last executing test programs:
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.0.151' (ED25519) to the list of known hosts.
[ 67.685453][ T5808] cgroup: Unknown subsys name 'net'
[ 67.852152][ T5808] cgroup: Unknown subsys name 'cpuset'
[ 67.860797][ T5808] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 69.236240][ T5808] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 71.300918][ T5827] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 71.311411][ T5830] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 71.319269][ T5830] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 71.326846][ T5830] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[ 71.340518][ T5831] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[ 71.348399][ T5831] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 71.356656][ T5831] ==================================================================
[ 71.359280][ T5833] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 71.364725][ T5831] BUG: KASAN: slab-use-after-free in hci_cmd_work+0x5d0/0x7b0
[ 71.373792][ T5833] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[ 71.379067][ T5831] Read of size 2 at addr ffff88805b5528f8 by task kworker/u9:5/5831
[ 71.379085][ T5831]
[ 71.379117][ T5831] CPU: 0 UID: 0 PID: 5831 Comm: kworker/u9:5 Not tainted syzkaller #0 PREEMPT(full)
[ 71.379135][ T5831] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 71.379146][ T5831] Workqueue: hci4 hci_cmd_work
[ 71.379178][ T5831] Call Trace:
[ 71.379186][ T5831]
[ 71.379195][ T5831] dump_stack_lvl+0x189/0x250
[ 71.379218][ T5831] ? __virt_addr_valid+0x1c8/0x5c0
[ 71.379235][ T5831] ? rcu_is_watching+0x15/0xb0
[ 71.379250][ T5831] ? __pfx_dump_stack_lvl+0x10/0x10
[ 71.379270][ T5831] ? rcu_is_watching+0x15/0xb0
[ 71.379284][ T5831] ? lock_release+0x4b/0x3d0
[ 71.379302][ T5831] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 71.379320][ T5831] ? __virt_addr_valid+0x1c8/0x5c0
[ 71.379336][ T5831] ? __virt_addr_valid+0x4a5/0x5c0
[ 71.379352][ T5831] print_report+0xca/0x240
[ 71.379372][ T5831] ? hci_cmd_work+0x5d0/0x7b0
[ 71.379390][ T5831] kasan_report+0x118/0x150
[ 71.379409][ T5831] ? hci_cmd_work+0x5d0/0x7b0
[ 71.379430][ T5831] hci_cmd_work+0x5d0/0x7b0
[ 71.379450][ T5831] ? process_one_work+0x868/0x15e0
[ 71.379468][ T5831] process_one_work+0x93a/0x15e0
[ 71.379486][ T5831] ? __lock_acquire+0xab9/0xd20
[ 71.379512][ T5831] ? __pfx_process_one_work+0x10/0x10
[ 71.379534][ T5831] ? assign_work+0x3a1/0x410
[ 71.379555][ T5831] worker_thread+0x9b0/0xee0
[ 71.379590][ T5831] kthread+0x711/0x8a0
[ 71.379606][ T5831] ? __pfx_worker_thread+0x10/0x10
[ 71.379625][ T5831] ? __pfx_kthread+0x10/0x10
[ 71.379640][ T5831] ? _raw_spin_unlock_irq+0x23/0x50
[ 71.379656][ T5831] ? lockdep_hardirqs_on+0x9c/0x150
[ 71.379673][ T5831] ? __pfx_kthread+0x10/0x10
[ 71.379687][ T5831] ret_from_fork+0x599/0xb30
[ 71.379707][ T5831] ? __pfx_ret_from_fork+0x10/0x10
[ 71.379729][ T5831] ? __switch_to_asm+0x39/0x70
[ 71.379744][ T5831] ? __switch_to_asm+0x33/0x70
[ 71.379758][ T5831] ? __pfx_kthread+0x10/0x10
[ 71.379773][ T5831] ret_from_fork_asm+0x1a/0x30
[ 71.379794][ T5831]
[ 71.379801][ T5831]
[ 71.388102][ T5833] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[ 71.394004][ T5831] Allocated by task 5830:
[ 71.394017][ T5831] kasan_save_track+0x3e/0x80
