program: socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') unshare(0x6a040000) r0 = socket(0x8, 0x3, 0x0) ioctl$PPPIOCGL2TPSTATS(r0, 0x61e1, 0x0) sendmmsg(r0, &(0x7f0000001f40)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000000c0)="a1826402a09896dcb597fc34bb3b1a88016cf5f71ebd8045968636d438f1d9eec865482eab5f526a204d141344bc69c15f6da2d8e2153a4e531c6f5a5ffb1453346a2e6fee968d4336934e67be80db64ba5df2eeab1c823ee14eb7b9e26eb45ccbd7aad83f53225718aafe9e1f57e49caeed2f37ce46b3105a10e2efbd6a9b61aba36da27b7a4f4bc714d3e76ac8cba7f23331acc80de93e6b5f118d2ba58091b8b1f2e7e4fb401f8c4719aef80bacd58f3672e937e6e8b35ba3285b82e4c748", 0xc0}], 0x1, &(0x7f0000000280)=[{0x100, 0x369, 0xf1, "d370edfb68a017ecc45be9ca461a1c2b04ea2d301fca2984eac451487cbac591c0406939266cf3367ad496c1ab4ac71eb1094193a3760ea697224febe5f5092506c32ccd83b8f75b21bd273757eca50e8ff780f3091e711ccb48427329850de3721ea10820f3e9c2290fbc569c77316531eaa36f26c1454ceb9c4028358ecd063ecc7f50fb80487c63bc55e371b32f1d62bd4f87a323e813db0a0468d6cf92fd4662023d241344ae742cce1e7d2eeceb88024e0128632cee855d143cdaeae3ebfd697d02c59a757f2e63a094307128f38997fcf253e29526a0c68f977ece7acdfe37955fafb396792b40"}, {0xa8, 0x1a, 0x4609, "24f513d8ce0a4e65803bd64ddf78c015921ab368e83236e4ccf701438af43303a98975d8f1f856273130289ee3ee116a4d328cff851fcb014430d3a87c07b52f1862530e1441f747f99480d6824b67f25d5940fe7d2efc57adf955e1eefeef790360898c83453fedc38c6f1b8865860dae5575ce00a5b4c0b48a458e125cef3253e7fc2e1f5eab414a47b9e0935fe6b6d4648d74"}, {0xc0, 0x0, 0x6, "eb0143c41d4f6b77d093440ce548817de3e67d111ee619b5bc613839667918a39cbcb50a72227ed6690d8103c7e74b784bbf595d29c539b4225f7179f74056d83be0e752c9419d87351b4a377e4414d0fd5ede31ded5dde12752c94b15421c99e2f2bc4a10dfe2535939225b58e7a30de7792398d290552466f9afcef738edc834c47400351f62cd17e03ee2ba5b2d732dc2da1bb7052c9e3474dc1e70b6a4d63ae091ecff9bf58cb0e9333c"}, {0xe0, 0x111, 0x8, "d2d875f13591cf75027ba5470833dd30c92efae6ce134471543eac35190ca5074ab6bca30f6972ad50c06304204c9e6f96de072611a8f72e5edb4fbda7b75104f13dc2c2d5bae7e16a09cb7955efdbda27ba412371393090ce09e443ede9d2ac47ec6ad9b2b528b090c4f00c6c8bf59005bbbddd5521fc9089d5f93933e670a40c214690cec750b2838ca0814e26636791b9051ee0baf55bfdabbcad9316702bfeed0fd93f334b594f1838d42d702e2437e01e4b650efa8a6febb75f21a83599e13054829c4f49de45b74ac2640784"}], 0x348}}], 0x1, 0x4008801) [ 85.377709][ T5304] Bluetooth: hci0: command tx timeout [ 85.611502][ T5324] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 85.614757][ T5324] #PF: supervisor instruction fetch in kernel mode [ 85.617538][ T5324] #PF: error_code(0x0010) - not-present page [ 85.620107][ T5324] PGD 0 P4D 0 [ 85.621666][ T5324] Oops: Oops: 0010 [#1] SMP KASAN NOPTI [ 85.624010][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted 6.15.0-rc6-syzkaller-00346-g5723cc3450bc #0 PREEMPT(full) [ 85.629054][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 85.633891][ T5324] RIP: 0010:0x0 [ 85.635473][ T5324] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 85.638616][ T5324] RSP: 0018:ffffc9000d3cf778 EFLAGS: 00010246 [ 85.641341][ T5324] RAX: 1ffffffff1910dd1 RBX: 00000000000000c0 RCX: dffffc0000000000 [ 85.644773][ T5324] RDX: ffffc9000dc82000 RSI: ffff88803e4c4640 RDI: ffff888052cd0000 [ 85.648357][ T5324] RBP: ffffc9000d3cf8d0 R08: ffff888052c9143f R09: 1ffff1100a592287 [ 85.651775][ T5324] R10: dffffc0000000000 R11: 0000000000000000 R12: 1ffff92001a79f00 [ 85.655248][ T5324] R13: ffff888052cd0000 R14: ffff88803e4c4640 R15: ffffffff8c886e88 [ 85.658612][ T5324] FS: 