syzbot

 sign-in | mailing list | source | docs
🐞 Open [993] ≡ Subsystems 🐞 Fixed [5244] 🐞 Invalid [12515] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

memory leak in mgmt_cmd_complete

Status: fixed on 2022/03/08 16:11
Subsystems: bluetooth
[Documentation on labels]
Reported-by: syzbot+4c4ffd1e1094dae61035@syzkaller.appspotmail.com
Fix commit: 709fca500067 Bluetooth: hci_sock: purge socket queues in the destruct() callback
First crash: 1091d, last: 976d
▶ ▼ Discussions (6)
Title Replies (including bot) Last reply
[PATCH 4.14/4.19/5.4/5.10/5.15 0/1] Bluetooth: hci_sock: purge socket queues in the destruct() callback 3 (3) 2023/03/10 11:50
[PATCH 5.16 0000/1039] 5.16.3-rc1 review 1058 (1058) 2022/02/03 14:49
[PATCH AUTOSEL 5.16 001/217] Bluetooth: hci_sock: purge socket queues in the destruct() callback 226 (226) 2022/01/22 19:17
[PATCH] media: em28xx: fix memory leak in em28xx_init_dev 6 (6) 2021/11/08 01:06
[PATCH] Bluetooth: hci_sock: purge socket queues in the destruct() callback 2 (2) 2021/10/12 15:38
[syzbot] memory leak in mgmt_cmd_complete 0 (2) 2021/08/25 00:31
▶ ▼ Last patch testing requests (5)
Created Duration User Patch Repo Result
2021/10/07 15:31 15m phind.uet@gmail.com patch upstream OK
2021/10/07 15:24 14m phind.uet@gmail.com upstream report log
2021/09/15 06:33 10m phind.uet@gmail.com linux-next report log
2021/08/06 05:41 13m phind.uet@gmail.com linux-next report log
2021/06/21 05:04 13m phind.uet@gmail.com upstream report log

Sample crash report:
BUG: memory leak
unreferenced object 0xffff88811858bb00 (size 232):
  comm "kworker/u5:10", pid 8505, jiffies 4294950224 (age 25.730s)
  hex dump (first 32 bytes):
    d0 14 3d 18 81 88 ff ff d0 14 3d 18 81 88 ff ff  ..=.......=.....
    00 00 00 00 00 00 00 00 00 14 3d 18 81 88 ff ff  ..........=.....
  backtrace:
    [<ffffffff836e557f>] __alloc_skb+0x20f/0x280 net/core/skbuff.c:414
    [<ffffffff83d1c5ed>] alloc_skb include/linux/skbuff.h:1112 [inline]
    [<ffffffff83d1c5ed>] mgmt_cmd_complete+0x3d/0x1a0 net/bluetooth/mgmt_util.c:146
    [<ffffffff83cdc8ee>] send_settings_rsp net/bluetooth/mgmt.c:1129 [inline]
    [<ffffffff83cdc8ee>] settings_rsp+0x5e/0x170 net/bluetooth/mgmt.c:1282
    [<ffffffff83d1c8d6>] mgmt_pending_foreach+0x76/0xa0 net/bluetooth/mgmt_util.c:226
    [<ffffffff83ce80bc>] __mgmt_power_off+0x5c/0x1e0 net/bluetooth/mgmt.c:8583
    [<ffffffff83cb8786>] hci_dev_do_close+0x5b6/0x710 net/bluetooth/hci_core.c:1774
    [<ffffffff812636d9>] process_one_work+0x2c9/0x610 kernel/workqueue.c:2276
    [<ffffffff81263fc9>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2422
    [<ffffffff8126d428>] kthread+0x188/0x1d0 kernel/kthread.c:319
    [<ffffffff810022cf>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