[ 71.394035][ T5831] __kasan_slab_alloc+0x6c/0x80
[ 71.394050][ T5831] kmem_cache_alloc_node_noprof+0x43c/0x710
[ 71.398342][ T5833] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[ 71.405804][ T5831] __alloc_skb+0x112/0x2d0
[ 71.405830][ T5831] hci_cmd_sync_alloc+0x3d/0x3b0
[ 71.405846][ T5831] __hci_cmd_sync_sk+0x1a7/0xc70
[ 71.405859][ T5831] hci_reset_sync+0x4a/0x140
[ 71.405870][ T5831] hci_dev_open_sync+0xec5/0x2dc0
[ 71.405882][ T5831] hci_power_on+0x1b4/0x720
[ 71.405898][ T5831] process_one_work+0x93a/0x15e0
[ 71.405914][ T5831] worker_thread+0x9b0/0xee0
[ 71.405932][ T5831] kthread+0x711/0x8a0
[ 71.405946][ T5831] ret_from_fork+0x599/0xb30
[ 71.405963][ T5831] ret_from_fork_asm+0x1a/0x30
[ 71.405979][ T5831]
[ 71.405984][ T5831] Freed by task 5835:
[ 71.405993][ T5831] kasan_save_track+0x3e/0x80
[ 71.406007][ T5831] kasan_save_free_info+0x46/0x50
[ 71.406026][ T5831] __kasan_slab_free+0x5c/0x80
[ 71.406042][ T5831] kmem_cache_free+0x197/0x640
[ 71.406057][ T5831] vhci_read+0x49a/0x5b0
[ 71.406075][ T5831] vfs_read+0x200/0xa30
[ 71.406089][ T5831] ksys_read+0x145/0x250
[ 71.406101][ T5831] do_syscall_64+0xfa/0xfa0
[ 71.406119][ T5831] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 71.406133][ T5831]
[ 71.406138][ T5831] The buggy address belongs to the object at ffff88805b5528c0
[ 71.406138][ T5831] which belongs to the cache skbuff_head_cache of size 240
[ 71.406153][ T5831] The buggy address is located 56 bytes inside of
[ 71.406153][ T5831] freed 240-byte region [ffff88805b5528c0, ffff88805b5529b0)
[ 71.406171][ T5831]
[ 71.406177][ T5831] The buggy address belongs to the physical page:
[ 71.406198][ T5831] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5b552
[ 71.406217][ T5831] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 71.406236][ T5831] page_type: f5(slab)
[ 71.406252][ T5831] raw: 00fff00000000000 ffff8881416d3a00 dead000000000122 0000000000000000
[ 71.406267][ T5831] raw: 0000000000000000 00000000000c000c 00000000f5000000 0000000000000000
[ 71.406275][ T5831] page dumped because: kasan: bad access detected
[ 71.406288][ T5831] page_owner tracks the page as allocated
[ 71.406294][ T5831] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5825, tgid 5825 (udevd), ts 71329831198, free_ts 71325918959
[ 71.406321][ T5831] post_alloc_hook+0x240/0x2a0
[ 71.406336][ T5831] get_page_from_freelist+0x2365/0x2440
[ 71.406353][ T5831] __alloc_frozen_pages_noprof+0x181/0x370
[ 71.406370][ T5831] alloc_pages_mpol+0x232/0x4a0
[ 71.406388][ T5831] allocate_slab+0x86/0x3b0
[ 71.406405][ T5831] ___slab_alloc+0xf56/0x1990
[ 71.406422][ T5831] __slab_alloc+0x65/0x100
[ 71.406438][ T5831] kmem_cache_alloc_node_noprof+0x4ce/0x710
[ 71.406453][ T5831] __alloc_skb+0x112/0x2d0
[ 71.406472][ T5831] alloc_skb_with_frags+0xca/0x890
[ 71.406486][ T5831] sock_alloc_send_pskb+0x84d/0x980
[ 71.406501][ T5831] unix_dgram_sendmsg+0x461/0x1850
[ 71.406519][ T5831] __sock_sendmsg+0x21c/0x270
[ 71.406536][ T5831] sock_write_iter+0x279/0x360
[ 71.406552][ T5831] vfs_write+0x5c9/0xb30
[ 71.406566][ T5831] ksys_write+0x145/0x250
[ 71.406589][ T5831] page last free pid 5834 tgid 5834 stack trace:
[ 71.406599][ T5831] __free_frozen_pages+0xbc8/0xd30
[ 71.406613][ T5831] __kasan_populate_vmalloc+0x1b2/0x1d0
[ 71.406628][ T5831] alloc_vmap_area+0xdca/0x1500
