last executing test programs:
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.1.53' (ED25519) to the list of known hosts.
[ 70.559586][ T5808] cgroup: Unknown subsys name 'net'
[ 70.666163][ T5808] cgroup: Unknown subsys name 'cpuset'
[ 70.675682][ T5808] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 71.301356][ T1299] ieee802154 phy0 wpan0: encryption failed: -22
[ 71.307889][ T1299] ieee802154 phy1 wpan1: encryption failed: -22
[ 72.169611][ T5808] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 74.097439][ T52] ==================================================================
[ 74.105542][ T52] BUG: KASAN: slab-use-after-free in hci_cmd_work+0x5d0/0x7b0
[ 74.113024][ T52] Read of size 2 at addr ffff88806526fdf8 by task kworker/u9:0/52
[ 74.120828][ T52]
[ 74.123173][ T52] CPU: 0 UID: 0 PID: 52 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT(full)
[ 74.123193][ T52] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 74.123204][ T52] Workqueue: hci0 hci_cmd_work
[ 74.123236][ T52] Call Trace:
[ 74.123243][ T52]
[ 74.123250][ T52] dump_stack_lvl+0x189/0x250
[ 74.123274][ T52] ? __virt_addr_valid+0x1c8/0x5c0
[ 74.123291][ T52] ? rcu_is_watching+0x15/0xb0
[ 74.123307][ T52] ? __pfx_dump_stack_lvl+0x10/0x10
[ 74.123328][ T52] ? rcu_is_watching+0x15/0xb0
[ 74.123342][ T52] ? lock_release+0x4b/0x3d0
[ 74.123361][ T52] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 74.123380][ T52] ? __virt_addr_valid+0x1c8/0x5c0
[ 74.123396][ T52] ? __virt_addr_valid+0x4a5/0x5c0
[ 74.123413][ T52] print_report+0xca/0x240
[ 74.123433][ T52] ? hci_cmd_work+0x5d0/0x7b0
[ 74.123451][ T52] kasan_report+0x118/0x150
[ 74.123471][ T52] ? hci_cmd_work+0x5d0/0x7b0
[ 74.123493][ T52] hci_cmd_work+0x5d0/0x7b0
[ 74.123513][ T52] ? process_one_work+0x868/0x15e0
[ 74.123532][ T52] process_one_work+0x93a/0x15e0
[ 74.123550][ T52] ? __lock_acquire+0xab9/0xd20
[ 74.123583][ T52] ? __pfx_process_one_work+0x10/0x10
[ 74.123606][ T52] ? assign_work+0x3a1/0x410
[ 74.123626][ T52] worker_thread+0x9b0/0xee0
[ 74.123657][ T52] kthread+0x711/0x8a0
[ 74.123674][ T52] ? __pfx_worker_thread+0x10/0x10
[ 74.123693][ T52] ? __pfx_kthread+0x10/0x10
[ 74.123708][ T52] ? _raw_spin_unlock_irq+0x23/0x50
[ 74.123724][ T52] ? lockdep_hardirqs_on+0x9c/0x150
[ 74.123742][ T52] ? __pfx_kthread+0x10/0x10
[ 74.123756][ T52] ret_from_fork+0x599/0xb30
[ 74.123775][ T52] ? __pfx_ret_from_fork+0x10/0x10
[ 74.123796][ T52] ? __switch_to_asm+0x39/0x70
[ 74.123811][ T52] ? __switch_to_asm+0x33/0x70
[ 74.123824][ T52] ? __pfx_kthread+0x10/0x10
[ 74.123838][ T52] ret_from_fork_asm+0x1a/0x30
[ 74.123859][ T52]
[ 74.123864][ T52]
[ 74.312664][ T52] Allocated by task 5145:
[ 74.316973][ T52] kasan_save_track+0x3e/0x80
[ 74.321634][ T52] __kasan_slab_alloc+0x6c/0x80
[ 74.326462][ T52] kmem_cache_alloc_node_noprof+0x43c/0x710
[ 74.332335][ T52] __alloc_skb+0x112/0x2d0
[ 74.336735][ T52] hci_cmd_sync_alloc+0x3d/0x3b0
[ 74.341653][ T52] __hci_cmd_sync_sk+0x1a7/0xc70
[ 74.346567][ T52] hci_reset_sync+0x4a/0x140