BUG: memory leak
unreferenced object 0xffff888111f7c600 (size 512):
  comm "kworker/u5:10", pid 8505, jiffies 4294950224 (age 25.730s)
  hex dump (first 32 bytes):
    01 00 03 00 07 00 05 00 00 82 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff836e544f>] kmalloc_reserve net/core/skbuff.c:355 [inline]
    [<ffffffff836e544f>] __alloc_skb+0xdf/0x280 net/core/skbuff.c:426
    [<ffffffff83d1c5ed>] alloc_skb include/linux/skbuff.h:1112 [inline]
    [<ffffffff83d1c5ed>] mgmt_cmd_complete+0x3d/0x1a0 net/bluetooth/mgmt_util.c:146
    [<ffffffff83cdc8ee>] send_settings_rsp net/bluetooth/mgmt.c:1129 [inline]
    [<ffffffff83cdc8ee>] settings_rsp+0x5e/0x170 net/bluetooth/mgmt.c:1282
    [<ffffffff83d1c8d6>] mgmt_pending_foreach+0x76/0xa0 net/bluetooth/mgmt_util.c:226
    [<ffffffff83ce80bc>] __mgmt_power_off+0x5c/0x1e0 net/bluetooth/mgmt.c:8583
    [<ffffffff83cb8786>] hci_dev_do_close+0x5b6/0x710 net/bluetooth/hci_core.c:1774
    [<ffffffff812636d9>] process_one_work+0x2c9/0x610 kernel/workqueue.c:2276
    [<ffffffff81263fc9>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2422
    [<ffffffff8126d428>] kthread+0x188/0x1d0 kernel/kthread.c:319
    [<ffffffff810022cf>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

BUG: memory leak
unreferenced object 0xffff88811858bb00 (size 232):
  comm "kworker/u5:10", pid 8505, jiffies 4294950224 (age 25.780s)
  hex dump (first 32 bytes):
    d0 14 3d 18 81 88 ff ff d0 14 3d 18 81 88 ff ff  ..=.......=.....
    00 00 00 00 00 00 00 00 00 14 3d 18 81 88 ff ff  ..........=.....
  backtrace:
    [<ffffffff836e557f>] __alloc_skb+0x20f/0x280 net/core/skbuff.c:414
    [<ffffffff83d1c5ed>] alloc_skb include/linux/skbuff.h:1112 [inline]
    [<ffffffff83d1c5ed>] mgmt_cmd_complete+0x3d/0x1a0 net/bluetooth/mgmt_util.c:146
    [<ffffffff83cdc8ee>] send_settings_rsp net/bluetooth/mgmt.c:1129 [inline]
    [<ffffffff83cdc8ee>] settings_rsp+0x5e/0x170 net/bluetooth/mgmt.c:1282
    [<ffffffff83d1c8d6>] mgmt_pending_foreach+0x76/0xa0 net/bluetooth/mgmt_util.c:226
    [<ffffffff83ce80bc>] __mgmt_power_off+0x5c/0x1e0 net/bluetooth/mgmt.c:8583
    [<ffffffff83cb8786>] hci_dev_do_close+0x5b6/0x710 net/bluetooth/hci_core.c:1774
    [<ffffffff812636d9>] process_one_work+0x2c9/0x610 kernel/workqueue.c:2276
    [<ffffffff81263fc9>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2422
    [<ffffffff8126d428>] kthread+0x188/0x1d0 kernel/kthread.c:319
    [<ffffffff810022cf>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

BUG: memory leak
unreferenced object 0xffff888111f7c600 (size 512):
  comm "kworker/u5:10", pid 8505, jiffies 4294950224 (age 25.780s)
  hex dump (first 32 bytes):
    01 00 03 00 07 00 05 00 00 82 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff836e544f>] kmalloc_reserve net/core/skbuff.c:355 [inline]
    [<ffffffff836e544f>] __alloc_skb+0xdf/0x280 net/core/skbuff.c:426
    [<ffffffff83d1c5ed>] alloc_skb include/linux/skbuff.h:1112 [inline]
    [<ffffffff83d1c5ed>] mgmt_cmd_complete+0x3d/0x1a0 net/bluetooth/mgmt_util.c:146
    [<ffffffff83cdc8ee>] send_settings_rsp net/bluetooth/mgmt.c:1129 [inline]
    [<ffffffff83cdc8ee>] settings_rsp+0x5e/0x170 net/bluetooth/mgmt.c:1282
    [<ffffffff83d1c8d6>] mgmt_pending_foreach+0x76/0xa0 net/bluetooth/mgmt_util.c:226
    [<ffffffff83ce80bc>] __mgmt_power_off+0x5c/0x1e0 net/bluetooth/mgmt.c:8583
    [<ffffffff83cb8786>] hci_dev_do_close+0x5b6/0x710 net/bluetooth/hci_core.c:1774
    [<ffffffff812636d9>] process_one_work+0x2c9/0x610 kernel/workqueue.c:2276
    [<ffffffff81263fc9>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2422
    [<ffffffff8126d428>] kthread+0x188/0x1d0 kernel/kthread.c:319
    [<ffffffff810022cf>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

