[PATCH] Bluetooth: hci_core: Fix leak of request command on tx timeout

[Jiakai Xu]

When a command transmission times out, hci_cmd_timeout() calls
hci_cmd_sync_cancel_sync() to mark the pending request as
HCI_REQ_CANCELED and wake up the waiter. However, nothing releases
the request command skb in this path: hci_cmd_sync_complete(), the
only place which frees hdev->req_skb during normal operation, bails
out early because the request status is no longer HCI_REQ_PEND.
Since commit f5afdff569a09 ("Bluetooth: hci_core: use skb_get()
instead of skb_clone() for req_skb"), hdev->req_skb holds an extra
reference to the same skb object as hdev->sent_cmd, so both pointers
keep the buffer alive and it leaks unless the device is closed,
which a fuzzer never does. This is the leak reported by kmemleak as
"memory leak in __hci_cmd_sync_sk".

Free the request command and the last sent command on the timeout
path and clear HCI_CMD_PENDING, mirroring the cleanup done by
hci_dev_close_sync(). This is safe because the waiter has already
been woken up and later command completion events tolerate a NULL
sent_cmd/req_skb via the hci_cmd_data() NULL checks.

Fixes: 63298d6e752fc ("Bluetooth: hci_core: Cancel request on command timeout")
Signed-off-by: Jiakai Xu <xujiakai24@xxxxxxxxxxxxxxxx>
---
 net/bluetooth/hci_core.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index d7355c73f93e8..d7a527d91d565 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1433,6 +1433,18 @@ static void hci_cmd_timeout(struct work_struct *work)
 		bt_dev_err(hdev, "command 0x%4.4x tx timeout", opcode);
 
 		hci_cmd_sync_cancel_sync(hdev, ETIMEDOUT);
+
+		/* The request has been canceled so hci_cmd_sync_complete()
+		 * will no longer release the request command. Free it along
+		 * with the last sent command, which shares the same data
+		 * buffer, otherwise they leak when the device stays up.
+		 */
+		kfree_skb(hdev->sent_cmd);
+		hdev->sent_cmd = NULL;
+
+		kfree_skb(hdev->req_skb);
+		hdev->req_skb = NULL;
+		hci_dev_clear_flag(hdev, HCI_CMD_PENDING);
 	} else {
 		bt_dev_err(hdev, "command tx timeout");
 	}
-- 
2.34.1


