last executing test programs:
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.0.152' (ED25519) to the list of known hosts.
[ 74.131981][ T5813] cgroup: Unknown subsys name 'net'
[ 74.284185][ T5813] cgroup: Unknown subsys name 'cpuset'
[ 74.294557][ T5813] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 75.771155][ T5813] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 77.922287][ T5838] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 77.931854][ T5838] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[ 77.939903][ T5838] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 77.949360][ T5838] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[ 77.959338][ T5838] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[ 77.959686][ T5842] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[ 77.975806][ T5843] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 77.985413][ T5838] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[ 77.985845][ T5842] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 77.993184][ T5838] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[ 78.003256][ T5842] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[ 78.009401][ T5838] ==================================================================
[ 78.014134][ T5844] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[ 78.022131][ T5838] BUG: KASAN: slab-use-after-free in hci_cmd_work+0x5d0/0x7b0
[ 78.022163][ T5838] Read of size 2 at addr ffff888059d493f8 by task kworker/u9:4/5838
[ 78.022177][ T5838]
[ 78.022202][ T5838] CPU: 0 UID: 0 PID: 5838 Comm: kworker/u9:4 Not tainted syzkaller #0 PREEMPT(full)
[ 78.022220][ T5838] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 78.022231][ T5838] Workqueue: hci0 hci_cmd_work
[ 78.022258][ T5838] Call Trace:
[ 78.022269][ T5838]
[ 78.022277][ T5838] dump_stack_lvl+0x189/0x250
[ 78.022300][ T5838] ? __virt_addr_valid+0x1c8/0x5c0
[ 78.022317][ T5838] ? rcu_is_watching+0x15/0xb0
[ 78.022332][ T5838] ? __pfx_dump_stack_lvl+0x10/0x10
[ 78.022352][ T5838] ? rcu_is_watching+0x15/0xb0
[ 78.022366][ T5838] ? lock_release+0x4b/0x3d0
[ 78.022385][ T5838] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 78.022403][ T5838] ? __virt_addr_valid+0x1c8/0x5c0
[ 78.022418][ T5838] ? __virt_addr_valid+0x4a5/0x5c0
[ 78.022436][ T5838] print_report+0xca/0x240
[ 78.022456][ T5838] ? hci_cmd_work+0x5d0/0x7b0
[ 78.022473][ T5838] kasan_report+0x118/0x150
[ 78.022494][ T5838] ? hci_cmd_work+0x5d0/0x7b0
[ 78.022515][ T5838] hci_cmd_work+0x5d0/0x7b0
[ 78.022534][ T5838] ? process_one_work+0x868/0x15e0
[ 78.022553][ T5838] process_one_work+0x93a/0x15e0
[ 78.022572][ T5838] ? __lock_acquire+0xab9/0xd20
[ 78.022603][ T5838] ? __pfx_process_one_work+0x10/0x10
[ 78.022625][ T5838] ? assign_work+0x3a1/0x410
[ 78.022645][ T5838] worker_thread+0x9b0/0xee0
[ 78.022679][ T5838] kthread+0x711/0x8a0
[ 78.022696][ T5838] ? __pfx_worker_thread+0x10/0x10
[ 78.022714][ T5838] ? __pfx_kthread+0x10/0x10
[ 78.022729][ T5838] ? _raw_spin_unlock_irq+0x23/0x50
[ 78.022746][ T5838] ? lockdep_hardirqs_on+0x9c/0x150
[ 78.022762][ T5838] ? __pfx_kthread+0x10/0x10
[ 78.022778][ T5838] ret_from_fork+0x599/0xb30
[ 78.022796][ T5838] ? __pfx_ret_from_fork+0x10/0x10
[ 78.022814][ T5838] ? __switch_to_asm+0x39/0x70
[ 78.022826][ T5838] ? __switch_to_asm+0x33/0x70
[ 78.022837][ T5838] ? __pfx_kthread+0x10/0x10
[ 78.022850][ T5838] ret_from_fork_asm+0x1a/0x30
[ 78.022872][ T5838]
[ 78.022878][ T5838]
[ 78.032564][ T5844] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[ 78.036956][ T5838] Allocated by task 5830:
