syzbot


memory leak in mgmt_cmd_complete
Status: fixed on 2022/03/08 16:11
Reported-by: syzbot+4c4ffd1e1094dae61035@syzkaller.appspotmail.com
Fix commit: 709fca500067 Bluetooth: hci_sock: purge socket queues in the destruct() callback
First crash: 391d, last: 275d
Patch testing requests:
Created Duration User Patch Repo Result
2021/10/07 15:31 15m phind.uet@gmail.com patch upstream OK
2021/10/07 15:24 14m phind.uet@gmail.com upstream report log
2021/09/15 06:33 10m phind.uet@gmail.com linux-next report log
2021/08/06 05:41 13m phind.uet@gmail.com linux-next report log
2021/06/21 05:04 13m phind.uet@gmail.com upstream report log

Sample crash report:
BUG: memory leak
unreferenced object 0xffff88811858bb00 (size 232):
  comm "kworker/u5:10", pid 8505, jiffies 4294950224 (age 25.730s)
  hex dump (first 32 bytes):
    d0 14 3d 18 81 88 ff ff d0 14 3d 18 81 88 ff ff  ..=.......=.....
    00 00 00 00 00 00 00 00 00 14 3d 18 81 88 ff ff  ..........=.....
  backtrace:
    [<ffffffff836e557f>] __alloc_skb+0x20f/0x280 net/core/skbuff.c:414
    [<ffffffff83d1c5ed>] alloc_skb include/linux/skbuff.h:1112 [inline]
    [<ffffffff83d1c5ed>] mgmt_cmd_complete+0x3d/0x1a0 net/bluetooth/mgmt_util.c:146
    [<ffffffff83cdc8ee>] send_settings_rsp net/bluetooth/mgmt.c:1129 [inline]
    [<ffffffff83cdc8ee>] settings_rsp+0x5e/0x170 net/bluetooth/mgmt.c:1282
    [<ffffffff83d1c8d6>] mgmt_pending_foreach+0x76/0xa0 net/bluetooth/mgmt_util.c:226
    [<ffffffff83ce80bc>] __mgmt_power_off+0x5c/0x1e0 net/bluetooth/mgmt.c:8583
    [<ffffffff83cb8786>] hci_dev_do_close+0x5b6/0x710 net/bluetooth/hci_core.c:1774
    [<ffffffff812636d9>] process_one_work+0x2c9/0x610 kernel/workqueue.c:2276
    [<ffffffff81263fc9>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2422
    [<ffffffff8126d428>] kthread+0x188/0x1d0 kernel/kthread.c:319
    [<ffffffff810022cf>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

BUG: memory leak
unreferenced object 0xffff888111f7c600 (size 512):
  comm "kworker/u5:10", pid 8505, jiffies 4294950224 (age 25.730s)
  hex dump (first 32 bytes):
    01 00 03 00 07 00 05 00 00 82 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff836e544f>] kmalloc_reserve net/core/skbuff.c:355 [inline]
    [<ffffffff836e544f>] __alloc_skb+0xdf/0x280 net/core/skbuff.c:426
    [<ffffffff83d1c5ed>] alloc_skb include/linux/skbuff.h:1112 [inline]
    [<ffffffff83d1c5ed>] mgmt_cmd_complete+0x3d/0x1a0 net/bluetooth/mgmt_util.c:146
    [<ffffffff83cdc8ee>] send_settings_rsp net/bluetooth/mgmt.c:1129 [inline]
    [<ffffffff83cdc8ee>] settings_rsp+0x5e/0x170 net/bluetooth/mgmt.c:1282
    [<ffffffff83d1c8d6>] mgmt_pending_foreach+0x76/0xa0 net/bluetooth/mgmt_util.c:226
    [<ffffffff83ce80bc>] __mgmt_power_off+0x5c/0x1e0 net/bluetooth/mgmt.c:8583
    [<ffffffff83cb8786>] hci_dev_do_close+0x5b6/0x710 net/bluetooth/hci_core.c:1774
    [<ffffffff812636d9>] process_one_work+0x2c9/0x610 kernel/workqueue.c:2276
    [<ffffffff81263fc9>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2422
    [<ffffffff8126d428>] kthread+0x188/0x1d0 kernel/kthread.c:319
    [<ffffffff810022cf>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