BUG: memory leak
unreferenced object 0xffff88811858bb00 (size 232):
  comm "kworker/u5:10", pid 8505, jiffies 4294950224 (age 25.840s)
  hex dump (first 32 bytes):
    d0 14 3d 18 81 88 ff ff d0 14 3d 18 81 88 ff ff  ..=.......=.....
    00 00 00 00 00 00 00 00 00 14 3d 18 81 88 ff ff  ..........=.....
  backtrace:
    [<ffffffff836e557f>] __alloc_skb+0x20f/0x280 net/core/skbuff.c:414
    [<ffffffff83d1c5ed>] alloc_skb include/linux/skbuff.h:1112 [inline]
    [<ffffffff83d1c5ed>] mgmt_cmd_complete+0x3d/0x1a0 net/bluetooth/mgmt_util.c:146
    [<ffffffff83cdc8ee>] send_settings_rsp net/bluetooth/mgmt.c:1129 [inline]
    [<ffffffff83cdc8ee>] settings_rsp+0x5e/0x170 net/bluetooth/mgmt.c:1282
    [<ffffffff83d1c8d6>] mgmt_pending_foreach+0x76/0xa0 net/bluetooth/mgmt_util.c:226
    [<ffffffff83ce80bc>] __mgmt_power_off+0x5c/0x1e0 net/bluetooth/mgmt.c:8583
    [<ffffffff83cb8786>] hci_dev_do_close+0x5b6/0x710 net/bluetooth/hci_core.c:1774
    [<ffffffff812636d9>] process_one_work+0x2c9/0x610 kernel/workqueue.c:2276
    [<ffffffff81263fc9>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2422
    [<ffffffff8126d428>] kthread+0x188/0x1d0 kernel/kthread.c:319
    [<ffffffff810022cf>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

BUG: memory leak
unreferenced object 0xffff888111f7c600 (size 512):
  comm "kworker/u5:10", pid 8505, jiffies 4294950224 (age 25.840s)
  hex dump (first 32 bytes):
    01 00 03 00 07 00 05 00 00 82 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff836e544f>] kmalloc_reserve net/core/skbuff.c:355 [inline]
    [<ffffffff836e544f>] __alloc_skb+0xdf/0x280 net/core/skbuff.c:426
    [<ffffffff83d1c5ed>] alloc_skb include/linux/skbuff.h:1112 [inline]
    [<ffffffff83d1c5ed>] mgmt_cmd_complete+0x3d/0x1a0 net/bluetooth/mgmt_util.c:146
    [<ffffffff83cdc8ee>] send_settings_rsp net/bluetooth/mgmt.c:1129 [inline]
    [<ffffffff83cdc8ee>] settings_rsp+0x5e/0x170 net/bluetooth/mgmt.c:1282
    [<ffffffff83d1c8d6>] mgmt_pending_foreach+0x76/0xa0 net/bluetooth/mgmt_util.c:226
    [<ffffffff83ce80bc>] __mgmt_power_off+0x5c/0x1e0 net/bluetooth/mgmt.c:8583
    [<ffffffff83cb8786>] hci_dev_do_close+0x5b6/0x710 net/bluetooth/hci_core.c:1774
    [<ffffffff812636d9>] process_one_work+0x2c9/0x610 kernel/workqueue.c:2276
    [<ffffffff81263fc9>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2422
    [<ffffffff8126d428>] kthread+0x188/0x1d0 kernel/kthread.c:319
    [<ffffffff810022cf>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

