bisecting fixing commit since fb683b5e3f53a73e761952735736180939a313df building syzkaller on 85f267515d439552478cbfcdee7e4d0609ff7310 testing commit fb683b5e3f53a73e761952735736180939a313df with gcc (GCC) 8.1.0 kernel signature: 6d5d51fa4730a20949522cb5eed32770c4602575755644b08f3bf369b5612927 run #0: crashed: KASAN: use-after-free Read in hci_cmd_timeout run #1: crashed: KASAN: use-after-free Read in hci_cmd_timeout run #2: crashed: KASAN: use-after-free Read in hci_cmd_timeout run #3: crashed: KASAN: use-after-free Read in hci_cmd_timeout run #4: crashed: KASAN: use-after-free Read in hci_cmd_timeout run #5: crashed: KASAN: use-after-free Read in hci_cmd_timeout run #6: crashed: KASAN: use-after-free Read in hci_cmd_timeout run #7: OK run #8: OK run #9: OK testing current HEAD 54b4fa6d39551639cb10664f6ac78b01993a1d7e testing commit 54b4fa6d39551639cb10664f6ac78b01993a1d7e with gcc (GCC) 8.1.0 kernel signature: c123263112f7ceeb36a5e75d7677e6f466c50b635cf830969dfa172de5cd1ca7 run #0: crashed: KASAN: use-after-free Read in hci_cmd_timeout run #1: crashed: KASAN: use-after-free Read in hci_cmd_timeout run #2: crashed: KASAN: use-after-free Read in hci_cmd_timeout run #3: crashed: KASAN: use-after-free Read in hci_cmd_timeout run #4: crashed: KASAN: use-after-free Read in hci_cmd_timeout run #5: crashed: KASAN: use-after-free Read in hci_cmd_timeout run #6: crashed: KASAN: use-after-free Read in hci_cmd_timeout run #7: OK run #8: OK run #9: OK revisions tested: 2, total time: 37m22.247285214s (build: 16m58.833376209s, test: 19m30.818879467s) the crash still happens on HEAD commit msg: Linux 4.19.113 crash: KASAN: use-after-free Read in hci_cmd_timeout Bluetooth: hci2: Entering manufacturer mode failed (-110) Bluetooth: hci3: Entering manufacturer mode failed (-110) Bluetooth: hci3: Frame reassembly failed (-84) Bluetooth: hci4: Entering manufacturer mode failed (-110) ================================================================== BUG: KASAN: use-after-free in hci_cmd_timeout+0x1b4/0x1d0 net/bluetooth/hci_core.c:2574 Read of size 2 at addr ffff88809248ec88 by task kworker/1:0/19 CPU: 1 PID: 19 Comm: kworker/1:0 Not tainted 4.19.113-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events hci_cmd_timeout Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x123/0x177 lib/dump_stack.c:118 print_address_description.cold.8+0x9/0x1ff mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report.cold.9+0x242/0x309 mm/kasan/report.c:412 __asan_report_load_n_noabort+0xf/0x20 mm/kasan/report.c:443 hci_cmd_timeout+0x1b4/0x1d0 net/bluetooth/hci_core.c:2574 process_one_work+0x830/0x1670 kernel/workqueue.c:2155 worker_thread+0x85/0xb60 kernel/workqueue.c:2298 kthread+0x324/0x3e0 kernel/kthread.c:246 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 Allocated by task 7562: save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:553 __do_kmalloc_node mm/slab.c:3689 [inline] __kmalloc_node_track_caller+0x50/0x70 mm/slab.c:3703 __kmalloc_reserve.isra.41+0x2c/0xc0 net/core/skbuff.c:137 __alloc_skb+0xd7/0x580 net/core/skbuff.c:205 alloc_skb include/linux/skbuff.h:995 [inline] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline] hci_prepare_cmd+0x2c/0x200 net/bluetooth/hci_request.c:292 hci_req_add_ev+0x7f/0x1f0 net/bluetooth/hci_request.c:326 __hci_cmd_sync_ev+0xf8/0x1a0 net/bluetooth/hci_request.c:138 __hci_cmd_sync+0x12/0x20 net/bluetooth/hci_request.c:187 btintel_enter_mfg+0x29/0x70 drivers/bluetooth/btintel.c:82 ag6xx_setup+0x112/0x7c0 drivers/bluetooth/hci_ag6xx.c:180 hci_uart_setup+0x19c/0x3a0 drivers/bluetooth/hci_ldisc.c:431 hci_dev_do_open+0x52d/0xfe0 net/bluetooth/hci_core.c:1423 hci_power_on+0xe2/0x410 net/bluetooth/hci_core.c:2130 process_one_work+0x830/0x1670 kernel/workqueue.c:2155 worker_thread+0x85/0xb60 kernel/workqueue.c:2298 kthread+0x324/0x3e0 kernel/kthread.c:246 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 Freed by task 7562: save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528 __cache_free mm/slab.c:3503 [inline] kfree+0xcf/0x220 mm/slab.c:3822 skb_free_head+0x74/0x90 net/core/skbuff.c:554 skb_release_data+0x50e/0x790 net/core/skbuff.c:574 skb_release_all+0x3d/0x50 net/core/skbuff.c:631 __kfree_skb net/core/skbuff.c:645 [inline] kfree_skb+0x97/0x280 net/core/skbuff.c:663 hci_dev_do_open+0x965/0xfe0 net/bluetooth/hci_core.c:1509 hci_power_on+0xe2/0x410 net/bluetooth/hci_core.c:2130 process_one_work+0x830/0x1670 kernel/workqueue.c:2155 worker_thread+0x85/0xb60 kernel/workqueue.c:2298 kthread+0x324/0x3e0 kernel/kthread.c:246 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 The buggy address belongs to the object at ffff88809248ec80 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 8 bytes inside of 512-byte region [ffff88809248ec80, ffff88809248ee80) The buggy address belongs to the page: page:ffffea0002492380 count:1 mapcount:0 mapping:ffff88812c29c940 index:0xffff88809248e500 flags: 0xfffe0000000100(slab) raw: 00fffe0000000100 ffffea00028042c8 ffffea00029e4b48 ffff88812c29c940 raw: ffff88809248e500 ffff88809248e000 0000000100000005 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88809248eb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88809248ec00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88809248ec80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88809248ed00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88809248ed80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Bluetooth: hci5: Entering manufacturer mode failed (-110)