last executing test programs:
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.1.221' (ED25519) to the list of known hosts.
[ 69.056514][ T5813] cgroup: Unknown subsys name 'net'
[ 69.246663][ T5813] cgroup: Unknown subsys name 'cpuset'
[ 69.255006][ T5813] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 70.613905][ T5813] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 71.278003][ T1298] ieee802154 phy0 wpan0: encryption failed: -22
[ 71.284429][ T1298] ieee802154 phy1 wpan1: encryption failed: -22
[ 72.603610][ T5827] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 72.613358][ T5827] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 72.623159][ T5827] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 72.631100][ T5827] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 72.638300][ T5827] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 72.646139][ T5827] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[ 72.654106][ T5827] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 72.671757][ T5830] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[ 72.679709][ T5830] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[ 72.687883][ T5830] ==================================================================
[ 72.690346][ T5837] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[ 72.695949][ T5830] BUG: KASAN: slab-use-after-free in hci_cmd_work+0x5d0/0x7b0
[ 72.695977][ T5830] Read of size 2 at addr ffff888060241cb8 by task kworker/u9:4/5830
[ 72.718258][ T5830]
[ 72.720582][ T5830] CPU: 0 UID: 0 PID: 5830 Comm: kworker/u9:4 Not tainted syzkaller #0 PREEMPT(full)
[ 72.720597][ T5830] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 72.720606][ T5830] Workqueue: hci0 hci_cmd_work
[ 72.720630][ T5830] Call Trace:
[ 72.720636][ T5830]
[ 72.720642][ T5830] dump_stack_lvl+0x189/0x250
[ 72.720661][ T5830] ? __virt_addr_valid+0x1c8/0x5c0
[ 72.720674][ T5830] ? rcu_is_watching+0x15/0xb0
[ 72.720685][ T5830] ? __pfx_dump_stack_lvl+0x10/0x10
[ 72.720702][ T5830] ? rcu_is_watching+0x15/0xb0
[ 72.720712][ T5830] ? lock_release+0x4b/0x3d0
[ 72.720727][ T5830] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 72.720742][ T5830] ? __virt_addr_valid+0x1c8/0x5c0
[ 72.720754][ T5830] ? __virt_addr_valid+0x4a5/0x5c0
[ 72.720767][ T5830] print_report+0xca/0x240
[ 72.720783][ T5830] ? hci_cmd_work+0x5d0/0x7b0
[ 72.720796][ T5830] kasan_report+0x118/0x150
[ 72.720812][ T5830] ? hci_cmd_work+0x5d0/0x7b0
[ 72.720829][ T5830] hci_cmd_work+0x5d0/0x7b0
[ 72.720844][ T5830] ? process_one_work+0x868/0x15e0
[ 72.720859][ T5830] process_one_work+0x93a/0x15e0
[ 72.720873][ T5830] ? __lock_acquire+0xab9/0xd20
[ 72.720894][ T5830] ? __pfx_process_one_work+0x10/0x10
[ 72.720912][ T5830] ? assign_work+0x3a1/0x410
[ 72.720927][ T5830] worker_thread+0x9b0/0xee0
[ 72.720950][ T5830] kthread+0x711/0x8a0
[ 72.720963][ T5830] ? __pfx_worker_thread+0x10/0x10
[ 72.720978][ T5830] ? __pfx_kthread+0x10/0x10
[ 72.720989][ T5830] ? _raw_spin_unlock_irq+0x23/0x50
[ 72.721001][ T5830] ? lockdep_hardirqs_on+0x9c/0x150
[ 72.721014][ T5830] ? __pfx_kthread+0x10/0x10
[ 72.721026][ T5830] ret_from_fork+0x599/0xb30
[ 72.721041][ T5830] ? __pfx_ret_from_fork+0x10/0x10
[ 72.721059][ T5830] ? __switch_to_asm+0x39/0x70
[ 72.721071][ T5830] ? __switch_to_asm+0x33/0x70
[ 72.721082][ T5830] ? __pfx_kthread+0x10/0x10