BUG: memory leak
unreferenced object 0xffff88811858bb00 (size 232):
  comm "kworker/u5:10", pid 8505, jiffies 4294950224 (age 25.780s)
  hex dump (first 32 bytes):
    d0 14 3d 18 81 88 ff ff d0 14 3d 18 81 88 ff ff  ..=.......=.....
    00 00 00 00 00 00 00 00 00 14 3d 18 81 88 ff ff  ..........=.....
  backtrace:
    [<ffffffff836e557f>] __alloc_skb+0x20f/0x280 net/core/skbuff.c:414
    [<ffffffff83d1c5ed>] alloc_skb include/linux/skbuff.h:1112 [inline]
    [<ffffffff83d1c5ed>] mgmt_cmd_complete+0x3d/0x1a0 net/bluetooth/mgmt_util.c:146
    [<ffffffff83cdc8ee>] send_settings_rsp net/bluetooth/mgmt.c:1129 [inline]
    [<ffffffff83cdc8ee>] settings_rsp+0x5e/0x170 net/bluetooth/mgmt.c:1282
    [<ffffffff83d1c8d6>] mgmt_pending_foreach+0x76/0xa0 net/bluetooth/mgmt_util.c:226
    [<ffffffff83ce80bc>] __mgmt_power_off+0x5c/0x1e0 net/bluetooth/mgmt.c:8583
    [<ffffffff83cb8786>] hci_dev_do_close+0x5b6/0x710 net/bluetooth/hci_core.c:1774
    [<ffffffff812636d9>] process_one_work+0x2c9/0x610 kernel/workqueue.c:2276
    [<ffffffff81263fc9>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2422
    [<ffffffff8126d428>] kthread+0x188/0x1d0 kernel/kthread.c:319
    [<ffffffff810022cf>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

BUG: memory leak
unreferenced object 0xffff888111f7c600 (size 512):
  comm "kworker/u5:10", pid 8505, jiffies 4294950224 (age 25.780s)
  hex dump (first 32 bytes):
    01 00 03 00 07 00 05 00 00 82 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff836e544f>] kmalloc_reserve net/core/skbuff.c:355 [inline]
    [<ffffffff836e544f>] __alloc_skb+0xdf/0x280 net/core/skbuff.c:426
    [<ffffffff83d1c5ed>] alloc_skb include/linux/skbuff.h:1112 [inline]
    [<ffffffff83d1c5ed>] mgmt_cmd_complete+0x3d/0x1a0 net/bluetooth/mgmt_util.c:146
    [<ffffffff83cdc8ee>] send_settings_rsp net/bluetooth/mgmt.c:1129 [inline]
    [<ffffffff83cdc8ee>] settings_rsp+0x5e/0x170 net/bluetooth/mgmt.c:1282
    [<ffffffff83d1c8d6>] mgmt_pending_foreach+0x76/0xa0 net/bluetooth/mgmt_util.c:226
    [<ffffffff83ce80bc>] __mgmt_power_off+0x5c/0x1e0 net/bluetooth/mgmt.c:8583
    [<ffffffff83cb8786>] hci_dev_do_close+0x5b6/0x710 net/bluetooth/hci_core.c:1774
    [<ffffffff812636d9>] process_one_work+0x2c9/0x610 kernel/workqueue.c:2276
    [<ffffffff81263fc9>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2422
    [<ffffffff8126d428>] kthread+0x188/0x1d0 kernel/kthread.c:319
    [<ffffffff810022cf>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

