Warning: Permanently added '10.128.0.115' (ED25519) to the list of known hosts.
executing program
syzkaller login: [   43.114927][ T4024] ==================================================================
[   43.116878][ T4024] BUG: KASAN: slab-out-of-bounds in hci_le_meta_evt+0xde8/0x31c0
[   43.118622][ T4024] Read of size 1 at addr ffff0000ca72de04 by task kworker/u5:2/4024
[   43.120400][ T4024] 
[   43.120928][ T4024] CPU: 0 PID: 4024 Comm: kworker/u5:2 Not tainted 5.15.178-syzkaller #0
[   43.122836][ T4024] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[   43.125181][ T4024] Workqueue: hci0 hci_rx_work
[   43.126245][ T4024] Call trace:
[   43.127010][ T4024]  dump_backtrace+0x0/0x530
[   43.128100][ T4024]  show_stack+0x2c/0x3c
[   43.129032][ T4024]  dump_stack_lvl+0x108/0x170
[   43.130115][ T4024]  print_address_description+0x7c/0x3f0
[   43.131379][ T4024]  kasan_report+0x174/0x1e4
[   43.132398][ T4024]  __asan_report_load1_noabort+0x44/0x50
[   43.133706][ T4024]  hci_le_meta_evt+0xde8/0x31c0
[   43.134805][ T4024]  hci_event_packet+0xd34/0x12b4
[   43.135907][ T4024]  hci_rx_work+0x1d0/0x830
[   43.136915][ T4024]  process_one_work+0x790/0x11b8
[   43.138033][ T4024]  worker_thread+0x910/0x1034
[   43.139086][ T4024]  kthread+0x37c/0x45c
[   43.140051][ T4024]  ret_from_fork+0x10/0x20
[   43.141050][ T4024] 
[   43.141595][ T4024] Allocated by task 4019:
[   43.142579][ T4024]  ____kasan_kmalloc+0xbc/0xfc
[   43.143681][ T4024]  __kasan_kmalloc+0x10/0x1c
[   43.144836][ T4024]  __kmalloc_node_track_caller+0x234/0x448
[   43.146195][ T4024]  kmalloc_reserve+0xe8/0x270
[   43.147317][ T4024]  __alloc_skb+0x1a4/0x584
[   43.148360][ T4024]  vhci_write+0xb8/0x3b8
[   43.149313][ T4024]  vfs_write+0x884/0xb44
[   43.150287][ T4024]  ksys_write+0x15c/0x26c
[   43.151269][ T4024]  __arm64_sys_write+0x7c/0x90
[   43.152379][ T4024]  invoke_syscall+0x98/0x2b8
[   43.153417][ T4024]  el0_svc_common+0x138/0x258
[   43.154460][ T4024]  do_el0_svc+0x58/0x14c
[   43.155405][ T4024]  el0_svc+0x7c/0x1f0
[   43.156334][ T4024]  el0t_64_sync_handler+0x84/0xe4
[   43.157547][ T4024]  el0t_64_sync+0x1a0/0x1a4
[   43.158656][ T4024] 
[   43.159179][ T4024] The buggy address belongs to the object at ffff0000ca72dc00
[   43.159179][ T4024]  which belongs to the cache kmalloc-512 of size 512
[   43.162567][ T4024] The buggy address is located 4 bytes to the right of
[   43.162567][ T4024]  512-byte region [ffff0000ca72dc00, ffff0000ca72de00)
[   43.165662][ T4024] The buggy address belongs to the page:
[   43.166938][ T4024] page:000000002a8035fd refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10a72c
[   43.169347][ T4024] head:000000002a8035fd order:2 compound_mapcount:0 compound_pincount:0
[   43.171223][ T4024] flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff)
[   43.173076][ T4024] raw: 05ffc00000010200 0000000000000000 0000000100000001 ffff0000c0002600
[   43.175067][ T4024] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[   43.177060][ T4024] page dumped because: kasan: bad access detected
[   43.178567][ T4024] 
[   43.179073][ T4024] Memory state around the buggy address:
[   43.180363][ T4024]  ffff0000ca72dd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   43.182203][ T4024]  ffff0000ca72dd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   43.184082][ T4024] >ffff0000ca72de00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   43.186012][ T4024]                    ^
[   43.186925][ T4024]  ffff0000ca72de80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   43.188800][ T4024]  ffff0000ca72df00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   43.190621][ T4024] ==================================================================
[   43.192458][ T4024] Disabling lock debugging due to kernel taint
[   43.197155][ T4024] Bluetooth: hci0: Unknown advertising packet type: 0x6b3c
[   43.197198][ T4024] Bluetooth: hci0: Unknown advertising packet type: 0x6873
[   43.198873][ T4024] Bluetooth: hci0: Unknown advertising packet type: 0xa000
[   43.200495][ T4024] Bluetooth: hci0: Unknown advertising packet type: 0xffff
[   43.202148][ T4024] Bluetooth: hci0: Unknown advertising packet type: 0x8000
[   43.203894][ T4024] Bluetooth: hci0: Unknown advertising packet type: 0x8000