-- 
Below is the crash report:
BUG: memory leak
unreferenced object 0xffff88800b4b3000 (size 240):
  comm "syz.0.963", pid 18664, jiffies 4295035394
  hex dump (first 32 bytes):
    00 26 94 0c 80 88 ff ff 80 e8 fe 08 81 88 ff ff  .&..............
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc c3a6fa22):
    kmemleak_alloc_recursive home/zzzrrll/tmp/kf_src/linux-7.1.13/include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook home/zzzrrll/tmp/kf_src/linux-7.1.13/mm/slub.c:4550 [inline]
    slab_alloc_node home/zzzrrll/tmp/kf_src/linux-7.1.13/mm/slub.c:4874 [inline]
    kmem_cache_alloc_node_noprof+0x267/0x4c0 home/zzzrrll/tmp/kf_src/linux-7.1.13/mm/slub.c:4926
    __alloc_skb+0x236/0x500 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/core/skbuff.c:702
    alloc_skb home/zzzrrll/tmp/kf_src/linux-7.1.13/include/linux/skbuff.h:1385 [inline]
    bt_skb_alloc home/zzzrrll/tmp/kf_src/linux-7.1.13/include/net/bluetooth/bluetooth.h:520 [inline]
    hci_cmd_sync_alloc+0x30/0x120 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:58
    hci_cmd_sync_add home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:99 [inline]
    __hci_cmd_sync_sk+0x7b/0x510 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:168
    __hci_cmd_sync_status_sk home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:263 [inline]
    __hci_cmd_sync_status home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:287 [inline]
    hci_inquiry_sync+0xe5/0x190 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:6120
    hci_inquiry+0x277/0x3f0 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_core.c:372
    sock_do_ioctl+0x7c/0x1e0 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/socket.c:1302
    sock_ioctl+0x423/0x5d0 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/socket.c:1423
    vfs_ioctl home/zzzrrll/tmp/kf_src/linux-7.1.13/fs/ioctl.c:51 [inline]
    __do_sys_ioctl home/zzzrrll/tmp/kf_src/linux-7.1.13/fs/ioctl.c:597 [inline]
    __se_sys_ioctl+0xbb/0x130 home/zzzrrll/tmp/kf_src/linux-7.1.13/fs/ioctl.c:583
    do_syscall_x64 home/zzzrrll/tmp/kf_src/linux-7.1.13/arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0x187/0x520 home/zzzrrll/tmp/kf_src/linux-7.1.13/arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888015014b00 (size 704):
  comm "syz.0.963", pid 18664, jiffies 4295035394
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 01 04 05 33 8b 9e 13 05  ...........3....
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 62ed5507):
    kmemleak_alloc_recursive home/zzzrrll/tmp/kf_src/linux-7.1.13/include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook home/zzzrrll/tmp/kf_src/linux-7.1.13/mm/slub.c:4550 [inline]
    slab_alloc_node home/zzzrrll/tmp/kf_src/linux-7.1.13/mm/slub.c:4874 [inline]
    kmem_cache_alloc_node_noprof+0x267/0x4c0 home/zzzrrll/tmp/kf_src/linux-7.1.13/mm/slub.c:4926
    kmalloc_reserve+0x69/0x120 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/core/skbuff.c:613
    __alloc_skb+0x33c/0x500 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/core/skbuff.c:713
    alloc_skb home/zzzrrll/tmp/kf_src/linux-7.1.13/include/linux/skbuff.h:1385 [inline]
    bt_skb_alloc home/zzzrrll/tmp/kf_src/linux-7.1.13/include/net/bluetooth/bluetooth.h:520 [inline]
    hci_cmd_sync_alloc+0x30/0x120 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:58
    hci_cmd_sync_add home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:99 [inline]
    __hci_cmd_sync_sk+0x7b/0x510 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:168
    __hci_cmd_sync_status_sk home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:263 [inline]
    __hci_cmd_sync_status home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:287 [inline]
    hci_inquiry_sync+0xe5/0x190 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:6120
    hci_inquiry+0x277/0x3f0 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_core.c:372
    sock_do_ioctl+0x7c/0x1e0 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/socket.c:1302
    sock_ioctl+0x423/0x5d0 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/socket.c:1423
    vfs_ioctl home/zzzrrll/tmp/kf_src/linux-7.1.13/fs/ioctl.c:51 [inline]
    __do_sys_ioctl home/zzzrrll/tmp/kf_src/linux-7.1.13/fs/ioctl.c:597 [inline]
    __se_sys_ioctl+0xbb/0x130 home/zzzrrll/tmp/kf_src/linux-7.1.13/fs/ioctl.c:583
    do_syscall_x64 home/zzzrrll/tmp/kf_src/linux-7.1.13/arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0x187/0x520 home/zzzrrll/tmp/kf_src/linux-7.1.13/arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88800c942600 (size 240):