BUG: memory leak
unreferenced object 0xffff88811858bb00 (size 232):
  comm "kworker/u5:10", pid 8505, jiffies 4294950224 (age 25.840s)
  hex dump (first 32 bytes):
    d0 14 3d 18 81 88 ff ff d0 14 3d 18 81 88 ff ff  ..=.......=.....
    00 00 00 00 00 00 00 00 00 14 3d 18 81 88 ff ff  ..........=.....
  backtrace:
    [<ffffffff836e557f>] __alloc_skb+0x20f/0x280 net/core/skbuff.c:414
    [<ffffffff83d1c5ed>] alloc_skb include/linux/skbuff.h:1112 [inline]
    [<ffffffff83d1c5ed>] mgmt_cmd_complete+0x3d/0x1a0 net/bluetooth/mgmt_util.c:146
    [<ffffffff83cdc8ee>] send_settings_rsp net/bluetooth/mgmt.c:1129 [inline]
    [<ffffffff83cdc8ee>] settings_rsp+0x5e/0x170 net/bluetooth/mgmt.c:1282
    [<ffffffff83d1c8d6>] mgmt_pending_foreach+0x76/0xa0 net/bluetooth/mgmt_util.c:226
    [<ffffffff83ce80bc>] __mgmt_power_off+0x5c/0x1e0 net/bluetooth/mgmt.c:8583
    [<ffffffff83cb8786>] hci_dev_do_close+0x5b6/0x710 net/bluetooth/hci_core.c:1774
    [<ffffffff812636d9>] process_one_work+0x2c9/0x610 kernel/workqueue.c:2276
    [<ffffffff81263fc9>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2422
    [<ffffffff8126d428>] kthread+0x188/0x1d0 kernel/kthread.c:319
    [<ffffffff810022cf>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

BUG: memory leak
unreferenced object 0xffff888111f7c600 (size 512):
  comm "kworker/u5:10", pid 8505, jiffies 4294950224 (age 25.840s)
  hex dump (first 32 bytes):
    01 00 03 00 07 00 05 00 00 82 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff836e544f>] kmalloc_reserve net/core/skbuff.c:355 [inline]
    [<ffffffff836e544f>] __alloc_skb+0xdf/0x280 net/core/skbuff.c:426
    [<ffffffff83d1c5ed>] alloc_skb include/linux/skbuff.h:1112 [inline]
    [<ffffffff83d1c5ed>] mgmt_cmd_complete+0x3d/0x1a0 net/bluetooth/mgmt_util.c:146
    [<ffffffff83cdc8ee>] send_settings_rsp net/bluetooth/mgmt.c:1129 [inline]
    [<ffffffff83cdc8ee>] settings_rsp+0x5e/0x170 net/bluetooth/mgmt.c:1282
    [<ffffffff83d1c8d6>] mgmt_pending_foreach+0x76/0xa0 net/bluetooth/mgmt_util.c:226
    [<ffffffff83ce80bc>] __mgmt_power_off+0x5c/0x1e0 net/bluetooth/mgmt.c:8583
    [<ffffffff83cb8786>] hci_dev_do_close+0x5b6/0x710 net/bluetooth/hci_core.c:1774
    [<ffffffff812636d9>] process_one_work+0x2c9/0x610 kernel/workqueue.c:2276
    [<ffffffff81263fc9>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2422
    [<ffffffff8126d428>] kthread+0x188/0x1d0 kernel/kthread.c:319
    [<ffffffff810022cf>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

BUG: memory leak
unreferenced object 0xffff88811858bb00 (size 232):
  comm "kworker/u5:10", pid 8505, jiffies 4294950224 (age 25.900s)
  hex dump (first 32 bytes):
    d0 14 3d 18 81 88 ff ff d0 14 3d 18 81 88 ff ff  ..=.......=.....
    00 00 00 00 00 00 00 00 00 14 3d 18 81 88 ff ff  ..........=.....
  backtrace:
    [<ffffffff836e557f>] __alloc_skb+0x20f/0x280 net/core/skbuff.c:414
    [<ffffffff83d1c5ed>] alloc_skb include/linux/skbuff.h:1112 [inline]
    [<ffffffff83d1c5ed>] mgmt_cmd_complete+0x3d/0x1a0 net/bluetooth/mgmt_util.c:146
    [<ffffffff83cdc8ee>] send_settings_rsp net/bluetooth/mgmt.c:1129 [inline]
    [<ffffffff83cdc8ee>] settings_rsp+0x5e/0x170 net/bluetooth/mgmt.c:1282
    [<ffffffff83d1c8d6>] mgmt_pending_foreach+0x76/0xa0 net/bluetooth/mgmt_util.c:226
    [<ffffffff83ce80bc>] __mgmt_power_off+0x5c/0x1e0 net/bluetooth/mgmt.c:8583
    [<ffffffff83cb8786>] hci_dev_do_close+0x5b6/0x710 net/bluetooth/hci_core.c:1774
    [<ffffffff812636d9>] process_one_work+0x2c9/0x610 kernel/workqueue.c:2276
    [<ffffffff81263fc9>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2422
    [<ffffffff8126d428>] kthread+0x188/0x1d0 kernel/kthread.c:319
    [<ffffffff810022cf>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

