==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_write include/linux/instrumented.h:82 [inline]
BUG: KASAN: null-ptr-deref in clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline]
BUG: KASAN: null-ptr-deref in l2cap_sock_resume_cb+0xb4/0x17c net/bluetooth/l2cap_sock.c:1698
Write of size 8 at addr 0000000000000568 by task kworker/u9:2/6442

CPU: 1 UID: 0 PID: 6442 Comm: kworker/u9:2 Not tainted 6.14.0-rc6-syzkaller-g059f6cbcfa70 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Workqueue: hci4 hci_rx_work
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C)
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:120
 print_report+0xf8/0x550 mm/kasan/report.c:524
 kasan_report+0xd8/0x138 mm/kasan/report.c:634
 kasan_check_range+0x268/0x2a8 mm/kasan/generic.c:189
 __kasan_check_write+0x20/0x30 mm/kasan/shadow.c:37
 instrument_atomic_write include/linux/instrumented.h:82 [inline]
 clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline]
 l2cap_sock_resume_cb+0xb4/0x17c net/bluetooth/l2cap_sock.c:1698
 l2cap_security_cfm+0x4f8/0x127c net/bluetooth/l2cap_core.c:7311
 hci_security_cfm include/net/bluetooth/hci_core.h:2088 [inline]
 hci_encrypt_cfm+0x3c0/0x52c include/net/bluetooth/hci_core.h:2136
 hci_encrypt_change_evt+0x560/0xcf0 net/bluetooth/hci_event.c:3655
 hci_event_func net/bluetooth/hci_event.c:7473 [inline]
 hci_event_packet+0x8d0/0x1060 net/bluetooth/hci_event.c:7525
 hci_rx_work+0x31c/0xb04 net/bluetooth/hci_core.c:4015
 process_one_work+0x810/0x1638 kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3319 [inline]
 worker_thread+0x97c/0xeec kernel/workqueue.c:3400
 kthread+0x65c/0x7b0 kernel/kthread.c:464
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862
==================================================================
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000568
Mem abort info:
  ESR = 0x0000000096000004
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x04: level 0 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=000000010596b000
[0000000000000568] pgd=0000000000000000, p4d=0000000000000000
Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 UID: 0 PID: 6442 Comm: kworker/u9:2 Tainted: G    B              6.14.0-rc6-syzkaller-g059f6cbcfa70 #0
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Workqueue: hci4 hci_rx_work
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __lse_atomic64_andnot arch/arm64/include/asm/atomic_lse.h:131 [inline]
pc : arch_atomic64_andnot arch/arm64/include/asm/atomic.h:64 [inline]
pc : raw_atomic64_andnot include/linux/atomic/atomic-arch-fallback.h:3675 [inline]
pc : raw_atomic_long_andnot include/linux/atomic/atomic-long.h:964 [inline]
pc : arch_clear_bit include/asm-generic/bitops/atomic.h:25 [inline]
pc : clear_bit include/asm-generic/bitops/instrumented-atomic.h:42 [inline]
pc : l2cap_sock_resume_cb+0xc0/0x17c net/bluetooth/l2cap_sock.c:1698
lr : arch_atomic64_andnot arch/arm64/include/asm/atomic.h:64 [inline]
lr : raw_atomic64_andnot include/linux/atomic/atomic-arch-fallback.h:3675 [inline]
lr : raw_atomic_long_andnot include/linux/atomic/atomic-long.h:964 [inline]
lr : arch_clear_bit include/asm-generic/bitops/atomic.h:25 [inline]
lr : clear_bit include/asm-generic/bitops/instrumented-atomic.h:42 [inline]
lr : l2cap_sock_resume_cb+0xbc/0x17c net/bluetooth/l2cap_sock.c:1698
sp : ffff8000a12d7450
x29: ffff8000a12d7450 x28: ffff0000d65d202f x27: ffff0000c6820062
x26: ffff0000d65d2000 x25: ffff80008e167d80 x24: ffff0000d65d2480
x23: 1fffe0001acba402 x22: dfff800000000000 x21: 0000000000000002
x20: 0000000000000568 x19: 0000000000000000 x18: 0000000000000008
x17: 3d3d3d3d3d3d3d3d x16: ffff8000806a0364 x15: 0000000000000001
x14: 1ffff0001262e8f8 x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000100000 x10: 0000000000006fa6 x9 : ffff8000b0b45000
x8 : 0000000000000002 x7 : 0000000000000001 x6 : ffff8000804ac4ec
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff8000802f88ec
x2 : 0000000000000001 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
 arch_atomic64_andnot arch/arm64/include/asm/atomic.h:64 [inline] (P)
 raw_atomic64_andnot include/linux/atomic/atomic-arch-fallback.h:3675 [inline] (P)
 raw_atomic_long_andnot include/linux/atomic/atomic-long.h:964 [inline] (P)
 arch_clear_bit include/asm-generic/bitops/atomic.h:25 [inline] (P)
 clear_bit include/asm-generic/bitops/instrumented-atomic.h:42 [inline] (P)
 l2cap_sock_resume_cb+0xc0/0x17c net/bluetooth/l2cap_sock.c:1698 (P)
 l2cap_security_cfm+0x4f8/0x127c net/bluetooth/l2cap_core.c:7311
 hci_security_cfm include/net/bluetooth/hci_core.h:2088 [inline]
 hci_encrypt_cfm+0x3c0/0x52c include/net/bluetooth/hci_core.h:2136
 hci_encrypt_change_evt+0x560/0xcf0 net/bluetooth/hci_event.c:3655
 hci_event_func net/bluetooth/hci_event.c:7473 [inline]
 hci_event_packet+0x8d0/0x1060 net/bluetooth/hci_event.c:7525
 hci_rx_work+0x31c/0xb04 net/bluetooth/hci_core.c:4015
 process_one_work+0x810/0x1638 kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3319 [inline]
 worker_thread+0x97c/0xeec kernel/workqueue.c:3400
 kthread+0x65c/0x7b0 kernel/kthread.c:464
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862
Code: 97565acc d503201f 9756764e 52800048 (f828129f) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	97565acc 	bl	0xfffffffffd596b30
   4:	d503201f 	nop
   8:	9756764e 	bl	0xfffffffffd59d940
   c:	52800048 	mov	w8, #0x2                   	// #2
* 10:	f828129f 	stclr	x8, [x20] <-- trapping instruction