==================================================================
BUG: KASAN: slab-use-after-free in llc_conn_ac_send_sabme_cmd_p_set_x+0x38a/0x420 net/llc/llc_c_ac.c:782
Read of size 1 at addr ffff88807a0dc010 by task udevd/5612

CPU: 1 UID: 0 PID: 5612 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description+0x55/0x1e0 mm/kasan/report.c:378
 print_report+0x58/0x70 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 llc_conn_ac_send_sabme_cmd_p_set_x+0x38a/0x420 net/llc/llc_c_ac.c:782
 llc_exec_conn_trans_actions net/llc/llc_conn.c:437 [inline]
 llc_conn_service net/llc/llc_conn.c:362 [inline]
 llc_conn_state_process+0x4fb/0x1380 net/llc/llc_conn.c:66
 llc_process_tmr_ev net/llc/llc_c_ac.c:1442 [inline]
 llc_conn_tmr_common_cb+0x34a/0x780 net/llc/llc_c_ac.c:1325
 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748
 expire_timers kernel/time/timer.c:1799 [inline]
 __run_timers kernel/time/timer.c:2374 [inline]
 __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386
 run_timer_base kernel/time/timer.c:2395 [inline]
 run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405
 handle_softirqs+0x225/0x840 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0xca/0x220 kernel/softirq.c:735
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:_compound_head include/linux/page-flags.h:247 [inline]
RIP: 0010:free_pages_and_swap_cache+0x1a3/0x490 mm/swap_state.c:577
Code: 01 09 00 4c 89 74 24 38 4d 8b 2e 49 83 e5 fc 49 8d 7d 08 48 89 f8 48 c1 e8 03 42 80 3c 20 00 74 05 e8 f1 00 09 00 49 8b 45 08 <41> 89 c6 41 83 e6 01 49 ff ce 49 09 c6 4d 21 ee 4c 89 f7 e8 05 f9
RSP: 0018:ffffc900036574e0 EFLAGS: 00000246
RAX: ffffea00012cd988 RBX: 0000000000000013 RCX: 0000000000000013
RDX: 0000000000000000 RSI: 0000000000000013 RDI: ffffea00012cd948
RBP: ffffc90003657770 R08: ffffea00012cd987 R09: 1ffffd4000259b30
R10: dffffc0000000000 R11: fffff94000259b31 R12: dffffc0000000000
R13: ffffea00012cd940 R14: ffff8880707590a8 R15: 1ffff1100e0eb215
 __tlb_batch_free_encoded_pages mm/mmu_gather.c:138 [inline]
 tlb_batch_pages_flush mm/mmu_gather.c:151 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:417 [inline]
 tlb_flush_mmu+0x6d3/0xa30 mm/mmu_gather.c:424
 tlb_finish_mmu+0xf4/0x220 mm/mmu_gather.c:549
 unmap_region+0x2a5/0x330 mm/vma.c:491
 vms_clear_ptes mm/vma.c:1303 [inline]
 vms_complete_munmap_vmas+0x427/0xbe0 mm/vma.c:1345
 do_vmi_align_munmap+0x3b7/0x4b0 mm/vma.c:1604
 do_vmi_munmap+0x252/0x2d0 mm/vma.c:1652
 __vm_munmap+0x241/0x3e0 mm/vma.c:3288
 __do_sys_munmap mm/mmap.c:1079 [inline]
 __se_sys_munmap mm/mmap.c:1076 [inline]
 __x64_sys_munmap+0x60/0x70 mm/mmap.c:1076
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd82bd1e097
Code: 73 01 c3 48 8b 0d 61 2d 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 0b 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 31 2d 0d 00 f7 d8 64 89 01 48
RSP: 002b:00007ffdbabbd4d8 EFLAGS: 00000246 ORIG_RAX: 000000000000000b
RAX: ffffffffffffffda RBX: 000055987b68dd50 RCX: 00007fd82bd1e097
RDX: 000055987b6776a8 RSI: 0000000000040000 RDI: 00007fd82bb7e000
RBP: 0000000000000019 R08: 000055987b66cce0 R09: 0000000000000003
R10: 0000000000000000 R11: 0000000000000246 R12: 000055987b67a0b0
R13: 00007fd82c45239c R14: 0000000000043000 R15: 0000000000000009
 </TASK>

Allocated by task 6900:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x32d/0x660 mm/slub.c:5515
 _kmalloc_noprof include/linux/slab.h:969 [inline]
 _kzalloc_noprof include/linux/slab.h:1290 [inline]
 llc_sap_alloc net/llc/llc_core.c:29 [inline]
 llc_sap_open+0xe1/0x3b0 net/llc/llc_core.c:96
 llc_ui_autobind+0x1f1/0x560 net/llc/af_llc.c:301
 llc_ui_connect+0x1d7/0xd50 net/llc/af_llc.c:498
 __sys_connect_file net/socket.c:2135 [inline]
 __sys_connect+0x323/0x460 net/socket.c:2154
 __do_sys_connect net/socket.c:2160 [inline]
 __se_sys_connect net/socket.c:2157 [inline]
 __x64_sys_connect+0x7a/0x90 net/socket.c:2157
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 5612:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2705 [inline]
 __rcu_free_sheaf_prepare+0x12d/0x2a0 mm/slub.c:2956
 rcu_free_sheaf+0x31/0x200 mm/slub.c:6004
 rcu_do_batch kernel/rcu/tree.c:2645 [inline]
 rcu_core+0x78b/0x10a0 kernel/rcu/tree.c:2897
 handle_softirqs+0x225/0x840 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0xca/0x220 kernel/softirq.c:735
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674

