BUG: memory leak
unreferenced object 0xffff88811643af00 (size 224):
  comm "syz-executor599", pid 7015, jiffies 4294947999 (age 23.270s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<0000000068aebe83>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<0000000068aebe83>] slab_post_alloc_hook mm/slab.h:522 [inline]
    [<0000000068aebe83>] slab_alloc_node mm/slab.c:3262 [inline]
    [<0000000068aebe83>] kmem_cache_alloc_node+0x163/0x2f0 mm/slab.c:3574
    [<00000000a43644f5>] __alloc_skb+0x6e/0x210 net/core/skbuff.c:197
    [<0000000081920b3f>] alloc_skb include/linux/skbuff.h:1055 [inline]
    [<0000000081920b3f>] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
    [<0000000081920b3f>] h4_recv_buf+0x26d/0x450 drivers/bluetooth/hci_h4.c:182
    [<0000000047237b37>] ag6xx_recv+0x51/0xb0 drivers/bluetooth/hci_ag6xx.c:108
    [<000000001ab42fc6>] hci_uart_tty_receive+0xba/0x200 drivers/bluetooth/hci_ldisc.c:613
    [<000000001fec88ba>] tiocsti drivers/tty/tty_io.c:2197 [inline]
    [<000000001fec88ba>] tty_ioctl+0x81c/0xa30 drivers/tty/tty_io.c:2573
    [<00000000e83c8b15>] vfs_ioctl fs/ioctl.c:46 [inline]
    [<00000000e83c8b15>] file_ioctl fs/ioctl.c:509 [inline]
    [<00000000e83c8b15>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
    [<000000004ad6bee5>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
    [<000000008bbf34c1>] __do_sys_ioctl fs/ioctl.c:720 [inline]
    [<000000008bbf34c1>] __se_sys_ioctl fs/ioctl.c:718 [inline]
    [<000000008bbf34c1>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
    [<0000000092142cda>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:296
    [<0000000007dace5c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888121a20400 (size 1024):
  comm "syz-executor599", pid 7015, jiffies 4294947999 (age 23.270s)
  hex dump (first 32 bytes):
    ad de ad de 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 4f 95 2a 81 88 ff ff a0 7e 9b 83 ff ff ff ff  .O.*.....~......
  backtrace:
    [<00000000267d43aa>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<00000000267d43aa>] slab_post_alloc_hook mm/slab.h:522 [inline]
    [<00000000267d43aa>] slab_alloc_node mm/slab.c:3262 [inline]
    [<00000000267d43aa>] kmem_cache_alloc_node_trace+0x161/0x2f0 mm/slab.c:3592
    [<000000002e93be84>] __do_kmalloc_node mm/slab.c:3614 [inline]
    [<000000002e93be84>] __kmalloc_node_track_caller+0x38/0x50 mm/slab.c:3629
    [<00000000bf186cd6>] __kmalloc_reserve.isra.0+0x40/0xb0 net/core/skbuff.c:141
    [<0000000069840101>] __alloc_skb+0xa0/0x210 net/core/skbuff.c:209
    [<0000000081920b3f>] alloc_skb include/linux/skbuff.h:1055 [inline]
    [<0000000081920b3f>] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
    [<0000000081920b3f>] h4_recv_buf+0x26d/0x450 drivers/bluetooth/hci_h4.c:182
    [<0000000047237b37>] ag6xx_recv+0x51/0xb0 drivers/bluetooth/hci_ag6xx.c:108
    [<000000001ab42fc6>] hci_uart_tty_receive+0xba/0x200 drivers/bluetooth/hci_ldisc.c:613
    [<000000001fec88ba>] tiocsti drivers/tty/tty_io.c:2197 [inline]
    [<000000001fec88ba>] tty_ioctl+0x81c/0xa30 drivers/tty/tty_io.c:2573
    [<00000000e83c8b15>] vfs_ioctl fs/ioctl.c:46 [inline]
    [<00000000e83c8b15>] file_ioctl fs/ioctl.c:509 [inline]
    [<00000000e83c8b15>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
    [<000000004ad6bee5>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
    [<000000008bbf34c1>] __do_sys_ioctl fs/ioctl.c:720 [inline]
    [<000000008bbf34c1>] __se_sys_ioctl fs/ioctl.c:718 [inline]
    [<000000008bbf34c1>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
    [<0000000092142cda>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:296
    [<0000000007dace5c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff88811643ab00 (size 224):
  comm "syz-executor599", pid 7018, jiffies 4294948055 (age 22.710s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<0000000068aebe83>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<0000000068aebe83>] slab_post_alloc_hook mm/slab.h:522 [inline]
    [<0000000068aebe83>] slab_alloc_node mm/slab.c:3262 [inline]
    [<0000000068aebe83>] kmem_cache_alloc_node+0x163/0x2f0 mm/slab.c:3574
    [<00000000a43644f5>] __alloc_skb+0x6e/0x210 net/core/skbuff.c:197
    [<0000000081920b3f>] alloc_skb include/linux/skbuff.h:1055 [inline]
    [<0000000081920b3f>] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
    [<0000000081920b3f>] h4_recv_buf+0x26d/0x450 drivers/bluetooth/hci_h4.c:182
    [<0000000047237b37>] ag6xx_recv+0x51/0xb0 drivers/bluetooth/hci_ag6xx.c:108
    [<000000001ab42fc6>] hci_uart_tty_receive+0xba/0x200 drivers/bluetooth/hci_ldisc.c:613
    [<000000001fec88ba>] tiocsti drivers/tty/tty_io.c:2197 [inline]
    [<000000001fec88ba>] tty_ioctl+0x81c/0xa30 drivers/tty/tty_io.c:2573
    [<00000000e83c8b15>] vfs_ioctl fs/ioctl.c:46 [inline]
    [<00000000e83c8b15>] file_ioctl fs/ioctl.c:509 [inline]
    [<00000000e83c8b15>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
    [<000000004ad6bee5>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
    [<000000008bbf34c1>] __do_sys_ioctl fs/ioctl.c:720 [inline]
    [<000000008bbf34c1>] __se_sys_ioctl fs/ioctl.c:718 [inline]
    [<000000008bbf34c1>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
    [<0000000092142cda>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:296
    [<0000000007dace5c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888121a0bc00 (size 1024):
  comm "syz-executor599", pid 7018, jiffies 4294948055 (age 22.710s)
  hex dump (first 32 bytes):
    00 00 00 03 00 00 00 00 06 00 00 00 00 01 00 00  ................
