Extracting prog: 1m13.895592108s
Minimizing prog: 45m47.488833326s
Simplifying prog options: 0s
Extracting C: 1m18.204541703s
Simplifying C: 15m25.55582778s


extracting reproducer from 30 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendmsg$can_j1939-openat$uhid-clock_gettime-pselect6-openat$rdma_cm-write$RDMA_USER_CM_CMD_QUERY_ROUTE-ioctl$sock_bt_hidp_HIDPCONNDEL-syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendmsg$can_j1939-openat$uhid-clock_gettime-pselect6-openat$rdma_cm-write$RDMA_USER_CM_CMD_QUERY_ROUTE-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000)
r2 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vxcan1\x00', <r3=>0x0})
bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x0, {}, 0xfd}, 0x18)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18)
sendmsg$can_j1939(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)='.', 0x1a000}}, 0xfe)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
clock_gettime(0x0, &(0x7f0000000040)={<r4=>0x0, <r5=>0x0})
pselect6(0x40, &(0x7f0000000080)={0xc, 0x4, 0x401, 0x5, 0x6, 0x80081, 0x3, 0x87}, 0x0, 0x0, &(0x7f00000001c0)={r4, r5+10000000}, 0x0)
r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000c80), 0x2, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(r6, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}})
syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) (async)
syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) (async)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'}) (async)
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000) (async)
socket$can_j1939(0x1d, 0x2, 0x7) (async)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vxcan1\x00'}) (async)
bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x0, {}, 0xfd}, 0x18) (async)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
sendmsg$can_j1939(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)='.', 0x1a000}}, 0xfe) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
pselect6(0x40, &(0x7f0000000080)={0xc, 0x4, 0x401, 0x5, 0x6, 0x80081, 0x3, 0x87}, 0x0, 0x0, &(0x7f00000001c0)={r4, r5+10000000}, 0x0) (async)
openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000c80), 0x2, 0x0) (async)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(r6, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
single: successfully extracted reproducer
found reproducer with 32 syscalls
minimizing guilty program
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendmsg$can_j1939-openat$uhid-clock_gettime-pselect6-openat$rdma_cm-write$RDMA_USER_CM_CMD_QUERY_ROUTE-ioctl$sock_bt_hidp_HIDPCONNDEL-syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendmsg$can_j1939-openat$uhid-clock_gettime-pselect6-openat$rdma_cm-write$RDMA_USER_CM_CMD_QUERY_ROUTE
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000)
r2 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vxcan1\x00', <r3=>0x0})
bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x0, {}, 0xfd}, 0x18)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18)
sendmsg$can_j1939(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)='.', 0x1a000}}, 0xfe)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
clock_gettime(0x0, &(0x7f0000000040)={<r4=>0x0, <r5=>0x0})
pselect6(0x40, &(0x7f0000000080)={0xc, 0x4, 0x401, 0x5, 0x6, 0x80081, 0x3, 0x87}, 0x0, 0x0, &(0x7f00000001c0)={r4, r5+10000000}, 0x0)
r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000c80), 0x2, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(r6, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}})
syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) (async)
syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) (async)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'}) (async)
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000) (async)
socket$can_j1939(0x1d, 0x2, 0x7) (async)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vxcan1\x00'}) (async)
bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x0, {}, 0xfd}, 0x18) (async)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
sendmsg$can_j1939(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)='.', 0x1a000}}, 0xfe) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
pselect6(0x40, &(0x7f0000000080)={0xc, 0x4, 0x401, 0x5, 0x6, 0x80081, 0x3, 0x87}, 0x0, 0x0, &(0x7f00000001c0)={r4, r5+10000000}, 0x0) (async)
openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000c80), 0x2, 0x0) (async)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(r6, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18) (async)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendmsg$can_j1939-openat$uhid-clock_gettime-pselect6-openat$rdma_cm-write$RDMA_USER_CM_CMD_QUERY_ROUTE-ioctl$sock_bt_hidp_HIDPCONNDEL-syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendmsg$can_j1939-openat$uhid-clock_gettime-pselect6-openat$rdma_cm-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000)
r2 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vxcan1\x00', <r3=>0x0})
bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x0, {}, 0xfd}, 0x18)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18)
sendmsg$can_j1939(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)='.', 0x1a000}}, 0xfe)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