  comm "syz.3.1200", pid 20339, jiffies 4295059978
  hex dump (first 32 bytes):
    00 25 4b 0b 80 88 ff ff 00 30 4b 0b 80 88 ff ff  .%K......0K.....
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc d3272932):
    kmemleak_alloc_recursive home/zzzrrll/tmp/kf_src/linux-7.1.13/include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook home/zzzrrll/tmp/kf_src/linux-7.1.13/mm/slub.c:4550 [inline]
    slab_alloc_node home/zzzrrll/tmp/kf_src/linux-7.1.13/mm/slub.c:4874 [inline]
    kmem_cache_alloc_node_noprof+0x267/0x4c0 home/zzzrrll/tmp/kf_src/linux-7.1.13/mm/slub.c:4926
    __alloc_skb+0x236/0x500 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/core/skbuff.c:702
    alloc_skb home/zzzrrll/tmp/kf_src/linux-7.1.13/include/linux/skbuff.h:1385 [inline]
    bt_skb_alloc home/zzzrrll/tmp/kf_src/linux-7.1.13/include/net/bluetooth/bluetooth.h:520 [inline]
    hci_cmd_sync_alloc+0x30/0x120 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:58
    hci_cmd_sync_add home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:99 [inline]
    __hci_cmd_sync_sk+0x7b/0x510 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:168
    __hci_cmd_sync_status_sk home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:263 [inline]
    __hci_cmd_sync_status home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:287 [inline]
    hci_cmd_sync_status+0x4f/0xe0 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:298
    hci_dev_cmd+0x2ca/0x420 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_core.c:699
    sock_do_ioctl+0x7c/0x1e0 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/socket.c:1302
    sock_ioctl+0x423/0x5d0 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/socket.c:1423
    vfs_ioctl home/zzzrrll/tmp/kf_src/linux-7.1.13/fs/ioctl.c:51 [inline]
    __do_sys_ioctl home/zzzrrll/tmp/kf_src/linux-7.1.13/fs/ioctl.c:597 [inline]
    __se_sys_ioctl+0xbb/0x130 home/zzzrrll/tmp/kf_src/linux-7.1.13/fs/ioctl.c:583
    do_syscall_x64 home/zzzrrll/tmp/kf_src/linux-7.1.13/arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0x187/0x520 home/zzzrrll/tmp/kf_src/linux-7.1.13/arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88800ca6ac00 (size 704):
  comm "syz.3.1200", pid 20339, jiffies 4295059978
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 1a 0c 01 04 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc a1b85eb5):
    kmemleak_alloc_recursive home/zzzrrll/tmp/kf_src/linux-7.1.13/include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook home/zzzrrll/tmp/kf_src/linux-7.1.13/mm/slub.c:4550 [inline]
    slab_alloc_node home/zzzrrll/tmp/kf_src/linux-7.1.13/mm/slub.c:4874 [inline]
    kmem_cache_alloc_node_noprof+0x267/0x4c0 home/zzzrrll/tmp/kf_src/linux-7.1.13/mm/slub.c:4926
    kmalloc_reserve+0x69/0x120 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/core/skbuff.c:613
    __alloc_skb+0x33c/0x500 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/core/skbuff.c:713
    alloc_skb home/zzzrrll/tmp/kf_src/linux-7.1.13/include/linux/skbuff.h:1385 [inline]
    bt_skb_alloc home/zzzrrll/tmp/kf_src/linux-7.1.13/include/net/bluetooth/bluetooth.h:520 [inline]
    hci_cmd_sync_alloc+0x30/0x120 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:58
    hci_cmd_sync_add home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:99 [inline]
    __hci_cmd_sync_sk+0x7b/0x510 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:168
    __hci_cmd_sync_status_sk home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:263 [inline]
    __hci_cmd_sync_status home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:287 [inline]
    hci_cmd_sync_status+0x4f/0xe0 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:298
    hci_dev_cmd+0x2ca/0x420 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_core.c:699
    sock_do_ioctl+0x7c/0x1e0 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/socket.c:1302
    sock_ioctl+0x423/0x5d0 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/socket.c:1423
    vfs_ioctl home/zzzrrll/tmp/kf_src/linux-7.1.13/fs/ioctl.c:51 [inline]
    __do_sys_ioctl home/zzzrrll/tmp/kf_src/linux-7.1.13/fs/ioctl.c:597 [inline]
    __se_sys_ioctl+0xbb/0x130 home/zzzrrll/tmp/kf_src/linux-7.1.13/fs/ioctl.c:583
    do_syscall_x64 home/zzzrrll/tmp/kf_src/linux-7.1.13/arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0x187/0x520 home/zzzrrll/tmp/kf_src/linux-7.1.13/arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88800b4b2500 (size 240):