BUG: memory leak
unreferenced object 0xffff88811858bb00 (size 232):
  comm "kworker/u5:10", pid 8505, jiffies 4294950224 (age 25.900s)
  hex dump (first 32 bytes):
    d0 14 3d 18 81 88 ff ff d0 14 3d 18 81 88 ff ff  ..=.......=.....
    00 00 00 00 00 00 00 00 00 14 3d 18 81 88 ff ff  ..........=.....
  backtrace:
    [<ffffffff836e557f>] __alloc_skb+0x20f/0x280 net/core/skbuff.c:414
    [<ffffffff83d1c5ed>] alloc_skb include/linux/skbuff.h:1112 [inline]
    [<ffffffff83d1c5ed>] mgmt_cmd_complete+0x3d/0x1a0 net/bluetooth/mgmt_util.c:146
    [<ffffffff83cdc8ee>] send_settings_rsp net/bluetooth/mgmt.c:1129 [inline]
    [<ffffffff83cdc8ee>] settings_rsp+0x5e/0x170 net/bluetooth/mgmt.c:1282
    [<ffffffff83d1c8d6>] mgmt_pending_foreach+0x76/0xa0 net/bluetooth/mgmt_util.c:226
    [<ffffffff83ce80bc>] __mgmt_power_off+0x5c/0x1e0 net/bluetooth/mgmt.c:8583
    [<ffffffff83cb8786>] hci_dev_do_close+0x5b6/0x710 net/bluetooth/hci_core.c:1774
    [<ffffffff812636d9>] process_one_work+0x2c9/0x610 kernel/workqueue.c:2276
    [<ffffffff81263fc9>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2422
    [<ffffffff8126d428>] kthread+0x188/0x1d0 kernel/kthread.c:319
    [<ffffffff810022cf>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

BUG: memory leak
unreferenced object 0xffff888111f7c600 (size 512):
  comm "kworker/u5:10", pid 8505, jiffies 4294950224 (age 25.900s)
  hex dump (first 32 bytes):
    01 00 03 00 07 00 05 00 00 82 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff836e544f>] kmalloc_reserve net/core/skbuff.c:355 [inline]
    [<ffffffff836e544f>] __alloc_skb+0xdf/0x280 net/core/skbuff.c:426
    [<ffffffff83d1c5ed>] alloc_skb include/linux/skbuff.h:1112 [inline]
    [<ffffffff83d1c5ed>] mgmt_cmd_complete+0x3d/0x1a0 net/bluetooth/mgmt_util.c:146
    [<ffffffff83cdc8ee>] send_settings_rsp net/bluetooth/mgmt.c:1129 [inline]
    [<ffffffff83cdc8ee>] settings_rsp+0x5e/0x170 net/bluetooth/mgmt.c:1282
    [<ffffffff83d1c8d6>] mgmt_pending_foreach+0x76/0xa0 net/bluetooth/mgmt_util.c:226
    [<ffffffff83ce80bc>] __mgmt_power_off+0x5c/0x1e0 net/bluetooth/mgmt.c:8583
    [<ffffffff83cb8786>] hci_dev_do_close+0x5b6/0x710 net/bluetooth/hci_core.c:1774
    [<ffffffff812636d9>] process_one_work+0x2c9/0x610 kernel/workqueue.c:2276
    [<ffffffff81263fc9>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2422
    [<ffffffff8126d428>] kthread+0x188/0x1d0 kernel/kthread.c:319
    [<ffffffff810022cf>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

BUG: memory leak
unreferenced object 0xffff88811858bb00 (size 232):
  comm "kworker/u5:10", pid 8505, jiffies 4294950224 (age 25.950s)
  hex dump (first 32 bytes):
    d0 14 3d 18 81 88 ff ff d0 14 3d 18 81 88 ff ff  ..=.......=.....
    00 00 00 00 00 00 00 00 00 14 3d 18 81 88 ff ff  ..........=.....
  backtrace:
    [<ffffffff836e557f>] __alloc_skb+0x20f/0x280 net/core/skbuff.c:414
    [<ffffffff83d1c5ed>] alloc_skb include/linux/skbuff.h:1112 [inline]
    [<ffffffff83d1c5ed>] mgmt_cmd_complete+0x3d/0x1a0 net/bluetooth/mgmt_util.c:146
    [<ffffffff83cdc8ee>] send_settings_rsp net/bluetooth/mgmt.c:1129 [inline]
    [<ffffffff83cdc8ee>] settings_rsp+0x5e/0x170 net/bluetooth/mgmt.c:1282
    [<ffffffff83d1c8d6>] mgmt_pending_foreach+0x76/0xa0 net/bluetooth/mgmt_util.c:226
    [<ffffffff83ce80bc>] __mgmt_power_off+0x5c/0x1e0 net/bluetooth/mgmt.c:8583
    [<ffffffff83cb8786>] hci_dev_do_close+0x5b6/0x710 net/bluetooth/hci_core.c:1774
    [<ffffffff812636d9>] process_one_work+0x2c9/0x610 kernel/workqueue.c:2276
    [<ffffffff81263fc9>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2422
    [<ffffffff8126d428>] kthread+0x188/0x1d0 kernel/kthread.c:319
    [<ffffffff810022cf>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