clock_gettime(0x0, &(0x7f0000000040)={<r4=>0x0, <r5=>0x0})
pselect6(0x40, &(0x7f0000000080)={0xc, 0x4, 0x401, 0x5, 0x6, 0x80081, 0x3, 0x87}, 0x0, 0x0, &(0x7f00000001c0)={r4, r5+10000000}, 0x0)
r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000c80), 0x2, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(r6, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}})
syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) (async)
syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) (async)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'}) (async)
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000) (async)
socket$can_j1939(0x1d, 0x2, 0x7) (async)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vxcan1\x00'}) (async)
bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x0, {}, 0xfd}, 0x18) (async)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
sendmsg$can_j1939(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)='.', 0x1a000}}, 0xfe) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
pselect6(0x40, &(0x7f0000000080)={0xc, 0x4, 0x401, 0x5, 0x6, 0x80081, 0x3, 0x87}, 0x0, 0x0, &(0x7f00000001c0)={r4, r5+10000000}, 0x0) (async)
openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000c80), 0x2, 0x0) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendmsg$can_j1939-openat$uhid-clock_gettime-pselect6-openat$rdma_cm-write$RDMA_USER_CM_CMD_QUERY_ROUTE-ioctl$sock_bt_hidp_HIDPCONNDEL-syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendmsg$can_j1939-openat$uhid-clock_gettime-pselect6-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000)
r2 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vxcan1\x00', <r3=>0x0})
bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x0, {}, 0xfd}, 0x18)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18)
sendmsg$can_j1939(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)='.', 0x1a000}}, 0xfe)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
clock_gettime(0x0, &(0x7f0000000040)={<r4=>0x0, <r5=>0x0})
pselect6(0x40, &(0x7f0000000080)={0xc, 0x4, 0x401, 0x5, 0x6, 0x80081, 0x3, 0x87}, 0x0, 0x0, &(0x7f00000001c0)={r4, r5+10000000}, 0x0)
r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000c80), 0x2, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(r6, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}})
syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) (async)
syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) (async)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'}) (async)
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000) (async)
socket$can_j1939(0x1d, 0x2, 0x7) (async)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vxcan1\x00'}) (async)
bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x0, {}, 0xfd}, 0x18) (async)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
sendmsg$can_j1939(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)='.', 0x1a000}}, 0xfe) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
pselect6(0x40, &(0x7f0000000080)={0xc, 0x4, 0x401, 0x5, 0x6, 0x80081, 0x3, 0x87}, 0x0, 0x0, &(0x7f00000001c0)={r4, r5+10000000}, 0x0) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendmsg$can_j1939-openat$uhid-clock_gettime-pselect6-openat$rdma_cm-write$RDMA_USER_CM_CMD_QUERY_ROUTE-ioctl$sock_bt_hidp_HIDPCONNDEL-syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendmsg$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000)
r2 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vxcan1\x00', <r3=>0x0})
bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x0, {}, 0xfd}, 0x18)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18)
sendmsg$can_j1939(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)='.', 0x1a000}}, 0xfe)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
clock_gettime(0x0, &(0x7f0000000040)={<r4=>0x0, <r5=>0x0})
pselect6(0x40, &(0x7f0000000080)={0xc, 0x4, 0x401, 0x5, 0x6, 0x80081, 0x3, 0x87}, 0x0, 0x0, &(0x7f00000001c0)={r4, r5+10000000}, 0x0)
r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000c80), 0x2, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(r6, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}})
syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) (async)
syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) (async)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'}) (async)
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000) (async)
socket$can_j1939(0x1d, 0x2, 0x7) (async)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vxcan1\x00'}) (async)
bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x0, {}, 0xfd}, 0x18) (async)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
sendmsg$can_j1939(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)='.', 0x1a000}}, 0xfe) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendmsg$can_j1939-openat$uhid-clock_gettime-pselect6-openat$rdma_cm-write$RDMA_USER_CM_CMD_QUERY_ROUTE-ioctl$sock_bt_hidp_HIDPCONNDEL-syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendmsg$can_j1939-openat$uhid-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000)
r2 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vxcan1\x00', <r3=>0x0})
bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x0, {}, 0xfd}, 0x18)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18)
