Unable to handle kernel paging request at virtual address dfff800000000026 KASAN: null-ptr-deref in range [0x0000000000000130-0x0000000000000137] Mem abort info: ESR = 0x0000000096000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 [dfff800000000026] address between user and kernel address ranges Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 4303 Comm: kworker/u5:2 Tainted: G W 6.1.121-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: hci0 hci_rx_work pstate: 804000c5 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __lock_acquire+0x104/0x7680 kernel/locking/lockdep.c:4919 lr : lock_acquire+0x26c/0x7cc kernel/locking/lockdep.c:5662 sp : ffff8000211c70e0 x29: ffff8000211c7380 x28: 1ffff00002b520b1 x27: ffff8000115d4770 x26: 0000000000000001 x25: ffff700004238e40 x24: 0000000000000000 x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000000 x20: 0000000000000000 x19: 0000000000000130 x18: 0000000000000150 x17: ffff800015a8d000 x16: ffff80001232c424 x15: 0000000000000002 x14: 1ffff00002b520b2 x13: ffff8000211c7200 x12: dfff800000000000 x11: ffff800008304d68 x10: ffff800015a9058c x9 : 00000000000000f3 x8 : 0000000000000026 x7 : ffff8000115d4770 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000130 Call trace: __lock_acquire+0x104/0x7680 kernel/locking/lockdep.c:4919 lock_acquire+0x26c/0x7cc kernel/locking/lockdep.c:5662 lock_sock_nested+0x78/0x138 net/core/sock.c:3485 lock_sock include/net/sock.h:1750 [inline] l2cap_sock_new_connection_cb+0x50/0x298 net/bluetooth/l2cap_sock.c:1493 l2cap_connect_cfm+0x2fc/0xe5c net/bluetooth/l2cap_core.c:8317 hci_connect_cfm+0xa0/0x138 include/net/bluetooth/hci_core.h:1787 le_conn_complete_evt+0xa88/0xfe0 net/bluetooth/hci_event.c:5864 hci_le_conn_complete_evt+0x114/0x404 net/bluetooth/hci_event.c:5890 hci_le_meta_evt+0x2b8/0x47c net/bluetooth/hci_event.c:7059 hci_event_func net/bluetooth/hci_event.c:7370 [inline] hci_event_packet+0x6f8/0x109c net/bluetooth/hci_event.c:7425 hci_rx_work+0x310/0xa84 net/bluetooth/hci_core.c:4090 process_one_work+0x7ac/0x1404 kernel/workqueue.c:2292 worker_thread+0x8e4/0xfec kernel/workqueue.c:2439 kthread+0x250/0x2d8 kernel/kthread.c:376 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864 Code: b006c188 b9400108 34000208 d343fe68 (386c6908) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: b006c188 adrp x8, 0xd831000 4: b9400108 ldr w8, [x8] 8: 34000208 cbz w8, 0x48 c: d343fe68 lsr x8, x19, #3 * 10: 386c6908 ldrb w8, [x8, x12] <-- trapping instruction