[moderation] [bluetooth?] KFENCE: invalid free in __hci_req_sync

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 9d1ddab261f3 Merge tag '6.9-rc5-smb-client-fixes' of git:/..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=145d5280980000
kernel config: https://syzkaller.appspot.com/x/.config?x=545d4b3e07d6ccbc
dashboard link: https://syzkaller.appspot.com/bug?extid=9dd80221849b93a7e62e
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
CC: [johan....@gmail.com linux-b...@vger.kernel.org linux-...@vger.kernel.org luiz....@gmail.com mar...@holtmann.org]

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7bc7510fe41f/non_bootable_disk-9d1ddab2.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/5d5ab6e818c4/vmlinux-9d1ddab2.xz
kernel image: https://storage.googleapis.com/syzbot-assets/cf81babb0258/bzImage-9d1ddab2.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9dd802...@syzkaller.appspotmail.com

==================================================================
BUG: KFENCE: invalid free in kfree_skbmem+0x10e/0x200 net/core/skbuff.c:1159

Invalid free of 0xffff88816db60f00 (in kfence-#175):
kfree_skbmem+0x10e/0x200 net/core/skbuff.c:1159
__kfree_skb net/core/skbuff.c:1217 [inline]
kfree_skb_reason+0x13a/0x210 net/core/skbuff.c:1252
kfree_skb include/linux/skbuff.h:1262 [inline]
__hci_req_sync+0x61d/0x980 net/bluetooth/hci_request.c:184
hci_req_sync+0x97/0xd0 net/bluetooth/hci_request.c:206
hci_dev_cmd+0x653/0x9c0 net/bluetooth/hci_core.c:790
hci_sock_ioctl+0x4f3/0x8e0 net/bluetooth/hci_sock.c:1153
sock_do_ioctl+0x116/0x280 net/socket.c:1222
sock_ioctl+0x22e/0x6c0 net/socket.c:1341
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:904 [inline]
__se_sys_ioctl fs/ioctl.c:890 [inline]
__x64_sys_ioctl+0x193/0x220 fs/ioctl.c:890
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcf/0x260 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

kfence-#175: 0xffff88816db60f00-0xffff88816db60fef, size=240, cache=skbuff_head_cache

allocated by task 64 on cpu 2 at 217.660109s:
skb_clone+0x190/0x3f0 net/core/skbuff.c:2063
hci_send_cmd_sync net/bluetooth/hci_core.c:4220 [inline]
hci_cmd_work+0x66a/0x710 net/bluetooth/hci_core.c:4240
process_one_work+0x9a9/0x1ac0 kernel/workqueue.c:3254
process_scheduled_works kernel/workqueue.c:3335 [inline]
worker_thread+0x6c8/0xf70 kernel/workqueue.c:3416
kthread+0x2c1/0x3a0 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

freed by task 64 on cpu 2 at 217.660313s:
kfree_skbmem+0x10e/0x200 net/core/skbuff.c:1159
__kfree_skb net/core/skbuff.c:1217 [inline]
kfree_skb_reason+0x13a/0x210 net/core/skbuff.c:1252
kfree_skb include/linux/skbuff.h:1262 [inline]
hci_req_sync_complete+0x16c/0x270 net/bluetooth/hci_request.c:109
hci_event_packet+0x963/0x1170 net/bluetooth/hci_event.c:7604
hci_rx_work+0x2c4/0x1610 net/bluetooth/hci_core.c:4171
process_one_work+0x9a9/0x1ac0 kernel/workqueue.c:3254
process_scheduled_works kernel/workqueue.c:3335 [inline]
worker_thread+0x6c8/0xf70 kernel/workqueue.c:3416
kthread+0x2c1/0x3a0 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

CPU: 1 PID: 11620 Comm: syz-executor.2 Not tainted 6.9.0-rc5-syzkaller-00036-g9d1ddab261f3 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

Sending this report to the next reporting stage.