last executing test programs:
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.1.101' (ED25519) to the list of known hosts.
[ 65.211683][ T5819] cgroup: Unknown subsys name 'net'
[ 65.380002][ T5819] cgroup: Unknown subsys name 'cpuset'
[ 65.388499][ T5819] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 66.849957][ T5819] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 69.953477][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 69.969043][ T5833] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 69.980872][ T5839] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 69.990135][ T5836] ==================================================================
[ 69.998212][ T5836] BUG: KASAN: slab-use-after-free in hci_cmd_work+0x5d0/0x7b0
[ 70.005664][ T5836] Read of size 2 at addr ffff88805e0c0678 by task kworker/u9:3/5836
[ 70.013708][ T5836]
[ 70.016036][ T5836] CPU: 1 UID: 0 PID: 5836 Comm: kworker/u9:3 Not tainted syzkaller #0 PREEMPT(full)
[ 70.016051][ T5836] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 70.016060][ T5836] Workqueue: hci2 hci_cmd_work
[ 70.016087][ T5836] Call Trace:
[ 70.016096][ T5836]
[ 70.016102][ T5836] dump_stack_lvl+0x189/0x250
[ 70.016118][ T5836] ? __virt_addr_valid+0x1c8/0x5c0
[ 70.016135][ T5836] ? rcu_is_watching+0x15/0xb0
[ 70.016150][ T5836] ? __pfx_dump_stack_lvl+0x10/0x10
[ 70.016164][ T5836] ? rcu_is_watching+0x15/0xb0
[ 70.016178][ T5836] ? lock_release+0x4b/0x3d0
[ 70.016190][ T5836] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 70.016207][ T5836] ? __virt_addr_valid+0x1c8/0x5c0
[ 70.016223][ T5836] ? __virt_addr_valid+0x4a5/0x5c0
[ 70.016239][ T5836] print_report+0xca/0x240
[ 70.016255][ T5836] ? hci_cmd_work+0x5d0/0x7b0
[ 70.016271][ T5836] kasan_report+0x118/0x150
[ 70.016286][ T5836] ? hci_cmd_work+0x5d0/0x7b0
[ 70.016305][ T5836] hci_cmd_work+0x5d0/0x7b0
[ 70.016322][ T5836] ? process_one_work+0x868/0x15e0
[ 70.016335][ T5836] process_one_work+0x93a/0x15e0
[ 70.016347][ T5836] ? __lock_acquire+0xab9/0xd20
[ 70.016371][ T5836] ? __pfx_process_one_work+0x10/0x10
[ 70.016385][ T5836] ? assign_work+0x3a1/0x410
[ 70.016399][ T5836] worker_thread+0x9b0/0xee0
[ 70.016419][ T5836] kthread+0x711/0x8a0
[ 70.016435][ T5836] ? __pfx_worker_thread+0x10/0x10
[ 70.016448][ T5836] ? __pfx_kthread+0x10/0x10
[ 70.016463][ T5836] ? _raw_spin_unlock_irq+0x23/0x50
[ 70.016477][ T5836] ? lockdep_hardirqs_on+0x9c/0x150
[ 70.016492][ T5836] ? __pfx_kthread+0x10/0x10
[ 70.016507][ T5836] ret_from_fork+0x599/0xb30
[ 70.016521][ T5836] ? __pfx_ret_from_fork+0x10/0x10
[ 70.016535][ T5836] ? __switch_to_asm+0x39/0x70
[ 70.016550][ T5836] ? __switch_to_asm+0x33/0x70
[ 70.016567][ T5836] ? __pfx_kthread+0x10/0x10
[ 70.016584][ T5836] ret_from_fork_asm+0x1a/0x30
[ 70.016607][ T5836]
[ 70.016612][ T5836]
[ 70.205546][ T5836] Allocated by task 5833:
[ 70.209853][ T5836] kasan_save_track+0x3e/0x80
[ 70.214513][ T5836] __kasan_slab_alloc+0x6c/0x80
[ 70.219344][ T5836] kmem_cache_alloc_node_noprof+0x43c/0x710
[ 70.225221][ T5836] __alloc_skb+0x112/0x2d0
[ 70.229615][ T5836] hci_cmd_sync_alloc+0x3d/0x3b0
[ 70.234534][ T5836] __hci_cmd_sync_sk+0x1a7/0xc70
[ 70.239453][ T5836] hci_reset_sync+0x4a/0x140
