bisecting fixing commit since fb683b5e3f53a73e761952735736180939a313df building syzkaller on 85f267515d439552478cbfcdee7e4d0609ff7310 testing commit fb683b5e3f53a73e761952735736180939a313df with gcc (GCC) 8.1.0 kernel signature: 26cc5fdb0a79c562e47708e0cf79634c4b11979119390631e25f275d4df576d4 run #0: crashed: KASAN: use-after-free Read in hci_cmd_timeout run #1: crashed: KASAN: use-after-free Read in hci_cmd_timeout run #2: crashed: KASAN: use-after-free Read in hci_cmd_timeout run #3: crashed: KASAN: use-after-free Read in hci_cmd_timeout run #4: crashed: KASAN: use-after-free Read in hci_cmd_timeout run #5: crashed: KASAN: use-after-free Read in hci_cmd_timeout run #6: crashed: KASAN: use-after-free Read in hci_cmd_timeout run #7: OK run #8: OK run #9: OK testing current HEAD a39e75458e1ceb7fefaa3a0bd9df21558713cf0d testing commit a39e75458e1ceb7fefaa3a0bd9df21558713cf0d with gcc (GCC) 8.1.0 kernel signature: 146b7de426d00fa8f531ad82549e34227184716cd1762d35eba8af9ac5930f2d run #0: crashed: KASAN: use-after-free Read in hci_cmd_timeout run #1: crashed: KASAN: use-after-free Read in hci_cmd_timeout run #2: crashed: KASAN: use-after-free Read in hci_cmd_timeout run #3: crashed: KASAN: use-after-free Read in hci_cmd_timeout run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK revisions tested: 2, total time: 37m26.193072793s (build: 17m19.218376439s, test: 19m23.29135238s) the crash still happens on HEAD commit msg: Linux 4.19.130 crash: KASAN: use-after-free Read in hci_cmd_timeout Bluetooth: hci1: command 0xfc11 tx timeout Bluetooth: hci1: Entering manufacturer mode failed (-110) Bluetooth: hci2: Entering manufacturer mode failed (-110) ================================================================== Bluetooth: hci1: sending frame failed (-49) BUG: KASAN: use-after-free in hci_cmd_timeout+0x1b4/0x1d0 net/bluetooth/hci_core.c:2574 Read of size 2 at addr ffff8880a96a2d48 by task kworker/1:3/6922 CPU: 1 PID: 6922 Comm: kworker/1:3 Not tainted 4.19.130-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events hci_cmd_timeout Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x123/0x177 lib/dump_stack.c:118 print_address_description.cold.8+0x9/0x1ff mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report.cold.9+0x242/0x309 mm/kasan/report.c:412 __asan_report_load_n_noabort+0xf/0x20 mm/kasan/report.c:443 hci_cmd_timeout+0x1b4/0x1d0 net/bluetooth/hci_core.c:2574 process_one_work+0x830/0x1670 kernel/workqueue.c:2155 worker_thread+0x85/0xb60 kernel/workqueue.c:2298 kthread+0x324/0x3e0 kernel/kthread.c:246 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 Allocated by task 7464: save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:553 __do_kmalloc_node mm/slab.c:3689 [inline] __kmalloc_node_track_caller+0x50/0x70 mm/slab.c:3703 __kmalloc_reserve.isra.41+0x2c/0xc0 net/core/skbuff.c:137 __alloc_skb+0xd7/0x580 net/core/skbuff.c:205 alloc_skb include/linux/skbuff.h:995 [inline] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline] hci_prepare_cmd+0x2c/0x200 net/bluetooth/hci_request.c:292 hci_req_add_ev+0x7f/0x1f0 net/bluetooth/hci_request.c:326 __hci_cmd_sync_ev+0xf8/0x1a0 net/bluetooth/hci_request.c:138 __hci_cmd_sync+0x12/0x20 net/bluetooth/hci_request.c:187 btintel_enter_mfg+0x29/0x70 drivers/bluetooth/btintel.c:82 ag6xx_setup+0x112/0x7c0 drivers/bluetooth/hci_ag6xx.c:180 hci_uart_setup+0x19c/0x3a0 drivers/bluetooth/hci_ldisc.c:431 hci_dev_do_open+0x52d/0xfe0 net/bluetooth/hci_core.c:1423 hci_power_on+0xe2/0x410 net/bluetooth/hci_core.c:2130 process_one_work+0x830/0x1670 kernel/workqueue.c:2155 worker_thread+0x85/0xb60 kernel/workqueue.c:2298 kthread+0x324/0x3e0 kernel/kthread.c:246 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 Freed by task 7464: save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528 __cache_free mm/slab.c:3503 [inline] kfree+0xcf/0x220 mm/slab.c:3822 skb_free_head+0x74/0x90 net/core/skbuff.c:554 skb_release_data+0x50e/0x790 net/core/skbuff.c:574 skb_release_all+0x3d/0x50 net/core/skbuff.c:631 __kfree_skb net/core/skbuff.c:645 [inline] kfree_skb+0x97/0x280 net/core/skbuff.c:663 hci_dev_do_open+0x965/0xfe0 net/bluetooth/hci_core.c:1509 hci_power_on+0xe2/0x410 net/bluetooth/hci_core.c:2130 process_one_work+0x830/0x1670 kernel/workqueue.c:2155 worker_thread+0x85/0xb60 kernel/workqueue.c:2298 kthread+0x324/0x3e0 kernel/kthread.c:246 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 The buggy address belongs to the object at ffff8880a96a2d40 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 8 bytes inside of 512-byte region [ffff8880a96a2d40, ffff8880a96a2f40) The buggy address belongs to the page: page:ffffea0002a5a880 count:1 mapcount:0 mapping:ffff88812c29c940 index:0xffff8880a96a2ac0 flags: 0xfffe0000000100(slab) raw: 00fffe0000000100 ffffea0002902248 ffffea0002268d48 ffff88812c29c940 raw: ffff8880a96a2ac0 ffff8880a96a20c0 0000000100000005 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880a96a2c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880a96a2c80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc >ffff8880a96a2d00: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb ^ ffff8880a96a2d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880a96a2e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Bluetooth: hci3: Entering manufacturer mode failed (-110) Bluetooth: hci3: command 0xfc11 tx timeout