kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 8238 Comm: kworker/0:3 Not tainted 5.0.0-rc7+ #86
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events hci_uart_write_work
RIP: 0010:hci_uart_write_work+0x1b6/0x710 drivers/bluetooth/hci_ldisc.c:180
Code: 0f 85 6a 04 00 00 49 8b b4 24 c8 00 00 00 4c 89 ef e8 de 57 53 02 89 c6 48 8b 45 d0 48 8d b8 5c 10 00 00 48 89 f8 48 c1 e8 03 <0f> b6 14 18 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 1d
RSP: 0018:ffff8880762cfcb0 EFLAGS: 00010203
RAX: 000000000000020b RBX: dffffc0000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000008 RDI: 000000000000105c
RBP: ffff8880762cfd30 R08: ffff8880762c21c0 R09: ffff8880762c2a88
Bluetooth: Can't allocate HCI device
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88809ea506c0
kobject: 'loop4' (0000000078528116): kobject_uevent_env
R13: ffff8880856b08c0 R14: ffff8880a0996da8 R15: ffff88809ea50730
FS:  0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000073c000 CR3: 0000000091417000 CR4: 00000000001426f0
Call Trace:
 process_one_work+0x98e/0x1790 kernel/workqueue.c:2173
kobject: 'loop4' (0000000078528116): fill_kobj_path: path = '/devices/virtual/block/loop4'
 worker_thread+0x98/0xe40 kernel/workqueue.c:2319
 kthread+0x357/0x430 kernel/kthread.c:246
kobject: 'loop3' (000000008037f628): kobject_uevent_env
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
Modules linked in:
kobject: 'loop3' (000000008037f628): fill_kobj_path: path = '/devices/virtual/block/loop3'
kobject: 'kvm' (0000000022b1065e): kobject_uevent_env
kobject: 'loop0' (00000000fd170c3b): kobject_uevent_env
kobject: 'loop0' (00000000fd170c3b): fill_kobj_path: path = '/devices/virtual/block/loop0'
kobject: 'kvm' (0000000022b1065e): fill_kobj_path: path = '/devices/virtual/misc/kvm'
kobject: 'loop5' (000000009b158665): kobject_uevent_env
---[ end trace 9637b041f7560750 ]---
kobject: 'loop5' (000000009b158665): fill_kobj_path: path = '/devices/virtual/block/loop5'
kobject: 'loop4' (0000000078528116): kobject_uevent_env
RIP: 0010:hci_uart_write_work+0x1b6/0x710 drivers/bluetooth/hci_ldisc.c:180
kobject: 'loop4' (0000000078528116): fill_kobj_path: path = '/devices/virtual/block/loop4'
kobject: 'loop0' (00000000fd170c3b): kobject_uevent_env
Code: 0f 85 6a 04 00 00 49 8b b4 24 c8 00 00 00 4c 89 ef e8 de 57 53 02 89 c6 48 8b 45 d0 48 8d b8 5c 10 00 00 48 89 f8 48 c1 e8 03 <0f> b6 14 18 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 1d
kobject: 'loop0' (00000000fd170c3b): fill_kobj_path: path = '/devices/virtual/block/loop0'
kobject: 'loop2' (00000000ee5c9176): kobject_uevent_env
kobject: 'kvm' (0000000022b1065e): kobject_uevent_env
kobject: 'loop2' (00000000ee5c9176): fill_kobj_path: path = '/devices/virtual/block/loop2'
RSP: 0018:ffff8880762cfcb0 EFLAGS: 00010203
kobject: 'loop4' (0000000078528116): kobject_uevent_env
RAX: 000000000000020b RBX: dffffc0000000000 RCX: 0000000000000000
kobject: 'loop4' (0000000078528116): fill_kobj_path: path = '/devices/virtual/block/loop4'
FAULT_INJECTION: forcing a failure.
name fail_page_alloc, interval 1, probability 0, space 0, times 1
RDX: 0000000000000000 RSI: 0000000000000008 RDI: 000000000000105c
CPU: 1 PID: 10377 Comm: syz-executor.5 Tainted: G      D           5.0.0-rc7+ #86
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail.cold+0xa/0x1b lib/fault-inject.c:149
kobject: 'kvm' (0000000022b1065e): fill_kobj_path: path = '/devices/virtual/misc/kvm'
RBP: ffff8880762cfd30 R08: ffff8880762c21c0 R09: ffff8880762c2a88
 __should_fail_alloc_page mm/page_alloc.c:3164 [inline]
 should_fail_alloc_page+0x50/0x60 mm/page_alloc.c:3211
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88809ea506c0
 prepare_alloc_pages mm/page_alloc.c:4488 [inline]
 __alloc_pages_nodemask+0x1a1/0x710 mm/page_alloc.c:4535
R13: ffff8880856b08c0 R14: ffff8880a0996da8 R15: ffff88809ea50730
 __alloc_pages include/linux/gfp.h:473 [inline]
 __alloc_pages_node include/linux/gfp.h:486 [inline]
 kmem_getpages mm/slab.c:1398 [inline]
 cache_grow_begin+0x9c/0x8c0 mm/slab.c:2667
FS:  0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
 cache_alloc_refill mm/slab.c:3040 [inline]
 ____cache_alloc mm/slab.c:3123 [inline]
 ____cache_alloc mm/slab.c:3106 [inline]
 __do_cache_alloc mm/slab.c:3345 [inline]
 slab_alloc mm/slab.c:3380 [inline]
 kmem_cache_alloc_trace+0x67f/0x760 mm/slab.c:3613
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff26ea3fe8 CR3: 000000008aba0000 CR4: 00000000001426f0
 kmalloc include/linux/slab.h:545 [inline]
 kzalloc include/linux/slab.h:740 [inline]
 hci_alloc_dev+0x43/0x1d00 net/bluetooth/hci_core.c:3116
 hci_uart_register_dev drivers/bluetooth/hci_ldisc.c:623 [inline]
 hci_uart_set_proto drivers/bluetooth/hci_ldisc.c:693 [inline]
 hci_uart_tty_ioctl+0x321/0xa70 drivers/bluetooth/hci_ldisc.c:748
 tty_ioctl+0xac9/0x14d0 drivers/tty/tty_io.c:2662