    06 00 00 00 06 00 00 00 01 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000267d43aa>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<00000000267d43aa>] slab_post_alloc_hook mm/slab.h:522 [inline]
    [<00000000267d43aa>] slab_alloc_node mm/slab.c:3262 [inline]
    [<00000000267d43aa>] kmem_cache_alloc_node_trace+0x161/0x2f0 mm/slab.c:3592
    [<000000002e93be84>] __do_kmalloc_node mm/slab.c:3614 [inline]
    [<000000002e93be84>] __kmalloc_node_track_caller+0x38/0x50 mm/slab.c:3629
    [<00000000bf186cd6>] __kmalloc_reserve.isra.0+0x40/0xb0 net/core/skbuff.c:141
    [<0000000069840101>] __alloc_skb+0xa0/0x210 net/core/skbuff.c:209
    [<0000000081920b3f>] alloc_skb include/linux/skbuff.h:1055 [inline]
    [<0000000081920b3f>] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
    [<0000000081920b3f>] h4_recv_buf+0x26d/0x450 drivers/bluetooth/hci_h4.c:182
    [<0000000047237b37>] ag6xx_recv+0x51/0xb0 drivers/bluetooth/hci_ag6xx.c:108
    [<000000001ab42fc6>] hci_uart_tty_receive+0xba/0x200 drivers/bluetooth/hci_ldisc.c:613
    [<000000001fec88ba>] tiocsti drivers/tty/tty_io.c:2197 [inline]
    [<000000001fec88ba>] tty_ioctl+0x81c/0xa30 drivers/tty/tty_io.c:2573
    [<00000000e83c8b15>] vfs_ioctl fs/ioctl.c:46 [inline]
    [<00000000e83c8b15>] file_ioctl fs/ioctl.c:509 [inline]
    [<00000000e83c8b15>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
    [<000000004ad6bee5>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
    [<000000008bbf34c1>] __do_sys_ioctl fs/ioctl.c:720 [inline]
    [<000000008bbf34c1>] __se_sys_ioctl fs/ioctl.c:718 [inline]
    [<000000008bbf34c1>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
    [<0000000092142cda>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:296
    [<0000000007dace5c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff88811643af00 (size 224):
  comm "syz-executor599", pid 7015, jiffies 4294947999 (age 24.410s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<0000000068aebe83>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<0000000068aebe83>] slab_post_alloc_hook mm/slab.h:522 [inline]
    [<0000000068aebe83>] slab_alloc_node mm/slab.c:3262 [inline]
    [<0000000068aebe83>] kmem_cache_alloc_node+0x163/0x2f0 mm/slab.c:3574
    [<00000000a43644f5>] __alloc_skb+0x6e/0x210 net/core/skbuff.c:197
    [<0000000081920b3f>] alloc_skb include/linux/skbuff.h:1055 [inline]
    [<0000000081920b3f>] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
    [<0000000081920b3f>] h4_recv_buf+0x26d/0x450 drivers/bluetooth/hci_h4.c:182
    [<0000000047237b37>] ag6xx_recv+0x51/0xb0 drivers/bluetooth/hci_ag6xx.c:108
    [<000000001ab42fc6>] hci_uart_tty_receive+0xba/0x200 drivers/bluetooth/hci_ldisc.c:613
    [<000000001fec88ba>] tiocsti drivers/tty/tty_io.c:2197 [inline]
    [<000000001fec88ba>] tty_ioctl+0x81c/0xa30 drivers/tty/tty_io.c:2573
    [<00000000e83c8b15>] vfs_ioctl fs/ioctl.c:46 [inline]
    [<00000000e83c8b15>] file_ioctl fs/ioctl.c:509 [inline]
    [<00000000e83c8b15>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
    [<000000004ad6bee5>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
    [<000000008bbf34c1>] __do_sys_ioctl fs/ioctl.c:720 [inline]
    [<000000008bbf34c1>] __se_sys_ioctl fs/ioctl.c:718 [inline]
    [<000000008bbf34c1>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
    [<0000000092142cda>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:296
    [<0000000007dace5c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888121a20400 (size 1024):
  comm "syz-executor599", pid 7015, jiffies 4294947999 (age 24.410s)
  hex dump (first 32 bytes):
    ad de ad de 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 4f 95 2a 81 88 ff ff a0 7e 9b 83 ff ff ff ff  .O.*.....~......
  backtrace:
    [<00000000267d43aa>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<00000000267d43aa>] slab_post_alloc_hook mm/slab.h:522 [inline]
    [<00000000267d43aa>] slab_alloc_node mm/slab.c:3262 [inline]
    [<00000000267d43aa>] kmem_cache_alloc_node_trace+0x161/0x2f0 mm/slab.c:3592
    [<000000002e93be84>] __do_kmalloc_node mm/slab.c:3614 [inline]
    [<000000002e93be84>] __kmalloc_node_track_caller+0x38/0x50 mm/slab.c:3629
    [<00000000bf186cd6>] __kmalloc_reserve.isra.0+0x40/0xb0 net/core/skbuff.c:141
    [<0000000069840101>] __alloc_skb+0xa0/0x210 net/core/skbuff.c:209
    [<0000000081920b3f>] alloc_skb include/linux/skbuff.h:1055 [inline]
    [<0000000081920b3f>] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
    [<0000000081920b3f>] h4_recv_buf+0x26d/0x450 drivers/bluetooth/hci_h4.c:182
    [<0000000047237b37>] ag6xx_recv+0x51/0xb0 drivers/bluetooth/hci_ag6xx.c:108
    [<000000001ab42fc6>] hci_uart_tty_receive+0xba/0x200 drivers/bluetooth/hci_ldisc.c:613
    [<000000001fec88ba>] tiocsti drivers/tty/tty_io.c:2197 [inline]
    [<000000001fec88ba>] tty_ioctl+0x81c/0xa30 drivers/tty/tty_io.c:2573
    [<00000000e83c8b15>] vfs_ioctl fs/ioctl.c:46 [inline]
    [<00000000e83c8b15>] file_ioctl fs/ioctl.c:509 [inline]
    [<00000000e83c8b15>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
    [<000000004ad6bee5>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
    [<000000008bbf34c1>] __do_sys_ioctl fs/ioctl.c:720 [inline]
    [<000000008bbf34c1>] __se_sys_ioctl fs/ioctl.c:718 [inline]
    [<000000008bbf34c1>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
    [<0000000092142cda>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:296
    [<0000000007dace5c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff88811643ab00 (size 224):
  comm "syz-executor599", pid 7018, jiffies 4294948055 (age 23.850s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<0000000068aebe83>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<0000000068aebe83>] slab_post_alloc_hook mm/slab.h:522 [inline]
    [<0000000068aebe83>] slab_alloc_node mm/slab.c:3262 [inline]
    [<0000000068aebe83>] kmem_cache_alloc_node+0x163/0x2f0 mm/slab.c:3574
    [<00000000a43644f5>] __alloc_skb+0x6e/0x210 net/core/skbuff.c:197
    [<0000000081920b3f>] alloc_skb include/linux/skbuff.h:1055 [inline]
    [<0000000081920b3f>] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
    [<0000000081920b3f>] h4_recv_buf+0x26d/0x450 drivers/bluetooth/hci_h4.c:182
    [<0000000047237b37>] ag6xx_recv+0x51/0xb0 drivers/bluetooth/hci_ag6xx.c:108
    [<000000001ab42fc6>] hci_uart_tty_receive+0xba/0x200 drivers/bluetooth/hci_ldisc.c:613
    [<000000001fec88ba>] tiocsti drivers/tty/tty_io.c:2197 [inline]
    [<000000001fec88ba>] tty_ioctl+0x81c/0xa30 drivers/tty/tty_io.c:2573
    [<00000000e83c8b15>] vfs_ioctl fs/ioctl.c:46 [inline]
    [<00000000e83c8b15>] file_ioctl fs/ioctl.c:509 [inline]
    [<00000000e83c8b15>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
    [<000000004ad6bee5>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
    [<000000008bbf34c1>] __do_sys_ioctl fs/ioctl.c:720 [inline]
    [<000000008bbf34c1>] __se_sys_ioctl fs/ioctl.c:718 [inline]
    [<000000008bbf34c1>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
    [<0000000092142cda>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:296
    [<0000000007dace5c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888121a0bc00 (size 1024):
  comm "syz-executor599", pid 7018, jiffies 4294948055 (age 23.850s)
  hex dump (first 32 bytes):
    00 00 00 03 00 00 00 00 06 00 00 00 00 01 00 00  ................
