BUG: memory leak
unreferenced object 0xffff888118e08100 (size 224):
  comm "syz-executor023", pid 6992, jiffies 4294951610 (age 20.220s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000cc630ac2>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<00000000cc630ac2>] slab_post_alloc_hook mm/slab.h:586 [inline]
    [<00000000cc630ac2>] slab_alloc_node mm/slab.c:3262 [inline]
    [<00000000cc630ac2>] kmem_cache_alloc_node+0x163/0x2f0 mm/slab.c:3574
    [<0000000092c50770>] __alloc_skb+0x6e/0x210 net/core/skbuff.c:197
    [<00000000c481b7bb>] alloc_skb include/linux/skbuff.h:1049 [inline]
    [<00000000c481b7bb>] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
    [<00000000c481b7bb>] h4_recv_buf+0x26d/0x450 drivers/bluetooth/hci_h4.c:182
    [<00000000a5e6eede>] ag6xx_recv+0x51/0xb0 drivers/bluetooth/hci_ag6xx.c:108
    [<000000001bbc9bf6>] hci_uart_tty_receive+0xba/0x200 drivers/bluetooth/hci_ldisc.c:613
    [<000000002409ede1>] tiocsti drivers/tty/tty_io.c:2197 [inline]
    [<000000002409ede1>] tty_ioctl+0x81c/0xa30 drivers/tty/tty_io.c:2573
    [<00000000b6405218>] vfs_ioctl fs/ioctl.c:46 [inline]
    [<00000000b6405218>] file_ioctl fs/ioctl.c:509 [inline]
    [<00000000b6405218>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
    [<00000000227212f5>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
    [<00000000fa2f34da>] __do_sys_ioctl fs/ioctl.c:720 [inline]
    [<00000000fa2f34da>] __se_sys_ioctl fs/ioctl.c:718 [inline]
    [<00000000fa2f34da>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
    [<00000000c524bfec>] do_syscall_64+0x73/0x1f0 arch/x86/entry/common.c:290
    [<000000000f99ee15>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888118e08100 (size 224):
  comm "syz-executor023", pid 6992, jiffies 4294951610 (age 20.270s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000cc630ac2>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<00000000cc630ac2>] slab_post_alloc_hook mm/slab.h:586 [inline]
    [<00000000cc630ac2>] slab_alloc_node mm/slab.c:3262 [inline]
    [<00000000cc630ac2>] kmem_cache_alloc_node+0x163/0x2f0 mm/slab.c:3574
    [<0000000092c50770>] __alloc_skb+0x6e/0x210 net/core/skbuff.c:197
    [<00000000c481b7bb>] alloc_skb include/linux/skbuff.h:1049 [inline]
    [<00000000c481b7bb>] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
    [<00000000c481b7bb>] h4_recv_buf+0x26d/0x450 drivers/bluetooth/hci_h4.c:182
    [<00000000a5e6eede>] ag6xx_recv+0x51/0xb0 drivers/bluetooth/hci_ag6xx.c:108
    [<000000001bbc9bf6>] hci_uart_tty_receive+0xba/0x200 drivers/bluetooth/hci_ldisc.c:613
    [<000000002409ede1>] tiocsti drivers/tty/tty_io.c:2197 [inline]
    [<000000002409ede1>] tty_ioctl+0x81c/0xa30 drivers/tty/tty_io.c:2573
    [<00000000b6405218>] vfs_ioctl fs/ioctl.c:46 [inline]
    [<00000000b6405218>] file_ioctl fs/ioctl.c:509 [inline]
    [<00000000b6405218>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
    [<00000000227212f5>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
    [<00000000fa2f34da>] __do_sys_ioctl fs/ioctl.c:720 [inline]
    [<00000000fa2f34da>] __se_sys_ioctl fs/ioctl.c:718 [inline]
    [<00000000fa2f34da>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
    [<00000000c524bfec>] do_syscall_64+0x73/0x1f0 arch/x86/entry/common.c:290