  comm "syz.0.1229", pid 20584, jiffies 4295063225
  hex dump (first 32 bytes):
    00 2f 94 0c 80 88 ff ff 00 26 94 0c 80 88 ff ff  ./.......&......
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 1152a240):
    kmemleak_alloc_recursive home/zzzrrll/tmp/kf_src/linux-7.1.13/include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook home/zzzrrll/tmp/kf_src/linux-7.1.13/mm/slub.c:4550 [inline]
    slab_alloc_node home/zzzrrll/tmp/kf_src/linux-7.1.13/mm/slub.c:4874 [inline]
    kmem_cache_alloc_node_noprof+0x267/0x4c0 home/zzzrrll/tmp/kf_src/linux-7.1.13/mm/slub.c:4926
    __alloc_skb+0x236/0x500 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/core/skbuff.c:702
    alloc_skb home/zzzrrll/tmp/kf_src/linux-7.1.13/include/linux/skbuff.h:1385 [inline]
    bt_skb_alloc home/zzzrrll/tmp/kf_src/linux-7.1.13/include/net/bluetooth/bluetooth.h:520 [inline]
    hci_cmd_sync_alloc+0x30/0x120 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:58
    hci_cmd_sync_add home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:99 [inline]
    __hci_cmd_sync_sk+0x7b/0x510 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:168
    __hci_cmd_sync_status_sk home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:263 [inline]
    __hci_cmd_sync_status home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:287 [inline]
    hci_cmd_sync_status+0x4f/0xe0 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:298
    hci_dev_cmd+0x2ca/0x420 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_core.c:699
    sock_do_ioctl+0x7c/0x1e0 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/socket.c:1302
    sock_ioctl+0x423/0x5d0 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/socket.c:1423
    vfs_ioctl home/zzzrrll/tmp/kf_src/linux-7.1.13/fs/ioctl.c:51 [inline]
    __do_sys_ioctl home/zzzrrll/tmp/kf_src/linux-7.1.13/fs/ioctl.c:597 [inline]
    __se_sys_ioctl+0xbb/0x130 home/zzzrrll/tmp/kf_src/linux-7.1.13/fs/ioctl.c:583
    do_syscall_x64 home/zzzrrll/tmp/kf_src/linux-7.1.13/arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0x187/0x520 home/zzzrrll/tmp/kf_src/linux-7.1.13/arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888015017180 (size 704):
  comm "syz.0.1229", pid 20584, jiffies 4295063225
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 1a 0c 01 04 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc a1b85eb5):
    kmemleak_alloc_recursive home/zzzrrll/tmp/kf_src/linux-7.1.13/include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook home/zzzrrll/tmp/kf_src/linux-7.1.13/mm/slub.c:4550 [inline]
    slab_alloc_node home/zzzrrll/tmp/kf_src/linux-7.1.13/mm/slub.c:4874 [inline]
    kmem_cache_alloc_node_noprof+0x267/0x4c0 home/zzzrrll/tmp/kf_src/linux-7.1.13/mm/slub.c:4926
    kmalloc_reserve+0x69/0x120 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/core/skbuff.c:613
    __alloc_skb+0x33c/0x500 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/core/skbuff.c:713
    alloc_skb home/zzzrrll/tmp/kf_src/linux-7.1.13/include/linux/skbuff.h:1385 [inline]
    bt_skb_alloc home/zzzrrll/tmp/kf_src/linux-7.1.13/include/net/bluetooth/bluetooth.h:520 [inline]
    hci_cmd_sync_alloc+0x30/0x120 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:58
    hci_cmd_sync_add home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:99 [inline]
    __hci_cmd_sync_sk+0x7b/0x510 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:168
    __hci_cmd_sync_status_sk home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:263 [inline]
    __hci_cmd_sync_status home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:287 [inline]
    hci_cmd_sync_status+0x4f/0xe0 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:298
    hci_dev_cmd+0x2ca/0x420 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_core.c:699
    sock_do_ioctl+0x7c/0x1e0 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/socket.c:1302
    sock_ioctl+0x423/0x5d0 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/socket.c:1423
    vfs_ioctl home/zzzrrll/tmp/kf_src/linux-7.1.13/fs/ioctl.c:51 [inline]
    __do_sys_ioctl home/zzzrrll/tmp/kf_src/linux-7.1.13/fs/ioctl.c:597 [inline]
    __se_sys_ioctl+0xbb/0x130 home/zzzrrll/tmp/kf_src/linux-7.1.13/fs/ioctl.c:583
    do_syscall_x64 home/zzzrrll/tmp/kf_src/linux-7.1.13/arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0x187/0x520 home/zzzrrll/tmp/kf_src/linux-7.1.13/arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f