[ 78.046364][ T5844] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[ 78.047263][ T5838] kasan_save_track+0x3e/0x80
[ 78.082421][ T5147] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[ 78.083126][ T5838] __kasan_slab_alloc+0x6c/0x80
[ 78.089660][ T5147] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[ 78.093102][ T5838] kmem_cache_alloc_node_noprof+0x43c/0x710
[ 78.093127][ T5838] __alloc_skb+0x112/0x2d0
[ 78.093151][ T5838] hci_cmd_sync_alloc+0x3d/0x3b0
[ 78.093167][ T5838] __hci_cmd_sync_sk+0x1a7/0xc70
[ 78.093181][ T5838] hci_dev_open_sync+0x163e/0x2dc0
[ 78.093193][ T5838] hci_power_on+0x1b4/0x720
[ 78.099953][ T5147] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[ 78.103161][ T5838] process_one_work+0x93a/0x15e0
[ 78.103188][ T5838] worker_thread+0x9b0/0xee0
[ 78.103204][ T5838] kthread+0x711/0x8a0
[ 78.103216][ T5838] ret_from_fork+0x599/0xb30
[ 78.103232][ T5838] ret_from_fork_asm+0x1a/0x30
[ 78.103247][ T5838]
[ 78.111071][ T5147] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[ 78.113253][ T5838] Freed by task 5834:
[ 78.125643][ T5147] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[ 78.128251][ T5838] kasan_save_track+0x3e/0x80
[ 78.137549][ T5147] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[ 78.137667][ T5838] kasan_save_free_info+0x46/0x50
[ 78.143112][ T5147] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[ 78.146998][ T5838] __kasan_slab_free+0x5c/0x80
[ 78.147022][ T5838] kmem_cache_free+0x197/0x640
[ 78.147036][ T5838] vhci_read+0x49a/0x5b0
[ 78.157731][ T5147] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[ 78.162004][ T5838] vfs_read+0x200/0xa30
[ 78.162028][ T5838] ksys_read+0x145/0x250
[ 78.162040][ T5838] do_syscall_64+0xfa/0xfa0
[ 78.162056][ T5838] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 78.162069][ T5838]
[ 78.162074][ T5838] The buggy address belongs to the object at ffff888059d493c0
[ 78.162074][ T5838] which belongs to the cache skbuff_head_cache of size 240
[ 78.162087][ T5838] The buggy address is located 56 bytes inside of
[ 78.162087][ T5838] freed 240-byte region [ffff888059d493c0, ffff888059d494b0)
[ 78.162102][ T5838]
[ 78.162108][ T5838] The buggy address belongs to the physical page:
[ 78.162128][ T5838] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x59d49
[ 78.479991][ T5838] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 78.487100][ T5838] page_type: f5(slab)
[ 78.491182][ T5838] raw: 00fff00000000000 ffff88814168fa00 dead000000000122 0000000000000000
[ 78.499773][ T5838] raw: 0000000000000000 00000000000c000c 00000000f5000000 0000000000000000
[ 78.508339][ T5838] page dumped because: kasan: bad access detected
[ 78.514742][ T5838] page_owner tracks the page as allocated
[ 78.520531][ T5838] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5841, tgid 5829 (syz-executor), ts 77992944455, free_ts 22789728470
[ 78.540230][ T5838] post_alloc_hook+0x240/0x2a0
[ 78.545084][ T5838] get_page_from_freelist+0x2365/0x2440
[ 78.550713][ T5838] __alloc_frozen_pages_noprof+0x181/0x370
[ 78.556530][ T5838] alloc_pages_mpol+0x232/0x4a0
[ 78.561387][ T5838] allocate_slab+0x86/0x3b0
[ 78.565903][ T5838] ___slab_alloc+0xf56/0x1990
[ 78.571252][ T5838] __slab_alloc+0x65/0x100
[ 78.576187][ T5838] kmem_cache_alloc_node_noprof+0x4ce/0x710
[ 78.582338][ T5838] __alloc_skb+0x112/0x2d0
[ 78.586893][ T5838] vhci_write+0xbe/0x4a0
[ 78.591264][ T5838] do_iter_readv_writev+0x623/0x8c0
[ 78.596742][ T5838] vfs_writev+0x31a/0x960
[ 78.601090][ T5838] do_writev+0x14d/0x2d0
[ 78.605801][ T5838] do_syscall_64+0xfa/0xfa0