sendmsg$can_j1939(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)='.', 0x1a000}}, 0xfe)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
clock_gettime(0x0, &(0x7f0000000040)={<r4=>0x0, <r5=>0x0})
pselect6(0x40, &(0x7f0000000080)={0xc, 0x4, 0x401, 0x5, 0x6, 0x80081, 0x3, 0x87}, 0x0, 0x0, &(0x7f00000001c0)={r4, r5+10000000}, 0x0)
r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000c80), 0x2, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(r6, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}})
syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) (async)
syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) (async)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'}) (async)
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000) (async)
socket$can_j1939(0x1d, 0x2, 0x7) (async)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vxcan1\x00'}) (async)
bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x0, {}, 0xfd}, 0x18) (async)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
sendmsg$can_j1939(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)='.', 0x1a000}}, 0xfe) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendmsg$can_j1939-openat$uhid-clock_gettime-pselect6-openat$rdma_cm-write$RDMA_USER_CM_CMD_QUERY_ROUTE-ioctl$sock_bt_hidp_HIDPCONNDEL-syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendmsg$can_j1939-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000)
r2 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vxcan1\x00', <r3=>0x0})
bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x0, {}, 0xfd}, 0x18)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18)
sendmsg$can_j1939(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)='.', 0x1a000}}, 0xfe)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
clock_gettime(0x0, &(0x7f0000000040)={<r4=>0x0, <r5=>0x0})
pselect6(0x40, &(0x7f0000000080)={0xc, 0x4, 0x401, 0x5, 0x6, 0x80081, 0x3, 0x87}, 0x0, 0x0, &(0x7f00000001c0)={r4, r5+10000000}, 0x0)
r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000c80), 0x2, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(r6, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}})
syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) (async)
syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) (async)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'}) (async)
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000) (async)
socket$can_j1939(0x1d, 0x2, 0x7) (async)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vxcan1\x00'}) (async)
bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x0, {}, 0xfd}, 0x18) (async)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
sendmsg$can_j1939(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)='.', 0x1a000}}, 0xfe) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendmsg$can_j1939-openat$uhid-clock_gettime-pselect6-openat$rdma_cm-write$RDMA_USER_CM_CMD_QUERY_ROUTE-ioctl$sock_bt_hidp_HIDPCONNDEL-syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000)
r2 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vxcan1\x00', <r3=>0x0})
bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x0, {}, 0xfd}, 0x18)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18)
sendmsg$can_j1939(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)='.', 0x1a000}}, 0xfe)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
clock_gettime(0x0, &(0x7f0000000040)={<r4=>0x0, <r5=>0x0})
pselect6(0x40, &(0x7f0000000080)={0xc, 0x4, 0x401, 0x5, 0x6, 0x80081, 0x3, 0x87}, 0x0, 0x0, &(0x7f00000001c0)={r4, r5+10000000}, 0x0)
r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000c80), 0x2, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(r6, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}})
syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) (async)
syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) (async)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'}) (async)
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000) (async)
socket$can_j1939(0x1d, 0x2, 0x7) (async)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vxcan1\x00'}) (async)
bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x0, {}, 0xfd}, 0x18) (async)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendmsg$can_j1939-openat$uhid-clock_gettime-pselect6-openat$rdma_cm-write$RDMA_USER_CM_CMD_QUERY_ROUTE-ioctl$sock_bt_hidp_HIDPCONNDEL-syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000)
r2 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vxcan1\x00', <r3=>0x0})
bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x0, {}, 0xfd}, 0x18)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18)
sendmsg$can_j1939(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)='.', 0x1a000}}, 0xfe)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
clock_gettime(0x0, &(0x7f0000000040)={<r4=>0x0, <r5=>0x0})
pselect6(0x40, &(0x7f0000000080)={0xc, 0x4, 0x401, 0x5, 0x6, 0x80081, 0x3, 0x87}, 0x0, 0x0, &(0x7f00000001c0)={r4, r5+10000000}, 0x0)
r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000c80), 0x2, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(r6, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}})
syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) (async)
syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) (async)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'}) (async)
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000) (async)
socket$can_j1939(0x1d, 0x2, 0x7) (async)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vxcan1\x00'}) (async)
bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x0, {}, 0xfd}, 0x18) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendmsg$can_j1939-openat$uhid-clock_gettime-pselect6-openat$rdma_cm-write$RDMA_USER_CM_CMD_QUERY_ROUTE-ioctl$sock_bt_hidp_HIDPCONNDEL-syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000)
r2 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vxcan1\x00', <r3=>0x0})
bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x0, {}, 0xfd}, 0x18)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18)
sendmsg$can_j1939(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)='.', 0x1a000}}, 0xfe)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
clock_gettime(0x0, &(0x7f0000000040)={<r4=>0x0, <r5=>0x0})
pselect6(0x40, &(0x7f0000000080)={0xc, 0x4, 0x401, 0x5, 0x6, 0x80081, 0x3, 0x87}, 0x0, 0x0, &(0x7f00000001c0)={r4, r5+10000000}, 0x0)
r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000c80), 0x2, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(r6, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}})
syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) (async)
syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) (async)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'}) (async)
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000) (async)
socket$can_j1939(0x1d, 0x2, 0x7) (async)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vxcan1\x00'}) (async)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendmsg$can_j1939-openat$uhid-clock_gettime-pselect6-openat$rdma_cm-write$RDMA_USER_CM_CMD_QUERY_ROUTE-ioctl$sock_bt_hidp_HIDPCONNDEL-syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000)
r2 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vxcan1\x00', <r3=>0x0})
bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x0, {}, 0xfd}, 0x18)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18)
sendmsg$can_j1939(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)='.', 0x1a000}}, 0xfe)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
clock_gettime(0x0, &(0x7f0000000040)={<r4=>0x0, <r5=>0x0})
pselect6(0x40, &(0x7f0000000080)={0xc, 0x4, 0x401, 0x5, 0x6, 0x80081, 0x3, 0x87}, 0x0, 0x0, &(0x7f00000001c0)={r4, r5+10000000}, 0x0)
r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000c80), 0x2, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(r6, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}})
syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) (async)
syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) (async)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'}) (async)
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000) (async)
socket$can_j1939(0x1d, 0x2, 0x7) (async)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendmsg$can_j1939-openat$uhid-clock_gettime-pselect6-openat$rdma_cm-write$RDMA_USER_CM_CMD_QUERY_ROUTE-ioctl$sock_bt_hidp_HIDPCONNDEL-syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000)
r2 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vxcan1\x00', <r3=>0x0})
bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x0, {}, 0xfd}, 0x18)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18)
sendmsg$can_j1939(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)='.', 0x1a000}}, 0xfe)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
clock_gettime(0x0, &(0x7f0000000040)={<r4=>0x0, <r5=>0x0})
pselect6(0x40, &(0x7f0000000080)={0xc, 0x4, 0x401, 0x5, 0x6, 0x80081, 0x3, 0x87}, 0x0, 0x0, &(0x7f00000001c0)={r4, r5+10000000}, 0x0)
r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000c80), 0x2, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(r6, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}})
syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) (async)
syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) (async)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'}) (async)
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000) (async)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendmsg$can_j1939-openat$uhid-clock_gettime-pselect6-openat$rdma_cm-write$RDMA_USER_CM_CMD_QUERY_ROUTE-ioctl$sock_bt_hidp_HIDPCONNDEL-syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000)
r2 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vxcan1\x00', <r3=>0x0})
bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x0, {}, 0xfd}, 0x18)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18)
sendmsg$can_j1939(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)='.', 0x1a000}}, 0xfe)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
clock_gettime(0x0, &(0x7f0000000040)={<r4=>0x0, <r5=>0x0})
pselect6(0x40, &(0x7f0000000080)={0xc, 0x4, 0x401, 0x5, 0x6, 0x80081, 0x3, 0x87}, 0x0, 0x0, &(0x7f00000001c0)={r4, r5+10000000}, 0x0)
r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000c80), 0x2, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(r6, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}})
syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) (async)
syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) (async)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'}) (async)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendmsg$can_j1939-openat$uhid-clock_gettime-pselect6-openat$rdma_cm-write$RDMA_USER_CM_CMD_QUERY_ROUTE-ioctl$sock_bt_hidp_HIDPCONNDEL-syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000)
r2 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vxcan1\x00', <r3=>0x0})
bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x0, {}, 0xfd}, 0x18)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18)
sendmsg$can_j1939(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)='.', 0x1a000}}, 0xfe)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
clock_gettime(0x0, &(0x7f0000000040)={<r4=>0x0, <r5=>0x0})
pselect6(0x40, &(0x7f0000000080)={0xc, 0x4, 0x401, 0x5, 0x6, 0x80081, 0x3, 0x87}, 0x0, 0x0, &(0x7f00000001c0)={r4, r5+10000000}, 0x0)
r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000c80), 0x2, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(r6, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}})
syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) (async)
syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) (async)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendmsg$can_j1939-openat$uhid-clock_gettime-pselect6-openat$rdma_cm-write$RDMA_USER_CM_CMD_QUERY_ROUTE-ioctl$sock_bt_hidp_HIDPCONNDEL-syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000)
r2 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vxcan1\x00', <r3=>0x0})
bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x0, {}, 0xfd}, 0x18)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18)
sendmsg$can_j1939(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)='.', 0x1a000}}, 0xfe)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
clock_gettime(0x0, &(0x7f0000000040)={<r4=>0x0, <r5=>0x0})
pselect6(0x40, &(0x7f0000000080)={0xc, 0x4, 0x401, 0x5, 0x6, 0x80081, 0x3, 0x87}, 0x0, 0x0, &(0x7f00000001c0)={r4, r5+10000000}, 0x0)
r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000c80), 0x2, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(r6, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}})
syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) (async)
syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) (async)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendmsg$can_j1939-openat$uhid-clock_gettime-pselect6-openat$rdma_cm-write$RDMA_USER_CM_CMD_QUERY_ROUTE-ioctl$sock_bt_hidp_HIDPCONNDEL-syz_init_net_socket$bt_hidp-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000)
r2 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vxcan1\x00', <r3=>0x0})
bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x0, {}, 0xfd}, 0x18)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18)
sendmsg$can_j1939(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)='.', 0x1a000}}, 0xfe)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
clock_gettime(0x0, &(0x7f0000000040)={<r4=>0x0, <r5=>0x0})
pselect6(0x40, &(0x7f0000000080)={0xc, 0x4, 0x401, 0x5, 0x6, 0x80081, 0x3, 0x87}, 0x0, 0x0, &(0x7f00000001c0)={r4, r5+10000000}, 0x0)
r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000c80), 0x2, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(r6, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}})
syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) (async)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendmsg$can_j1939-openat$uhid-clock_gettime-pselect6-openat$rdma_cm-write$RDMA_USER_CM_CMD_QUERY_ROUTE-ioctl$sock_bt_hidp_HIDPCONNDEL-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000)
r2 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vxcan1\x00', <r3=>0x0})
bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x0, {}, 0xfd}, 0x18)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18)
sendmsg$can_j1939(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)='.', 0x1a000}}, 0xfe)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
clock_gettime(0x0, &(0x7f0000000040)={<r4=>0x0, <r5=>0x0})
pselect6(0x40, &(0x7f0000000080)={0xc, 0x4, 0x401, 0x5, 0x6, 0x80081, 0x3, 0x87}, 0x0, 0x0, &(0x7f00000001c0)={r4, r5+10000000}, 0x0)
r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000c80), 0x2, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(r6, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}})
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendmsg$can_j1939-openat$uhid-clock_gettime-pselect6-openat$rdma_cm-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000)
r2 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vxcan1\x00', <r3=>0x0})
bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x0, {}, 0xfd}, 0x18)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18)
sendmsg$can_j1939(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)='.', 0x1a000}}, 0xfe)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
clock_gettime(0x0, &(0x7f0000000040)={<r4=>0x0, <r5=>0x0})
pselect6(0x40, &(0x7f0000000080)={0xc, 0x4, 0x401, 0x5, 0x6, 0x80081, 0x3, 0x87}, 0x0, 0x0, &(0x7f00000001c0)={r4, r5+10000000}, 0x0)
r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000c80), 0x2, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(r6, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendmsg$can_j1939-openat$uhid-clock_gettime-pselect6-openat$rdma_cm-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000)