The buggy address belongs to the object at ffff88807a0dc000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 16 bytes inside of
 freed 2048-byte region [ffff88807a0dc000, ffff88807a0dc800)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88807a0de000 pfn:0x7a0d8
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000240 ffff88801b005000 ffffea0000972a10 ffffea0001eebc10
raw: ffff88807a0de000 0000000800080005 00000000f5000000 0000000000000000
head: 00fff00000000240 ffff88801b005000 ffffea0000972a10 ffffea0001eebc10
head: ffff88807a0de000 0000000800080005 00000000f5000000 0000000000000000
head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd28c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 60, tgid 60 (kworker/u8:5), ts 114494358735, free_ts 114203394340
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
 prep_new_page mm/page_alloc.c:1867 [inline]
 get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
 __alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
 alloc_slab_page mm/slub.c:3294 [inline]
 allocate_slab+0x79/0x5e0 mm/slub.c:3408
 new_slab mm/slub.c:3454 [inline]
 refill_objects+0x2d5/0x350 mm/slub.c:7338
 refill_sheaf mm/slub.c:2832 [inline]
 __pcs_replace_empty_main+0x2bf/0x6b0 mm/slub.c:4703
 alloc_from_pcs mm/slub.c:4801 [inline]
 slab_alloc_node mm/slub.c:4933 [inline]
 __do_kmalloc_node mm/slub.c:5361 [inline]
 __kmalloc_node_track_caller_noprof+0x557/0x730 mm/slub.c:5497
 kmalloc_reserve net/core/skbuff.c:637 [inline]
 pskb_expand_head+0x22c/0x13a0 net/core/skbuff.c:2306
 netlink_trim+0x1b3/0x2c0 net/netlink/af_netlink.c:1300
 netlink_broadcast_filtered+0x6d/0xea0 net/netlink/af_netlink.c:1518
 nlmsg_multicast_filtered include/net/netlink.h:1165 [inline]
 nlmsg_multicast include/net/netlink.h:1184 [inline]
 nlmsg_notify+0xe3/0x1a0 net/netlink/af_netlink.c:2599
 netif_state_change+0x297/0x3a0 net/core/dev.c:1605
 __linkwatch_run_queue+0x52a/0x800 net/core/link_watch.c:240
 linkwatch_event+0x4c/0x60 net/core/link_watch.c:314
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
page last free pid 5865 tgid 5865 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1406 [inline]
 __free_frozen_pages+0xc1e/0xd10 mm/page_alloc.c:2950
 __slab_free+0x274/0x2c0 mm/slub.c:5767
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4612 [inline]
 slab_alloc_node mm/slub.c:4945 [inline]
 kmem_cache_alloc_noprof+0x2a0/0x5f0 mm/slub.c:4959
 lsm_inode_alloc security/security.c:254 [inline]
 security_inode_alloc+0x39/0x310 security/security.c:1215
 inode_init_always_gfp+0x97e/0xd30 fs/inode.c:298
 inode_init_always include/linux/fs.h:2945 [inline]
 alloc_inode+0x82/0x1b0 fs/inode.c:345
 new_inode+0x1f/0x170 fs/inode.c:1174
 proc_pid_make_inode+0x21/0x130 fs/proc/base.c:1932
 proc_pident_instantiate+0x6d/0x2a0 fs/proc/base.c:2667
 proc_pident_lookup+0x1b7/0x270 fs/proc/base.c:2702
 lookup_open fs/namei.c:4481 [inline]
 open_last_lookups fs/namei.c:4608 [inline]
 path_openat+0x111f/0x3830 fs/namei.c:4860
 do_file_open+0x23e/0x4a0 fs/namei.c:4892
 do_sys_openat2+0x115/0x200 fs/open.c:1368

Memory state around the buggy address:
 ffff88807a0dbf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88807a0dbf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88807a0dc000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                         ^
 ffff88807a0dc080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88807a0dc100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess):
   0:	01 09                	add    %ecx,(%rcx)
   2:	00 4c 89 74          	add    %cl,0x74(%rcx,%rcx,4)
   6:	24 38                	and    $0x38,%al
   8:	4d 8b 2e             	mov    (%r14),%r13
   b:	49 83 e5 fc          	and    $0xfffffffffffffffc,%r13
   f:	49 8d 7d 08          	lea    0x8(%r13),%rdi
  13:	48 89 f8             	mov    %rdi,%rax
  16:	48 c1 e8 03          	shr    $0x3,%rax
  1a:	42 80 3c 20 00       	cmpb   $0x0,(%rax,%r12,1)
  1f:	74 05                	je     0x26
  21:	e8 f1 00 09 00       	call   0x90117
  26:	49 8b 45 08          	mov    0x8(%r13),%rax
* 2a:	41 89 c6             	mov    %eax,%r14d <-- trapping instruction
  2d:	41 83 e6 01          	and    $0x1,%r14d
  31:	49 ff ce             	dec    %r14
  34:	49 09 c6             	or     %rax,%r14
  37:	4d 21 ee             	and    %r13,%r14
  3a:	4c 89 f7             	mov    %r14,%rdi
  3d:	e8                   	.byte 0xe8
  3e:	05                   	.byte 0x5
  3f:	f9                   	stc