BUG: unable to handle page fault for address: 000000502444c750
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0 
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 4199 Comm: kworker/u5:8 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: hci1 hci_power_on
RIP: 0010:find_stack lib/stackdepot.c:208 [inline]
RIP: 0010:stack_depot_save+0x164/0x440 lib/stackdepot.c:280
Code: 18 29 cd 4c 8b 2d 74 56 41 12 41 89 ee 41 81 e6 ff ff 0f 00 4f 8b 7c f5 00 4d 85 ff 74 58 89 d9 eb 08 4d 8b 3f 4d 85 ff 74 4c <41> 39 6f 08 75 f2 41 39 5f 0c 75 ec 31 f6 4c 8b 04 f7 4d 3b 44 f7
RSP: 0018:ffffc9000335f5f0 EFLAGS: 00010206
RAX: 0000000000000000 RBX: 000000000000000b RCX: 000000000000000b
RDX: 0000000000000a20 RSI: 00000000a7c09adf RDI: ffffc9000335f650
RBP: 0000000088bb068c R08: 000000008fe9394b R09: 0000000000000001
R10: 0000000061e6f96c R11: 00000000161db7c9 R12: ffff88806007a228
R13: ffff88823b000000 R14: 00000000000b068c R15: 000000502444c748
FS:  0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000502444c750 CR3: 0000000054905000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 kasan_save_stack mm/kasan/common.c:40 [inline]
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:434 [inline]
 __kasan_slab_alloc+0xb3/0xd0 mm/kasan/common.c:467
 kasan_slab_alloc include/linux/kasan.h:254 [inline]
 slab_post_alloc_hook+0x4c/0x380 mm/slab.h:519
 slab_alloc_node mm/slub.c:3225 [inline]
 kmem_cache_alloc_node+0x12d/0x2d0 mm/slub.c:3261
 __alloc_skb+0xf4/0x750 net/core/skbuff.c:415
 alloc_skb include/linux/skbuff.h:1162 [inline]
 bt_skb_alloc include/net/bluetooth/bluetooth.h:392 [inline]
 hci_si_event net/bluetooth/hci_sock.c:726 [inline]
 hci_sock_dev_event+0xf5/0x560 net/bluetooth/hci_sock.c:768
 hci_dev_do_open+0xea1/0x1270 net/bluetooth/hci_core.c:1606
 hci_power_on+0x1c1/0x610 net/bluetooth/hci_core.c:2265
 process_one_work+0x863/0x1000 kernel/workqueue.c:2310
 worker_thread+0xaa8/0x12a0 kernel/workqueue.c:2457
 kthread+0x436/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
Modules linked in:
CR2: 000000502444c750
---[ end trace 7211b2f8442b7d8d ]---
RIP: 0010:find_stack lib/stackdepot.c:208 [inline]
RIP: 0010:stack_depot_save+0x164/0x440 lib/stackdepot.c:280
Code: 18 29 cd 4c 8b 2d 74 56 41 12 41 89 ee 41 81 e6 ff ff 0f 00 4f 8b 7c f5 00 4d 85 ff 74 58 89 d9 eb 08 4d 8b 3f 4d 85 ff 74 4c <41> 39 6f 08 75 f2 41 39 5f 0c 75 ec 31 f6 4c 8b 04 f7 4d 3b 44 f7
RSP: 0018:ffffc9000335f5f0 EFLAGS: 00010206
RAX: 0000000000000000 RBX: 000000000000000b RCX: 000000000000000b
RDX: 0000000000000a20 RSI: 00000000a7c09adf RDI: ffffc9000335f650
RBP: 0000000088bb068c R08: 000000008fe9394b R09: 0000000000000001
R10: 0000000061e6f96c R11: 00000000161db7c9 R12: ffff88806007a228
R13: ffff88823b000000 R14: 00000000000b068c R15: 000000502444c748
FS:  0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000502444c750 CR3: 0000000054905000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	18 29                	sbb    %ch,(%rcx)
   2:	cd 4c                	int    $0x4c
   4:	8b 2d 74 56 41 12    	mov    0x12415674(%rip),%ebp        # 0x1241567e
   a:	41 89 ee             	mov    %ebp,%r14d
   d:	41 81 e6 ff ff 0f 00 	and    $0xfffff,%r14d
  14:	4f 8b 7c f5 00       	mov    0x0(%r13,%r14,8),%r15
  19:	4d 85 ff             	test   %r15,%r15
  1c:	74 58                	je     0x76
  1e:	89 d9                	mov    %ebx,%ecx
  20:	eb 08                	jmp    0x2a
  22:	4d 8b 3f             	mov    (%r15),%r15
  25:	4d 85 ff             	test   %r15,%r15
  28:	74 4c                	je     0x76
* 2a:	41 39 6f 08          	cmp    %ebp,0x8(%r15) <-- trapping instruction
  2e:	75 f2                	jne    0x22
  30:	41 39 5f 0c          	cmp    %ebx,0xc(%r15)
  34:	75 ec                	jne    0x22
  36:	31 f6                	xor    %esi,%esi
  38:	4c 8b 04 f7          	mov    (%rdi,%rsi,8),%r8
  3c:	4d                   	rex.WRB
  3d:	3b                   	.byte 0x3b
  3e:	44                   	rex.R
  3f:	f7                   	.byte 0xf7