r2 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vxcan1\x00', <r3=>0x0})
bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x0, {}, 0xfd}, 0x18)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18)
sendmsg$can_j1939(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)='.', 0x1a000}}, 0xfe)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
clock_gettime(0x0, &(0x7f0000000040)={<r4=>0x0, <r5=>0x0})
pselect6(0x40, &(0x7f0000000080)={0xc, 0x4, 0x401, 0x5, 0x6, 0x80081, 0x3, 0x87}, 0x0, 0x0, &(0x7f00000001c0)={r4, r5+10000000}, 0x0)
openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000c80), 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendmsg$can_j1939-openat$uhid-clock_gettime-pselect6-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000)
r2 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vxcan1\x00', <r3=>0x0})
bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x0, {}, 0xfd}, 0x18)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18)
sendmsg$can_j1939(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)='.', 0x1a000}}, 0xfe)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
clock_gettime(0x0, &(0x7f0000000040)={<r4=>0x0, <r5=>0x0})
pselect6(0x40, &(0x7f0000000080)={0xc, 0x4, 0x401, 0x5, 0x6, 0x80081, 0x3, 0x87}, 0x0, 0x0, &(0x7f00000001c0)={r4, r5+10000000}, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendmsg$can_j1939-openat$uhid-clock_gettime-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000)
r2 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vxcan1\x00', <r3=>0x0})
bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x0, {}, 0xfd}, 0x18)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18)
sendmsg$can_j1939(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)='.', 0x1a000}}, 0xfe)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
clock_gettime(0x0, &(0x7f0000000040))
write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendmsg$can_j1939-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000)
r2 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vxcan1\x00', <r3=>0x0})
bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x0, {}, 0xfd}, 0x18)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18)
sendmsg$can_j1939(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)='.', 0x1a000}}, 0xfe)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendmsg$can_j1939-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000)
r2 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vxcan1\x00', <r3=>0x0})
bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x0, {}, 0xfd}, 0x18)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18)
sendmsg$can_j1939(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)='.', 0x1a000}}, 0xfe)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000)
r2 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vxcan1\x00', <r3=>0x0})
bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x0, {}, 0xfd}, 0x18)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000)
r2 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vxcan1\x00', <r3=>0x0})
bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x0, {}, 0xfd}, 0x18)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000)
r2 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vxcan1\x00', <r3=>0x0})
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, r3, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-socket$can_j1939-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000)
r2 = socket$can_j1939(0x1d, 0x2, 0x7)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
connect$can_j1939(r2, &(0x7f0000000080)={0x1d, 0x0, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-mmap-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000000, 0x32, 0xffffffffffffffff, 0x33ed0000)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
connect$can_j1939(0xffffffffffffffff, &(0x7f0000000080)={0x1d, 0x0, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
connect$can_j1939(0xffffffffffffffff, &(0x7f0000000080)={0x1d, 0x0, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
connect$can_j1939(0xffffffffffffffff, &(0x7f0000000080)={0x1d, 0x0, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
connect$can_j1939(0xffffffffffffffff, &(0x7f0000000080)={0x1d, 0x0, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18)
connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
connect$can_j1939(0xffffffffffffffff, &(0x7f0000000080)={0x1d, 0x0, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(0xffffffffffffffff, 0x400448c8, &(0x7f0000000200)={r0, r0, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18)
connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
connect$can_j1939(0xffffffffffffffff, &(0x7f0000000080)={0x1d, 0x0, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(0xffffffffffffffff, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
connect$can_j1939(0xffffffffffffffff, &(0x7f0000000080)={0x1d, 0x0, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
clock_gettime(0x0, &(0x7f0000000040))
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, 0x0, 0x0)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