BUG: memory leak
unreferenced object 0xffff888111f7c600 (size 512):
  comm "kworker/u5:10", pid 8505, jiffies 4294950224 (age 25.900s)
  hex dump (first 32 bytes):
    01 00 03 00 07 00 05 00 00 82 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff836e544f>] kmalloc_reserve net/core/skbuff.c:355 [inline]
    [<ffffffff836e544f>] __alloc_skb+0xdf/0x280 net/core/skbuff.c:426
    [<ffffffff83d1c5ed>] alloc_skb include/linux/skbuff.h:1112 [inline]
    [<ffffffff83d1c5ed>] mgmt_cmd_complete+0x3d/0x1a0 net/bluetooth/mgmt_util.c:146
    [<ffffffff83cdc8ee>] send_settings_rsp net/bluetooth/mgmt.c:1129 [inline]
    [<ffffffff83cdc8ee>] settings_rsp+0x5e/0x170 net/bluetooth/mgmt.c:1282
    [<ffffffff83d1c8d6>] mgmt_pending_foreach+0x76/0xa0 net/bluetooth/mgmt_util.c:226
    [<ffffffff83ce80bc>] __mgmt_power_off+0x5c/0x1e0 net/bluetooth/mgmt.c:8583
    [<ffffffff83cb8786>] hci_dev_do_close+0x5b6/0x710 net/bluetooth/hci_core.c:1774
    [<ffffffff812636d9>] process_one_work+0x2c9/0x610 kernel/workqueue.c:2276
    [<ffffffff81263fc9>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2422
    [<ffffffff8126d428>] kthread+0x188/0x1d0 kernel/kthread.c:319
    [<ffffffff810022cf>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

BUG: memory leak
unreferenced object 0xffff88811858bb00 (size 232):
  comm "kworker/u5:10", pid 8505, jiffies 4294950224 (age 25.950s)
  hex dump (first 32 bytes):
    d0 14 3d 18 81 88 ff ff d0 14 3d 18 81 88 ff ff  ..=.......=.....
    00 00 00 00 00 00 00 00 00 14 3d 18 81 88 ff ff  ..........=.....
  backtrace:
    [<ffffffff836e557f>] __alloc_skb+0x20f/0x280 net/core/skbuff.c:414
    [<ffffffff83d1c5ed>] alloc_skb include/linux/skbuff.h:1112 [inline]
    [<ffffffff83d1c5ed>] mgmt_cmd_complete+0x3d/0x1a0 net/bluetooth/mgmt_util.c:146
    [<ffffffff83cdc8ee>] send_settings_rsp net/bluetooth/mgmt.c:1129 [inline]
    [<ffffffff83cdc8ee>] settings_rsp+0x5e/0x170 net/bluetooth/mgmt.c:1282
    [<ffffffff83d1c8d6>] mgmt_pending_foreach+0x76/0xa0 net/bluetooth/mgmt_util.c:226
    [<ffffffff83ce80bc>] __mgmt_power_off+0x5c/0x1e0 net/bluetooth/mgmt.c:8583
    [<ffffffff83cb8786>] hci_dev_do_close+0x5b6/0x710 net/bluetooth/hci_core.c:1774
    [<ffffffff812636d9>] process_one_work+0x2c9/0x610 kernel/workqueue.c:2276
    [<ffffffff81263fc9>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2422
    [<ffffffff8126d428>] kthread+0x188/0x1d0 kernel/kthread.c:319
    [<ffffffff810022cf>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