[ 71.406641][ T5831] __get_vm_area_node+0x1f8/0x300
[ 71.406654][ T5831] __vmalloc_node_range_noprof+0x365/0x1640
[ 71.406669][ T5831] __vmalloc_node_noprof+0xc2/0x110
[ 71.406684][ T5831] dup_task_struct+0x3d4/0x830
[ 71.406703][ T5831] copy_process+0x4ea/0x3930
[ 71.406720][ T5831] kernel_clone+0x21e/0x850
[ 71.406740][ T5831] __se_sys_clone3+0x256/0x2d0
[ 71.406753][ T5831] do_syscall_64+0xfa/0xfa0
[ 71.406769][ T5831] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 71.406785][ T5831]
[ 71.406789][ T5831] Memory state around the buggy address:
[ 71.406798][ T5831] ffff88805b552780: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 71.406810][ T5831] ffff88805b552800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 71.406820][ T5831] >ffff88805b552880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 71.406829][ T5831] ^
[ 71.406838][ T5831] ffff88805b552900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 71.406849][ T5831] ffff88805b552980: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[ 71.406858][ T5831] ==================================================================
[ 71.407771][ T5831] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 71.407793][ T5831] CPU: 0 UID: 0 PID: 5831 Comm: kworker/u9:5 Not tainted syzkaller #0 PREEMPT(full)
[ 71.407813][ T5831] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 71.407825][ T5831] Workqueue: hci4 hci_cmd_work
[ 71.407849][ T5831] Call Trace:
[ 71.407856][ T5831]
[ 71.407864][ T5831] dump_stack_lvl+0x99/0x250
[ 71.407887][ T5831] ? __asan_memcpy+0x40/0x70
[ 71.407902][ T5831] ? __pfx_dump_stack_lvl+0x10/0x10
[ 71.407924][ T5831] ? __pfx__printk+0x10/0x10
[ 71.407946][ T5831] vpanic+0x237/0x6d0
[ 71.407961][ T5831] ? __pfx_vpanic+0x10/0x10
[ 71.407974][ T5831] ? preempt_schedule+0xae/0xc0
[ 71.407991][ T5831] ? __pfx_preempt_schedule+0x10/0x10
[ 71.408010][ T5831] panic+0xb9/0xc0
[ 71.408024][ T5831] ? __pfx_panic+0x10/0x10
[ 71.408039][ T5831] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 71.408058][ T5831] ? is_module_address+0x17/0xf0
[ 71.408077][ T5831] ? hci_cmd_work+0x5d0/0x7b0
[ 71.408095][ T5831] check_panic_on_warn+0x89/0xb0
[ 71.408112][ T5831] ? hci_cmd_work+0x5d0/0x7b0
[ 71.408130][ T5831] end_report+0x6f/0x160
[ 71.408148][ T5831] kasan_report+0x129/0x150
[ 71.408168][ T5831] ? hci_cmd_work+0x5d0/0x7b0
[ 71.408189][ T5831] hci_cmd_work+0x5d0/0x7b0
[ 71.408209][ T5831] ? process_one_work+0x868/0x15e0
[ 71.408228][ T5831] process_one_work+0x93a/0x15e0
[ 71.408247][ T5831] ? __lock_acquire+0xab9/0xd20
[ 71.408274][ T5831] ? __pfx_process_one_work+0x10/0x10
[ 71.408296][ T5831] ? assign_work+0x3a1/0x410
[ 71.408317][ T5831] worker_thread+0x9b0/0xee0
[ 71.408346][ T5831] kthread+0x711/0x8a0
[ 71.408363][ T5831] ? __pfx_worker_thread+0x10/0x10
[ 71.408383][ T5831] ? __pfx_kthread+0x10/0x10
[ 71.408398][ T5831] ? _raw_spin_unlock_irq+0x23/0x50
[ 71.408414][ T5831] ? lockdep_hardirqs_on+0x9c/0x150
[ 71.408431][ T5831] ? __pfx_kthread+0x10/0x10
[ 71.408446][ T5831] ret_from_fork+0x599/0xb30
[ 71.408466][ T5831] ? __pfx_ret_from_fork+0x10/0x10
[ 71.408489][ T5831] ? __switch_to_asm+0x39/0x70
[ 71.408504][ T5831] ? __switch_to_asm+0x33/0x70
[ 71.408519][ T5831] ? __pfx_kthread+0x10/0x10
[ 71.408534][ T5831] ret_from_fork_asm+0x1a/0x30
[ 71.408561][ T5831]
[ 71.418174][ T5831] Kernel Offset: disabled