[   18.531570][ T3635] 8021q: adding VLAN 0 to HW filter on device bond0
[   18.535126][ T3635] eql: remember to turn off Van-Jacobson compression on your slave devices
[   18.581401][  T136] gvnic 0000:00:00.0 enp0s0: Device link is up.
[   18.586347][ T1523] IPv6: ADDRCONF(NETDEV_CHANGE): enp0s0: link becomes ready
Starting sshd: OK

syzkaller
Warning: Permanently added '10.128.0.130' (ED25519) to the list of known hosts.
executing program
syzkaller login: [   41.889814][ T3963] ==================================================================
[   41.891875][ T3963] BUG: KASAN: slab-out-of-bounds in hci_le_meta_evt+0xdf0/0x30dc
[   41.893868][ T3963] Read of size 1 at addr ffff0000cecb6604 by task kworker/u5:2/3963
[   41.895984][ T3963] 
[   41.896550][ T3963] CPU: 1 PID: 3963 Comm: kworker/u5:2 Not tainted 5.15.153-syzkaller #0
[   41.898700][ T3963] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
[   41.901299][ T3963] Workqueue: hci0 hci_rx_work
[   41.902500][ T3963] Call trace:
[   41.903303][ T3963]  dump_backtrace+0x0/0x530
[   41.904465][ T3963]  show_stack+0x2c/0x3c
[   41.905533][ T3963]  dump_stack_lvl+0x108/0x170
[   41.906721][ T3963]  print_address_description+0x7c/0x3f0
[   41.908059][ T3963]  kasan_report+0x174/0x1e4
[   41.909205][ T3963]  __asan_report_load1_noabort+0x44/0x50
[   41.910630][ T3963]  hci_le_meta_evt+0xdf0/0x30dc
[   41.911861][ T3963]  hci_event_packet+0xd34/0x12b4
[   41.913120][ T3963]  hci_rx_work+0x1c0/0x7c4
[   41.914220][ T3963]  process_one_work+0x790/0x11b8
[   41.915445][ T3963]  worker_thread+0x910/0x1034
[   41.916586][ T3963]  kthread+0x37c/0x45c
[   41.917577][ T3963]  ret_from_fork+0x10/0x20
[   41.918716][ T3963] 
[   41.919288][ T3963] Allocated by task 3960:
[   41.920370][ T3963]  ____kasan_kmalloc+0xbc/0xfc
[   41.921544][ T3963]  __kasan_kmalloc+0x10/0x1c
[   41.922678][ T3963]  __kmalloc_node_track_caller+0x234/0x448
[   41.924121][ T3963]  kmalloc_reserve+0xe8/0x270
[   41.925307][ T3963]  __alloc_skb+0x1a4/0x584
[   41.926452][ T3963]  vhci_write+0xb8/0x3b8
[   41.927500][ T3963]  vfs_write+0x87c/0xb3c
[   41.928579][ T3963]  ksys_write+0x15c/0x26c
[   41.929683][ T3963]  __arm64_sys_write+0x7c/0x90
[   41.930887][ T3963]  invoke_syscall+0x98/0x2b8
[   41.932055][ T3963]  el0_svc_common+0x138/0x258
[   41.933270][ T3963]  do_el0_svc+0x58/0x14c
[   41.934297][ T3963]  el0_svc+0x7c/0x1f0
[   41.935298][ T3963]  el0t_64_sync_handler+0x84/0xe4
[   41.936567][ T3963]  el0t_64_sync+0x1a0/0x1a4
[   41.937732][ T3963] 
[   41.938301][ T3963] The buggy address belongs to the object at ffff0000cecb6400
[   41.938301][ T3963]  which belongs to the cache kmalloc-512 of size 512
[   41.941923][ T3963] The buggy address is located 4 bytes to the right of
[   41.941923][ T3963]  512-byte region [ffff0000cecb6400, ffff0000cecb6600)
[   41.945423][ T3963] The buggy address belongs to the page:
[   41.946825][ T3963] page:000000004e1a5f2b refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10ecb4
[   41.949352][ T3963] head:000000004e1a5f2b order:2 compound_mapcount:0 compound_pincount:0
[   41.951475][ T3963] flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff)
[   41.953531][ T3963] raw: 05ffc00000010200 dead000000000100 dead000000000122 ffff0000c0002600
[   41.955687][ T3963] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[   41.957871][ T3963] page dumped because: kasan: bad access detected
[   41.959503][ T3963] 
[   41.960081][ T3963] Memory state around the buggy address:
[   41.961477][ T3963]  ffff0000cecb6500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   41.963489][ T3963]  ffff0000cecb6580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   41.965519][ T3963] >ffff0000cecb6600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   41.967551][ T3963]                    ^
[   41.968566][ T3963]  ffff0000cecb6680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   41.970587][ T3963]  ffff0000cecb6700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   41.972655][ T3963] ==================================================================
[   41.974711][ T3963] Disabling lock debugging due to kernel taint
[   41.976691][ T3963] Bluetooth: hci0: Unknown advertising packet type: 0x303d
[   41.976710][ T3963] Bluetooth: hci0: Unknown advertising packet type: 0x7375
[   41.978666][ T3963] Bluetooth: hci0: Unknown advertising packet type: 0xffff