[ 72.721093][ T5830] ret_from_fork_asm+0x1a/0x30
[ 72.721110][ T5830]
[ 72.721115][ T5830]
[ 72.909863][ T5830] Allocated by task 5147:
[ 72.914175][ T5830] kasan_save_track+0x3e/0x80
[ 72.918837][ T5830] __kasan_slab_alloc+0x6c/0x80
[ 72.923667][ T5830] kmem_cache_alloc_node_noprof+0x43c/0x710
[ 72.929541][ T5830] __alloc_skb+0x112/0x2d0
[ 72.933943][ T5830] hci_cmd_sync_alloc+0x3d/0x3b0
[ 72.938862][ T5830] __hci_cmd_sync_sk+0x1a7/0xc70
[ 72.943780][ T5830] hci_read_num_supported_iac_sync+0x2c/0x120
[ 72.949832][ T5830] hci_dev_open_sync+0x243b/0x2dc0
[ 72.954924][ T5830] hci_power_on+0x1b4/0x720
[ 72.959413][ T5830] process_one_work+0x93a/0x15e0
[ 72.964333][ T5830] worker_thread+0x9b0/0xee0
[ 72.968906][ T5830] kthread+0x711/0x8a0
[ 72.972954][ T5830] ret_from_fork+0x599/0xb30
[ 72.977523][ T5830] ret_from_fork_asm+0x1a/0x30
[ 72.982268][ T5830]
[ 72.984570][ T5830] Freed by task 5828:
[ 72.988530][ T5830] kasan_save_track+0x3e/0x80
[ 72.993193][ T5830] kasan_save_free_info+0x46/0x50
[ 72.998199][ T5830] __kasan_slab_free+0x5c/0x80
[ 73.002940][ T5830] kmem_cache_free+0x197/0x640
[ 73.007688][ T5830] vhci_read+0x49a/0x5b0
[ 73.011913][ T5830] vfs_read+0x200/0xa30
[ 73.016050][ T5830] ksys_read+0x145/0x250
[ 73.020270][ T5830] do_syscall_64+0xfa/0xfa0
[ 73.024754][ T5830] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 73.030636][ T5830]
[ 73.032941][ T5830] The buggy address belongs to the object at ffff888060241c80
[ 73.032941][ T5830] which belongs to the cache skbuff_head_cache of size 240
[ 73.047492][ T5830] The buggy address is located 56 bytes inside of
[ 73.047492][ T5830] freed 240-byte region [ffff888060241c80, ffff888060241d70)
[ 73.061178][ T5830]
[ 73.063483][ T5830] The buggy address belongs to the physical page:
[ 73.069883][ T5830] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x60241
[ 73.078623][ T5830] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 73.085713][ T5830] page_type: f5(slab)
[ 73.089674][ T5830] raw: 00fff00000000000 ffff888140ed8a00 dead000000000122 0000000000000000
[ 73.098248][ T5830] raw: 0000000000000000 00000000000c000c 00000000f5000000 0000000000000000
[ 73.106813][ T5830] page dumped because: kasan: bad access detected
[ 73.113215][ T5830] page_owner tracks the page as allocated
[ 73.118907][ T5830] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5825, tgid 5825 (udevd), ts 72664730554, free_ts 20092100069
[ 73.137550][ T5830] post_alloc_hook+0x240/0x2a0
[ 73.142303][ T5830] get_page_from_freelist+0x2365/0x2440
[ 73.147830][ T5830] __alloc_frozen_pages_noprof+0x181/0x370
[ 73.153618][ T5830] alloc_pages_mpol+0x232/0x4a0
[ 73.158450][ T5830] allocate_slab+0x86/0x3b0
[ 73.162937][ T5830] ___slab_alloc+0xf56/0x1990
[ 73.167597][ T5830] __slab_alloc+0x65/0x100
[ 73.171994][ T5830] kmem_cache_alloc_noprof+0x40f/0x700
[ 73.177430][ T5830] skb_clone+0x212/0x3a0
[ 73.181653][ T5830] netlink_broadcast_filtered+0x6ae/0x1000
[ 73.187446][ T5830] netlink_sendmsg+0x7ae/0xb30
[ 73.192190][ T5830] __sock_sendmsg+0x21c/0x270
[ 73.196850][ T5830] ____sys_sendmsg+0x505/0x870
[ 73.201595][ T5830] ___sys_sendmsg+0x21f/0x2a0
[ 73.206251][ T5830] __x64_sys_sendmsg+0x19b/0x260
[ 73.211168][ T5830] do_syscall_64+0xfa/0xfa0
[ 73.215653][ T5830] page last free pid 1 tgid 1 stack trace:
[ 73.221432][ T5830] __free_frozen_pages+0xbc8/0xd30
[ 73.226524][ T5830] free_contig_range+0x1bd/0x4a0
