================================================================== BUG: KASAN: slab-use-after-free in hci_uart_write_work+0x81c/0x950 drivers/bluetooth/hci_ldisc.c:165 Read of size 4 at addr ffff888025b75d30 by task kworker/1:1/53 CPU: 1 UID: 0 PID: 53 Comm: kworker/1:1 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: events hci_uart_write_work Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x156/0x4c9 mm/kasan/report.c:482 kasan_report+0xdf/0x1a0 mm/kasan/report.c:595 hci_uart_write_work+0x81c/0x950 drivers/bluetooth/hci_ldisc.c:165 process_one_work+0x9c2/0x1840 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x5da/0xe40 kernel/workqueue.c:3421 kthread+0x3b3/0x730 kernel/kthread.c:463 ret_from_fork+0x754/0xaf0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 Allocated by task 9823: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 unpoison_slab_object mm/kasan/common.c:340 [inline] __kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:366 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4953 [inline] slab_alloc_node mm/slub.c:5263 [inline] kmem_cache_alloc_node_noprof+0x303/0x880 mm/slub.c:5315 __alloc_skb+0x156/0x410 net/core/skbuff.c:679 alloc_skb include/linux/skbuff.h:1383 [inline] bcsp_prepare_pkt+0xe0/0xa90 drivers/bluetooth/hci_bcsp.c:218 bcsp_dequeue+0x237/0x4b0 drivers/bluetooth/hci_bcsp.c:308 hci_uart_dequeue drivers/bluetooth/hci_ldisc.c:107 [inline] hci_uart_write_work+0x4d9/0x950 drivers/bluetooth/hci_ldisc.c:161 process_one_work+0x9c2/0x1840 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x5da/0xe40 kernel/workqueue.c:3421 kthread+0x3b3/0x730 kernel/kthread.c:463 ret_from_fork+0x754/0xaf0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 The buggy address belongs to the object at ffff888025b75cc0 which belongs to the cache skbuff_head_cache of size 240 The buggy address is located 112 bytes inside of freed 240-byte region [ffff888025b75cc0, ffff888025b75db0) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x25b74 head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 memcg:ffff88802503ae01 anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801c7088c0 0000000000000000 dead000000000001 raw: 0000000000000000 0000000000190019 00000000f5000000 ffff88802503ae01 head: 00fff00000000040 ffff88801c7088c0 0000000000000000 dead000000000001 head: 0000000000000000 0000000000190019 00000000f5000000 ffff88802503ae01 head: 00fff00000000001 ffffea000096dd01 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 1, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 6494, tgid 6493 (syz.4.146), ts 71548229822, free_ts 55743315821 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1e1/0x250 mm/page_alloc.c:1884 prep_new_page mm/page_alloc.c:1892 [inline] get_page_from_freelist+0xe3d/0x2e10 mm/page_alloc.c:3945 __alloc_frozen_pages_noprof+0x26c/0x2410 mm/page_alloc.c:5240 alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2486 alloc_slab_page mm/slub.c:3075 [inline] allocate_slab mm/slub.c:3248 [inline] new_slab+0x2c4/0x440 mm/slub.c:3302 ___slab_alloc+0xda3/0x1ca0 mm/slub.c:4656 __slab_alloc.isra.0+0x63/0x110 mm/slub.c:4779 __slab_alloc_node mm/slub.c:4855 [inline] slab_alloc_node mm/slub.c:5251 [inline] kmem_cache_alloc_noprof+0x4ec/0x780 mm/slub.c:5270 skb_clone+0x190/0x400 net/core/skbuff.c:2088 ip_mc_output+0x612/0xfc0 net/ipv4/ip_output.c:399 dst_output include/net/dst.h:464 [inline] dst_output include/net/dst.h:462 [inline] ip_local_out net/ipv4/ip_output.c:131 [inline] ip_send_skb+0x344/0x550 net/ipv4/ip_output.c:1508 udp_send_skb+0x71e/0x15e0 net/ipv4/udp.c:1195 udp_sendmsg+0x17f8/0x2880 net/ipv4/udp.c:1484 inet_sendmsg+0x105/0x140 net/ipv4/af_inet.c:859 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg+0x9ad/0xc30 net/socket.c:2592 ___sys_sendmsg+0x190/0x1e0 net/socket.c:2646 page last free pid 1229 tgid 1229 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1433 [inline] __free_frozen_pages+0x822/0x1130 mm/page_alloc.c:2973 discard_slab mm/slub.c:3346 [inline] __put_partials+0x127/0x160 mm/slub.c:3886 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xe0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4953 [inline] slab_alloc_node mm/slub.c:5263 [inline] __do_kmalloc_node mm/slub.c:5656 [inline] __kmalloc_noprof+0x300/0x9c0 mm/slub.c:5669 kmalloc_noprof include/linux/slab.h:961 [inline] kzalloc_noprof include/linux/slab.h:1094 [inline] __sta_info_alloc+0xa7/0x1cd0 net/mac80211/sta_info.c:609 ieee80211_ibss_add_sta+0x2e9/0x710 net/mac80211/ibss.c:613 ieee80211_update_sta_info net/mac80211/ibss.c:1000 [inline] ieee80211_rx_bss_info net/mac80211/ibss.c:1092 [inline] ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1575 [inline] ieee80211_ibss_rx_queued_mgmt+0x24f8/0x2f30 net/mac80211/ibss.c:1602 ieee80211_iface_process_skb net/mac80211/iface.c:1740 [inline] ieee80211_iface_work+0xbf1/0x1350 net/mac80211/iface.c:1794 cfg80211_wiphy_work+0x3f7/0x560 net/wireless/core.c:438 process_one_work+0x9c2/0x1840 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x5da/0xe40 kernel/workqueue.c:3421 kthread+0x3b3/0x730 kernel/kthread.c:463 ret_from_fork+0x754/0xaf0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 Memory state around the buggy address: ffff888025b75c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc ffff888025b75c80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb >ffff888025b75d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888025b75d80: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc ffff888025b75e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================