BUG: memory leak
unreferenced object 0xffff888111f7c600 (size 512):
  comm "kworker/u5:10", pid 8505, jiffies 4294950224 (age 25.950s)
  hex dump (first 32 bytes):
    01 00 03 00 07 00 05 00 00 82 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff836e544f>] kmalloc_reserve net/core/skbuff.c:355 [inline]
    [<ffffffff836e544f>] __alloc_skb+0xdf/0x280 net/core/skbuff.c:426
    [<ffffffff83d1c5ed>] alloc_skb include/linux/skbuff.h:1112 [inline]
    [<ffffffff83d1c5ed>] mgmt_cmd_complete+0x3d/0x1a0 net/bluetooth/mgmt_util.c:146
    [<ffffffff83cdc8ee>] send_settings_rsp net/bluetooth/mgmt.c:1129 [inline]
    [<ffffffff83cdc8ee>] settings_rsp+0x5e/0x170 net/bluetooth/mgmt.c:1282
    [<ffffffff83d1c8d6>] mgmt_pending_foreach+0x76/0xa0 net/bluetooth/mgmt_util.c:226
    [<ffffffff83ce80bc>] __mgmt_power_off+0x5c/0x1e0 net/bluetooth/mgmt.c:8583
    [<ffffffff83cb8786>] hci_dev_do_close+0x5b6/0x710 net/bluetooth/hci_core.c:1774
    [<ffffffff812636d9>] process_one_work+0x2c9/0x610 kernel/workqueue.c:2276
    [<ffffffff81263fc9>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2422
    [<ffffffff8126d428>] kthread+0x188/0x1d0 kernel/kthread.c:319
    [<ffffffff810022cf>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

BUG: memory leak
unreferenced object 0xffff88811858bb00 (size 232):
  comm "kworker/u5:10", pid 8505, jiffies 4294950224 (age 26.010s)
  hex dump (first 32 bytes):
    d0 14 3d 18 81 88 ff ff d0 14 3d 18 81 88 ff ff  ..=.......=.....
    00 00 00 00 00 00 00 00 00 14 3d 18 81 88 ff ff  ..........=.....
  backtrace:
    [<ffffffff836e557f>] __alloc_skb+0x20f/0x280 net/core/skbuff.c:414
    [<ffffffff83d1c5ed>] alloc_skb include/linux/skbuff.h:1112 [inline]
    [<ffffffff83d1c5ed>] mgmt_cmd_complete+0x3d/0x1a0 net/bluetooth/mgmt_util.c:146
    [<ffffffff83cdc8ee>] send_settings_rsp net/bluetooth/mgmt.c:1129 [inline]
    [<ffffffff83cdc8ee>] settings_rsp+0x5e/0x170 net/bluetooth/mgmt.c:1282
    [<ffffffff83d1c8d6>] mgmt_pending_foreach+0x76/0xa0 net/bluetooth/mgmt_util.c:226
    [<ffffffff83ce80bc>] __mgmt_power_off+0x5c/0x1e0 net/bluetooth/mgmt.c:8583
    [<ffffffff83cb8786>] hci_dev_do_close+0x5b6/0x710 net/bluetooth/hci_core.c:1774
    [<ffffffff812636d9>] process_one_work+0x2c9/0x610 kernel/workqueue.c:2276
    [<ffffffff81263fc9>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2422
    [<ffffffff8126d428>] kthread+0x188/0x1d0 kernel/kthread.c:319
    [<ffffffff810022cf>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

