Warning: Permanently added '10.128.0.23' (ECDSA) to the list of known hosts.
executing program
syzkaller login: [   38.966143][ T4057] Bluetooth: hci0: Unknown advertising packet type: 0x6678
[   38.966261][ T4057] ==================================================================
[   38.969769][ T4057] BUG: KASAN: slab-out-of-bounds in hci_le_meta_evt+0xe70/0x2f38
[   38.971451][ T4057] Read of size 1 at addr ffff0000dad8540a by task kworker/u5:2/4057
[   38.973388][ T4057] 
[   38.973915][ T4057] CPU: 1 PID: 4057 Comm: kworker/u5:2 Not tainted 5.15.101-syzkaller #0
[   38.975810][ T4057] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
[   38.978115][ T4057] Workqueue: hci0 hci_rx_work
[   38.979201][ T4057] Call trace:
[   38.979962][ T4057]  dump_backtrace+0x0/0x530
[   38.980957][ T4057]  show_stack+0x2c/0x3c
[   38.981989][ T4057]  dump_stack_lvl+0x108/0x170
[   38.983050][ T4057]  print_address_description+0x7c/0x3f0
[   38.984457][ T4057]  kasan_report+0x174/0x1e4
[   38.985451][ T4057]  __asan_report_load1_noabort+0x44/0x50
[   38.986754][ T4057]  hci_le_meta_evt+0xe70/0x2f38
[   38.987914][ T4057]  hci_event_packet+0xe04/0x1258
[   38.989108][ T4057]  hci_rx_work+0x1d0/0x6d0
[   38.990169][ T4057]  process_one_work+0x84c/0x14b8
[   38.991404][ T4057]  worker_thread+0x910/0x1034
[   38.992503][ T4057]  kthread+0x37c/0x45c
[   38.993415][ T4057]  ret_from_fork+0x10/0x20
[   38.994524][ T4057] 
[   38.995119][ T4057] Allocated by task 4052:
[   38.996163][ T4057]  ____kasan_kmalloc+0xbc/0xfc
[   38.997310][ T4057]  __kasan_kmalloc+0x10/0x1c
[   38.998384][ T4057]  __kmalloc_node_track_caller+0x20c/0x384
[   38.999855][ T4057]  kmalloc_reserve+0xe8/0x270
[   39.000932][ T4057]  __alloc_skb+0x1a4/0x584
[   39.001991][ T4057]  vhci_write+0xb8/0x3b8
[   39.002979][ T4057]  vfs_write+0x87c/0xb3c
[   39.004014][ T4057]  ksys_write+0x15c/0x26c
[   39.005071][ T4057]  __arm64_sys_write+0x7c/0x90
[   39.006277][ T4057]  invoke_syscall+0x98/0x2b8
[   39.007318][ T4057]  el0_svc_common+0x138/0x258
[   39.008366][ T4057]  do_el0_svc+0x58/0x14c
[   39.009323][ T4057]  el0_svc+0x7c/0x1f0
[   39.010275][ T4057]  el0t_64_sync_handler+0x84/0xe4
[   39.011443][ T4057]  el0t_64_sync+0x1a0/0x1a4
[   39.012479][ T4057] 
[   39.013001][ T4057] The buggy address belongs to the object at ffff0000dad85000
[   39.013001][ T4057]  which belongs to the cache kmalloc-1k of size 1024
[   39.016354][ T4057] The buggy address is located 10 bytes to the right of
[   39.016354][ T4057]  1024-byte region [ffff0000dad85000, ffff0000dad85400)
[   39.019684][ T4057] The buggy address belongs to the page:
[   39.021079][ T4057] page:000000005a30b55c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11ad80
[   39.023528][ T4057] head:000000005a30b55c order:3 compound_mapcount:0 compound_pincount:0
[   39.025536][ T4057] flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff)
[   39.027383][ T4057] raw: 05ffc00000010200 dead000000000100 dead000000000122 ffff0000c0002780
[   39.029370][ T4057] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[   39.031317][ T4057] page dumped because: kasan: bad access detected
[   39.032787][ T4057] 
[   39.033320][ T4057] Memory state around the buggy address:
[   39.034678][ T4057]  ffff0000dad85300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   39.036578][ T4057]  ffff0000dad85380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   39.038549][ T4057] >ffff0000dad85400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   39.040408][ T4057]                       ^
[   39.041496][ T4057]  ffff0000dad85480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   39.043372][ T4057]  ffff0000dad85500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   39.045212][ T4057] ==================================================================
[   39.046993][ T4057] Disabling lock debugging due to kernel taint