<<<<<<<<<<<<<<< tail report >>>>>>>>>>>>>>>

    sock_do_ioctl+0x7c/0x1e0
    sock_ioctl+0x423/0x5d0
    __se_sys_ioctl+0xbb/0x130
    do_syscall_64+0x187/0x520
    entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff888015014b00 (size 704):
  comm "syz.0.963", pid 18664, jiffies 4295035394
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 01 04 05 33 8b 9e 13 05  ...........3....
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 62ed5507):
    kmem_cache_alloc_node_noprof+0x267/0x4c0
    kmalloc_reserve+0x69/0x120
    __alloc_skb+0x33c/0x500
    hci_cmd_sync_alloc+0x30/0x120
    __hci_cmd_sync_sk+0x7b/0x510
    hci_inquiry_sync+0xe5/0x190
    hci_inquiry+0x277/0x3f0
    sock_do_ioctl+0x7c/0x1e0
    sock_ioctl+0x423/0x5d0
    __se_sys_ioctl+0xbb/0x130
    do_syscall_64+0x187/0x520
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88800c942600 (size 240):
  comm "syz.3.1200", pid 20339, jiffies 4295059978
  hex dump (first 32 bytes):
    00 25 4b 0b 80 88 ff ff 00 30 4b 0b 80 88 ff ff  .%K......0K.....
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc d3272932):
    kmem_cache_alloc_node_noprof+0x267/0x4c0
    __alloc_skb+0x236/0x500
    hci_cmd_sync_alloc+0x30/0x120
    __hci_cmd_sync_sk+0x7b/0x510
    hci_cmd_sync_status+0x4f/0xe0
    hci_dev_cmd+0x2ca/0x420
    sock_do_ioctl+0x7c/0x1e0
    sock_ioctl+0x423/0x5d0
    __se_sys_ioctl+0xbb/0x130
    do_syscall_64+0x187/0x520
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88800ca6ac00 (size 704):
  comm "syz.3.1200", pid 20339, jiffies 4295059978
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 1a 0c 01 04 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc a1b85eb5):
    kmem_cache_alloc_node_noprof+0x267/0x4c0
    kmalloc_reserve+0x69/0x120
    __alloc_skb+0x33c/0x500
    hci_cmd_sync_alloc+0x30/0x120
    __hci_cmd_sync_sk+0x7b/0x510
    hci_cmd_sync_status+0x4f/0xe0
    hci_dev_cmd+0x2ca/0x420
    sock_do_ioctl+0x7c/0x1e0
    sock_ioctl+0x423/0x5d0
    __se_sys_ioctl+0xbb/0x130
    do_syscall_64+0x187/0x520
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88800b4b2500 (size 240):
  comm "syz.0.1229", pid 20584, jiffies 4295063225
  hex dump (first 32 bytes):
    00 2f 94 0c 80 88 ff ff 00 26 94 0c 80 88 ff ff  ./.......&......
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 1152a240):
    kmem_cache_alloc_node_noprof+0x267/0x4c0
    __alloc_skb+0x236/0x500
    hci_cmd_sync_alloc+0x30/0x120
    __hci_cmd_sync_sk+0x7b/0x510
    hci_cmd_sync_status+0x4f/0xe0
    hci_dev_cmd+0x2ca/0x420
    sock_do_ioctl+0x7c/0x1e0
    sock_ioctl+0x423/0x5d0
    __se_sys_ioctl+0xbb/0x130
    do_syscall_64+0x187/0x520
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888015017180 (size 704):
  comm "syz.0.1229", pid 20584, jiffies 4295063225
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 1a 0c 01 04 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc a1b85eb5):
    kmem_cache_alloc_node_noprof+0x267/0x4c0
    kmalloc_reserve+0x69/0x120
    __alloc_skb+0x33c/0x500
    hci_cmd_sync_alloc+0x30/0x120
    __hci_cmd_sync_sk+0x7b/0x510
    hci_cmd_sync_status+0x4f/0xe0
    hci_dev_cmd+0x2ca/0x420
    sock_do_ioctl+0x7c/0x1e0
    sock_ioctl+0x423/0x5d0
    __se_sys_ioctl+0xbb/0x130
    do_syscall_64+0x187/0x520
    entry_SYSCALL_64_after_hwframe+0x77/0x7f