BUG: memory leak
unreferenced object 0xffff888111f7c600 (size 512):
  comm "kworker/u5:10", pid 8505, jiffies 4294950224 (age 25.950s)
  hex dump (first 32 bytes):
    01 00 03 00 07 00 05 00 00 82 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff836e544f>] kmalloc_reserve net/core/skbuff.c:355 [inline]
    [<ffffffff836e544f>] __alloc_skb+0xdf/0x280 net/core/skbuff.c:426
    [<ffffffff83d1c5ed>] alloc_skb include/linux/skbuff.h:1112 [inline]
    [<ffffffff83d1c5ed>] mgmt_cmd_complete+0x3d/0x1a0 net/bluetooth/mgmt_util.c:146
    [<ffffffff83cdc8ee>] send_settings_rsp net/bluetooth/mgmt.c:1129 [inline]
    [<ffffffff83cdc8ee>] settings_rsp+0x5e/0x170 net/bluetooth/mgmt.c:1282
    [<ffffffff83d1c8d6>] mgmt_pending_foreach+0x76/0xa0 net/bluetooth/mgmt_util.c:226
    [<ffffffff83ce80bc>] __mgmt_power_off+0x5c/0x1e0 net/bluetooth/mgmt.c:8583
    [<ffffffff83cb8786>] hci_dev_do_close+0x5b6/0x710 net/bluetooth/hci_core.c:1774
    [<ffffffff812636d9>] process_one_work+0x2c9/0x610 kernel/workqueue.c:2276
    [<ffffffff81263fc9>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2422
    [<ffffffff8126d428>] kthread+0x188/0x1d0 kernel/kthread.c:319
    [<ffffffff810022cf>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

BUG: memory leak
unreferenced object 0xffff88811858bb00 (size 232):
  comm "kworker/u5:10", pid 8505, jiffies 4294950224 (age 26.010s)
  hex dump (first 32 bytes):
    d0 14 3d 18 81 88 ff ff d0 14 3d 18 81 88 ff ff  ..=.......=.....
    00 00 00 00 00 00 00 00 00 14 3d 18 81 88 ff ff  ..........=.....
  backtrace:
    [<ffffffff836e557f>] __alloc_skb+0x20f/0x280 net/core/skbuff.c:414
    [<ffffffff83d1c5ed>] alloc_skb include/linux/skbuff.h:1112 [inline]
    [<ffffffff83d1c5ed>] mgmt_cmd_complete+0x3d/0x1a0 net/bluetooth/mgmt_util.c:146
    [<ffffffff83cdc8ee>] send_settings_rsp net/bluetooth/mgmt.c:1129 [inline]
    [<ffffffff83cdc8ee>] settings_rsp+0x5e/0x170 net/bluetooth/mgmt.c:1282
    [<ffffffff83d1c8d6>] mgmt_pending_foreach+0x76/0xa0 net/bluetooth/mgmt_util.c:226
    [<ffffffff83ce80bc>] __mgmt_power_off+0x5c/0x1e0 net/bluetooth/mgmt.c:8583
    [<ffffffff83cb8786>] hci_dev_do_close+0x5b6/0x710 net/bluetooth/hci_core.c:1774
    [<ffffffff812636d9>] process_one_work+0x2c9/0x610 kernel/workqueue.c:2276
    [<ffffffff81263fc9>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2422
    [<ffffffff8126d428>] kthread+0x188/0x1d0 kernel/kthread.c:319
    [<ffffffff810022cf>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

