================================================================== BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:68 [inline] BUG: KASAN: null-ptr-deref in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] BUG: KASAN: null-ptr-deref in ida_free+0x1b9/0x400 lib/idr.c:511 Read of size 8 at addr 0000000000000048 by task syz-executor.0/28808 CPU: 1 PID: 28808 Comm: syz-executor.0 Not tainted 6.7.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 print_report+0xe6/0x540 mm/kasan/report.c:478 kasan_report+0x142/0x170 mm/kasan/report.c:588 kasan_check_range+0x27e/0x290 mm/kasan/generic.c:187 instrument_atomic_read include/linux/instrumented.h:68 [inline] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] ida_free+0x1b9/0x400 lib/idr.c:511 hci_conn_cleanup net/bluetooth/hci_conn.c:157 [inline] hci_conn_del+0x7c0/0xca0 net/bluetooth/hci_conn.c:1182 hci_conn_hash_flush+0x190/0x240 net/bluetooth/hci_conn.c:2615 hci_dev_close_sync+0x9b1/0xfe0 net/bluetooth/hci_sync.c:5021 hci_dev_do_close net/bluetooth/hci_core.c:554 [inline] hci_unregister_dev+0x1e3/0x4e0 net/bluetooth/hci_core.c:2739 vhci_release+0x83/0xd0 drivers/bluetooth/hci_vhci.c:672 __fput+0x3cc/0xa10 fs/file_table.c:394 task_work_run+0x24a/0x300 kernel/task_work.c:180 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0xa34/0x2750 kernel/exit.c:871 do_group_exit+0x206/0x2c0 kernel/exit.c:1021 get_signal+0x1769/0x1840 kernel/signal.c:2904 arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:309 exit_to_user_mode_loop+0x6a/0x100 kernel/entry/common.c:168 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x64/0x280 kernel/entry/common.c:296 do_syscall_64+0x50/0x110 arch/x86/entry/common.c:88 entry_SYSCALL_64_after_hwframe+0x63/0x6b RIP: 0033:0x7f7655aa7ef5 Code: Unable to access opcode bytes at 0x7f7655aa7ecb. RSP: 002b:00007f7656710010 EFLAGS: 00000293 ORIG_RAX: 00000000000000e6 RAX: fffffffffffffdfc RBX: 00007f7655b9bf80 RCX: 00007f7655aa7ef5 RDX: 00007f7656710050 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00007f7655ac847a R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 000000000000000b R14: 00007f7655b9bf80 R15: 00007ffcad101188 ==================================================================