BUG: memory leak
unreferenced object 0xffff888111f7c600 (size 512):
  comm "kworker/u5:10", pid 8505, jiffies 4294950224 (age 26.010s)
  hex dump (first 32 bytes):
    01 00 03 00 07 00 05 00 00 82 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff836e544f>] kmalloc_reserve net/core/skbuff.c:355 [inline]
    [<ffffffff836e544f>] __alloc_skb+0xdf/0x280 net/core/skbuff.c:426
    [<ffffffff83d1c5ed>] alloc_skb include/linux/skbuff.h:1112 [inline]
    [<ffffffff83d1c5ed>] mgmt_cmd_complete+0x3d/0x1a0 net/bluetooth/mgmt_util.c:146
    [<ffffffff83cdc8ee>] send_settings_rsp net/bluetooth/mgmt.c:1129 [inline]
    [<ffffffff83cdc8ee>] settings_rsp+0x5e/0x170 net/bluetooth/mgmt.c:1282
    [<ffffffff83d1c8d6>] mgmt_pending_foreach+0x76/0xa0 net/bluetooth/mgmt_util.c:226
    [<ffffffff83ce80bc>] __mgmt_power_off+0x5c/0x1e0 net/bluetooth/mgmt.c:8583
    [<ffffffff83cb8786>] hci_dev_do_close+0x5b6/0x710 net/bluetooth/hci_core.c:1774
    [<ffffffff812636d9>] process_one_work+0x2c9/0x610 kernel/workqueue.c:2276
    [<ffffffff81263fc9>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2422
    [<ffffffff8126d428>] kthread+0x188/0x1d0 kernel/kthread.c:319
    [<ffffffff810022cf>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

BUG: memory leak
unreferenced object 0xffff88811858bb00 (size 232):
  comm "kworker/u5:10", pid 8505, jiffies 4294950224 (age 26.060s)
  hex dump (first 32 bytes):
    d0 14 3d 18 81 88 ff ff d0 14 3d 18 81 88 ff ff  ..=.......=.....
    00 00 00 00 00 00 00 00 00 14 3d 18 81 88 ff ff  ..........=.....
  backtrace:
    [<ffffffff836e557f>] __alloc_skb+0x20f/0x280 net/core/skbuff.c:414
    [<ffffffff83d1c5ed>] alloc_skb include/linux/skbuff.h:1112 [inline]
    [<ffffffff83d1c5ed>] mgmt_cmd_complete+0x3d/0x1a0 net/bluetooth/mgmt_util.c:146
    [<ffffffff83cdc8ee>] send_settings_rsp net/bluetooth/mgmt.c:1129 [inline]
    [<ffffffff83cdc8ee>] settings_rsp+0x5e/0x170 net/bluetooth/mgmt.c:1282
    [<ffffffff83d1c8d6>] mgmt_pending_foreach+0x76/0xa0 net/bluetooth/mgmt_util.c:226
    [<ffffffff83ce80bc>] __mgmt_power_off+0x5c/0x1e0 net/bluetooth/mgmt.c:8583
    [<ffffffff83cb8786>] hci_dev_do_close+0x5b6/0x710 net/bluetooth/hci_core.c:1774
    [<ffffffff812636d9>] process_one_work+0x2c9/0x610 kernel/workqueue.c:2276
    [<ffffffff81263fc9>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2422
    [<ffffffff8126d428>] kthread+0x188/0x1d0 kernel/kthread.c:319
    [<ffffffff810022cf>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

BUG: memory leak
unreferenced object 0xffff888111f7c600 (size 512):
  comm "kworker/u5:10", pid 8505, jiffies 4294950224 (age 26.070s)
  hex dump (first 32 bytes):
    01 00 03 00 07 00 05 00 00 82 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff836e544f>] kmalloc_reserve net/core/skbuff.c:355 [inline]
    [<ffffffff836e544f>] __alloc_skb+0xdf/0x280 net/core/skbuff.c:426
    [<ffffffff83d1c5ed>] alloc_skb include/linux/skbuff.h:1112 [inline]
    [<ffffffff83d1c5ed>] mgmt_cmd_complete+0x3d/0x1a0 net/bluetooth/mgmt_util.c:146
    [<ffffffff83cdc8ee>] send_settings_rsp net/bluetooth/mgmt.c:1129 [inline]
    [<ffffffff83cdc8ee>] settings_rsp+0x5e/0x170 net/bluetooth/mgmt.c:1282
    [<ffffffff83d1c8d6>] mgmt_pending_foreach+0x76/0xa0 net/bluetooth/mgmt_util.c:226
    [<ffffffff83ce80bc>] __mgmt_power_off+0x5c/0x1e0 net/bluetooth/mgmt.c:8583
    [<ffffffff83cb8786>] hci_dev_do_close+0x5b6/0x710 net/bluetooth/hci_core.c:1774
    [<ffffffff812636d9>] process_one_work+0x2c9/0x610 kernel/workqueue.c:2276
    [<ffffffff81263fc9>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2422
    [<ffffffff8126d428>] kthread+0x188/0x1d0 kernel/kthread.c:319
    [<ffffffff810022cf>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