    06 00 00 00 06 00 00 00 01 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000267d43aa>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<00000000267d43aa>] slab_post_alloc_hook mm/slab.h:522 [inline]
    [<00000000267d43aa>] slab_alloc_node mm/slab.c:3262 [inline]
    [<00000000267d43aa>] kmem_cache_alloc_node_trace+0x161/0x2f0 mm/slab.c:3592
    [<000000002e93be84>] __do_kmalloc_node mm/slab.c:3614 [inline]
    [<000000002e93be84>] __kmalloc_node_track_caller+0x38/0x50 mm/slab.c:3629
    [<00000000bf186cd6>] __kmalloc_reserve.isra.0+0x40/0xb0 net/core/skbuff.c:141
    [<0000000069840101>] __alloc_skb+0xa0/0x210 net/core/skbuff.c:209
    [<0000000081920b3f>] alloc_skb include/linux/skbuff.h:1055 [inline]
    [<0000000081920b3f>] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
    [<0000000081920b3f>] h4_recv_buf+0x26d/0x450 drivers/bluetooth/hci_h4.c:182
    [<0000000047237b37>] ag6xx_recv+0x51/0xb0 drivers/bluetooth/hci_ag6xx.c:108
    [<000000001ab42fc6>] hci_uart_tty_receive+0xba/0x200 drivers/bluetooth/hci_ldisc.c:613
    [<000000001fec88ba>] tiocsti drivers/tty/tty_io.c:2197 [inline]
    [<000000001fec88ba>] tty_ioctl+0x81c/0xa30 drivers/tty/tty_io.c:2573
    [<00000000e83c8b15>] vfs_ioctl fs/ioctl.c:46 [inline]
    [<00000000e83c8b15>] file_ioctl fs/ioctl.c:509 [inline]
    [<00000000e83c8b15>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
    [<000000004ad6bee5>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
    [<000000008bbf34c1>] __do_sys_ioctl fs/ioctl.c:720 [inline]
    [<000000008bbf34c1>] __se_sys_ioctl fs/ioctl.c:718 [inline]
    [<000000008bbf34c1>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
    [<0000000092142cda>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:296
    [<0000000007dace5c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff88811643af00 (size 224):
  comm "syz-executor599", pid 7015, jiffies 4294947999 (age 25.550s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<0000000068aebe83>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<0000000068aebe83>] slab_post_alloc_hook mm/slab.h:522 [inline]
    [<0000000068aebe83>] slab_alloc_node mm/slab.c:3262 [inline]
    [<0000000068aebe83>] kmem_cache_alloc_node+0x163/0x2f0 mm/slab.c:3574
    [<00000000a43644f5>] __alloc_skb+0x6e/0x210 net/core/skbuff.c:197
    [<0000000081920b3f>] alloc_skb include/linux/skbuff.h:1055 [inline]
    [<0000000081920b3f>] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
    [<0000000081920b3f>] h4_recv_buf+0x26d/0x450 drivers/bluetooth/hci_h4.c:182
    [<0000000047237b37>] ag6xx_recv+0x51/0xb0 drivers/bluetooth/hci_ag6xx.c:108
    [<000000001ab42fc6>] hci_uart_tty_receive+0xba/0x200 drivers/bluetooth/hci_ldisc.c:613
    [<000000001fec88ba>] tiocsti drivers/tty/tty_io.c:2197 [inline]
    [<000000001fec88ba>] tty_ioctl+0x81c/0xa30 drivers/tty/tty_io.c:2573
    [<00000000e83c8b15>] vfs_ioctl fs/ioctl.c:46 [inline]
    [<00000000e83c8b15>] file_ioctl fs/ioctl.c:509 [inline]
    [<00000000e83c8b15>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
    [<000000004ad6bee5>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
    [<000000008bbf34c1>] __do_sys_ioctl fs/ioctl.c:720 [inline]
    [<000000008bbf34c1>] __se_sys_ioctl fs/ioctl.c:718 [inline]
    [<000000008bbf34c1>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
    [<0000000092142cda>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:296
    [<0000000007dace5c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888121a20400 (size 1024):
  comm "syz-executor599", pid 7015, jiffies 4294947999 (age 25.550s)
  hex dump (first 32 bytes):
    ad de ad de 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 4f 95 2a 81 88 ff ff a0 7e 9b 83 ff ff ff ff  .O.*.....~......
  backtrace:
    [<00000000267d43aa>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<00000000267d43aa>] slab_post_alloc_hook mm/slab.h:522 [inline]
    [<00000000267d43aa>] slab_alloc_node mm/slab.c:3262 [inline]
    [<00000000267d43aa>] kmem_cache_alloc_node_trace+0x161/0x2f0 mm/slab.c:3592
    [<000000002e93be84>] __do_kmalloc_node mm/slab.c:3614 [inline]
    [<000000002e93be84>] __kmalloc_node_track_caller+0x38/0x50 mm/slab.c:3629
    [<00000000bf186cd6>] __kmalloc_reserve.isra.0+0x40/0xb0 net/core/skbuff.c:141
    [<0000000069840101>] __alloc_skb+0xa0/0x210 net/core/skbuff.c:209
    [<0000000081920b3f>] alloc_skb include/linux/skbuff.h:1055 [inline]
    [<0000000081920b3f>] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
    [<0000000081920b3f>] h4_recv_buf+0x26d/0x450 drivers/bluetooth/hci_h4.c:182
    [<0000000047237b37>] ag6xx_recv+0x51/0xb0 drivers/bluetooth/hci_ag6xx.c:108
    [<000000001ab42fc6>] hci_uart_tty_receive+0xba/0x200 drivers/bluetooth/hci_ldisc.c:613
    [<000000001fec88ba>] tiocsti drivers/tty/tty_io.c:2197 [inline]
    [<000000001fec88ba>] tty_ioctl+0x81c/0xa30 drivers/tty/tty_io.c:2573
    [<00000000e83c8b15>] vfs_ioctl fs/ioctl.c:46 [inline]
    [<00000000e83c8b15>] file_ioctl fs/ioctl.c:509 [inline]
    [<00000000e83c8b15>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
    [<000000004ad6bee5>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
    [<000000008bbf34c1>] __do_sys_ioctl fs/ioctl.c:720 [inline]
    [<000000008bbf34c1>] __se_sys_ioctl fs/ioctl.c:718 [inline]
    [<000000008bbf34c1>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
    [<0000000092142cda>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:296
    [<0000000007dace5c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff88811643ab00 (size 224):
  comm "syz-executor599", pid 7018, jiffies 4294948055 (age 24.990s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<0000000068aebe83>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<0000000068aebe83>] slab_post_alloc_hook mm/slab.h:522 [inline]
    [<0000000068aebe83>] slab_alloc_node mm/slab.c:3262 [inline]
    [<0000000068aebe83>] kmem_cache_alloc_node+0x163/0x2f0 mm/slab.c:3574
    [<00000000a43644f5>] __alloc_skb+0x6e/0x210 net/core/skbuff.c:197
    [<0000000081920b3f>] alloc_skb include/linux/skbuff.h:1055 [inline]
    [<0000000081920b3f>] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
    [<0000000081920b3f>] h4_recv_buf+0x26d/0x450 drivers/bluetooth/hci_h4.c:182
    [<0000000047237b37>] ag6xx_recv+0x51/0xb0 drivers/bluetooth/hci_ag6xx.c:108
    [<000000001ab42fc6>] hci_uart_tty_receive+0xba/0x200 drivers/bluetooth/hci_ldisc.c:613
    [<000000001fec88ba>] tiocsti drivers/tty/tty_io.c:2197 [inline]
    [<000000001fec88ba>] tty_ioctl+0x81c/0xa30 drivers/tty/tty_io.c:2573
    [<00000000e83c8b15>] vfs_ioctl fs/ioctl.c:46 [inline]
    [<00000000e83c8b15>] file_ioctl fs/ioctl.c:509 [inline]
    [<00000000e83c8b15>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
    [<000000004ad6bee5>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
    [<000000008bbf34c1>] __do_sys_ioctl fs/ioctl.c:720 [inline]
    [<000000008bbf34c1>] __se_sys_ioctl fs/ioctl.c:718 [inline]
    [<000000008bbf34c1>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
    [<0000000092142cda>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:296
    [<0000000007dace5c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888121a0bc00 (size 1024):
  comm "syz-executor599", pid 7018, jiffies 4294948055 (age 24.990s)
  hex dump (first 32 bytes):
    00 00 00 03 00 00 00 00 06 00 00 00 00 01 00 00  ................