[ 70.244029][ T5836] hci_dev_open_sync+0xec5/0x2dc0
[ 70.249035][ T5836] hci_power_on+0x1b4/0x720
[ 70.253621][ T5836] process_one_work+0x93a/0x15e0
[ 70.258537][ T5836] worker_thread+0x9b0/0xee0
[ 70.263105][ T5836] kthread+0x711/0x8a0
[ 70.267158][ T5836] ret_from_fork+0x599/0xb30
[ 70.271724][ T5836] ret_from_fork_asm+0x1a/0x30
[ 70.276476][ T5836]
[ 70.278790][ T5836] Freed by task 5840:
[ 70.282745][ T5836] kasan_save_track+0x3e/0x80
[ 70.287401][ T5836] kasan_save_free_info+0x46/0x50
[ 70.292406][ T5836] __kasan_slab_free+0x5c/0x80
[ 70.297157][ T5836] kmem_cache_free+0x197/0x640
[ 70.301901][ T5836] vhci_read+0x49a/0x5b0
[ 70.306129][ T5836] vfs_read+0x200/0xa30
[ 70.310270][ T5836] ksys_read+0x145/0x250
[ 70.314493][ T5836] do_syscall_64+0xfa/0xfa0
[ 70.318982][ T5836] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 70.324855][ T5836]
[ 70.327163][ T5836] The buggy address belongs to the object at ffff88805e0c0640
[ 70.327163][ T5836] which belongs to the cache skbuff_head_cache of size 240
[ 70.341713][ T5836] The buggy address is located 56 bytes inside of
[ 70.341713][ T5836] freed 240-byte region [ffff88805e0c0640, ffff88805e0c0730)
[ 70.355830][ T5836]
[ 70.358138][ T5836] The buggy address belongs to the physical page:
[ 70.364540][ T5836] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5e0c0
[ 70.373281][ T5836] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 70.380398][ T5836] page_type: f5(slab)
[ 70.384383][ T5836] raw: 00fff00000000000 ffff888140efca00 dead000000000122 0000000000000000
[ 70.392945][ T5836] raw: 0000000000000000 00000000000c000c 00000000f5000000 0000000000000000
[ 70.401507][ T5836] page dumped because: kasan: bad access detected
[ 70.407904][ T5836] page_owner tracks the page as allocated
[ 70.413596][ T5836] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5838, tgid 5838 (syz-executor), ts 69968309861, free_ts 69966266672
[ 70.432935][ T5836] post_alloc_hook+0x240/0x2a0
[ 70.437690][ T5836] get_page_from_freelist+0x2365/0x2440
[ 70.443218][ T5836] __alloc_frozen_pages_noprof+0x181/0x370
[ 70.449003][ T5836] alloc_pages_mpol+0x232/0x4a0
[ 70.453845][ T5836] allocate_slab+0x86/0x3b0
[ 70.458330][ T5836] ___slab_alloc+0xf56/0x1990
[ 70.462985][ T5836] __slab_alloc+0x65/0x100
[ 70.467382][ T5836] kmem_cache_alloc_noprof+0x40f/0x700
[ 70.472826][ T5836] skb_clone+0x212/0x3a0
[ 70.477049][ T5836] netlink_broadcast_filtered+0x6ae/0x1000
[ 70.482834][ T5836] netlink_broadcast+0x37/0x50
[ 70.487574][ T5836] kobject_uevent_net_broadcast+0x378/0x560
[ 70.493447][ T5836] kobject_uevent_env+0x55c/0x9f0
[ 70.498449][ T5836] device_add+0x557/0xb80
[ 70.502756][ T5836] hci_register_dev+0x36c/0x8b0
[ 70.507589][ T5836] vhci_create_device+0x39c/0x650
[ 70.512593][ T5836] page last free pid 2 tgid 2 stack trace:
[ 70.518378][ T5836] __free_frozen_pages+0xbc8/0xd30
[ 70.523472][ T5836] __kasan_populate_vmalloc+0x1b2/0x1d0
[ 70.529001][ T5836] alloc_vmap_area+0xdca/0x1500
[ 70.533835][ T5836] __get_vm_area_node+0x1f8/0x300
[ 70.538843][ T5836] __vmalloc_node_range_noprof+0x371/0x16a0
[ 70.544721][ T5836] __vmalloc_node_noprof+0xc2/0x110
[ 70.549914][ T5836] dup_task_struct+0x3d4/0x830
[ 70.554664][ T5836] copy_process+0x4ea/0x3930
[ 70.559264][ T5836] kernel_clone+0x21e/0x850