[ 74.351134][ T52] hci_dev_open_sync+0xec5/0x2dc0
[ 74.356138][ T52] hci_power_on+0x1b4/0x720
[ 74.360626][ T52] process_one_work+0x93a/0x15e0
[ 74.365550][ T52] worker_thread+0x9b0/0xee0
[ 74.370127][ T52] kthread+0x711/0x8a0
[ 74.374174][ T52] ret_from_fork+0x599/0xb30
[ 74.378747][ T52] ret_from_fork_asm+0x1a/0x30
[ 74.383491][ T52]
[ 74.385794][ T52] Freed by task 5820:
[ 74.389751][ T52] kasan_save_track+0x3e/0x80
[ 74.394408][ T52] kasan_save_free_info+0x46/0x50
[ 74.399413][ T52] __kasan_slab_free+0x5c/0x80
[ 74.404157][ T52] kmem_cache_free+0x197/0x640
[ 74.408900][ T52] vhci_read+0x49a/0x5b0
[ 74.413126][ T52] vfs_read+0x200/0xa30
[ 74.417259][ T52] ksys_read+0x145/0x250
[ 74.421487][ T52] do_syscall_64+0xfa/0xfa0
[ 74.425973][ T52] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 74.431930][ T52]
[ 74.434232][ T52] The buggy address belongs to the object at ffff88806526fdc0
[ 74.434232][ T52] which belongs to the cache skbuff_head_cache of size 240
[ 74.448789][ T52] The buggy address is located 56 bytes inside of
[ 74.448789][ T52] freed 240-byte region [ffff88806526fdc0, ffff88806526feb0)
[ 74.462477][ T52]
[ 74.464785][ T52] The buggy address belongs to the physical page:
[ 74.471180][ T52] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6526f
[ 74.479923][ T52] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 74.487012][ T52] page_type: f5(slab)
[ 74.490974][ T52] raw: 00fff00000000000 ffff88801decda00 dead000000000122 0000000000000000
[ 74.499539][ T52] raw: 0000000000000000 00000000000c000c 00000000f5000000 0000000000000000
[ 74.508097][ T52] page dumped because: kasan: bad access detected
[ 74.514492][ T52] page_owner tracks the page as allocated
[ 74.520181][ T52] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 15, tgid 15 (ksoftirqd/0), ts 73968998545, free_ts 20701204840
[ 74.538995][ T52] post_alloc_hook+0x240/0x2a0
[ 74.543742][ T52] get_page_from_freelist+0x2365/0x2440
[ 74.549270][ T52] __alloc_frozen_pages_noprof+0x181/0x370
[ 74.555056][ T52] alloc_pages_mpol+0x232/0x4a0
[ 74.559889][ T52] allocate_slab+0x86/0x3b0
[ 74.564375][ T52] ___slab_alloc+0xf56/0x1990
[ 74.569033][ T52] __slab_alloc+0x65/0x100
[ 74.573430][ T52] kmem_cache_alloc_node_noprof+0x4ce/0x710
[ 74.579300][ T52] __alloc_skb+0x112/0x2d0
[ 74.583698][ T52] __tcp_send_ack+0xae/0x4f0
[ 74.588268][ T52] tcp_rcv_established+0x13f0/0x2680
[ 74.593538][ T52] tcp_v4_do_rcv+0xa90/0x1430
[ 74.598196][ T52] tcp_v4_rcv+0x2675/0x2f20
[ 74.602681][ T52] ip_protocol_deliver_rcu+0x221/0x440
[ 74.608125][ T52] ip_local_deliver_finish+0x3bb/0x6f0
[ 74.613567][ T52] NF_HOOK+0x30c/0x3a0
[ 74.617617][ T52] page last free pid 1 tgid 1 stack trace:
[ 74.623396][ T52] __free_frozen_pages+0xbc8/0xd30
[ 74.628488][ T52] free_contig_range+0x1bd/0x4a0
[ 74.633408][ T52] destroy_args+0x69/0x660
[ 74.637804][ T52] debug_vm_pgtable+0x38f/0x3a0
[ 74.642634][ T52] do_one_initcall+0x1fb/0x870
[ 74.647375][ T52] do_initcall_level+0x104/0x190
[ 74.652296][ T52] do_initcalls+0x59/0xa0