    06 00 00 00 06 00 00 00 01 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000267d43aa>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<00000000267d43aa>] slab_post_alloc_hook mm/slab.h:522 [inline]
    [<00000000267d43aa>] slab_alloc_node mm/slab.c:3262 [inline]
    [<00000000267d43aa>] kmem_cache_alloc_node_trace+0x161/0x2f0 mm/slab.c:3592
    [<000000002e93be84>] __do_kmalloc_node mm/slab.c:3614 [inline]
    [<000000002e93be84>] __kmalloc_node_track_caller+0x38/0x50 mm/slab.c:3629
    [<00000000bf186cd6>] __kmalloc_reserve.isra.0+0x40/0xb0 net/core/skbuff.c:141
    [<0000000069840101>] __alloc_skb+0xa0/0x210 net/core/skbuff.c:209
    [<0000000081920b3f>] alloc_skb include/linux/skbuff.h:1055 [inline]
    [<0000000081920b3f>] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
    [<0000000081920b3f>] h4_recv_buf+0x26d/0x450 drivers/bluetooth/hci_h4.c:182
    [<0000000047237b37>] ag6xx_recv+0x51/0xb0 drivers/bluetooth/hci_ag6xx.c:108
    [<000000001ab42fc6>] hci_uart_tty_receive+0xba/0x200 drivers/bluetooth/hci_ldisc.c:613
    [<000000001fec88ba>] tiocsti drivers/tty/tty_io.c:2197 [inline]
    [<000000001fec88ba>] tty_ioctl+0x81c/0xa30 drivers/tty/tty_io.c:2573
    [<00000000e83c8b15>] vfs_ioctl fs/ioctl.c:46 [inline]
    [<00000000e83c8b15>] file_ioctl fs/ioctl.c:509 [inline]
    [<00000000e83c8b15>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
    [<000000004ad6bee5>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
    [<000000008bbf34c1>] __do_sys_ioctl fs/ioctl.c:720 [inline]
    [<000000008bbf34c1>] __se_sys_ioctl fs/ioctl.c:718 [inline]
    [<000000008bbf34c1>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
    [<0000000092142cda>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:296
    [<0000000007dace5c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff88811643af00 (size 224):
  comm "syz-executor599", pid 7015, jiffies 4294947999 (age 26.690s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<0000000068aebe83>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<0000000068aebe83>] slab_post_alloc_hook mm/slab.h:522 [inline]
    [<0000000068aebe83>] slab_alloc_node mm/slab.c:3262 [inline]
    [<0000000068aebe83>] kmem_cache_alloc_node+0x163/0x2f0 mm/slab.c:3574
    [<00000000a43644f5>] __alloc_skb+0x6e/0x210 net/core/skbuff.c:197
    [<0000000081920b3f>] alloc_skb include/linux/skbuff.h:1055 [inline]
    [<0000000081920b3f>] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
    [<0000000081920b3f>] h4_recv_buf+0x26d/0x450 drivers/bluetooth/hci_h4.c:182
    [<0000000047237b37>] ag6xx_recv+0x51/0xb0 drivers/bluetooth/hci_ag6xx.c:108
    [<000000001ab42fc6>] hci_uart_tty_receive+0xba/0x200 drivers/bluetooth/hci_ldisc.c:613
    [<000000001fec88ba>] tiocsti drivers/tty/tty_io.c:2197 [inline]
    [<000000001fec88ba>] tty_ioctl+0x81c/0xa30 drivers/tty/tty_io.c:2573
    [<00000000e83c8b15>] vfs_ioctl fs/ioctl.c:46 [inline]
    [<00000000e83c8b15>] file_ioctl fs/ioctl.c:509 [inline]
    [<00000000e83c8b15>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
    [<000000004ad6bee5>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
    [<000000008bbf34c1>] __do_sys_ioctl fs/ioctl.c:720 [inline]
    [<000000008bbf34c1>] __se_sys_ioctl fs/ioctl.c:718 [inline]
    [<000000008bbf34c1>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
    [<0000000092142cda>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:296
    [<0000000007dace5c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888121a20400 (size 1024):
  comm "syz-executor599", pid 7015, jiffies 4294947999 (age 26.690s)
  hex dump (first 32 bytes):
    ad de ad de 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 4f 95 2a 81 88 ff ff a0 7e 9b 83 ff ff ff ff  .O.*.....~......