[ 70.563754][ T5836] kernel_thread+0x10d/0x160
[ 70.568338][ T5836] kthreadd+0x575/0x770
[ 70.572478][ T5836] ret_from_fork+0x599/0xb30
[ 70.577048][ T5836] ret_from_fork_asm+0x1a/0x30
[ 70.581806][ T5836]
[ 70.584110][ T5836] Memory state around the buggy address:
[ 70.589719][ T5836] ffff88805e0c0500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 70.597761][ T5836] ffff88805e0c0580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[ 70.605973][ T5836] >ffff88805e0c0600: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 70.614009][ T5836] ^
[ 70.621960][ T5836] ffff88805e0c0680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 70.630000][ T5836] ffff88805e0c0700: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[ 70.638047][ T5836] ==================================================================
[ 70.648106][ T5839] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 70.655289][ T5839] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 70.656645][ T5836] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 70.656670][ T5836] CPU: 1 UID: 0 PID: 5836 Comm: kworker/u9:3 Not tainted syzkaller #0 PREEMPT(full)
[ 70.656690][ T5836] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 70.656702][ T5836] Workqueue: hci2 hci_cmd_work
[ 70.656729][ T5836] Call Trace:
[ 70.656736][ T5836]
[ 70.656743][ T5836] dump_stack_lvl+0x99/0x250
[ 70.656765][ T5836] ? __asan_memcpy+0x40/0x70
[ 70.656787][ T5836] ? __pfx_dump_stack_lvl+0x10/0x10
[ 70.656805][ T5836] ? __pfx__printk+0x10/0x10
[ 70.656828][ T5836] vpanic+0x237/0x6d0
[ 70.656842][ T5836] ? __pfx_vpanic+0x10/0x10
[ 70.656856][ T5836] ? preempt_schedule+0xae/0xc0
[ 70.656875][ T5836] ? __pfx_preempt_schedule+0x10/0x10
[ 70.656897][ T5836] panic+0xb9/0xc0
[ 70.656910][ T5836] ? __pfx_panic+0x10/0x10
[ 70.656926][ T5836] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 70.656947][ T5836] ? is_module_address+0x17/0xf0
[ 70.656963][ T5836] ? hci_cmd_work+0x5d0/0x7b0
[ 70.656984][ T5836] check_panic_on_warn+0x89/0xb0
[ 70.657006][ T5836] ? hci_cmd_work+0x5d0/0x7b0
[ 70.657027][ T5836] end_report+0x6f/0x160
[ 70.657043][ T5836] kasan_report+0x129/0x150
[ 70.657061][ T5836] ? hci_cmd_work+0x5d0/0x7b0
[ 70.657085][ T5836] hci_cmd_work+0x5d0/0x7b0
[ 70.657108][ T5836] ? process_one_work+0x868/0x15e0
[ 70.657124][ T5836] process_one_work+0x93a/0x15e0
[ 70.657139][ T5836] ? __lock_acquire+0xab9/0xd20
[ 70.657163][ T5836] ? __pfx_process_one_work+0x10/0x10
[ 70.657182][ T5836] ? assign_work+0x3a1/0x410
[ 70.657200][ T5836] worker_thread+0x9b0/0xee0
[ 70.657227][ T5836] kthread+0x711/0x8a0
[ 70.657247][ T5836] ? __pfx_worker_thread+0x10/0x10
[ 70.657264][ T5836] ? __pfx_kthread+0x10/0x10
[ 70.657284][ T5836] ? _raw_spin_unlock_irq+0x23/0x50
[ 70.657310][ T5836] ? lockdep_hardirqs_on+0x9c/0x150
[ 70.657329][ T5836] ? __pfx_kthread+0x10/0x10
[ 70.657349][ T5836] ret_from_fork+0x599/0xb30
[ 70.657366][ T5836] ? __pfx_ret_from_fork+0x10/0x10
[ 70.657386][ T5836] ? __switch_to_asm+0x39/0x70
[ 70.657405][ T5836] ? __switch_to_asm+0x33/0x70
[ 70.657424][ T5836] ? __pfx_kthread+0x10/0x10
[ 70.657443][ T5836] ret_from_fork_asm+0x1a/0x30
[ 70.657470][ T5836]
[ 70.662630][ T5836] Kernel Offset: disabled