[ 74.656606][ T52] kernel_init_freeable+0x334/0x4b0
[ 74.661790][ T52] kernel_init+0x1d/0x1d0
[ 74.666101][ T52] ret_from_fork+0x599/0xb30
[ 74.670672][ T52] ret_from_fork_asm+0x1a/0x30
[ 74.675413][ T52]
[ 74.677716][ T52] Memory state around the buggy address:
[ 74.683323][ T52] ffff88806526fc80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 74.691362][ T52] ffff88806526fd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 74.699401][ T52] >ffff88806526fd80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 74.707437][ T52] ^
[ 74.715390][ T52] ffff88806526fe00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 74.723427][ T52] ffff88806526fe80: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[ 74.731462][ T52] ==================================================================
[ 74.740815][ T52] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 74.748027][ T52] CPU: 0 UID: 0 PID: 52 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT(full)
[ 74.757309][ T52] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 74.767363][ T52] Workqueue: hci0 hci_cmd_work
[ 74.772137][ T52] Call Trace:
[ 74.775414][ T52]
[ 74.778342][ T52] dump_stack_lvl+0x99/0x250
[ 74.782935][ T52] ? __asan_memcpy+0x40/0x70
[ 74.787513][ T52] ? __pfx_dump_stack_lvl+0x10/0x10
[ 74.792694][ T52] ? __pfx__printk+0x10/0x10
[ 74.797271][ T52] vpanic+0x237/0x6d0
[ 74.801235][ T52] ? __pfx_vpanic+0x10/0x10
[ 74.805716][ T52] ? preempt_schedule+0xae/0xc0
[ 74.810549][ T52] ? __pfx_preempt_schedule+0x10/0x10
[ 74.815902][ T52] panic+0xb9/0xc0
[ 74.819600][ T52] ? __pfx_panic+0x10/0x10
[ 74.823995][ T52] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 74.829870][ T52] ? is_module_address+0x17/0xf0
[ 74.834787][ T52] ? hci_cmd_work+0x5d0/0x7b0
[ 74.839448][ T52] check_panic_on_warn+0x89/0xb0
[ 74.844370][ T52] ? hci_cmd_work+0x5d0/0x7b0
[ 74.849028][ T52] end_report+0x6f/0x160
[ 74.853254][ T52] kasan_report+0x129/0x150
[ 74.857743][ T52] ? hci_cmd_work+0x5d0/0x7b0
[ 74.862405][ T52] hci_cmd_work+0x5d0/0x7b0
[ 74.866892][ T52] ? process_one_work+0x868/0x15e0
[ 74.871984][ T52] process_one_work+0x93a/0x15e0
[ 74.876902][ T52] ? __lock_acquire+0xab9/0xd20
[ 74.881745][ T52] ? __pfx_process_one_work+0x10/0x10
[ 74.887103][ T52] ? assign_work+0x3a1/0x410
[ 74.891680][ T52] worker_thread+0x9b0/0xee0
[ 74.896260][ T52] kthread+0x711/0x8a0
[ 74.900311][ T52] ? __pfx_worker_thread+0x10/0x10
[ 74.905404][ T52] ? __pfx_kthread+0x10/0x10
[ 74.909973][ T52] ? _raw_spin_unlock_irq+0x23/0x50
[ 74.915153][ T52] ? lockdep_hardirqs_on+0x9c/0x150
[ 74.920330][ T52] ? __pfx_kthread+0x10/0x10
[ 74.924901][ T52] ret_from_fork+0x599/0xb30
[ 74.929475][ T52] ? __pfx_ret_from_fork+0x10/0x10
[ 74.934575][ T52] ? __switch_to_asm+0x39/0x70
[ 74.939321][ T52] ? __switch_to_asm+0x33/0x70
[ 74.944061][ T52] ? __pfx_kthread+0x10/0x10
[ 74.948631][ T52] ret_from_fork_asm+0x1a/0x30
[ 74.953379][ T52]
[ 74.956716][ T52] Kernel Offset: disabled
[ 74.961025][ T52] Rebooting in 86400 seconds..