Bluetooth: Invalid header checksum
kasan: GPF could be caused by NULL-ptr deref or user memory access
Bluetooth: Invalid header checksum
Bluetooth: Can't allocate HCI device
Bluetooth: Invalid header checksum
general protection fault: 0000 [#1] PREEMPT SMP KASAN
kobject: '(null)' (00000000aff27fd1): kobject_cleanup, parent           (null)
CPU: 1 PID: 3468 Comm: kworker/1:3 Not tainted 5.0.0-rc8+ #2
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events hci_uart_write_work
RIP: 0010:hci_uart_write_work+0x1b6/0x710 drivers/bluetooth/hci_ldisc.c:180
Code: 0f 85 6a 04 00 00 49 8b b4 24 c8 00 00 00 4c 89 ef e8 8e 57 53 02 89 c6 48 8b 45 d0 48 8d b8 5c 10 00 00 48 89 f8 48 c1 e8 03 <0f> b6 14 18 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 1d
kobject: '(null)' (00000000aff27fd1): calling ktype release
RSP: 0018:ffff88809b137cb0 EFLAGS: 00010203
RAX: 000000000000020b RBX: dffffc0000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000008 RDI: 000000000000105c
RBP: ffff88809b137d30 R08: ffff88809b142480 R09: ffff88809b142d48
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88809f816e80
R13: ffff8880870acac0 R14: ffff888084b6daa8 R15: ffff88809f816ef0
FS:  0000000000000000(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
kobject: 'loop2' (00000000006028a3): kobject_uevent_env
CR2: 00007eff7cd8ddb8 CR3: 00000000912a5000 CR4: 00000000001426e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 process_one_work+0x98e/0x1790 kernel/workqueue.c:2173
kobject: 'loop2' (00000000006028a3): fill_kobj_path: path = '/devices/virtual/block/loop2'
 worker_thread+0x98/0xe40 kernel/workqueue.c:2319
 kthread+0x357/0x430 kernel/kthread.c:246
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
Modules linked in:
Bluetooth: Invalid header checksum
kobject: 'loop1' (00000000be31e481): kobject_uevent_env
---[ end trace 2a7065ec91e4ebf6 ]---
kobject: 'loop1' (00000000be31e481): fill_kobj_path: path = '/devices/virtual/block/loop1'
RIP: 0010:hci_uart_write_work+0x1b6/0x710 drivers/bluetooth/hci_ldisc.c:180
kobject: 'loop4' (0000000027961a1d): kobject_uevent_env
kobject: '(null)' (00000000e9c709ab): kobject_cleanup, parent           (null)
kobject: '(null)' (00000000e9c709ab): calling ktype release
Code: 0f 85 6a 04 00 00 49 8b b4 24 c8 00 00 00 4c 89 ef e8 8e 57 53 02 89 c6 48 8b 45 d0 48 8d b8 5c 10 00 00 48 89 f8 48 c1 e8 03 <0f> b6 14 18 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 1d
kobject: 'loop4' (0000000027961a1d): fill_kobj_path: path = '/devices/virtual/block/loop4'
FAULT_INJECTION: forcing a failure.