connect$can_j1939(0xffffffffffffffff, &(0x7f0000000080)={0x1d, 0x0, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, 0x0)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
connect$can_j1939(0xffffffffffffffff, &(0x7f0000000080)={0x1d, 0x0, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
openat$uhid(0xffffffffffffff9c, 0x0, 0x802, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f0000000100)={0x16, 0x10, 0xfa00, {0xffffffffffffffff}}, 0x18)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
connect$can_j1939(0xffffffffffffffff, &(0x7f0000000080)={0x1d, 0x0, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
openat$uhid(0xffffffffffffff9c, 0x0, 0x802, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, 0x0, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
connect$can_j1939(0xffffffffffffffff, &(0x7f0000000080)={0x1d, 0x0, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
openat$uhid(0xffffffffffffff9c, 0x0, 0x802, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, 0x0, 0x0)
connect$bt_l2cap(r1, 0x0, 0x0) (async)
connect$can_j1939(0xffffffffffffffff, &(0x7f0000000080)={0x1d, 0x0, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
openat$uhid(0xffffffffffffff9c, 0x0, 0x802, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, 0x0, 0x0)
connect$bt_l2cap(r1, 0x0, 0x0)
connect$can_j1939(0xffffffffffffffff, &(0x7f0000000080)={0x1d, 0x0, 0x0, {0x0, 0x0, 0x2}, 0xfe}, 0x18) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
openat$uhid(0xffffffffffffff9c, 0x0, 0x802, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, 0x0, 0x0)
connect$bt_l2cap(r1, 0x0, 0x0) (async)
connect$can_j1939(0xffffffffffffffff, 0x0, 0x0) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
openat$uhid(0xffffffffffffff9c, 0x0, 0x802, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, 0x0, 0x0)
connect$bt_l2cap(r1, 0x0, 0x0) (async)
connect$can_j1939(0xffffffffffffffff, 0x0, 0x0)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
openat$uhid(0xffffffffffffff9c, 0x0, 0x802, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, 0x0, 0x0)
connect$bt_l2cap(r1, 0x0, 0x0) (async)
connect$can_j1939(0xffffffffffffffff, 0x0, 0x0) (async)
openat$uhid(0xffffffffffffff9c, 0x0, 0x802, 0x0) (async)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
openat$uhid(0xffffffffffffff9c, 0x0, 0x802, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, 0x0, 0x0)
connect$bt_l2cap(r1, 0x0, 0x0) (async)
connect$can_j1939(0xffffffffffffffff, 0x0, 0x0) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
clock_gettime(0x0, &(0x7f0000000040)) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
openat$uhid(0xffffffffffffff9c, 0x0, 0x802, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, 0x0, 0x0)
connect$bt_l2cap(r1, 0x0, 0x0) (async)
connect$can_j1939(0xffffffffffffffff, 0x0, 0x0) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
clock_gettime(0x0, 0x0) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
openat$uhid(0xffffffffffffff9c, 0x0, 0x802, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, 0x0, 0x0)
connect$bt_l2cap(r1, 0x0, 0x0) (async)
connect$can_j1939(0xffffffffffffffff, 0x0, 0x0) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
clock_gettime(0x0, 0x0)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
openat$uhid(0xffffffffffffff9c, 0x0, 0x802, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, 0x0, 0x0)
connect$bt_l2cap(r1, 0x0, 0x0) (async)
connect$can_j1939(0xffffffffffffffff, 0x0, 0x0) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
clock_gettime(0x0, 0x0)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, 0x0) (async)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
openat$uhid(0xffffffffffffff9c, 0x0, 0x802, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, 0x0, 0x0)
connect$bt_l2cap(r1, 0x0, 0x0) (async)
connect$can_j1939(0xffffffffffffffff, 0x0, 0x0) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
clock_gettime(0x0, 0x0)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}})

program did not crash
extracting C reproducer
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
simplifying C reproducer
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
program did not crash
testing compiled C program (duration=30s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
program did not crash
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
program did not crash
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
program did not crash
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
program did not crash
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
program did not crash
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
openat$uhid(0xffffffffffffff9c, 0x0, 0x802, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, 0x0, 0x0)
connect$bt_l2cap(r1, 0x0, 0x0) (async)
connect$can_j1939(0xffffffffffffffff, 0x0, 0x0) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
clock_gettime(0x0, 0x0)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
validation run: crashed=true
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
openat$uhid(0xffffffffffffff9c, 0x0, 0x802, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, 0x0, 0x0)
connect$bt_l2cap(r1, 0x0, 0x0) (async)