  backtrace:
    [<00000000267d43aa>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<00000000267d43aa>] slab_post_alloc_hook mm/slab.h:522 [inline]
    [<00000000267d43aa>] slab_alloc_node mm/slab.c:3262 [inline]
    [<00000000267d43aa>] kmem_cache_alloc_node_trace+0x161/0x2f0 mm/slab.c:3592
    [<000000002e93be84>] __do_kmalloc_node mm/slab.c:3614 [inline]
    [<000000002e93be84>] __kmalloc_node_track_caller+0x38/0x50 mm/slab.c:3629
    [<00000000bf186cd6>] __kmalloc_reserve.isra.0+0x40/0xb0 net/core/skbuff.c:141
    [<0000000069840101>] __alloc_skb+0xa0/0x210 net/core/skbuff.c:209
    [<0000000081920b3f>] alloc_skb include/linux/skbuff.h:1055 [inline]
    [<0000000081920b3f>] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
    [<0000000081920b3f>] h4_recv_buf+0x26d/0x450 drivers/bluetooth/hci_h4.c:182
    [<0000000047237b37>] ag6xx_recv+0x51/0xb0 drivers/bluetooth/hci_ag6xx.c:108
    [<000000001ab42fc6>] hci_uart_tty_receive+0xba/0x200 drivers/bluetooth/hci_ldisc.c:613
    [<000000001fec88ba>] tiocsti drivers/tty/tty_io.c:2197 [inline]
    [<000000001fec88ba>] tty_ioctl+0x81c/0xa30 drivers/tty/tty_io.c:2573
    [<00000000e83c8b15>] vfs_ioctl fs/ioctl.c:46 [inline]
    [<00000000e83c8b15>] file_ioctl fs/ioctl.c:509 [inline]
    [<00000000e83c8b15>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
    [<000000004ad6bee5>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
    [<000000008bbf34c1>] __do_sys_ioctl fs/ioctl.c:720 [inline]
    [<000000008bbf34c1>] __se_sys_ioctl fs/ioctl.c:718 [inline]
    [<000000008bbf34c1>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
    [<0000000092142cda>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:296
    [<0000000007dace5c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff88811643ab00 (size 224):
  comm "syz-executor599", pid 7018, jiffies 4294948055 (age 26.130s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<0000000068aebe83>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<0000000068aebe83>] slab_post_alloc_hook mm/slab.h:522 [inline]
    [<0000000068aebe83>] slab_alloc_node mm/slab.c:3262 [inline]
    [<0000000068aebe83>] kmem_cache_alloc_node+0x163/0x2f0 mm/slab.c:3574
    [<00000000a43644f5>] __alloc_skb+0x6e/0x210 net/core/skbuff.c:197
    [<0000000081920b3f>] alloc_skb include/linux/skbuff.h:1055 [inline]
    [<0000000081920b3f>] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
    [<0000000081920b3f>] h4_recv_buf+0x26d/0x450 drivers/bluetooth/hci_h4.c:182
    [<0000000047237b37>] ag6xx_recv+0x51/0xb0 drivers/bluetooth/hci_ag6xx.c:108
    [<000000001ab42fc6>] hci_uart_tty_receive+0xba/0x200 drivers/bluetooth/hci_ldisc.c:613
    [<000000001fec88ba>] tiocsti drivers/tty/tty_io.c:2197 [inline]
    [<000000001fec88ba>] tty_ioctl+0x81c/0xa30 drivers/tty/tty_io.c:2573
    [<00000000e83c8b15>] vfs_ioctl fs/ioctl.c:46 [inline]
    [<00000000e83c8b15>] file_ioctl fs/ioctl.c:509 [inline]
    [<00000000e83c8b15>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
    [<000000004ad6bee5>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
    [<000000008bbf34c1>] __do_sys_ioctl fs/ioctl.c:720 [inline]
    [<000000008bbf34c1>] __se_sys_ioctl fs/ioctl.c:718 [inline]
    [<000000008bbf34c1>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
    [<0000000092142cda>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:296
    [<0000000007dace5c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888121a0bc00 (size 1024):
  comm "syz-executor599", pid 7018, jiffies 4294948055 (age 26.130s)
  hex dump (first 32 bytes):
    00 00 00 03 00 00 00 00 06 00 00 00 00 01 00 00  ................
    06 00 00 00 06 00 00 00 01 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000267d43aa>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<00000000267d43aa>] slab_post_alloc_hook mm/slab.h:522 [inline]
    [<00000000267d43aa>] slab_alloc_node mm/slab.c:3262 [inline]
    [<00000000267d43aa>] kmem_cache_alloc_node_trace+0x161/0x2f0 mm/slab.c:3592
    [<000000002e93be84>] __do_kmalloc_node mm/slab.c:3614 [inline]
    [<000000002e93be84>] __kmalloc_node_track_caller+0x38/0x50 mm/slab.c:3629
    [<00000000bf186cd6>] __kmalloc_reserve.isra.0+0x40/0xb0 net/core/skbuff.c:141
    [<0000000069840101>] __alloc_skb+0xa0/0x210 net/core/skbuff.c:209
    [<0000000081920b3f>] alloc_skb include/linux/skbuff.h:1055 [inline]
    [<0000000081920b3f>] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
    [<0000000081920b3f>] h4_recv_buf+0x26d/0x450 drivers/bluetooth/hci_h4.c:182
    [<0000000047237b37>] ag6xx_recv+0x51/0xb0 drivers/bluetooth/hci_ag6xx.c:108
    [<000000001ab42fc6>] hci_uart_tty_receive+0xba/0x200 drivers/bluetooth/hci_ldisc.c:613
    [<000000001fec88ba>] tiocsti drivers/tty/tty_io.c:2197 [inline]
    [<000000001fec88ba>] tty_ioctl+0x81c/0xa30 drivers/tty/tty_io.c:2573
    [<00000000e83c8b15>] vfs_ioctl fs/ioctl.c:46 [inline]
    [<00000000e83c8b15>] file_ioctl fs/ioctl.c:509 [inline]
    [<00000000e83c8b15>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
    [<000000004ad6bee5>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
    [<000000008bbf34c1>] __do_sys_ioctl fs/ioctl.c:720 [inline]
    [<000000008bbf34c1>] __se_sys_ioctl fs/ioctl.c:718 [inline]
    [<000000008bbf34c1>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
    [<0000000092142cda>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:296
    [<0000000007dace5c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff88811643af00 (size 224):
  comm "syz-executor599", pid 7015, jiffies 4294947999 (age 26.760s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<0000000068aebe83>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<0000000068aebe83>] slab_post_alloc_hook mm/slab.h:522 [inline]
    [<0000000068aebe83>] slab_alloc_node mm/slab.c:3262 [inline]
    [<0000000068aebe83>] kmem_cache_alloc_node+0x163/0x2f0 mm/slab.c:3574
    [<00000000a43644f5>] __alloc_skb+0x6e/0x210 net/core/skbuff.c:197
    [<0000000081920b3f>] alloc_skb include/linux/skbuff.h:1055 [inline]
    [<0000000081920b3f>] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
    [<0000000081920b3f>] h4_recv_buf+0x26d/0x450 drivers/bluetooth/hci_h4.c:182
    [<0000000047237b37>] ag6xx_recv+0x51/0xb0 drivers/bluetooth/hci_ag6xx.c:108
    [<000000001ab42fc6>] hci_uart_tty_receive+0xba/0x200 drivers/bluetooth/hci_ldisc.c:613
    [<000000001fec88ba>] tiocsti drivers/tty/tty_io.c:2197 [inline]
    [<000000001fec88ba>] tty_ioctl+0x81c/0xa30 drivers/tty/tty_io.c:2573
    [<00000000e83c8b15>] vfs_ioctl fs/ioctl.c:46 [inline]
    [<00000000e83c8b15>] file_ioctl fs/ioctl.c:509 [inline]
    [<00000000e83c8b15>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
    [<000000004ad6bee5>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
    [<000000008bbf34c1>] __do_sys_ioctl fs/ioctl.c:720 [inline]
    [<000000008bbf34c1>] __se_sys_ioctl fs/ioctl.c:718 [inline]
    [<000000008bbf34c1>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
    [<0000000092142cda>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:296
    [<0000000007dace5c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888121a20400 (size 1024):
  comm "syz-executor599", pid 7015, jiffies 4294947999 (age 26.760s)
  hex dump (first 32 bytes):
    ad de ad de 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 4f 95 2a 81 88 ff ff a0 7e 9b 83 ff ff ff ff  .O.*.....~......
