000
[ 86.690009][ T5832] raw: 0000000000000000 00000000000c000c 00000000f5000000 0000000000000000
[ 86.690016][ T5832] page dumped because: kasan: bad access detected
[ 86.690026][ T5832] page_owner tracks the page as allocated
[ 86.690031][ T5832] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5842, tgid 5842 (udevd), ts 86613377488, free_ts 27864146050
[ 86.690052][ T5832] post_alloc_hook+0x240/0x2a0
[ 86.690069][ T5832] get_page_from_freelist+0x2365/0x2440
[ 86.690082][ T5832] __alloc_frozen_pages_noprof+0x181/0x370
[ 86.690095][ T5832] alloc_pages_mpol+0x232/0x4a0
[ 86.690108][ T5832] allocate_slab+0x86/0x3b0
[ 86.690122][ T5832] ___slab_alloc+0xf56/0x1990
[ 86.690133][ T5832] __slab_alloc+0x65/0x100
[ 86.690145][ T5832] kmem_cache_alloc_node_noprof+0x4ce/0x710
[ 86.690161][ T5832] __alloc_skb+0x112/0x2d0
[ 86.690172][ T5832] alloc_skb_with_frags+0xca/0x890
[ 86.690186][ T5832] sock_alloc_send_pskb+0x84d/0x980
[ 86.690201][ T5832] unix_dgram_sendmsg+0x461/0x1850
[ 86.690214][ T5832] __sock_sendmsg+0x21c/0x270
[ 86.690231][ T5832] sock_write_iter+0x279/0x360
[ 86.690248][ T5832] vfs_write+0x5c9/0xb30
[ 86.690259][ T5832] ksys_write+0x145/0x250
[ 86.690271][ T5832] page last free pid 1 tgid 1 stack trace:
[ 86.690279][ T5832] __free_frozen_pages+0xbc8/0xd30
[ 86.690290][ T5832] free_contig_range+0x1bd/0x4a0
[ 86.690306][ T5832] destroy_args+0x69/0x660
[ 86.690332][ T5832] debug_vm_pgtable+0x38f/0x3a0
[ 86.690344][ T5832] do_one_initcall+0x1fb/0x870
[ 86.690359][ T5832] do_initcall_level+0x104/0x190
[ 86.690373][ T5832] do_initcalls+0x59/0xa0
[ 86.690387][ T5832] kernel_init_freeable+0x334/0x4b0
[ 86.695234][ T5844] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 86.696965][ T5832] kernel_init+0x1d/0x1d0
[ 87.253203][ T5832] ret_from_fork+0x599/0xb30
[ 87.258432][ T5832] ret_from_fork_asm+0x1a/0x30
[ 87.263298][ T5832]
[ 87.265619][ T5832] Memory state around the buggy address:
[ 87.271323][ T5832] ffff8880605a8400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 87.279718][ T5832] ffff8880605a8480: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[ 87.287869][ T5832] >ffff8880605a8500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 87.296088][ T5832] ^
[ 87.301960][ T5832] ffff8880605a8580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 87.310014][ T5832] ffff8880605a8600: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 87.318166][ T5832] ==================================================================
[ 87.328768][ T5832] Kernel panic - not syncing: KASAN: panic_on_warn set ...
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[ 87.336018][ T5832] CPU: 0 UID: 0 PID: 5832 Comm: kworker/u9:2 Not tainted syzkaller #0 PREEMPT(full)
[ 87.346299][ T5832] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 87.356987][ T5832] Workqueue: hci2 hci_cmd_work
[ 87.362049][ T5832] Call Trace:
[ 87.365536][ T5832]
[ 87.368561][ T5832] dump_stack_lvl+0x99/0x250
[ 87.373870][ T5832] ? __asan_memcpy+0x40/0x70
[ 87.378830][ T5832] ? __pfx_dump_stack_lvl+0x10/0x10
[ 87.384059][ T5832] ? __pfx__printk+0x10/0x10
[ 87.388656][ T5832] vpanic+0x237/0x6d0
[ 87.392718][ T5832] ? __pfx_vpanic+0x10/0x10
[ 87.397390][ T5832] ? preempt_schedule+0xae/0xc0
[ 87.402276][ T5832] ? __pfx_preempt_schedule+0x10/0x10
[ 87.407832][ T5832] panic+0xb9/0xc0
[ 87.411733][ T5832] ? __pfx_panic+0x10/0x10
[ 87.416393][ T5832] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 87.422470][ T5832] ? is_module_address+0x17/0xf0
[ 87.427611][ T5832] ? hci_cmd_work+0x5d0/0x7b0
[ 87.432397][ T5832] check_panic_on_warn+0x89/0xb0
[ 87.438758][ T5832] ? hci_cmd_work+0x5d0/0x7b0
[ 87.443444][ T5832] end_report+0x6f/0x160
[ 87.449694][ T5832] kasan_report+0x129/0x150
[ 87.454838][ T5832] ? hci_cmd_work+0x5d0/0x7b0
[ 87.459522][ T5832] hci_cmd_work+0x5d0/0x7b0
[ 87.464065][ T5832] ? process_one_work+0x868/0x15e0
[ 87.469258][ T5832] process_one_work+0x93a/0x15e0
[ 87.474289][ T5832] ? __lock_acquire+0xab9/0xd20
[ 87.479248][ T5832] ? __pfx_process_one_work+0x10/0x10
[ 87.484629][ T5832] ? assign_work+0x3a1/0x410
[ 87.489230][ T5832] worker_thread+0x9b0/0xee0
[ 87.494192][ T5832] kthread+0x711/0x8a0
[ 87.498310][ T5832] ? __pfx_worker_thread+0x10/0x10
[ 87.503410][ T5832] ? __pfx_kthread+0x10/0x10
[ 87.507991][ T5832] ? _raw_spin_unlock_irq+0x23/0x50
[ 87.513546][ T5832] ? lockdep_hardirqs_on+0x9c/0x150
[ 87.518765][ T5832] ? __pfx_kthread+0x10/0x10
[ 87.523383][ T5832] ret_from_fork+0x599/0xb30
[ 87.527991][ T5832] ? __pfx_ret_from_fork+0x10/0x10
[ 87.533122][ T5832] ? __switch_to_asm+0x39/0x70
[ 87.537893][ T5832] ? __switch_to_asm+0x33/0x70
[ 87.543199][ T5832] ? __pfx_kthread+0x10/0x10
[ 87.547803][ T5832] ret_from_fork_asm+0x1a/0x30
[ 87.552811][ T5832]
[ 87.556669][ T5832] Kernel Offset: disabled
[ 87.560997][ T5832] Rebooting in 86400 seconds..