<<<<<<<<<<<<<<< tail report >>>>>>>>>>>>>>>

    sock_do_ioctl+0x7c/0x1e0
    sock_ioctl+0x423/0x5d0
    __se_sys_ioctl+0xbb/0x130
    do_syscall_64+0x187/0x520
    entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff88800c942600 (size 240):
  comm "syz.3.1200", pid 20339, jiffies 4295059978
  hex dump (first 32 bytes):
    00 25 4b 0b 80 88 ff ff 00 30 4b 0b 80 88 ff ff  .%K......0K.....
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc d3272932):
    kmem_cache_alloc_node_noprof+0x267/0x4c0
    __alloc_skb+0x236/0x500
    hci_cmd_sync_alloc+0x30/0x120
    __hci_cmd_sync_sk+0x7b/0x510
    hci_cmd_sync_status+0x4f/0xe0
    hci_dev_cmd+0x2ca/0x420
    sock_do_ioctl+0x7c/0x1e0
    sock_ioctl+0x423/0x5d0
    __se_sys_ioctl+0xbb/0x130
    do_syscall_64+0x187/0x520
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88800ca6ac00 (size 704):
  comm "syz.3.1200", pid 20339, jiffies 4295059978
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 1a 0c 01 04 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc a1b85eb5):
    kmem_cache_alloc_node_noprof+0x267/0x4c0
    kmalloc_reserve+0x69/0x120
    __alloc_skb+0x33c/0x500
    hci_cmd_sync_alloc+0x30/0x120
    __hci_cmd_sync_sk+0x7b/0x510
    hci_cmd_sync_status+0x4f/0xe0
    hci_dev_cmd+0x2ca/0x420
    sock_do_ioctl+0x7c/0x1e0
    sock_ioctl+0x423/0x5d0
    __se_sys_ioctl+0xbb/0x130
    do_syscall_64+0x187/0x520
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88800b4b2500 (size 240):
  comm "syz.0.1229", pid 20584, jiffies 4295063225
  hex dump (first 32 bytes):
    00 2f 94 0c 80 88 ff ff 00 26 94 0c 80 88 ff ff  ./.......&......
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 1152a240):
    kmem_cache_alloc_node_noprof+0x267/0x4c0
    __alloc_skb+0x236/0x500
    hci_cmd_sync_alloc+0x30/0x120
    __hci_cmd_sync_sk+0x7b/0x510
    hci_cmd_sync_status+0x4f/0xe0
    hci_dev_cmd+0x2ca/0x420
    sock_do_ioctl+0x7c/0x1e0
    sock_ioctl+0x423/0x5d0
    __se_sys_ioctl+0xbb/0x130
    do_syscall_64+0x187/0x520
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888015017180 (size 704):
  comm "syz.0.1229", pid 20584, jiffies 4295063225
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 1a 0c 01 04 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc a1b85eb5):
    kmem_cache_alloc_node_noprof+0x267/0x4c0
    kmalloc_reserve+0x69/0x120
    __alloc_skb+0x33c/0x500
    hci_cmd_sync_alloc+0x30/0x120
    __hci_cmd_sync_sk+0x7b/0x510
    hci_cmd_sync_status+0x4f/0xe0
    hci_dev_cmd+0x2ca/0x420
    sock_do_ioctl+0x7c/0x1e0
    sock_ioctl+0x423/0x5d0
    __se_sys_ioctl+0xbb/0x130
    do_syscall_64+0x187/0x520
    entry_SYSCALL_64_after_hwframe+0x77/0x7f


<<<<<<<<<<<<<<< tail report >>>>>>>>>>>>>>>

    sock_do_ioctl+0x7c/0x1e0
    sock_ioctl+0x423/0x5d0
    __se_sys_ioctl+0xbb/0x130
    do_syscall_64+0x187/0x520
    entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff88800ca6ac00 (size 704):
  comm "syz.3.1200", pid 20339, jiffies 4295059978
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 1a 0c 01 04 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc a1b85eb5):
    kmem_cache_alloc_node_noprof+0x267/0x4c0
    kmalloc_reserve+0x69/0x120
    __alloc_skb+0x33c/0x500
    hci_cmd_sync_alloc+0x30/0x120
    __hci_cmd_sync_sk+0x7b/0x510
    hci_cmd_sync_status+0x4f/0xe0
    hci_dev_cmd+0x2ca/0x420
    sock_do_ioctl+0x7c/0x1e0
    sock_ioctl+0x423/0x5d0
    __se_sys_ioctl+0xbb/0x130
    do_syscall_64+0x187/0x520
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88800b4b2500 (size 240):
  comm "syz.0.1229", pid 20584, jiffies 4295063225
  hex dump (first 32 bytes):
    00 2f 94 0c 80 88 ff ff 00 26 94 0c 80 88 ff ff  ./.......&......
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 1152a240):
    kmem_cache_alloc_node_noprof+0x267/0x4c0
    __alloc_skb+0x236/0x500
    hci_cmd_sync_alloc+0x30/0x120
    __hci_cmd_sync_sk+0x7b/0x510
    hci_cmd_sync_status+0x4f/0xe0
    hci_dev_cmd+0x2ca/0x420
    sock_do_ioctl+0x7c/0x1e0
    sock_ioctl+0x423/0x5d0
    __se_sys_ioctl+0xbb/0x130
    do_syscall_64+0x187/0x520
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888015017180 (size 704):
  comm "syz.0.1229", pid 20584, jiffies 4295063225
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 1a 0c 01 04 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc a1b85eb5):
    kmem_cache_alloc_node_noprof+0x267/0x4c0
    kmalloc_reserve+0x69/0x120
    __alloc_skb+0x33c/0x500
    hci_cmd_sync_alloc+0x30/0x120
    __hci_cmd_sync_sk+0x7b/0x510
    hci_cmd_sync_status+0x4f/0xe0
    hci_dev_cmd+0x2ca/0x420
    sock_do_ioctl+0x7c/0x1e0
    sock_ioctl+0x423/0x5d0
    __se_sys_ioctl+0xbb/0x130
    do_syscall_64+0x187/0x520
    entry_SYSCALL_64_after_hwframe+0x77/0x7f


