Warning: Permanently added '10.128.0.238' (ED25519) to the list of known hosts.
executing program
[   39.795665][ T3971] ==================================================================
[   39.797851][ T3971] BUG: KASAN: slab-out-of-bounds in hci_le_meta_evt+0xe54/0x3028
[   39.799914][ T3971] Read of size 1 at addr ffff0000cea8b604 by task kworker/u5:1/3971
[   39.802113][ T3971] 
[   39.802690][ T3971] CPU: 0 PID: 3971 Comm: kworker/u5:1 Not tainted 5.15.137-syzkaller #0
[   39.805020][ T3971] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023
[   39.807672][ T3971] Workqueue: hci0 hci_rx_work
[   39.808873][ T3971] Call trace:
[   39.809698][ T3971]  dump_backtrace+0x0/0x530
[   39.810838][ T3971]  show_stack+0x2c/0x3c
[   39.811962][ T3971]  dump_stack_lvl+0x108/0x170
[   39.813194][ T3971]  print_address_description+0x7c/0x3f0
[   39.814526][ T3971]  kasan_report+0x174/0x1e4
[   39.815693][ T3971]  __asan_report_load1_noabort+0x44/0x50
[   39.817132][ T3971]  hci_le_meta_evt+0xe54/0x3028
[   39.818407][ T3971]  hci_event_packet+0xd34/0x12b4
[   39.819656][ T3971]  hci_rx_work+0x1c0/0x7c4
[   39.820847][ T3971]  process_one_work+0x790/0x11b8
[   39.822035][ T3971]  worker_thread+0x910/0x1034
[   39.823258][ T3971]  kthread+0x37c/0x45c
[   39.824357][ T3971]  ret_from_fork+0x10/0x20
[   39.825465][ T3971] 
[   39.826035][ T3971] Allocated by task 3970:
[   39.827130][ T3971]  ____kasan_kmalloc+0xbc/0xfc
[   39.828451][ T3971]  __kasan_kmalloc+0x10/0x1c
[   39.829560][ T3971]  __kmalloc_node_track_caller+0x234/0x448
[   39.831021][ T3971]  kmalloc_reserve+0xe8/0x270
[   39.832192][ T3971]  __alloc_skb+0x1a4/0x584
[   39.833392][ T3971]  vhci_write+0xb8/0x3b8
[   39.834497][ T3971]  vfs_write+0x87c/0xb3c
[   39.835614][ T3971]  ksys_write+0x15c/0x26c
[   39.836722][ T3971]  __arm64_sys_write+0x7c/0x90
[   39.837966][ T3971]  invoke_syscall+0x98/0x2b8
[   39.839191][ T3971]  el0_svc_common+0x138/0x258
[   39.840406][ T3971]  do_el0_svc+0x58/0x14c
[   39.841515][ T3971]  el0_svc+0x7c/0x1f0
[   39.842540][ T3971]  el0t_64_sync_handler+0x84/0xe4
[   39.843833][ T3971]  el0t_64_sync+0x1a0/0x1a4
[   39.845053][ T3971] 
[   39.845647][ T3971] The buggy address belongs to the object at ffff0000cea8b400
[   39.845647][ T3971]  which belongs to the cache kmalloc-512 of size 512
[   39.849217][ T3971] The buggy address is located 4 bytes to the right of
[   39.849217][ T3971]  512-byte region [ffff0000cea8b400, ffff0000cea8b600)
[   39.852749][ T3971] The buggy address belongs to the page:
[   39.854243][ T3971] page:000000002ecd1ec4 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10ea88
[   39.856897][ T3971] head:000000002ecd1ec4 order:2 compound_mapcount:0 compound_pincount:0
[   39.859162][ T3971] flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff)
[   39.861119][ T3971] raw: 05ffc00000010200 dead000000000100 dead000000000122 ffff0000c0002600
[   39.863360][ T3971] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[   39.865630][ T3971] page dumped because: kasan: bad access detected
[   39.867224][ T3971] 
[   39.867796][ T3971] Memory state around the buggy address:
[   39.869269][ T3971]  ffff0000cea8b500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   39.871458][ T3971]  ffff0000cea8b580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   39.873625][ T3971] >ffff0000cea8b600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   39.875642][ T3971]                    ^
[   39.876743][ T3971]  ffff0000cea8b680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   39.878787][ T3971]  ffff0000cea8b700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   39.880974][ T3971] ==================================================================
[   39.883094][ T3971] Disabling lock debugging due to kernel taint
[   39.886026][ T3971] Bluetooth: hci0: Unknown advertising packet type: 0x16
[   39.886062][ T3971] Bluetooth: hci0: Unknown advertising packet type: 0xff80
[   39.887698][ T3971] Bluetooth: hci0: Unknown advertising packet type: 0xff80
[   39.889486][ T3971] Bluetooth: hci0: Unknown advertising packet type: 0xff80
[   39.891175][ T3971] Bluetooth: hci0: Unknown advertising packet type: 0xff80
[   39.893199][ T3971] Bluetooth: hci0: Unknown advertising packet type: 0xff80
[   39.895047][ T3971] Bluetooth: hci0: Unknown advertising packet type: 0xff80
[   39.896782][ T3971] Bluetooth: hci0: Unknown advertising packet type: 0xff80
[   39.898544][ T3971] Bluetooth: hci0: Unknown advertising packet type: 0xff80