    [<000000000f99ee15>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888118e08100 (size 224):
  comm "syz-executor023", pid 6992, jiffies 4294951610 (age 21.210s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000cc630ac2>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<00000000cc630ac2>] slab_post_alloc_hook mm/slab.h:586 [inline]
    [<00000000cc630ac2>] slab_alloc_node mm/slab.c:3262 [inline]
    [<00000000cc630ac2>] kmem_cache_alloc_node+0x163/0x2f0 mm/slab.c:3574
    [<0000000092c50770>] __alloc_skb+0x6e/0x210 net/core/skbuff.c:197
    [<00000000c481b7bb>] alloc_skb include/linux/skbuff.h:1049 [inline]
    [<00000000c481b7bb>] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
    [<00000000c481b7bb>] h4_recv_buf+0x26d/0x450 drivers/bluetooth/hci_h4.c:182
    [<00000000a5e6eede>] ag6xx_recv+0x51/0xb0 drivers/bluetooth/hci_ag6xx.c:108
    [<000000001bbc9bf6>] hci_uart_tty_receive+0xba/0x200 drivers/bluetooth/hci_ldisc.c:613
    [<000000002409ede1>] tiocsti drivers/tty/tty_io.c:2197 [inline]
    [<000000002409ede1>] tty_ioctl+0x81c/0xa30 drivers/tty/tty_io.c:2573
    [<00000000b6405218>] vfs_ioctl fs/ioctl.c:46 [inline]
    [<00000000b6405218>] file_ioctl fs/ioctl.c:509 [inline]
    [<00000000b6405218>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
    [<00000000227212f5>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
    [<00000000fa2f34da>] __do_sys_ioctl fs/ioctl.c:720 [inline]
    [<00000000fa2f34da>] __se_sys_ioctl fs/ioctl.c:718 [inline]
    [<00000000fa2f34da>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
    [<00000000c524bfec>] do_syscall_64+0x73/0x1f0 arch/x86/entry/common.c:290
    [<000000000f99ee15>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888118e08100 (size 224):
  comm "syz-executor023", pid 6992, jiffies 4294951610 (age 22.170s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000cc630ac2>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<00000000cc630ac2>] slab_post_alloc_hook mm/slab.h:586 [inline]
    [<00000000cc630ac2>] slab_alloc_node mm/slab.c:3262 [inline]
    [<00000000cc630ac2>] kmem_cache_alloc_node+0x163/0x2f0 mm/slab.c:3574
    [<0000000092c50770>] __alloc_skb+0x6e/0x210 net/core/skbuff.c:197
    [<00000000c481b7bb>] alloc_skb include/linux/skbuff.h:1049 [inline]
    [<00000000c481b7bb>] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
    [<00000000c481b7bb>] h4_recv_buf+0x26d/0x450 drivers/bluetooth/hci_h4.c:182
    [<00000000a5e6eede>] ag6xx_recv+0x51/0xb0 drivers/bluetooth/hci_ag6xx.c:108
    [<000000001bbc9bf6>] hci_uart_tty_receive+0xba/0x200 drivers/bluetooth/hci_ldisc.c:613
    [<000000002409ede1>] tiocsti drivers/tty/tty_io.c:2197 [inline]
    [<000000002409ede1>] tty_ioctl+0x81c/0xa30 drivers/tty/tty_io.c:2573
    [<00000000b6405218>] vfs_ioctl fs/ioctl.c:46 [inline]
    [<00000000b6405218>] file_ioctl fs/ioctl.c:509 [inline]
    [<00000000b6405218>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
    [<00000000227212f5>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
    [<00000000fa2f34da>] __do_sys_ioctl fs/ioctl.c:720 [inline]
    [<00000000fa2f34da>] __se_sys_ioctl fs/ioctl.c:718 [inline]
    [<00000000fa2f34da>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
    [<00000000c524bfec>] do_syscall_64+0x73/0x1f0 arch/x86/entry/common.c:290