BUG: memory leak
unreferenced object 0xffff88811858bb00 (size 232):
  comm "kworker/u5:10", pid 8505, jiffies 4294950224 (age 26.120s)
  hex dump (first 32 bytes):
    d0 14 3d 18 81 88 ff ff d0 14 3d 18 81 88 ff ff  ..=.......=.....
    00 00 00 00 00 00 00 00 00 14 3d 18 81 88 ff ff  ..........=.....
  backtrace:
    [<ffffffff836e557f>] __alloc_skb+0x20f/0x280 net/core/skbuff.c:414
    [<ffffffff83d1c5ed>] alloc_skb include/linux/skbuff.h:1112 [inline]
    [<ffffffff83d1c5ed>] mgmt_cmd_complete+0x3d/0x1a0 net/bluetooth/mgmt_util.c:146
    [<ffffffff83cdc8ee>] send_settings_rsp net/bluetooth/mgmt.c:1129 [inline]
    [<ffffffff83cdc8ee>] settings_rsp+0x5e/0x170 net/bluetooth/mgmt.c:1282
    [<ffffffff83d1c8d6>] mgmt_pending_foreach+0x76/0xa0 net/bluetooth/mgmt_util.c:226
    [<ffffffff83ce80bc>] __mgmt_power_off+0x5c/0x1e0 net/bluetooth/mgmt.c:8583
    [<ffffffff83cb8786>] hci_dev_do_close+0x5b6/0x710 net/bluetooth/hci_core.c:1774
    [<ffffffff812636d9>] process_one_work+0x2c9/0x610 kernel/workqueue.c:2276
    [<ffffffff81263fc9>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2422
    [<ffffffff8126d428>] kthread+0x188/0x1d0 kernel/kthread.c:319
    [<ffffffff810022cf>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

BUG: memory leak
unreferenced object 0xffff888111f7c600 (size 512):
  comm "kworker/u5:10", pid 8505, jiffies 4294950224 (age 26.120s)
  hex dump (first 32 bytes):
    01 00 03 00 07 00 05 00 00 82 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff836e544f>] kmalloc_reserve net/core/skbuff.c:355 [inline]
    [<ffffffff836e544f>] __alloc_skb+0xdf/0x280 net/core/skbuff.c:426
    [<ffffffff83d1c5ed>] alloc_skb include/linux/skbuff.h:1112 [inline]
    [<ffffffff83d1c5ed>] mgmt_cmd_complete+0x3d/0x1a0 net/bluetooth/mgmt_util.c:146
    [<ffffffff83cdc8ee>] send_settings_rsp net/bluetooth/mgmt.c:1129 [inline]
    [<ffffffff83cdc8ee>] settings_rsp+0x5e/0x170 net/bluetooth/mgmt.c:1282
    [<ffffffff83d1c8d6>] mgmt_pending_foreach+0x76/0xa0 net/bluetooth/mgmt_util.c:226
    [<ffffffff83ce80bc>] __mgmt_power_off+0x5c/0x1e0 net/bluetooth/mgmt.c:8583
    [<ffffffff83cb8786>] hci_dev_do_close+0x5b6/0x710 net/bluetooth/hci_core.c:1774
    [<ffffffff812636d9>] process_one_work+0x2c9/0x610 kernel/workqueue.c:2276
    [<ffffffff81263fc9>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2422
    [<ffffffff8126d428>] kthread+0x188/0x1d0 kernel/kthread.c:319
    [<ffffffff810022cf>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295


Crashes (3):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-gce-leak 2021/08/25 00:30 upstream 6e764bcd1cf7 b599f2fc .config log report syz C memory leak in mgmt_cmd_complete
ci-upstream-gce-leak 2021/08/24 15:46 upstream d5ae8d7f85b7 b599f2fc .config log report syz memory leak in mgmt_cmd_complete
ci-upstream-gce-leak 2021/05/01 16:08 upstream 9f67672a817e 77e2b668 .config log report syz memory leak in mgmt_cmd_complete