  backtrace:
    [<00000000267d43aa>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<00000000267d43aa>] slab_post_alloc_hook mm/slab.h:522 [inline]
    [<00000000267d43aa>] slab_alloc_node mm/slab.c:3262 [inline]
    [<00000000267d43aa>] kmem_cache_alloc_node_trace+0x161/0x2f0 mm/slab.c:3592
    [<000000002e93be84>] __do_kmalloc_node mm/slab.c:3614 [inline]
    [<000000002e93be84>] __kmalloc_node_track_caller+0x38/0x50 mm/slab.c:3629
    [<00000000bf186cd6>] __kmalloc_reserve.isra.0+0x40/0xb0 net/core/skbuff.c:141
    [<0000000069840101>] __alloc_skb+0xa0/0x210 net/core/skbuff.c:209
    [<0000000081920b3f>] alloc_skb include/linux/skbuff.h:1055 [inline]
    [<0000000081920b3f>] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
    [<0000000081920b3f>] h4_recv_buf+0x26d/0x450 drivers/bluetooth/hci_h4.c:182
    [<0000000047237b37>] ag6xx_recv+0x51/0xb0 drivers/bluetooth/hci_ag6xx.c:108
    [<000000001ab42fc6>] hci_uart_tty_receive+0xba/0x200 drivers/bluetooth/hci_ldisc.c:613
    [<000000001fec88ba>] tiocsti drivers/tty/tty_io.c:2197 [inline]
    [<000000001fec88ba>] tty_ioctl+0x81c/0xa30 drivers/tty/tty_io.c:2573
    [<00000000e83c8b15>] vfs_ioctl fs/ioctl.c:46 [inline]
    [<00000000e83c8b15>] file_ioctl fs/ioctl.c:509 [inline]
    [<00000000e83c8b15>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
    [<000000004ad6bee5>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
    [<000000008bbf34c1>] __do_sys_ioctl fs/ioctl.c:720 [inline]
    [<000000008bbf34c1>] __se_sys_ioctl fs/ioctl.c:718 [inline]
    [<000000008bbf34c1>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
    [<0000000092142cda>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:296
    [<0000000007dace5c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff88811643ab00 (size 224):
  comm "syz-executor599", pid 7018, jiffies 4294948055 (age 26.200s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<0000000068aebe83>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<0000000068aebe83>] slab_post_alloc_hook mm/slab.h:522 [inline]
    [<0000000068aebe83>] slab_alloc_node mm/slab.c:3262 [inline]
    [<0000000068aebe83>] kmem_cache_alloc_node+0x163/0x2f0 mm/slab.c:3574
    [<00000000a43644f5>] __alloc_skb+0x6e/0x210 net/core/skbuff.c:197
    [<0000000081920b3f>] alloc_skb include/linux/skbuff.h:1055 [inline]
    [<0000000081920b3f>] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
    [<0000000081920b3f>] h4_recv_buf+0x26d/0x450 drivers/bluetooth/hci_h4.c:182
    [<0000000047237b37>] ag6xx_recv+0x51/0xb0 drivers/bluetooth/hci_ag6xx.c:108
    [<000000001ab42fc6>] hci_uart_tty_receive+0xba/0x200 drivers/bluetooth/hci_ldisc.c:613
    [<000000001fec88ba>] tiocsti drivers/tty/tty_io.c:2197 [inline]
    [<000000001fec88ba>] tty_ioctl+0x81c/0xa30 drivers/tty/tty_io.c:2573
    [<00000000e83c8b15>] vfs_ioctl fs/ioctl.c:46 [inline]
    [<00000000e83c8b15>] file_ioctl fs/ioctl.c:509 [inline]
    [<00000000e83c8b15>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
    [<000000004ad6bee5>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
    [<000000008bbf34c1>] __do_sys_ioctl fs/ioctl.c:720 [inline]
    [<000000008bbf34c1>] __se_sys_ioctl fs/ioctl.c:718 [inline]
    [<000000008bbf34c1>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
    [<0000000092142cda>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:296
    [<0000000007dace5c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888121a0bc00 (size 1024):
  comm "syz-executor599", pid 7018, jiffies 4294948055 (age 26.200s)
  hex dump (first 32 bytes):
    00 00 00 03 00 00 00 00 06 00 00 00 00 01 00 00  ................
    06 00 00 00 06 00 00 00 01 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000267d43aa>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<00000000267d43aa>] slab_post_alloc_hook mm/slab.h:522 [inline]
    [<00000000267d43aa>] slab_alloc_node mm/slab.c:3262 [inline]
    [<00000000267d43aa>] kmem_cache_alloc_node_trace+0x161/0x2f0 mm/slab.c:3592
    [<000000002e93be84>] __do_kmalloc_node mm/slab.c:3614 [inline]
    [<000000002e93be84>] __kmalloc_node_track_caller+0x38/0x50 mm/slab.c:3629
    [<00000000bf186cd6>] __kmalloc_reserve.isra.0+0x40/0xb0 net/core/skbuff.c:141
    [<0000000069840101>] __alloc_skb+0xa0/0x210 net/core/skbuff.c:209
    [<0000000081920b3f>] alloc_skb include/linux/skbuff.h:1055 [inline]
    [<0000000081920b3f>] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
    [<0000000081920b3f>] h4_recv_buf+0x26d/0x450 drivers/bluetooth/hci_h4.c:182
    [<0000000047237b37>] ag6xx_recv+0x51/0xb0 drivers/bluetooth/hci_ag6xx.c:108
    [<000000001ab42fc6>] hci_uart_tty_receive+0xba/0x200 drivers/bluetooth/hci_ldisc.c:613
    [<000000001fec88ba>] tiocsti drivers/tty/tty_io.c:2197 [inline]
    [<000000001fec88ba>] tty_ioctl+0x81c/0xa30 drivers/tty/tty_io.c:2573
    [<00000000e83c8b15>] vfs_ioctl fs/ioctl.c:46 [inline]
    [<00000000e83c8b15>] file_ioctl fs/ioctl.c:509 [inline]
    [<00000000e83c8b15>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
    [<000000004ad6bee5>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
    [<000000008bbf34c1>] __do_sys_ioctl fs/ioctl.c:720 [inline]
    [<000000008bbf34c1>] __se_sys_ioctl fs/ioctl.c:718 [inline]
    [<000000008bbf34c1>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
    [<0000000092142cda>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:296
    [<0000000007dace5c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff88811643af00 (size 224):
  comm "syz-executor599", pid 7015, jiffies 4294947999 (age 26.830s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<0000000068aebe83>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<0000000068aebe83>] slab_post_alloc_hook mm/slab.h:522 [inline]
    [<0000000068aebe83>] slab_alloc_node mm/slab.c:3262 [inline]
    [<0000000068aebe83>] kmem_cache_alloc_node+0x163/0x2f0 mm/slab.c:3574
    [<00000000a43644f5>] __alloc_skb+0x6e/0x210 net/core/skbuff.c:197
    [<0000000081920b3f>] alloc_skb include/linux/skbuff.h:1055 [inline]
    [<0000000081920b3f>] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
    [<0000000081920b3f>] h4_recv_buf+0x26d/0x450 drivers/bluetooth/hci_h4.c:182
    [<0000000047237b37>] ag6xx_recv+0x51/0xb0 drivers/bluetooth/hci_ag6xx.c:108
    [<000000001ab42fc6>] hci_uart_tty_receive+0xba/0x200 drivers/bluetooth/hci_ldisc.c:613
    [<000000001fec88ba>] tiocsti drivers/tty/tty_io.c:2197 [inline]
    [<000000001fec88ba>] tty_ioctl+0x81c/0xa30 drivers/tty/tty_io.c:2573
    [<00000000e83c8b15>] vfs_ioctl fs/ioctl.c:46 [inline]
    [<00000000e83c8b15>] file_ioctl fs/ioctl.c:509 [inline]
    [<00000000e83c8b15>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
    [<000000004ad6bee5>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
    [<000000008bbf34c1>] __do_sys_ioctl fs/ioctl.c:720 [inline]
    [<000000008bbf34c1>] __se_sys_ioctl fs/ioctl.c:718 [inline]
    [<000000008bbf34c1>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
    [<0000000092142cda>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:296
    [<0000000007dace5c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888121a20400 (size 1024):
  comm "syz-executor599", pid 7015, jiffies 4294947999 (age 26.830s)
  hex dump (first 32 bytes):
    ad de ad de 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 4f 95 2a 81 88 ff ff a0 7e 9b 83 ff ff ff ff  .O.*.....~......