    [<000000000f99ee15>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888118e08100 (size 224):
  comm "syz-executor023", pid 6992, jiffies 4294951610 (age 23.110s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000cc630ac2>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<00000000cc630ac2>] slab_post_alloc_hook mm/slab.h:586 [inline]
    [<00000000cc630ac2>] slab_alloc_node mm/slab.c:3262 [inline]
    [<00000000cc630ac2>] kmem_cache_alloc_node+0x163/0x2f0 mm/slab.c:3574
    [<0000000092c50770>] __alloc_skb+0x6e/0x210 net/core/skbuff.c:197
    [<00000000c481b7bb>] alloc_skb include/linux/skbuff.h:1049 [inline]
    [<00000000c481b7bb>] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
    [<00000000c481b7bb>] h4_recv_buf+0x26d/0x450 drivers/bluetooth/hci_h4.c:182
    [<00000000a5e6eede>] ag6xx_recv+0x51/0xb0 drivers/bluetooth/hci_ag6xx.c:108
    [<000000001bbc9bf6>] hci_uart_tty_receive+0xba/0x200 drivers/bluetooth/hci_ldisc.c:613
    [<000000002409ede1>] tiocsti drivers/tty/tty_io.c:2197 [inline]
    [<000000002409ede1>] tty_ioctl+0x81c/0xa30 drivers/tty/tty_io.c:2573
    [<00000000b6405218>] vfs_ioctl fs/ioctl.c:46 [inline]
    [<00000000b6405218>] file_ioctl fs/ioctl.c:509 [inline]
    [<00000000b6405218>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
    [<00000000227212f5>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
    [<00000000fa2f34da>] __do_sys_ioctl fs/ioctl.c:720 [inline]
    [<00000000fa2f34da>] __se_sys_ioctl fs/ioctl.c:718 [inline]
    [<00000000fa2f34da>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
    [<00000000c524bfec>] do_syscall_64+0x73/0x1f0 arch/x86/entry/common.c:290
    [<000000000f99ee15>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888118e08100 (size 224):
  comm "syz-executor023", pid 6992, jiffies 4294951610 (age 24.050s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000cc630ac2>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<00000000cc630ac2>] slab_post_alloc_hook mm/slab.h:586 [inline]
    [<00000000cc630ac2>] slab_alloc_node mm/slab.c:3262 [inline]
    [<00000000cc630ac2>] kmem_cache_alloc_node+0x163/0x2f0 mm/slab.c:3574
    [<0000000092c50770>] __alloc_skb+0x6e/0x210 net/core/skbuff.c:197
    [<00000000c481b7bb>] alloc_skb include/linux/skbuff.h:1049 [inline]
    [<00000000c481b7bb>] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
    [<00000000c481b7bb>] h4_recv_buf+0x26d/0x450 drivers/bluetooth/hci_h4.c:182
    [<00000000a5e6eede>] ag6xx_recv+0x51/0xb0 drivers/bluetooth/hci_ag6xx.c:108
    [<000000001bbc9bf6>] hci_uart_tty_receive+0xba/0x200 drivers/bluetooth/hci_ldisc.c:613
    [<000000002409ede1>] tiocsti drivers/tty/tty_io.c:2197 [inline]
    [<000000002409ede1>] tty_ioctl+0x81c/0xa30 drivers/tty/tty_io.c:2573
    [<00000000b6405218>] vfs_ioctl fs/ioctl.c:46 [inline]
    [<00000000b6405218>] file_ioctl fs/ioctl.c:509 [inline]
    [<00000000b6405218>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
    [<00000000227212f5>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
    [<00000000fa2f34da>] __do_sys_ioctl fs/ioctl.c:720 [inline]
    [<00000000fa2f34da>] __se_sys_ioctl fs/ioctl.c:718 [inline]
    [<00000000fa2f34da>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
    [<00000000c524bfec>] do_syscall_64+0x73/0x1f0 arch/x86/entry/common.c:290
    [<000000000f99ee15>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888118e08100 (size 224):