[ 78.610499][ T5838] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 78.616482][ T5838] page last free pid 1 tgid 1 stack trace:
[ 78.622716][ T5838] __free_frozen_pages+0xbc8/0xd30
[ 78.628186][ T5838] free_contig_range+0x1bd/0x4a0
[ 78.633315][ T5838] destroy_args+0x69/0x660
[ 78.638346][ T5838] debug_vm_pgtable+0x38f/0x3a0
[ 78.643476][ T5838] do_one_initcall+0x1fb/0x870
[ 78.648225][ T5838] do_initcall_level+0x104/0x190
[ 78.653328][ T5838] do_initcalls+0x59/0xa0
[ 78.657648][ T5838] kernel_init_freeable+0x334/0x4b0
[ 78.662848][ T5838] kernel_init+0x1d/0x1d0
[ 78.667287][ T5838] ret_from_fork+0x599/0xb30
[ 78.672057][ T5838] ret_from_fork_asm+0x1a/0x30
[ 78.676843][ T5838]
[ 78.679165][ T5838] Memory state around the buggy address:
[ 78.685065][ T5838] ffff888059d49280: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.693690][ T5838] ffff888059d49300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 78.702009][ T5838] >ffff888059d49380: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 78.710065][ T5838] ^
[ 78.718082][ T5838] ffff888059d49400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.726240][ T5838] ffff888059d49480: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[ 78.734465][ T5838] ==================================================================
[ 78.743185][ T5838] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 78.750490][ T5838] CPU: 0 UID: 0 PID: 5838 Comm: kworker/u9:4 Not tainted syzkaller #0 PREEMPT(full)
[ 78.759962][ T5838] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 78.770101][ T5838] Workqueue: hci0 hci_cmd_work
[ 78.774977][ T5838] Call Trace:
[ 78.778267][ T5838]
[ 78.781205][ T5838] dump_stack_lvl+0x99/0x250
[ 78.785817][ T5838] ? __asan_memcpy+0x40/0x70
[ 78.790603][ T5838] ? __pfx_dump_stack_lvl+0x10/0x10
[ 78.795912][ T5838] ? __pfx__printk+0x10/0x10
[ 78.800792][ T5838] vpanic+0x237/0x6d0
[ 78.804909][ T5838] ? __pfx_vpanic+0x10/0x10
[ 78.809643][ T5838] ? preempt_schedule+0xae/0xc0
[ 78.814867][ T5838] ? __pfx_preempt_schedule+0x10/0x10
[ 78.820405][ T5838] panic+0xb9/0xc0
[ 78.824145][ T5838] ? __pfx_panic+0x10/0x10
[ 78.828771][ T5838] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 78.835203][ T5838] ? is_module_address+0x17/0xf0
[ 78.840339][ T5838] ? hci_cmd_work+0x5d0/0x7b0
[ 78.845306][ T5838] check_panic_on_warn+0x89/0xb0
[ 78.850711][ T5838] ? hci_cmd_work+0x5d0/0x7b0
[ 78.855798][ T5838] end_report+0x6f/0x160
[ 78.860247][ T5838] kasan_report+0x129/0x150
[ 78.865626][ T5838] ? hci_cmd_work+0x5d0/0x7b0
[ 78.870513][ T5838] hci_cmd_work+0x5d0/0x7b0
[ 78.875397][ T5838] ? process_one_work+0x868/0x15e0
[ 78.880707][ T5838] process_one_work+0x93a/0x15e0
[ 78.885772][ T5838] ? __lock_acquire+0xab9/0xd20
[ 78.890764][ T5838] ? __pfx_process_one_work+0x10/0x10
[ 78.896353][ T5838] ? assign_work+0x3a1/0x410
[ 78.901000][ T5838] worker_thread+0x9b0/0xee0
[ 78.905630][ T5838] kthread+0x711/0x8a0
[ 78.909731][ T5838] ? __pfx_worker_thread+0x10/0x10
[ 78.914985][ T5838] ? __pfx_kthread+0x10/0x10
[ 78.919606][ T5838] ? _raw_spin_unlock_irq+0x23/0x50
[ 78.924839][ T5838] ? lockdep_hardirqs_on+0x9c/0x150
[ 78.930147][ T5838] ? __pfx_kthread+0x10/0x10
[ 78.934849][ T5838] ret_from_fork+0x599/0xb30
[ 78.939536][ T5838] ? __pfx_ret_from_fork+0x10/0x10
[ 78.944789][ T5838] ? __switch_to_asm+0x39/0x70
[ 78.949753][ T5838] ? __switch_to_asm+0x33/0x70
[ 78.954715][ T5838] ? __pfx_kthread+0x10/0x10
[ 78.959597][ T5838] ret_from_fork_asm+0x1a/0x30
[ 78.964572][ T5838]
[ 78.968578][ T5838] Kernel Offset: disabled
[ 78.973237][ T5838] Rebooting in 86400 seconds..