Bluetooth: hci0: Opcode 0x0406 failed: -4
Bluetooth: hci1: Opcode 0x0c1a failed: -4
Bluetooth: hci1: Opcode 0x0406 failed: -4
==================================================================
BUG: KASAN: use-after-free in _raw_spin_lock_bh+0x36/0x50
Read of size 1 at addr ffff8881bba1d5a0 by task syz.3.2795/27658

CPU: 0 UID: 0 PID: 27658 Comm: syz.3.2795 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150
 print_address_description+0x55/0x1e0
 print_report+0x58/0x70
 kasan_report+0x117/0x150
 __kasan_check_byte+0x2a/0x40
 lock_acquire+0x84/0x350
 _raw_spin_lock_bh+0x36/0x50
 bt_accept_unlink+0x63/0x2c0
 l2cap_sock_teardown_cb+0x17e/0x490
 l2cap_chan_del+0x98/0x600
 l2cap_conn_del+0x2f2/0x520
 l2cap_connect_cfm+0x12b/0x1620
 hci_conn_failed+0x1b2/0x320
 hci_abort_conn_sync+0xdd0/0x1190
 hci_disconnect_all_sync+0x1b5/0x350
 hci_suspend_sync+0x40f/0xca0
 hci_suspend_dev+0x28e/0x530
 hci_suspend_notifier+0xf2/0x2f0
 notifier_call_chain+0x1a5/0x3d0
 blocking_notifier_call_chain_robust+0x85/0x100
 pm_notifier_call_chain_robust+0x2c/0x60
 snapshot_open+0x19c/0x290
 misc_open+0x2d5/0x350
 chrdev_open+0x4d9/0x600
 do_dentry_open+0x816/0x1380
 vfs_open+0x3b/0x340
 path_openat+0x2e44/0x3830
 do_file_open+0x23e/0x4a0
 do_sys_openat2+0x115/0x200
 __x64_sys_openat+0x138/0x170
 do_syscall_64+0x174/0x580
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe00999e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fe00a91e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fe009c25fa0 RCX: 00007fe00999e0d9
RDX: 0000000000000400 RSI: 0000200000000200 RDI: ffffffffffffff9c
RBP: 00007fe009a35024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fe009c26038 R14: 00007fe009c25fa0 R15: 00007ffd0ad95fd8
 </TASK>

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x851 pfn:0x1bba1d
flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff)
raw: 057ff00000000000 0000000000000000 dead000000000122 0000000000000000
raw: 0000000000000851 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x29c2(GFP_NOWAIT|__GFP_HIGHMEM|__GFP_IO|__GFP_FS|__GFP_ZERO), pid 2, tgid 2 (kthreadd), ts 554065557886
 post_alloc_hook+0x1f9/0x250
 get_page_from_freelist+0x2205/0x2280
 __alloc_frozen_pages_noprof+0x217/0x5a0
 alloc_pages_mpol+0x21e/0x390
 alloc_pages_noprof+0xac/0x2a0
 __vmalloc_node_range_noprof+0x709/0x1560
 __vmalloc_node_noprof+0xc2/0x100
 dup_task_struct+0x2a0/0x8e0
 copy_process+0x820/0x4390
 kernel_clone+0x2d7/0x940
 kernel_thread+0x13f/0x1b0
 kthreadd+0x4ec/0x6e0
 ret_from_fork+0x514/0xb70
 ret_from_fork_asm+0x1a/0x30
page last free pid 5675 tgid 5675 ts 557972804891 stack trace:
 free_pages_prepare+0x9eb/0xaf0
 __free_contig_range_common+0x174/0x340
 free_pages_bulk+0x48/0x120
 vfree+0x224/0x4a0
 delayed_vfree_work+0x55/0x80
 process_scheduled_works+0xa8e/0x14e0
 worker_thread+0xa47/0xfb0
 kthread+0x388/0x470
 ret_from_fork+0x514/0xb70
 ret_from_fork_asm+0x1a/0x30

Memory state around the buggy address:
 ffff8881bba1d480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8881bba1d500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff8881bba1d580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                               ^
 ffff8881bba1d600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8881bba1d680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