BUG: memory leak
unreferenced object 0xffff888111f7c600 (size 512):
  comm "kworker/u5:10", pid 8505, jiffies 4294950224 (age 26.010s)
  hex dump (first 32 bytes):
    01 00 03 00 07 00 05 00 00 82 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff836e544f>] kmalloc_reserve net/core/skbuff.c:355 [inline]
    [<ffffffff836e544f>] __alloc_skb+0xdf/0x280 net/core/skbuff.c:426
    [<ffffffff83d1c5ed>] alloc_skb include/linux/skbuff.h:1112 [inline]
    [<ffffffff83d1c5ed>] mgmt_cmd_complete+0x3d/0x1a0 net/bluetooth/mgmt_util.c:146
    [<ffffffff83cdc8ee>] send_settings_rsp net/bluetooth/mgmt.c:1129 [inline]
    [<ffffffff83cdc8ee>] settings_rsp+0x5e/0x170 net/bluetooth/mgmt.c:1282
    [<ffffffff83d1c8d6>] mgmt_pending_foreach+0x76/0xa0 net/bluetooth/mgmt_util.c:226
    [<ffffffff83ce80bc>] __mgmt_power_off+0x5c/0x1e0 net/bluetooth/mgmt.c:8583
    [<ffffffff83cb8786>] hci_dev_do_close+0x5b6/0x710 net/bluetooth/hci_core.c:1774
    [<ffffffff812636d9>] process_one_work+0x2c9/0x610 kernel/workqueue.c:2276
    [<ffffffff81263fc9>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2422
    [<ffffffff8126d428>] kthread+0x188/0x1d0 kernel/kthread.c:319
    [<ffffffff810022cf>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

BUG: memory leak
unreferenced object 0xffff88811858bb00 (size 232):
  comm "kworker/u5:10", pid 8505, jiffies 4294950224 (age 26.060s)
  hex dump (first 32 bytes):
    d0 14 3d 18 81 88 ff ff d0 14 3d 18 81 88 ff ff  ..=.......=.....
    00 00 00 00 00 00 00 00 00 14 3d 18 81 88 ff ff  ..........=.....
  backtrace:
    [<ffffffff836e557f>] __alloc_skb+0x20f/0x280 net/core/skbuff.c:414
    [<ffffffff83d1c5ed>] alloc_skb include/linux/skbuff.h:1112 [inline]
    [<ffffffff83d1c5ed>] mgmt_cmd_complete+0x3d/0x1a0 net/bluetooth/mgmt_util.c:146
    [<ffffffff83cdc8ee>] send_settings_rsp net/bluetooth/mgmt.c:1129 [inline]
    [<ffffffff83cdc8ee>] settings_rsp+0x5e/0x170 net/bluetooth/mgmt.c:1282
    [<ffffffff83d1c8d6>] mgmt_pending_foreach+0x76/0xa0 net/bluetooth/mgmt_util.c:226
    [<ffffffff83ce80bc>] __mgmt_power_off+0x5c/0x1e0 net/bluetooth/mgmt.c:8583
    [<ffffffff83cb8786>] hci_dev_do_close+0x5b6/0x710 net/bluetooth/hci_core.c:1774
    [<ffffffff812636d9>] process_one_work+0x2c9/0x610 kernel/workqueue.c:2276
    [<ffffffff81263fc9>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2422
    [<ffffffff8126d428>] kthread+0x188/0x1d0 kernel/kthread.c:319
    [<ffffffff810022cf>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

BUG: memory leak
unreferenced object 0xffff888111f7c600 (size 512):
  comm "kworker/u5:10", pid 8505, jiffies 4294950224 (age 26.070s)
  hex dump (first 32 bytes):
    01 00 03 00 07 00 05 00 00 82 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff836e544f>] kmalloc_reserve net/core/skbuff.c:355 [inline]
    [<ffffffff836e544f>] __alloc_skb+0xdf/0x280 net/core/skbuff.c:426
    [<ffffffff83d1c5ed>] alloc_skb include/linux/skbuff.h:1112 [inline]
    [<ffffffff83d1c5ed>] mgmt_cmd_complete+0x3d/0x1a0 net/bluetooth/mgmt_util.c:146
    [<ffffffff83cdc8ee>] send_settings_rsp net/bluetooth/mgmt.c:1129 [inline]
    [<ffffffff83cdc8ee>] settings_rsp+0x5e/0x170 net/bluetooth/mgmt.c:1282
    [<ffffffff83d1c8d6>] mgmt_pending_foreach+0x76/0xa0 net/bluetooth/mgmt_util.c:226
    [<ffffffff83ce80bc>] __mgmt_power_off+0x5c/0x1e0 net/bluetooth/mgmt.c:8583
    [<ffffffff83cb8786>] hci_dev_do_close+0x5b6/0x710 net/bluetooth/hci_core.c:1774
    [<ffffffff812636d9>] process_one_work+0x2c9/0x610 kernel/workqueue.c:2276
    [<ffffffff81263fc9>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2422
    [<ffffffff8126d428>] kthread+0x188/0x1d0 kernel/kthread.c:319
    [<ffffffff810022cf>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

