BUG: memory leak
unreferenced object 0xffff888016ea8000 (size 4096):
  comm "syz-executor.7", pid 4772, jiffies 4294943759 (age 685.616s)
  hex dump (first 32 bytes):
    00 a0 ea 16 80 88 ff ff 22 01 00 00 00 00 ad de  ........".......
    00 00 00 00 00 00 00 00 00 00 00 aa aa aa aa aa  ................
  backtrace:
    [<0000000000faea39>] kmalloc include/linux/slab.h:552 [inline]
    [<0000000000faea39>] kzalloc include/linux/slab.h:664 [inline]
    [<0000000000faea39>] hci_conn_add+0x53/0x1280 net/bluetooth/hci_conn.c:525
    [<00000000430eff02>] hci_connect_sco+0x351/0x8d0 net/bluetooth/hci_conn.c:1292
    [<000000009ff6a890>] sco_connect net/bluetooth/sco.c:258 [inline]
    [<000000009ff6a890>] sco_sock_connect+0x352/0xa60 net/bluetooth/sco.c:596
    [<000000002f72a66c>] __sys_connect_file+0x15b/0x1a0 net/socket.c:1865
    [<0000000075a981c0>] io_connect+0x10d/0x610 io_uring/io_uring.c:5280
    [<00000000f52cfa0e>] io_issue_sqe+0x1611/0x7700 io_uring/io_uring.c:6785
    [<0000000048f84e1c>] __io_queue_sqe+0x90/0x9d0 io_uring/io_uring.c:7057
    [<000000003a63732d>] io_queue_sqe io_uring/io_uring.c:7108 [inline]
    [<000000003a63732d>] io_submit_sqe io_uring/io_uring.c:7285 [inline]
    [<000000003a63732d>] io_submit_sqes+0x4461/0x85c0 io_uring/io_uring.c:7391
    [<00000000bb7bb65f>] __do_sys_io_uring_enter+0x6b5/0x18c0 io_uring/io_uring.c:9918
    [<00000000542be166>] do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
    [<00000000cabe949d>] entry_SYSCALL_64_after_hwframe+0x67/0xd1

BUG: memory leak
unreferenced object 0xffff88801cf93140 (size 232):
  comm "syz-executor.6", pid 4956, jiffies 4294985174 (age 644.202s)
  hex dump (first 32 bytes):
    68 71 16 1b 80 88 ff ff 68 71 16 1b 80 88 ff ff  hq......hq......
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000570c02c8>] __alloc_skb+0x6d/0x5b0 net/core/skbuff.c:199
    [<00000000a4df535a>] alloc_skb include/linux/skbuff.h:1102 [inline]
    [<00000000a4df535a>] bt_skb_alloc include/net/bluetooth/bluetooth.h:391 [inline]
    [<00000000a4df535a>] vhci_get_user drivers/bluetooth/hci_vhci.c:170 [inline]
    [<00000000a4df535a>] vhci_write+0xbd/0x450 drivers/bluetooth/hci_vhci.c:290
    [<000000002b6041a6>] call_write_iter include/linux/fs.h:1964 [inline]
    [<000000002b6041a6>] new_sync_write+0x42c/0x660 fs/read_write.c:518
    [<00000000834e2365>] vfs_write+0x747/0xa70 fs/read_write.c:605
    [<000000007bf72597>] ksys_write+0x12d/0x260 fs/read_write.c:658
    [<00000000542be166>] do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
    [<00000000cabe949d>] entry_SYSCALL_64_after_hwframe+0x67/0xd1

BUG: memory leak
unreferenced object 0xffff888047b14c00 (size 512):
  comm "syz-executor.6", pid 4956, jiffies 4294985174 (age 644.202s)
  hex dump (first 32 bytes):
    00 33 b1 47 80 88 ff ff 02 00 00 10 00 0c 00 05  .3.G............
    07 18 00 08 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000a4784384>] __kmalloc_reserve net/core/skbuff.c:143 [inline]
    [<00000000a4784384>] __alloc_skb+0xb1/0x5b0 net/core/skbuff.c:211
    [<00000000a4df535a>] alloc_skb include/linux/skbuff.h:1102 [inline]
    [<00000000a4df535a>] bt_skb_alloc include/net/bluetooth/bluetooth.h:391 [inline]
    [<00000000a4df535a>] vhci_get_user drivers/bluetooth/hci_vhci.c:170 [inline]
    [<00000000a4df535a>] vhci_write+0xbd/0x450 drivers/bluetooth/hci_vhci.c:290
    [<000000002b6041a6>] call_write_iter include/linux/fs.h:1964 [inline]
    [<000000002b6041a6>] new_sync_write+0x42c/0x660 fs/read_write.c:518
    [<00000000834e2365>] vfs_write+0x747/0xa70 fs/read_write.c:605
    [<000000007bf72597>] ksys_write+0x12d/0x260 fs/read_write.c:658
    [<00000000542be166>] do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
    [<00000000cabe949d>] entry_SYSCALL_64_after_hwframe+0x67/0xd1

BUG: memory leak
unreferenced object 0xffff88801b167000 (size 1024):
  comm "kworker/u5:4", pid 302, jiffies 4294985176 (age 644.200s)
  hex dump (first 32 bytes):
    00 80 ea 16 80 88 ff ff 00 5f c2 0c 80 88 ff ff  ........._......
    fd 03 00 00 00 00 00 00 00 06 00 00 00 00 00 00  ................
  backtrace:
    [<00000000a390152e>] kmalloc include/linux/slab.h:552 [inline]
    [<00000000a390152e>] kzalloc include/linux/slab.h:664 [inline]
    [<00000000a390152e>] l2cap_conn_add.part.0+0x64/0xdf0 net/bluetooth/l2cap_core.c:7860
    [<0000000007249564>] l2cap_conn_add net/bluetooth/l2cap_core.c:7853 [inline]
    [<0000000007249564>] l2cap_recv_acldata+0x578/0x8e0 net/bluetooth/l2cap_core.c:8441
    [<000000006685563d>] hci_acldata_packet net/bluetooth/hci_core.c:4779 [inline]
    [<000000006685563d>] hci_rx_work+0x4b6/0xcb0 net/bluetooth/hci_core.c:4970
    [<000000008c6cfc75>] process_one_work+0x9a9/0x14b0 kernel/workqueue.c:2282
    [<000000009d750404>] worker_thread+0x61d/0x1310 kernel/workqueue.c:2428
    [<0000000027702d26>] kthread+0x38f/0x470 kernel/kthread.c:313
    [<00000000406cd0c2>] ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:298

BUG: leak checking failed