connect$can_j1939(0xffffffffffffffff, 0x0, 0x0) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
clock_gettime(0x0, 0x0)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
validation run: crashed=true
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-ioctl$sock_bt_hidp_HIDPCONNADD-openat$uhid-write$RDMA_USER_CM_CMD_QUERY_ROUTE-connect$bt_l2cap-connect$can_j1939-openat$uhid-clock_gettime-ioctl$sock_bt_hidp_HIDPCONNDEL
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000200)={r1, r1, 0x7fff, 0x0, 0x0, 0x6, 0x4c, 0x96c0, 0x9, 0x0, 0x3, 0x9, 'syz0\x00'})
openat$uhid(0xffffffffffffff9c, 0x0, 0x802, 0x0)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, 0x0, 0x0)
connect$bt_l2cap(r1, 0x0, 0x0) (async)
connect$can_j1939(0xffffffffffffffff, 0x0, 0x0) (async)
openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0)
clock_gettime(0x0, 0x0)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)

program crashed: BUG: unable to handle kernel paging request in l2cap_unregister_user
validation run: crashed=true
reproducing took 1h6m44.133516756s
repro crashed as (corrupted=false):
Unable to handle kernel paging request at virtual address dfff800000000000
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
Mem abort info:
  ESR = 0x0000000096000006
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x06: level 2 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000006
  CM = 0, WnR = 0
[dfff800000000000] address between user and kernel address ranges
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 4686 Comm: syz.3.47 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : l2cap_unregister_user+0x34/0x194 net/bluetooth/l2cap_core.c:1775
lr : l2cap_unregister_user+0x30/0x194 net/bluetooth/l2cap_core.c:1774
sp : ffff800021be77b0
x29: ffff800021be77b0 x28: ffff0000dad39c00 x27: 00000000000089f0
x26: dfff800000000000 x25: dfff800000000000 x24: ffff800021be7840
x23: 1ffff0000437cf2b x22: dfff800000000000 x21: 0000000000000000
x20: 0000000000000000 x19: ffff0000d9f38090 x18: 1fffe00033e7217e
x17: ffff80001539d000 x16: ffff8000082dd25c x15: ffff00019f390bfc
x14: 0000000000000001 x13: 1fffe00033e74870 x12: 0000000000000000
x11: ff00800010df18bc x10: 0000000000000000 x9 : ffff800010df18bc
x8 : 0000000000000000 x7 : ffff80000825ab48 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : ffff800021be73c0 x1 : ffff0000d9f38090 x0 : 0000000000000000
Call trace:
 l2cap_unregister_user+0x34/0x194 net/bluetooth/l2cap_core.c:1775
 hidp_connection_del+0xb4/0x154 net/bluetooth/hidp/core.c:1441
 do_hidp_sock_ioctl net/bluetooth/hidp/sock.c:97 [inline]
 hidp_sock_ioctl+0x60c/0xa70 net/bluetooth/hidp/sock.c:128
 sock_do_ioctl+0x100/0x258 net/socket.c:1202
 sock_ioctl+0x234/0x828 net/socket.c:1321
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:870 [inline]
 __se_sys_ioctl fs/ioctl.c:856 [inline]
 __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: aa0003f4 f2fbfff6 97c80048 d343fe88 (38766908) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	aa0003f4 	mov	x20, x0
   4:	f2fbfff6 	movk	x22, #0xdfff, lsl #48
   8:	97c80048 	bl	0xffffffffff200128
   c:	d343fe88 	lsr	x8, x20, #3
* 10:	38766908 	ldrb	w8, [x8, x22] <-- trapping instruction

final repro crashed as (corrupted=false):
Unable to handle kernel paging request at virtual address dfff800000000000
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
Mem abort info:
  ESR = 0x0000000096000006
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x06: level 2 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000006
  CM = 0, WnR = 0
[dfff800000000000] address between user and kernel address ranges
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 4686 Comm: syz.3.47 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : l2cap_unregister_user+0x34/0x194 net/bluetooth/l2cap_core.c:1775
lr : l2cap_unregister_user+0x30/0x194 net/bluetooth/l2cap_core.c:1774
sp : ffff800021be77b0
x29: ffff800021be77b0 x28: ffff0000dad39c00 x27: 00000000000089f0
x26: dfff800000000000 x25: dfff800000000000 x24: ffff800021be7840
x23: 1ffff0000437cf2b x22: dfff800000000000 x21: 0000000000000000
x20: 0000000000000000 x19: ffff0000d9f38090 x18: 1fffe00033e7217e
x17: ffff80001539d000 x16: ffff8000082dd25c x15: ffff00019f390bfc
x14: 0000000000000001 x13: 1fffe00033e74870 x12: 0000000000000000
x11: ff00800010df18bc x10: 0000000000000000 x9 : ffff800010df18bc
x8 : 0000000000000000 x7 : ffff80000825ab48 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : ffff800021be73c0 x1 : ffff0000d9f38090 x0 : 0000000000000000
Call trace:
 l2cap_unregister_user+0x34/0x194 net/bluetooth/l2cap_core.c:1775
 hidp_connection_del+0xb4/0x154 net/bluetooth/hidp/core.c:1441
 do_hidp_sock_ioctl net/bluetooth/hidp/sock.c:97 [inline]
 hidp_sock_ioctl+0x60c/0xa70 net/bluetooth/hidp/sock.c:128
 sock_do_ioctl+0x100/0x258 net/socket.c:1202
 sock_ioctl+0x234/0x828 net/socket.c:1321
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:870 [inline]
 __se_sys_ioctl fs/ioctl.c:856 [inline]
 __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: aa0003f4 f2fbfff6 97c80048 d343fe88 (38766908) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	aa0003f4 	mov	x20, x0
   4:	f2fbfff6 	movk	x22, #0xdfff, lsl #48
   8:	97c80048 	bl	0xffffffffff200128
   c:	d343fe88 	lsr	x8, x20, #3
* 10:	38766908 	ldrb	w8, [x8, x22] <-- trapping instruction