==================================================================
BUG: KFENCE: use-after-free read in hci_cmd_timeout+0x70/0x210 net/bluetooth/hci_core.c:1473

Use-after-free read at 0xffff88823bd1efd0 (in kfence-#142):
 hci_cmd_timeout+0x70/0x210 net/bluetooth/hci_core.c:1473
 process_one_work+0x9ac/0x1650 kernel/workqueue.c:2307
 worker_thread+0x657/0x1110 kernel/workqueue.c:2454
 kthread+0x2e9/0x3a0 kernel/kthread.c:377
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

kfence-#142: 0xffff88823bd1ef00-0xffff88823bd1efe7, size=232, cache=skbuff_head_cache

allocated by task 3644 on cpu 0 at 735.569317s:
 skb_clone+0x170/0x3c0 net/core/skbuff.c:1519
 hci_cmd_work+0x18e/0x3c0 net/bluetooth/hci_core.c:3853
 process_one_work+0x9ac/0x1650 kernel/workqueue.c:2307
 worker_thread+0x657/0x1110 kernel/workqueue.c:2454
 kthread+0x2e9/0x3a0 kernel/kthread.c:377
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

freed by task 11588 on cpu 0 at 737.661751s:
 kfree_skbmem+0xef/0x1b0 net/core/skbuff.c:700
 __kfree_skb net/core/skbuff.c:757 [inline]
 kfree_skb_reason net/core/skbuff.c:776 [inline]
 kfree_skb_reason+0x145/0x400 net/core/skbuff.c:770
 kfree_skb include/linux/skbuff.h:1114 [inline]
 hci_dev_open_sync+0x9e4/0x20c0 net/bluetooth/hci_sync.c:4009
 hci_dev_do_open+0x32/0x70 net/bluetooth/hci_core.c:482
 hci_power_on+0x133/0x640 net/bluetooth/hci_core.c:963
 process_one_work+0x9ac/0x1650 kernel/workqueue.c:2307
 worker_thread+0x657/0x1110 kernel/workqueue.c:2454
 kthread+0x2e9/0x3a0 kernel/kthread.c:377
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

CPU: 0 PID: 7 Comm: kworker/0:1 Not tainted 5.16.0-next-20220112-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events hci_cmd_timeout
RIP: 0010:hci_cmd_timeout+0x70/0x210 net/bluetooth/hci_core.c:1473
Code: 01 00 00 e8 a2 c3 41 f9 48 8d bd d0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 7c 01 00 00 <48> 8b ad d0 00 00 00 48 b9 00 00 00 00 00 fc ff df 48 89 e8 48 c1
RSP: 0018:ffffc90000cc7d00 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffff888010e74ac8 RCX: 0000000000000000
RDX: 1ffff110477a3dfa RSI: ffffffff88369c6e RDI: ffff88823bd1efd0
RBP: ffff88823bd1ef00 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff814cb4d2 R11: 0000000000000000 R12: ffff888010e740a0
R13: ffffc90000cc7db8 R14: ffff888010db3900 R15: ffff8880b9c39480
FS:  0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88823bd1efd0 CR3: 000000000b88e000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 process_one_work+0x9ac/0x1650 kernel/workqueue.c:2307
 worker_thread+0x657/0x1110 kernel/workqueue.c:2454
 kthread+0x2e9/0x3a0 kernel/kthread.c:377
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
==================================================================
----------------
Code disassembly (best guess):
   0:	01 00                	add    %eax,(%rax)
   2:	00 e8                	add    %ch,%al
   4:	a2 c3 41 f9 48 8d bd 	movabs %al,0xd0bd8d48f941c3
   b:	d0 00
   d:	00 00                	add    %al,(%rax)
   f:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  16:	fc ff df
  19:	48 89 fa             	mov    %rdi,%rdx
  1c:	48 c1 ea 03          	shr    $0x3,%rdx
  20:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
  24:	0f 85 7c 01 00 00    	jne    0x1a6
* 2a:	48 8b ad d0 00 00 00 	mov    0xd0(%rbp),%rbp <-- trapping instruction
  31:	48 b9 00 00 00 00 00 	movabs $0xdffffc0000000000,%rcx
  38:	fc ff df
  3b:	48 89 e8             	mov    %rbp,%rax
  3e:	48                   	rex.W
  3f:	c1                   	.byte 0xc1