BUG: memory leak
unreferenced object 0xffff88811858bb00 (size 232):
  comm "kworker/u5:10", pid 8505, jiffies 4294950224 (age 26.120s)
  hex dump (first 32 bytes):
    d0 14 3d 18 81 88 ff ff d0 14 3d 18 81 88 ff ff  ..=.......=.....
    00 00 00 00 00 00 00 00 00 14 3d 18 81 88 ff ff  ..........=.....
  backtrace:
    [<ffffffff836e557f>] __alloc_skb+0x20f/0x280 net/core/skbuff.c:414
    [<ffffffff83d1c5ed>] alloc_skb include/linux/skbuff.h:1112 [inline]
    [<ffffffff83d1c5ed>] mgmt_cmd_complete+0x3d/0x1a0 net/bluetooth/mgmt_util.c:146
    [<ffffffff83cdc8ee>] send_settings_rsp net/bluetooth/mgmt.c:1129 [inline]
    [<ffffffff83cdc8ee>] settings_rsp+0x5e/0x170 net/bluetooth/mgmt.c:1282
    [<ffffffff83d1c8d6>] mgmt_pending_foreach+0x76/0xa0 net/bluetooth/mgmt_util.c:226
    [<ffffffff83ce80bc>] __mgmt_power_off+0x5c/0x1e0 net/bluetooth/mgmt.c:8583
    [<ffffffff83cb8786>] hci_dev_do_close+0x5b6/0x710 net/bluetooth/hci_core.c:1774
    [<ffffffff812636d9>] process_one_work+0x2c9/0x610 kernel/workqueue.c:2276
    [<ffffffff81263fc9>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2422
    [<ffffffff8126d428>] kthread+0x188/0x1d0 kernel/kthread.c:319
    [<ffffffff810022cf>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

BUG: memory leak
unreferenced object 0xffff888111f7c600 (size 512):
  comm "kworker/u5:10", pid 8505, jiffies 4294950224 (age 26.120s)
  hex dump (first 32 bytes):
    01 00 03 00 07 00 05 00 00 82 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff836e544f>] kmalloc_reserve net/core/skbuff.c:355 [inline]
    [<ffffffff836e544f>] __alloc_skb+0xdf/0x280 net/core/skbuff.c:426
    [<ffffffff83d1c5ed>] alloc_skb include/linux/skbuff.h:1112 [inline]
    [<ffffffff83d1c5ed>] mgmt_cmd_complete+0x3d/0x1a0 net/bluetooth/mgmt_util.c:146
    [<ffffffff83cdc8ee>] send_settings_rsp net/bluetooth/mgmt.c:1129 [inline]
    [<ffffffff83cdc8ee>] settings_rsp+0x5e/0x170 net/bluetooth/mgmt.c:1282
    [<ffffffff83d1c8d6>] mgmt_pending_foreach+0x76/0xa0 net/bluetooth/mgmt_util.c:226
    [<ffffffff83ce80bc>] __mgmt_power_off+0x5c/0x1e0 net/bluetooth/mgmt.c:8583
    [<ffffffff83cb8786>] hci_dev_do_close+0x5b6/0x710 net/bluetooth/hci_core.c:1774
    [<ffffffff812636d9>] process_one_work+0x2c9/0x610 kernel/workqueue.c:2276
    [<ffffffff81263fc9>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2422
    [<ffffffff8126d428>] kthread+0x188/0x1d0 kernel/kthread.c:319
    [<ffffffff810022cf>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/08/25 00:30 upstream 6e764bcd1cf7 b599f2fc .config console log report syz C ci-upstream-gce-leak memory leak in mgmt_cmd_complete
2021/08/24 15:46 upstream d5ae8d7f85b7 b599f2fc .config console log report syz ci-upstream-gce-leak memory leak in mgmt_cmd_complete
2021/05/01 16:08 upstream 9f67672a817e 77e2b668 .config console log report syz ci-upstream-gce-leak memory leak in mgmt_cmd_complete
* Struck through repros no longer work on HEAD.