  backtrace:
    [<00000000267d43aa>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<00000000267d43aa>] slab_post_alloc_hook mm/slab.h:522 [inline]
    [<00000000267d43aa>] slab_alloc_node mm/slab.c:3262 [inline]
    [<00000000267d43aa>] kmem_cache_alloc_node_trace+0x161/0x2f0 mm/slab.c:3592
    [<000000002e93be84>] __do_kmalloc_node mm/slab.c:3614 [inline]
    [<000000002e93be84>] __kmalloc_node_track_caller+0x38/0x50 mm/slab.c:3629
    [<00000000bf186cd6>] __kmalloc_reserve.isra.0+0x40/0xb0 net/core/skbuff.c:141
    [<0000000069840101>] __alloc_skb+0xa0/0x210 net/core/skbuff.c:209
    [<0000000081920b3f>] alloc_skb include/linux/skbuff.h:1055 [inline]
    [<0000000081920b3f>] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
    [<0000000081920b3f>] h4_recv_buf+0x26d/0x450 drivers/bluetooth/hci_h4.c:182
    [<0000000047237b37>] ag6xx_recv+0x51/0xb0 drivers/bluetooth/hci_ag6xx.c:108
    [<000000001ab42fc6>] hci_uart_tty_receive+0xba/0x200 drivers/bluetooth/hci_ldisc.c:613
    [<000000001fec88ba>] tiocsti drivers/tty/tty_io.c:2197 [inline]
    [<000000001fec88ba>] tty_ioctl+0x81c/0xa30 drivers/tty/tty_io.c:2573
    [<00000000e83c8b15>] vfs_ioctl fs/ioctl.c:46 [inline]
    [<00000000e83c8b15>] file_ioctl fs/ioctl.c:509 [inline]
    [<00000000e83c8b15>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
    [<000000004ad6bee5>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
    [<000000008bbf34c1>] __do_sys_ioctl fs/ioctl.c:720 [inline]
    [<000000008bbf34c1>] __se_sys_ioctl fs/ioctl.c:718 [inline]
    [<000000008bbf34c1>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
    [<0000000092142cda>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:296
    [<0000000007dace5c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff88811643ab00 (size 224):
  comm "syz-executor599", pid 7018, jiffies 4294948055 (age 26.270s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<0000000068aebe83>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<0000000068aebe83>] slab_post_alloc_hook mm/slab.h:522 [inline]
    [<0000000068aebe83>] slab_alloc_node mm/slab.c:3262 [inline]
    [<0000000068aebe83>] kmem_cache_alloc_node+0x163/0x2f0 mm/slab.c:3574
    [<00000000a43644f5>] __alloc_skb+0x6e/0x210 net/core/skbuff.c:197
    [<0000000081920b3f>] alloc_skb include/linux/skbuff.h:1055 [inline]
    [<0000000081920b3f>] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
    [<0000000081920b3f>] h4_recv_buf+0x26d/0x450 drivers/bluetooth/hci_h4.c:182
    [<0000000047237b37>] ag6xx_recv+0x51/0xb0 drivers/bluetooth/hci_ag6xx.c:108
    [<000000001ab42fc6>] hci_uart_tty_receive+0xba/0x200 drivers/bluetooth/hci_ldisc.c:613
    [<000000001fec88ba>] tiocsti drivers/tty/tty_io.c:2197 [inline]
    [<000000001fec88ba>] tty_ioctl+0x81c/0xa30 drivers/tty/tty_io.c:2573
    [<00000000e83c8b15>] vfs_ioctl fs/ioctl.c:46 [inline]
    [<00000000e83c8b15>] file_ioctl fs/ioctl.c:509 [inline]
    [<00000000e83c8b15>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
    [<000000004ad6bee5>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
    [<000000008bbf34c1>] __do_sys_ioctl fs/ioctl.c:720 [inline]
    [<000000008bbf34c1>] __se_sys_ioctl fs/ioctl.c:718 [inline]
    [<000000008bbf34c1>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
    [<0000000092142cda>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:296
    [<0000000007dace5c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888121a0bc00 (size 1024):
  comm "syz-executor599", pid 7018, jiffies 4294948055 (age 26.270s)
  hex dump (first 32 bytes):
    00 00 00 03 00 00 00 00 06 00 00 00 00 01 00 00  ................
    06 00 00 00 06 00 00 00 01 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000267d43aa>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<00000000267d43aa>] slab_post_alloc_hook mm/slab.h:522 [inline]
    [<00000000267d43aa>] slab_alloc_node mm/slab.c:3262 [inline]
    [<00000000267d43aa>] kmem_cache_alloc_node_trace+0x161/0x2f0 mm/slab.c:3592
    [<000000002e93be84>] __do_kmalloc_node mm/slab.c:3614 [inline]
    [<000000002e93be84>] __kmalloc_node_track_caller+0x38/0x50 mm/slab.c:3629
    [<00000000bf186cd6>] __kmalloc_reserve.isra.0+0x40/0xb0 net/core/skbuff.c:141
    [<0000000069840101>] __alloc_skb+0xa0/0x210 net/core/skbuff.c:209
    [<0000000081920b3f>] alloc_skb include/linux/skbuff.h:1055 [inline]
    [<0000000081920b3f>] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
    [<0000000081920b3f>] h4_recv_buf+0x26d/0x450 drivers/bluetooth/hci_h4.c:182
    [<0000000047237b37>] ag6xx_recv+0x51/0xb0 drivers/bluetooth/hci_ag6xx.c:108
    [<000000001ab42fc6>] hci_uart_tty_receive+0xba/0x200 drivers/bluetooth/hci_ldisc.c:613
    [<000000001fec88ba>] tiocsti drivers/tty/tty_io.c:2197 [inline]
    [<000000001fec88ba>] tty_ioctl+0x81c/0xa30 drivers/tty/tty_io.c:2573
    [<00000000e83c8b15>] vfs_ioctl fs/ioctl.c:46 [inline]
    [<00000000e83c8b15>] file_ioctl fs/ioctl.c:509 [inline]
    [<00000000e83c8b15>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
    [<000000004ad6bee5>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
    [<000000008bbf34c1>] __do_sys_ioctl fs/ioctl.c:720 [inline]
    [<000000008bbf34c1>] __se_sys_ioctl fs/ioctl.c:718 [inline]
    [<000000008bbf34c1>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
    [<0000000092142cda>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:296
    [<0000000007dace5c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff88811643af00 (size 224):
  comm "syz-executor599", pid 7015, jiffies 4294947999 (age 28.010s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<0000000068aebe83>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<0000000068aebe83>] slab_post_alloc_hook mm/slab.h:522 [inline]
    [<0000000068aebe83>] slab_alloc_node mm/slab.c:3262 [inline]
    [<0000000068aebe83>] kmem_cache_alloc_node+0x163/0x2f0 mm/slab.c:3574
    [<00000000a43644f5>] __alloc_skb+0x6e/0x210 net/core/skbuff.c:197
    [<0000000081920b3f>] alloc_skb include/linux/skbuff.h:1055 [inline]
    [<0000000081920b3f>] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
    [<0000000081920b3f>] h4_recv_buf+0x26d/0x450 drivers/bluetooth/hci_h4.c:182
    [<0000000047237b37>] ag6xx_recv+0x51/0xb0 drivers/bluetooth/hci_ag6xx.c:108
    [<000000001ab42fc6>] hci_uart_tty_receive+0xba/0x200 drivers/bluetooth/hci_ldisc.c:613
    [<000000001fec88ba>] tiocsti drivers/tty/tty_io.c:2197 [inline]
    [<000000001fec88ba>] tty_ioctl+0x81c/0xa30 drivers/tty/tty_io.c:2573
    [<00000000e83c8b15>] vfs_ioctl fs/ioctl.c:46 [inline]
    [<00000000e83c8b15>] file_ioctl fs/ioctl.c:509 [inline]
    [<00000000e83c8b15>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
    [<000000004ad6bee5>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
    [<000000008bbf34c1>] __do_sys_ioctl fs/ioctl.c:720 [inline]
    [<000000008bbf34c1>] __se_sys_ioctl fs/ioctl.c:718 [inline]
    [<000000008bbf34c1>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
    [<0000000092142cda>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:296
    [<0000000007dace5c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888121a20400 (size 1024):
  comm "syz-executor599", pid 7015, jiffies 4294947999 (age 28.010s)
  hex dump (first 32 bytes):
    ad de ad de 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 4f 95 2a 81 88 ff ff a0 7e 9b 83 ff ff ff ff  .O.*.....~......
