bisecting fixing commit since 574823bfab82d9d8fa47f422778043fbb4b4f50e
building syzkaller on ee332608e9ebc1d77675662fd8511ff94fd49acd
testing commit 574823bfab82d9d8fa47f422778043fbb4b4f50e with gcc (GCC) 8.1.0
kernel signature: e886792292dc072eab1aa8802e6fc198c217c369
all runs: crashed: KASAN: slab-out-of-bounds Read in hci_event_packet
testing current HEAD 9455d25f4e3b3d009fa1b810862e5b06229530e4
testing commit 9455d25f4e3b3d009fa1b810862e5b06229530e4 with gcc (GCC) 8.1.0
kernel signature: 96a820974f64630358657ac44720adb69da39a5a
all runs: crashed: KASAN: slab-out-of-bounds Read in hci_event_packet
revisions tested: 2, total time: 19m46.374724764s (build: 11m27.059696732s, test: 7m27.585868258s)
the crash still happens on HEAD
commit msg: Merge tag 'ntb-5.5' of git://github.com/jonmason/ntb
crash: KASAN: slab-out-of-bounds Read in hci_event_packet
IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
8021q: adding VLAN 0 to HW filter on device batadv0
8021q: adding VLAN 0 to HW filter on device batadv0
8021q: adding VLAN 0 to HW filter on device batadv0
==================================================================
BUG: KASAN: slab-out-of-bounds in hci_inquiry_result_with_rssi_evt net/bluetooth/hci_event.c:4072 [inline]
BUG: KASAN: slab-out-of-bounds in hci_event_packet+0x7fcf/0x9a96 net/bluetooth/hci_event.c:5947
Read of size 1 at addr ffff888094e26c00 by task kworker/u5:2/7670

CPU: 1 PID: 7670 Comm: kworker/u5:2 Not tainted 5.4.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: hci2 hci_rx_work
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x12d/0x187 lib/dump_stack.c:118
 print_address_description.constprop.8.cold.10+0x9/0x31d mm/kasan/report.c:374
 __kasan_report.cold.11+0x1b/0x3a mm/kasan/report.c:506
 kasan_report+0x12/0x20 mm/kasan/common.c:639
 __asan_report_load1_noabort+0x14/0x20 mm/kasan/generic_report.c:132
 hci_inquiry_result_with_rssi_evt net/bluetooth/hci_event.c:4072 [inline]
 hci_event_packet+0x7fcf/0x9a96 net/bluetooth/hci_event.c:5947
 hci_rx_work+0x53d/0x930 net/bluetooth/hci_core.c:4491
kobject: 'hci4' (00000000e946358c): fill_kobj_path: path = '/devices/virtual/bluetooth/hci4'
 process_one_work+0x85b/0x1630 kernel/workqueue.c:2264
 worker_thread+0x85/0xb60 kernel/workqueue.c:2410
 kthread+0x334/0x3f0 kernel/kthread.c:255
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352

Allocated by task 7689:
 save_stack+0x21/0x90 mm/kasan/common.c:72
 set_track mm/kasan/common.c:80 [inline]
 __kasan_kmalloc.constprop.9+0xc7/0xd0 mm/kasan/common.c:513
 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:527
 __do_kmalloc_node mm/slab.c:3616 [inline]
 __kmalloc_node_track_caller+0x4d/0x70 mm/slab.c:3630
 __kmalloc_reserve.isra.46+0x2c/0xc0 net/core/skbuff.c:141
 __alloc_skb+0xd7/0x570 net/core/skbuff.c:209
 alloc_skb include/linux/skbuff.h:1049 [inline]
 bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
 vhci_get_user drivers/bluetooth/hci_vhci.c:165 [inline]
 vhci_write+0xa8/0x3e0 drivers/bluetooth/hci_vhci.c:284
 call_write_iter include/linux/fs.h:1902 [inline]
 new_sync_write+0x402/0x7e0 fs/read_write.c:483
 __vfs_write+0x97/0x110 fs/read_write.c:496
 vfs_write+0x18a/0x520 fs/read_write.c:558
 ksys_write+0x105/0x220 fs/read_write.c:611
 __do_sys_write fs/read_write.c:623 [inline]
 __se_sys_write fs/read_write.c:620 [inline]
 __x64_sys_write+0x6e/0xb0 fs/read_write.c:620
 do_syscall_64+0xd0/0x600 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
kobject: 'rfkill9' (00000000d3a0d7df): kobject_add_internal: parent: 'hci4', set: 'devices'

Freed by task 0:
(stack is not available)

The buggy address belongs to the object at ffff888094e26800
 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 0 bytes to the right of
 1024-byte region [ffff888094e26800, ffff888094e26c00)
The buggy address belongs to the page:
page:ffffea0002538980 refcount:1 mapcount:0 mapping:ffff8880aa800c40 index:0x0
raw: 01fffc0000000200 ffffea00025190c8 ffffea0002550fc8 ffff8880aa800c40
raw: 0000000000000000 ffff888094e26000 0000000100000002 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff888094e26b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff888094e26b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
kobject: 'rfkill9' (00000000d3a0d7df): kobject_uevent_env
>ffff888094e26c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                   ^
 ffff888094e26c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888094e26d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
kobject: 'loop3' (000000004da26631): kobject_uevent_env
kobject: 'rfkill9' (00000000d3a0d7df): fill_kobj_path: path = '/devices/virtual/bluetooth/hci4/rfkill9'