  comm "syz-executor023", pid 6992, jiffies 4294951610 (age 24.110s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000cc630ac2>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<00000000cc630ac2>] slab_post_alloc_hook mm/slab.h:586 [inline]
    [<00000000cc630ac2>] slab_alloc_node mm/slab.c:3262 [inline]
    [<00000000cc630ac2>] kmem_cache_alloc_node+0x163/0x2f0 mm/slab.c:3574
    [<0000000092c50770>] __alloc_skb+0x6e/0x210 net/core/skbuff.c:197
    [<00000000c481b7bb>] alloc_skb include/linux/skbuff.h:1049 [inline]
    [<00000000c481b7bb>] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
    [<00000000c481b7bb>] h4_recv_buf+0x26d/0x450 drivers/bluetooth/hci_h4.c:182
    [<00000000a5e6eede>] ag6xx_recv+0x51/0xb0 drivers/bluetooth/hci_ag6xx.c:108
    [<000000001bbc9bf6>] hci_uart_tty_receive+0xba/0x200 drivers/bluetooth/hci_ldisc.c:613
    [<000000002409ede1>] tiocsti drivers/tty/tty_io.c:2197 [inline]
    [<000000002409ede1>] tty_ioctl+0x81c/0xa30 drivers/tty/tty_io.c:2573
    [<00000000b6405218>] vfs_ioctl fs/ioctl.c:46 [inline]
    [<00000000b6405218>] file_ioctl fs/ioctl.c:509 [inline]
    [<00000000b6405218>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
    [<00000000227212f5>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
    [<00000000fa2f34da>] __do_sys_ioctl fs/ioctl.c:720 [inline]
    [<00000000fa2f34da>] __se_sys_ioctl fs/ioctl.c:718 [inline]
    [<00000000fa2f34da>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
    [<00000000c524bfec>] do_syscall_64+0x73/0x1f0 arch/x86/entry/common.c:290
    [<000000000f99ee15>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888118e08100 (size 224):
  comm "syz-executor023", pid 6992, jiffies 4294951610 (age 24.160s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000cc630ac2>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<00000000cc630ac2>] slab_post_alloc_hook mm/slab.h:586 [inline]
    [<00000000cc630ac2>] slab_alloc_node mm/slab.c:3262 [inline]
    [<00000000cc630ac2>] kmem_cache_alloc_node+0x163/0x2f0 mm/slab.c:3574
    [<0000000092c50770>] __alloc_skb+0x6e/0x210 net/core/skbuff.c:197
    [<00000000c481b7bb>] alloc_skb include/linux/skbuff.h:1049 [inline]
    [<00000000c481b7bb>] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
    [<00000000c481b7bb>] h4_recv_buf+0x26d/0x450 drivers/bluetooth/hci_h4.c:182
    [<00000000a5e6eede>] ag6xx_recv+0x51/0xb0 drivers/bluetooth/hci_ag6xx.c:108
    [<000000001bbc9bf6>] hci_uart_tty_receive+0xba/0x200 drivers/bluetooth/hci_ldisc.c:613
    [<000000002409ede1>] tiocsti drivers/tty/tty_io.c:2197 [inline]
    [<000000002409ede1>] tty_ioctl+0x81c/0xa30 drivers/tty/tty_io.c:2573
    [<00000000b6405218>] vfs_ioctl fs/ioctl.c:46 [inline]
    [<00000000b6405218>] file_ioctl fs/ioctl.c:509 [inline]
    [<00000000b6405218>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
    [<00000000227212f5>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
    [<00000000fa2f34da>] __do_sys_ioctl fs/ioctl.c:720 [inline]
    [<00000000fa2f34da>] __se_sys_ioctl fs/ioctl.c:718 [inline]
    [<00000000fa2f34da>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
    [<00000000c524bfec>] do_syscall_64+0x73/0x1f0 arch/x86/entry/common.c:290
    [<000000000f99ee15>] entry_SYSCALL_64_after_hwframe+0x44/0xa9