bisecting fixing commit since 574823bfab82d9d8fa47f422778043fbb4b4f50e
building syzkaller on ee332608e9ebc1d77675662fd8511ff94fd49acd
testing commit 574823bfab82d9d8fa47f422778043fbb4b4f50e with gcc (GCC) 8.1.0
kernel signature: 315661082af608aff93010b74c1026b931bbbd6e0d511f8e7f19d26bca966084
all runs: crashed: KASAN: slab-out-of-bounds Read in hci_event_packet
testing current HEAD f757165705e92db62f85a1ad287e9251d1f2cd82
testing commit f757165705e92db62f85a1ad287e9251d1f2cd82 with gcc (GCC) 8.1.0
kernel signature: 3be67fc37d7fb8f8cc99aec0fbea50c7ae5f93fba59873e8f9315f00c2c6b8d2
all runs: crashed: KASAN: slab-out-of-bounds Read in hci_event_packet
revisions tested: 2, total time: 21m24.33319988s (build: 12m36.730649171s, test: 7m53.518716799s)
the crash still happens on HEAD
commit msg: Merge tag 'fuse-fixes-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse
crash: KASAN: slab-out-of-bounds Read in hci_event_packet
IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
8021q: adding VLAN 0 to HW filter on device batadv0
8021q: adding VLAN 0 to HW filter on device batadv0
==================================================================
BUG: KASAN: slab-out-of-bounds in hci_inquiry_result_with_rssi_evt net/bluetooth/hci_event.c:4072 [inline]
BUG: KASAN: slab-out-of-bounds in hci_event_packet+0x7fcf/0x9a96 net/bluetooth/hci_event.c:5972
Read of size 1 at addr ffff88808b1f7c00 by task kworker/u5:3/7927

CPU: 0 PID: 7927 Comm: kworker/u5:3 Not tainted 5.5.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: hci2 hci_rx_work
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x12d/0x187 lib/dump_stack.c:118
 print_address_description.constprop.8.cold.10+0x9/0x31d mm/kasan/report.c:374
 __kasan_report.cold.11+0x1b/0x32 mm/kasan/report.c:506
 kasan_report+0x12/0x20 mm/kasan/common.c:641
 __asan_report_load1_noabort+0x14/0x20 mm/kasan/generic_report.c:132
 hci_inquiry_result_with_rssi_evt net/bluetooth/hci_event.c:4072 [inline]
 hci_event_packet+0x7fcf/0x9a96 net/bluetooth/hci_event.c:5972
 hci_rx_work+0x18e/0x940 net/bluetooth/hci_core.c:4557
 process_one_work+0x891/0x1690 kernel/workqueue.c:2264
 worker_thread+0x85/0xb60 kernel/workqueue.c:2410
 kthread+0x334/0x3f0 kernel/kthread.c:255
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352

Allocated by task 7926:
 save_stack+0x21/0x90 mm/kasan/common.c:72
 set_track mm/kasan/common.c:80 [inline]
 __kasan_kmalloc.constprop.9+0xc7/0xd0 mm/kasan/common.c:515
 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:529
 __do_kmalloc_node mm/slab.c:3616 [inline]
 __kmalloc_node_track_caller+0x4d/0x70 mm/slab.c:3630
 __kmalloc_reserve.isra.47+0x2c/0xc0 net/core/skbuff.c:142
 __alloc_skb+0xd7/0x570 net/core/skbuff.c:210
 alloc_skb include/linux/skbuff.h:1051 [inline]
 bt_skb_alloc include/net/bluetooth/bluetooth.h:341 [inline]
 vhci_get_user drivers/bluetooth/hci_vhci.c:165 [inline]
 vhci_write+0xa8/0x3e0 drivers/bluetooth/hci_vhci.c:285
 call_write_iter include/linux/fs.h:1901 [inline]
 new_sync_write+0x402/0x7e0 fs/read_write.c:483
 __vfs_write+0x97/0x110 fs/read_write.c:496
 vfs_write+0x18a/0x520 fs/read_write.c:558
 ksys_write+0x105/0x220 fs/read_write.c:611
 __do_sys_write fs/read_write.c:623 [inline]
 __se_sys_write fs/read_write.c:620 [inline]
 __x64_sys_write+0x6e/0xb0 fs/read_write.c:620
 do_syscall_64+0xd0/0x600 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 0:
(stack is not available)

The buggy address belongs to the object at ffff88808b1f7800
 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 0 bytes to the right of
 1024-byte region [ffff88808b1f7800, ffff88808b1f7c00)
The buggy address belongs to the page:
page:ffffea00022c7dc0 refcount:1 mapcount:0 mapping:ffff8880aa800c40 index:0x0
flags: 0x1fffc0000000200(slab)
raw: 01fffc0000000200 ffffea0001f87ec8 ffffea00028ff508 ffff8880aa800c40
raw: 0000000000000000 ffff88808b1f7000 0000000100000002 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88808b1f7b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff88808b1f7b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88808b1f7c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                   ^
 ffff88808b1f7c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88808b1f7d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================