<<<<<<<<<<<<<<< tail report >>>>>>>>>>>>>>>

    sock_do_ioctl+0x7c/0x1e0
    sock_ioctl+0x423/0x5d0
    __se_sys_ioctl+0xbb/0x130
    do_syscall_64+0x187/0x520
    entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff88800b4b2500 (size 240):
  comm "syz.0.1229", pid 20584, jiffies 4295063225
  hex dump (first 32 bytes):
    00 2f 94 0c 80 88 ff ff 00 26 94 0c 80 88 ff ff  ./.......&......
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 1152a240):
    kmem_cache_alloc_node_noprof+0x267/0x4c0
    __alloc_skb+0x236/0x500
    hci_cmd_sync_alloc+0x30/0x120
    __hci_cmd_sync_sk+0x7b/0x510
    hci_cmd_sync_status+0x4f/0xe0
    hci_dev_cmd+0x2ca/0x420
    sock_do_ioctl+0x7c/0x1e0
    sock_ioctl+0x423/0x5d0
    __se_sys_ioctl+0xbb/0x130
    do_syscall_64+0x187/0x520
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888015017180 (size 704):
  comm "syz.0.1229", pid 20584, jiffies 4295063225
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 1a 0c 01 04 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc a1b85eb5):
    kmem_cache_alloc_node_noprof+0x267/0x4c0
    kmalloc_reserve+0x69/0x120
    __alloc_skb+0x33c/0x500
    hci_cmd_sync_alloc+0x30/0x120
    __hci_cmd_sync_sk+0x7b/0x510
    hci_cmd_sync_status+0x4f/0xe0
    hci_dev_cmd+0x2ca/0x420
    sock_do_ioctl+0x7c/0x1e0
    sock_ioctl+0x423/0x5d0
    __se_sys_ioctl+0xbb/0x130
    do_syscall_64+0x187/0x520
    entry_SYSCALL_64_after_hwframe+0x77/0x7f


<<<<<<<<<<<<<<< tail report >>>>>>>>>>>>>>>

    sock_do_ioctl+0x7c/0x1e0
    sock_ioctl+0x423/0x5d0
    __se_sys_ioctl+0xbb/0x130
    do_syscall_64+0x187/0x520
    entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff888015017180 (size 704):
  comm "syz.0.1229", pid 20584, jiffies 4295063225
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 1a 0c 01 04 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc a1b85eb5):
    kmem_cache_alloc_node_noprof+0x267/0x4c0
    kmalloc_reserve+0x69/0x120
    __alloc_skb+0x33c/0x500
    hci_cmd_sync_alloc+0x30/0x120
    __hci_cmd_sync_sk+0x7b/0x510
    hci_cmd_sync_status+0x4f/0xe0
    hci_dev_cmd+0x2ca/0x420
    sock_do_ioctl+0x7c/0x1e0
    sock_ioctl+0x423/0x5d0
    __se_sys_ioctl+0xbb/0x130
    do_syscall_64+0x187/0x520
    entry_SYSCALL_64_after_hwframe+0x77/0x7f


<<<<<<<<<<<<<<< tail report >>>>>>>>>>>>>>>

---