[ 73.231442][ T5830] destroy_args+0x69/0x660
[ 73.235842][ T5830] debug_vm_pgtable+0x38f/0x3a0
[ 73.240673][ T5830] do_one_initcall+0x1fb/0x870
[ 73.245415][ T5830] do_initcall_level+0x104/0x190
[ 73.250339][ T5830] do_initcalls+0x59/0xa0
[ 73.254654][ T5830] kernel_init_freeable+0x334/0x4b0
[ 73.259835][ T5830] kernel_init+0x1d/0x1d0
[ 73.264147][ T5830] ret_from_fork+0x599/0xb30
[ 73.268717][ T5830] ret_from_fork_asm+0x1a/0x30
[ 73.273460][ T5830]
[ 73.275763][ T5830] Memory state around the buggy address:
[ 73.281378][ T5830] ffff888060241b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 73.289419][ T5830] ffff888060241c00: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[ 73.297456][ T5830] >ffff888060241c80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 73.305491][ T5830] ^
[ 73.311359][ T5830] ffff888060241d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 73.319405][ T5830] ffff888060241d80: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
[ 73.327443][ T5830] ==================================================================
[ 73.337170][ T5837] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[ 73.341585][ T5830] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 73.341611][ T5830] CPU: 0 UID: 0 PID: 5830 Comm: kworker/u9:4 Not tainted syzkaller #0 PREEMPT(full)
[ 73.341629][ T5830] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 73.341640][ T5830] Workqueue: hci0 hci_cmd_work
[ 73.341664][ T5830] Call Trace:
[ 73.341671][ T5830]
[ 73.341679][ T5830] dump_stack_lvl+0x99/0x250
[ 73.341702][ T5830] ? __asan_memcpy+0x40/0x70
[ 73.341717][ T5830] ? __pfx_dump_stack_lvl+0x10/0x10
[ 73.341738][ T5830] ? __pfx__printk+0x10/0x10
[ 73.341761][ T5830] vpanic+0x237/0x6d0
[ 73.341776][ T5830] ? __pfx_vpanic+0x10/0x10
[ 73.341789][ T5830] ? preempt_schedule+0xae/0xc0
[ 73.341806][ T5830] ? __pfx_preempt_schedule+0x10/0x10
[ 73.341826][ T5830] panic+0xb9/0xc0
[ 73.341839][ T5830] ? __pfx_panic+0x10/0x10
[ 73.341854][ T5830] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 73.341873][ T5830] ? is_module_address+0x17/0xf0
[ 73.341892][ T5830] ? hci_cmd_work+0x5d0/0x7b0
[ 73.341910][ T5830] check_panic_on_warn+0x89/0xb0
[ 73.341927][ T5830] ? hci_cmd_work+0x5d0/0x7b0
[ 73.341946][ T5830] end_report+0x6f/0x160
[ 73.341963][ T5830] kasan_report+0x129/0x150
[ 73.341983][ T5830] ? hci_cmd_work+0x5d0/0x7b0
[ 73.342004][ T5830] hci_cmd_work+0x5d0/0x7b0
[ 73.342024][ T5830] ? process_one_work+0x868/0x15e0
[ 73.342043][ T5830] process_one_work+0x93a/0x15e0
[ 73.342061][ T5830] ? __lock_acquire+0xab9/0xd20
[ 73.342089][ T5830] ? __pfx_process_one_work+0x10/0x10
[ 73.342111][ T5830] ? assign_work+0x3a1/0x410
[ 73.342132][ T5830] worker_thread+0x9b0/0xee0
[ 73.342161][ T5830] kthread+0x711/0x8a0
[ 73.342178][ T5830] ? __pfx_worker_thread+0x10/0x10
[ 73.342197][ T5830] ? __pfx_kthread+0x10/0x10
[ 73.342213][ T5830] ? _raw_spin_unlock_irq+0x23/0x50
[ 73.342228][ T5830] ? lockdep_hardirqs_on+0x9c/0x150
[ 73.342245][ T5830] ? __pfx_kthread+0x10/0x10
[ 73.342261][ T5830] ret_from_fork+0x599/0xb30
[ 73.342281][ T5830] ? __pfx_ret_from_fork+0x10/0x10
[ 73.342304][ T5830] ? __switch_to_asm+0x39/0x70
[ 73.342319][ T5830] ? __switch_to_asm+0x33/0x70
[ 73.342333][ T5830] ? __pfx_kthread+0x10/0x10
[ 73.342349][ T5830] ret_from_fork_asm+0x1a/0x30
[ 73.342378][ T5830]
[ 73.344282][ T5830] Kernel Offset: disabled