name fail_page_alloc, interval 1, probability 0, space 0, times 1
CPU: 1 PID: 20263 Comm: syz-executor.4 Tainted: G      D           5.0.0-rc8+ #2
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
kobject: 'loop5' (00000000afd62453): kobject_uevent_env
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail.cold+0xa/0x1b lib/fault-inject.c:149
kobject: 'loop5' (00000000afd62453): fill_kobj_path: path = '/devices/virtual/block/loop5'
kobject: 'loop0' (00000000a3a13c8b): kobject_uevent_env
 __should_fail_alloc_page mm/page_alloc.c:3164 [inline]
 should_fail_alloc_page+0x50/0x60 mm/page_alloc.c:3211
kobject: 'loop0' (00000000a3a13c8b): fill_kobj_path: path = '/devices/virtual/block/loop0'
 prepare_alloc_pages mm/page_alloc.c:4488 [inline]
 __alloc_pages_nodemask+0x1a1/0x710 mm/page_alloc.c:4535
 __alloc_pages include/linux/gfp.h:473 [inline]
 __alloc_pages_node include/linux/gfp.h:486 [inline]
 kmem_getpages mm/slab.c:1398 [inline]
 cache_grow_begin+0x9c/0x8c0 mm/slab.c:2667
kobject: 'loop3' (00000000a0a9dce1): kobject_uevent_env
 cache_alloc_refill mm/slab.c:3040 [inline]
 ____cache_alloc mm/slab.c:3123 [inline]
 ____cache_alloc mm/slab.c:3106 [inline]
 __do_cache_alloc mm/slab.c:3345 [inline]
 slab_alloc mm/slab.c:3380 [inline]
 kmem_cache_alloc_trace+0x67f/0x760 mm/slab.c:3613
kobject: 'loop3' (00000000a0a9dce1): fill_kobj_path: path = '/devices/virtual/block/loop3'
 kmalloc include/linux/slab.h:545 [inline]
 kzalloc include/linux/slab.h:740 [inline]
 hci_alloc_dev+0x43/0x1d00 net/bluetooth/hci_core.c:3116
 hci_uart_register_dev drivers/bluetooth/hci_ldisc.c:623 [inline]
 hci_uart_set_proto drivers/bluetooth/hci_ldisc.c:693 [inline]
 hci_uart_tty_ioctl+0x321/0xa70 drivers/bluetooth/hci_ldisc.c:748
 tty_ioctl+0xac9/0x14d0 drivers/tty/tty_io.c:2662
kobject: 'loop2' (00000000006028a3): kobject_uevent_env
kobject: 'loop2' (00000000006028a3): fill_kobj_path: path = '/devices/virtual/block/loop2'
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:509 [inline]
 do_vfs_ioctl+0xd6e/0x1390 fs/ioctl.c:696
 ksys_ioctl+0xab/0xd0 fs/ioctl.c:713
 __do_sys_ioctl fs/ioctl.c:720 [inline]
 __se_sys_ioctl fs/ioctl.c:718 [inline]
 __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718
 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457e29
Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f5307edfc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f5307edfc90 RCX: 0000000000457e29
RDX: 0000000000000002 RSI: 00000000400455c8 RDI: 0000000000000003
RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5307ee06d4
R13: 00000000004c06b8 R14: 00000000004d23f0 R15: 0000000000000004
kobject: 'loop5' (00000000afd62453): kobject_uevent_env
RSP: 0018:ffff88809b137cb0 EFLAGS: 00010203
kobject: 'loop5' (00000000afd62453): fill_kobj_path: path = '/devices/virtual/block/loop5'
RAX: 000000000000020b RBX: dffffc0000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000008 RDI: 000000000000105c
RBP: ffff88809b137d30 R08: ffff88809b142480 R09: ffff88809b142d48
kobject: '(null)' (0000000008e7fd51): kobject_cleanup, parent           (null)
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88809f816e80
kobject: 'loop5' (00000000afd62453): kobject_uevent_env
kobject: '(null)' (00000000b1381efb): kobject_cleanup, parent           (null)
kobject: 'loop5' (00000000afd62453): fill_kobj_path: path = '/devices/virtual/block/loop5'
R13: ffff8880870acac0 R14: ffff888084b6daa8 R15: ffff88809f816ef0
kobject: '(null)' (0000000008e7fd51): calling ktype release
kobject: 'loop2' (00000000006028a3): kobject_uevent_env
kobject: '(null)' (00000000b1381efb): calling ktype release
kobject: 'loop2' (00000000006028a3): fill_kobj_path: path = '/devices/virtual/block/loop2'
FS:  0000000000000000(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
kobject: 'loop0' (00000000a3a13c8b): kobject_uevent_env
CR2: 0000000000738000 CR3: 000000009fae6000 CR4: 00000000001426e0
kobject: 'loop0' (00000000a3a13c8b): fill_kobj_path: path = '/devices/virtual/block/loop0'
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
kobject: 'loop5' (00000000afd62453): kobject_uevent_env
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
kobject: 'loop5' (00000000afd62453): fill_kobj_path: path = '/devices/virtual/block/loop5'