Bluetooth: hci0 command 0x041b tx timeout Bluetooth: hci0 command 0x040f tx timeout Bluetooth: hci0 command 0x0419 tx timeout ================================================================== BUG: KASAN: use-after-free in hci_chan_del+0x131/0x180 net/bluetooth/hci_conn.c:1547 Read of size 8 at addr ffff8880a40c0618 by task syz-executor.0/6383 CPU: 1 PID: 6383 Comm: syz-executor.0 Not tainted 4.14.191-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x283 lib/dump_stack.c:58 print_address_description.cold+0x54/0x1d3 mm/kasan/report.c:252 kasan_report_error.cold+0x8a/0x194 mm/kasan/report.c:351 kasan_report mm/kasan/report.c:409 [inline] __asan_report_load8_noabort+0x68/0x70 mm/kasan/report.c:430 hci_chan_del+0x131/0x180 net/bluetooth/hci_conn.c:1547 l2cap_conn_del+0x417/0x670 net/bluetooth/l2cap_core.c:1736 l2cap_disconn_cfm net/bluetooth/l2cap_core.c:7435 [inline] l2cap_disconn_cfm+0x6b/0x80 net/bluetooth/l2cap_core.c:7428 hci_disconn_cfm include/net/bluetooth/hci_core.h:1226 [inline] hci_conn_hash_flush+0x114/0x220 net/bluetooth/hci_conn.c:1376