Unable to handle kernel paging request at virtual address dfff800000000006
KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
Mem abort info:
  ESR = 0x0000000096000005
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x05: level 1 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[dfff800000000006] address between user and kernel address ranges
Internal error: Oops: 0000000096000005 [#1]  SMP
Modules linked in:
CPU: 0 UID: 0 PID: 6565 Comm: syz-executor Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : kernfs_rename_ns+0x48/0x6a0 fs/kernfs/dir.c:1747
lr : kernfs_rename_ns+0x40/0x6a0 fs/kernfs/dir.c:1740
sp : ffff8000a2a47600
x29: ffff8000a2a47610 x28: 1fffe0001a8a10dd x27: 1ffff00014548ed4
x26: dfff800000000000 x25: 1fffe0001b48ea0e x24: 0000000000000000
x23: 0000000000000030 x22: ffff0000c2b925a0 x21: 0000000000000000
x20: 0000000000000000 x19: 0000000000000000 x18: 00000000ffffffff
x17: ffff800093304000 x16: ffff80008ad634c8 x15: 0000000000000002
x14: 0000000000000000 x13: 0000000000000007 x12: 0000000000ff0100
x11: ffff0000c9270000 x10: 0000000000ff0100 x9 : 0000000000000000
x8 : 0000000000000006 x7 : 3d444c4f5f485441 x6 : 5f48544150564544
x5 : ffff0000f5b3544c x4 : ffff80008dbe480c x3 : 0000000000000000
x2 : 0000000000000000 x1 : ffff0000c2b925a0 x0 : 0000000000000000
Call trace:
 kernfs_rename_ns+0x48/0x6a0 fs/kernfs/dir.c:1747 (P)
 sysfs_move_dir_ns+0xbc/0xd0 fs/sysfs/dir.c:126
 kobject_move+0x460/0x624 lib/kobject.c:569
 device_move+0xe0/0x5b0 drivers/base/core.c:4606
 hci_conn_del_sysfs+0xb4/0x170 net/bluetooth/hci_sysfs.c:75
 hci_conn_cleanup net/bluetooth/hci_conn.c:173 [inline]
 hci_conn_del+0xa40/0xf3c net/bluetooth/hci_conn.c:1217
 hci_conn_hash_flush+0x17c/0x218 net/bluetooth/hci_conn.c:2610
 hci_dev_close_sync+0x89c/0x1154 net/bluetooth/hci_sync.c:5308
 hci_dev_do_close net/bluetooth/hci_core.c:501 [inline]
 hci_unregister_dev+0x204/0x4c0 net/bluetooth/hci_core.c:2715
 vhci_release+0x12c/0x17c drivers/bluetooth/hci_vhci.c:690
 __fput+0x340/0x75c fs/file_table.c:468
 ____fput+0x20/0x58 fs/file_table.c:496
 task_work_run+0x1dc/0x260 kernel/task_work.c:227
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0x524/0x1a14 kernel/exit.c:966
 do_group_exit+0x194/0x22c kernel/exit.c:1107
 __do_sys_exit_group kernel/exit.c:1118 [inline]
 __se_sys_exit_group kernel/exit.c:1116 [inline]
 pid_child_should_wake+0x0/0x1dc kernel/exit.c:1116
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xe8/0x23c arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
 el0_svc+0x5c/0x254 arch/arm64/kernel/entry-common.c:724
 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:743
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596
Code: f2fbfffa 97dd7f55 9100c297 d343fee8 (387a6908) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	f2fbfffa 	movk	x26, #0xdfff, lsl #48
   4:	97dd7f55 	bl	0xffffffffff75fd58
   8:	9100c297 	add	x23, x20, #0x30
   c:	d343fee8 	lsr	x8, x23, #3
* 10:	387a6908 	ldrb	w8, [x8, x26] <-- trapping instruction