  backtrace:
    [<00000000267d43aa>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<00000000267d43aa>] slab_post_alloc_hook mm/slab.h:522 [inline]
    [<00000000267d43aa>] slab_alloc_node mm/slab.c:3262 [inline]
    [<00000000267d43aa>] kmem_cache_alloc_node_trace+0x161/0x2f0 mm/slab.c:3592
    [<000000002e93be84>] __do_kmalloc_node mm/slab.c:3614 [inline]
    [<000000002e93be84>] __kmalloc_node_track_caller+0x38/0x50 mm/slab.c:3629
    [<00000000bf186cd6>] __kmalloc_reserve.isra.0+0x40/0xb0 net/core/skbuff.c:141
    [<0000000069840101>] __alloc_skb+0xa0/0x210 net/core/skbuff.c:209
    [<0000000081920b3f>] alloc_skb include/linux/skbuff.h:1055 [inline]
    [<0000000081920b3f>] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
    [<0000000081920b3f>] h4_recv_buf+0x26d/0x450 drivers/bluetooth/hci_h4.c:182
    [<0000000047237b37>] ag6xx_recv+0x51/0xb0 drivers/bluetooth/hci_ag6xx.c:108
    [<000000001ab42fc6>] hci_uart_tty_receive+0xba/0x200 drivers/bluetooth/hci_ldisc.c:613
    [<000000001fec88ba>] tiocsti drivers/tty/tty_io.c:2197 [inline]
    [<000000001fec88ba>] tty_ioctl+0x81c/0xa30 drivers/tty/tty_io.c:2573
    [<00000000e83c8b15>] vfs_ioctl fs/ioctl.c:46 [inline]
    [<00000000e83c8b15>] file_ioctl fs/ioctl.c:509 [inline]
    [<00000000e83c8b15>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
    [<000000004ad6bee5>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
    [<000000008bbf34c1>] __do_sys_ioctl fs/ioctl.c:720 [inline]
    [<000000008bbf34c1>] __se_sys_ioctl fs/ioctl.c:718 [inline]
    [<000000008bbf34c1>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
    [<0000000092142cda>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:296
    [<0000000007dace5c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff88811643ab00 (size 224):
  comm "syz-executor599", pid 7018, jiffies 4294948055 (age 27.450s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<0000000068aebe83>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<0000000068aebe83>] slab_post_alloc_hook mm/slab.h:522 [inline]
    [<0000000068aebe83>] slab_alloc_node mm/slab.c:3262 [inline]
    [<0000000068aebe83>] kmem_cache_alloc_node+0x163/0x2f0 mm/slab.c:3574
    [<00000000a43644f5>] __alloc_skb+0x6e/0x210 net/core/skbuff.c:197
    [<0000000081920b3f>] alloc_skb include/linux/skbuff.h:1055 [inline]
    [<0000000081920b3f>] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
    [<0000000081920b3f>] h4_recv_buf+0x26d/0x450 drivers/bluetooth/hci_h4.c:182
    [<0000000047237b37>] ag6xx_recv+0x51/0xb0 drivers/bluetooth/hci_ag6xx.c:108
    [<000000001ab42fc6>] hci_uart_tty_receive+0xba/0x200 drivers/bluetooth/hci_ldisc.c:613
    [<000000001fec88ba>] tiocsti drivers/tty/tty_io.c:2197 [inline]
    [<000000001fec88ba>] tty_ioctl+0x81c/0xa30 drivers/tty/tty_io.c:2573
    [<00000000e83c8b15>] vfs_ioctl fs/ioctl.c:46 [inline]
    [<00000000e83c8b15>] file_ioctl fs/ioctl.c:509 [inline]
    [<00000000e83c8b15>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
    [<000000004ad6bee5>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
    [<000000008bbf34c1>] __do_sys_ioctl fs/ioctl.c:720 [inline]
    [<000000008bbf34c1>] __se_sys_ioctl fs/ioctl.c:718 [inline]
    [<000000008bbf34c1>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
    [<0000000092142cda>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:296
    [<0000000007dace5c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888121a0bc00 (size 1024):
  comm "syz-executor599", pid 7018, jiffies 4294948055 (age 27.450s)
  hex dump (first 32 bytes):
    00 00 00 03 00 00 00 00 06 00 00 00 00 01 00 00  ................
    06 00 00 00 06 00 00 00 01 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000267d43aa>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<00000000267d43aa>] slab_post_alloc_hook mm/slab.h:522 [inline]
    [<00000000267d43aa>] slab_alloc_node mm/slab.c:3262 [inline]
    [<00000000267d43aa>] kmem_cache_alloc_node_trace+0x161/0x2f0 mm/slab.c:3592
    [<000000002e93be84>] __do_kmalloc_node mm/slab.c:3614 [inline]
    [<000000002e93be84>] __kmalloc_node_track_caller+0x38/0x50 mm/slab.c:3629
    [<00000000bf186cd6>] __kmalloc_reserve.isra.0+0x40/0xb0 net/core/skbuff.c:141
    [<0000000069840101>] __alloc_skb+0xa0/0x210 net/core/skbuff.c:209
    [<0000000081920b3f>] alloc_skb include/linux/skbuff.h:1055 [inline]
    [<0000000081920b3f>] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
    [<0000000081920b3f>] h4_recv_buf+0x26d/0x450 drivers/bluetooth/hci_h4.c:182
    [<0000000047237b37>] ag6xx_recv+0x51/0xb0 drivers/bluetooth/hci_ag6xx.c:108
    [<000000001ab42fc6>] hci_uart_tty_receive+0xba/0x200 drivers/bluetooth/hci_ldisc.c:613
    [<000000001fec88ba>] tiocsti drivers/tty/tty_io.c:2197 [inline]
    [<000000001fec88ba>] tty_ioctl+0x81c/0xa30 drivers/tty/tty_io.c:2573
    [<00000000e83c8b15>] vfs_ioctl fs/ioctl.c:46 [inline]
    [<00000000e83c8b15>] file_ioctl fs/ioctl.c:509 [inline]
    [<00000000e83c8b15>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
    [<000000004ad6bee5>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
    [<000000008bbf34c1>] __do_sys_ioctl fs/ioctl.c:720 [inline]
    [<000000008bbf34c1>] __se_sys_ioctl fs/ioctl.c:718 [inline]
    [<000000008bbf34c1>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
    [<0000000092142cda>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:296
    [<0000000007dace5c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

executing program