Bluetooth: hci4: Opcode 0x0406 failed: -4
Bluetooth: hci4: Opcode 0x0406 failed: -4
Bluetooth: hci2: Opcode 0x0c1a failed: -4
Bluetooth: hci2: Opcode 0x0406 failed: -4
Unable to handle kernel paging request at virtual address dfff80000000000b
KASAN: null-ptr-deref in range [0x0000000000000058-0x000000000000005f]
Mem abort info:
  ESR = 0x0000000096000005
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x05: level 1 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[dfff80000000000b] address between user and kernel address ranges
Internal error: Oops: 0000000096000005 [#1]  SMP
Modules linked in:
CPU: 1 UID: 0 PID: 8600 Comm: syz.0.355 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025
pstate: 03400005 (nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : klist_put lib/klist.c:212 [inline]
pc : klist_del lib/klist.c:230 [inline]
pc : klist_remove+0x12c/0x334 lib/klist.c:249
lr : spin_unlock include/linux/spinlock.h:391 [inline]
lr : klist_remove+0x108/0x334 lib/klist.c:247
sp : ffff8000998b6e80
x29: ffff8000998b6f20 x28: 0000000000000000 x27: 1fffe0001aa2a0e1
x26: dfff800000000000 x25: ffff0000f73d1e80 x24: dfff800000000000
x23: ffff700013316dd0 x22: ffff800092df0e00 x21: 1fffe0001b86280c
x20: 0000000000000000 x19: ffff0000dc314060 x18: 1fffe00033793888
x17: ffff80009353a000 x16: ffff8000805379bc x15: 0000000000000001
x14: 1ffff000125be1c4 x13: 0000000000000000 x12: 0000000000000000
x11: ffff7000125be1c5 x10: 0000000000000001 x9 : dfff800000000000
x8 : 000000000000000b x7 : ffff80008afa3050 x6 : 0000000000000000
x5 : ffff8000938dc150 x4 : 0000000000000008 x3 : ffff800080537ac4
x2 : 0000000000000001 x1 : 0000000000000001 x0 : 0000000000000058
Call trace:
 klist_put lib/klist.c:212 [inline] (P)
 klist_del lib/klist.c:230 [inline] (P)
 klist_remove+0x12c/0x334 lib/klist.c:249 (P)
 device_move+0x16c/0x5b0 drivers/base/core.c:4615
 hci_conn_del_sysfs+0xb4/0x170 net/bluetooth/hci_sysfs.c:75
 hci_conn_cleanup net/bluetooth/hci_conn.c:173 [inline]
 hci_conn_del+0xa40/0xf3c net/bluetooth/hci_conn.c:1211
 hci_conn_failed+0x224/0x318 net/bluetooth/hci_conn.c:1314
 hci_abort_conn_sync+0x558/0xbb8 net/bluetooth/hci_sync.c:5689
 hci_disconnect_all_sync+0x1b0/0x35c net/bluetooth/hci_sync.c:5712
 hci_suspend_sync+0x464/0xb38 net/bluetooth/hci_sync.c:6188
 hci_suspend_dev+0x1dc/0x3f4 net/bluetooth/hci_core.c:2849
 hci_suspend_notifier+0xe4/0x270 net/bluetooth/hci_core.c:2420
 notifier_call_chain+0x1b8/0x4e4 kernel/notifier.c:85
 notifier_call_chain_robust kernel/notifier.c:120 [inline]
 blocking_notifier_call_chain_robust+0x88/0x110 kernel/notifier.c:345
 pm_notifier_call_chain_robust+0x34/0x60 kernel/power/main.c:103
 snapshot_open+0x17c/0x268 kernel/power/user.c:77
 misc_open+0x2b8/0x328 drivers/char/misc.c:161
 chrdev_open+0x1b0/0x4b0 fs/char_dev.c:414
 do_dentry_open+0x7a4/0x10bc fs/open.c:965
 vfs_open+0x44/0x2d4 fs/open.c:1095
 do_open fs/namei.c:3887 [inline]
 path_openat+0x2424/0x2c40 fs/namei.c:4046
 do_filp_open+0x18c/0x36c fs/namei.c:4073
 do_sys_openat2+0x11c/0x1b4 fs/open.c:1435
 do_sys_open fs/open.c:1450 [inline]
 __do_sys_openat fs/open.c:1466 [inline]
 __se_sys_openat fs/open.c:1461 [inline]
 __arm64_sys_openat+0x120/0x158 fs/open.c:1461
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
 el0_svc+0x5c/0x254 arch/arm64/kernel/entry-common.c:744
 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:763
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596
Code: f9400268 927ff914 91016280 d343fc08 (38786908) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	f9400268 	ldr	x8, [x19]
   4:	927ff914 	and	x20, x8, #0xfffffffffffffffe
   8:	91016280 	add	x0, x20, #0x58
   c:	d343fc08 	lsr	x8, x0, #3
* 10:	38786908 	ldrb	w8, [x8, x24] <-- trapping instruction