00007fbc762566c0(0000) GS:ffff88808d6c2000(0000) knlGS:0000000000000000 [ 85.662512][ T5324] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 85.665418][ T5324] CR2: ffffffffffffffd6 CR3: 0000000041f1b000 CR4: 0000000000352ef0 [ 85.668868][ T5324] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 85.672287][ T5324] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 85.675733][ T5324] Call Trace: [ 85.677239][ T5324] [ 85.678582][ T5324] vcc_sendmsg+0xa10/0xc50 [ 85.680681][ T5324] ? __pfx_vcc_sendmsg+0x10/0x10 [ 85.682921][ T5324] ? __pfx_autoremove_wake_function+0x10/0x10 [ 85.685467][ T5324] ? aa_sock_msg_perm+0x94/0x160 [ 85.687598][ T5324] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 85.689926][ T5324] ? __pfx_vcc_sendmsg+0x10/0x10 [ 85.695296][ T5324] __sock_sendmsg+0x219/0x270 [ 85.697343][ T5324] ____sys_sendmsg+0x52d/0x830 [ 85.699416][ T5324] ? __pfx_____sys_sendmsg+0x10/0x10 [ 85.701699][ T5324] ? import_iovec+0x74/0xa0 [ 85.703747][ T5324] ___sys_sendmsg+0x21f/0x2a0 [ 85.705820][ T5324] ? __pfx____sys_sendmsg+0x10/0x10 [ 85.708072][ T5324] ? __fget_files+0x2a/0x420 [ 85.710139][ T5324] ? __fget_files+0x3a0/0x420 [ 85.712220][ T5324] __sys_sendmmsg+0x227/0x430 [ 85.714339][ T5324] ? __pfx___sys_sendmmsg+0x10/0x10 [ 85.716669][ T5324] ? rcu_is_watching+0x15/0xb0 [ 85.718668][ T5324] __x64_sys_sendmmsg+0xa0/0xc0 [ 85.720857][ T5324] do_syscall_64+0xf6/0x210 [ 85.722849][ T5324] ? clear_bhb_loop+0x60/0xb0 [ 85.724906][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.727493][ T5324] RIP: 0033:0x7fbc7538e969 [ 85.729593][ T5324] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 85.737750][ T5324] RSP: 002b:00007fbc76256038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 85.741374][ T5324] RAX: ffffffffffffffda RBX: 00007fbc755b5fa0 RCX: 00007fbc7538e969 [ 85.744760][ T5324] RDX: 0000000000000001 RSI: 0000200000001f40 RDI: 0000000000000004 [ 85.748141][ T5324] RBP: 00007fbc75410ab1 R08: 0000000000000000 R09: 0000000000000000 [ 85.751560][ T5324] R10: 0000000004008801 R11: 0000000000000246 R12: 0000000000000000 [ 85.755160][ T5324] R13: 0000000000000000 R14: 00007fbc755b5fa0 R15: 00007fffd7d24cf8 [ 85.758648][ T5324] [ 85.760033][ T5324] Modules linked in: [ 85.761789][ T5324] CR2: 0000000000000000 [ 85.763657][ T5324] ---[ end trace 0000000000000000 ]--- [ 85.766034][ T5324] RIP: 0010:0x0 [ 85.767603][ T5324] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 85.770865][ T5324] RSP: 0018:ffffc9000d3cf778 EFLAGS: 00010246 [ 85.773684][ T5324] RAX: 1ffffffff1910dd1 RBX: 00000000000000c0 RCX: dffffc0000000000 [ 85.777124][ T5324] RDX: ffffc9000dc82000 RSI: ffff88803e4c4640 RDI: ffff888052cd0000 [ 85.780617][ T5324] RBP: ffffc9000d3cf8d0 R08: ffff888052c9143f R09: 1ffff1100a592287 [ 85.783896][ T5324] R10: dffffc0000000000 R11: 0000000000000000 R12: 1ffff92001a79f00 [ 85.787287][ T5324] R13: ffff888052cd0000 R14: ffff88803e4c4640 R15: ffffffff8c886e88 [ 85.790618][ T5324] FS: 00007fbc762566c0(0000) GS:ffff88808d6c2000(0000) knlGS:0000000000000000 [ 85.794288][ T5324] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 85.797070][ T5324] CR2: ffffffffffffffd6 CR3: 0000000041f1b000 CR4: 0000000000352ef0 [ 85.800601][ T5324] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 85.803962][ T5324] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 85.807284][ T5324] Kernel panic - not syncing: Fatal exception [ 85.810173][ T5324] Kernel Offset: disabled [ 85.812069][ T5324] Rebooting in 86400 seconds..