==================================================================
BUG: KASAN: slab-use-after-free in l2cap_conn_ready net/bluetooth/l2cap_core.c:1639 [inline]
BUG: KASAN: slab-use-after-free in l2cap_connect_cfm+0x570/0xb94 net/bluetooth/l2cap_core.c:7427
Read of size 8 at addr ffff0000f19f0480 by task kworker/u9:7/4680

CPU: 1 UID: 0 PID: 4680 Comm: kworker/u9:7 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Workqueue: hci0 hci_rx_work
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 print_address_description+0xb0/0x238 mm/kasan/report.c:378
 print_report+0x68/0x84 mm/kasan/report.c:482
 kasan_report+0x8c/0xc4 mm/kasan/report.c:595
 __asan_report_load8_noabort+0x20/0x2c mm/kasan/report_generic.c:381
 l2cap_conn_ready net/bluetooth/l2cap_core.c:1639 [inline]
 l2cap_connect_cfm+0x570/0xb94 net/bluetooth/l2cap_core.c:7427
 hci_connect_cfm+0x98/0x134 include/net/bluetooth/hci_core.h:2139
 le_conn_complete_evt+0xc78/0x109c net/bluetooth/hci_event.c:5865
 hci_le_conn_complete_evt+0x114/0x40c net/bluetooth/hci_event.c:5891
 hci_le_meta_evt+0x2d4/0x49c net/bluetooth/hci_event.c:7506
 hci_event_func net/bluetooth/hci_event.c:7770 [inline]
 hci_event_packet+0x4e4/0xa00 net/bluetooth/hci_event.c:7824
 hci_rx_work+0x2fc/0xd1c net/bluetooth/hci_core.c:4077
 process_one_work+0x78c/0x173c kernel/workqueue.c:3302
 process_scheduled_works+0xdc/0x13c kernel/workqueue.c:3385
 worker_thread+0x770/0xbd0 kernel/workqueue.c:3466
 kthread+0x2f0/0x3c0 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:842

Allocated by task 4680:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x40/0x78 mm/kasan/common.c:78
 kasan_save_alloc_info+0x44/0x54 mm/kasan/generic.c:570
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x9c/0xb4 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x284/0x56c mm/slub.c:5415
 kmalloc_noprof include/linux/slab.h:950 [inline]
 kzalloc_noprof include/linux/slab.h:1188 [inline]
 l2cap_chan_create+0x58/0x6b4 net/bluetooth/l2cap_core.c:445
 l2cap_sock_alloc+0xd4/0x168 net/bluetooth/l2cap_sock.c:1934
 l2cap_sock_new_connection_cb+0xdc/0x1fc net/bluetooth/l2cap_sock.c:1510
 l2cap_connect_cfm+0x2d8/0xb94 net/bluetooth/l2cap_core.c:7410
 hci_connect_cfm+0x98/0x134 include/net/bluetooth/hci_core.h:2139
 le_conn_complete_evt+0xc78/0x109c net/bluetooth/hci_event.c:5865
 hci_le_conn_complete_evt+0x114/0x40c net/bluetooth/hci_event.c:5891
 hci_le_meta_evt+0x2d4/0x49c net/bluetooth/hci_event.c:7506
 hci_event_func net/bluetooth/hci_event.c:7770 [inline]
 hci_event_packet+0x4e4/0xa00 net/bluetooth/hci_event.c:7824
 hci_rx_work+0x2fc/0xd1c net/bluetooth/hci_core.c:4077
 process_one_work+0x78c/0x173c kernel/workqueue.c:3302
 process_scheduled_works+0xdc/0x13c kernel/workqueue.c:3385
 worker_thread+0x770/0xbd0 kernel/workqueue.c:3466
 kthread+0x2f0/0x3c0 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:842

Freed by task 8425:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x40/0x78 mm/kasan/common.c:78
 kasan_save_free_info+0x58/0x70 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x74/0xa4 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2689 [inline]
 slab_free mm/slub.c:6246 [inline]
 kfree+0x188/0x5e4 mm/slub.c:6561
 l2cap_chan_destroy net/bluetooth/l2cap_core.c:491 [inline]
 kref_put include/linux/kref.h:65 [inline]
 l2cap_chan_put+0x16c/0x280 net/bluetooth/l2cap_core.c:516
 l2cap_sock_cleanup_listen+0x104/0x2d0 net/bluetooth/l2cap_sock.c:1493
 l2cap_sock_release+0x68/0x1f8 net/bluetooth/l2cap_sock.c:1451
 __sock_release+0xa0/0x1d4 net/socket.c:722
 sock_close+0x24/0x38 net/socket.c:1514
 __fput+0x340/0x744 fs/file_table.c:510
 ____fput+0x20/0x30 fs/file_table.c:538
 task_work_run+0x1c4/0x254 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
 exit_to_user_mode_loop+0x10c/0x17c kernel/entry/common.c:98
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 exit_to_user_mode_prepare_legacy include/linux/irq-entry-common.h:224 [inline]
 arm64_exit_to_user_mode arch/arm64/kernel/entry-common.c:86 [inline]
 el0_svc+0x180/0x25c arch/arm64/kernel/entry-common.c:724
 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:742
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594

The buggy address belongs to the object at ffff0000f19f0000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 1152 bytes inside of
 freed 2048-byte region [ffff0000f19f0000, ffff0000f19f0800)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1319f0
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 05ffc00000000040 ffff0000c0002000 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
head: 05ffc00000000040 ffff0000c0002000 dead000000000100 dead000000000122
head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
head: 05ffc00000000003 fffffdffc3c67c01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000f19f0380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff0000f19f0400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff0000f19f0480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff0000f19f0500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff0000f19f0580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Unable to handle kernel paging request at virtual address fbd51fffffffff91
KASAN: maybe wild-memory-access in range [0xdeacfffffffffc88-0xdeacfffffffffc8f]
Mem abort info:
  ESR = 0x0000000096000004
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x04: level 0 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[fbd51fffffffff91] address between user and kernel address ranges
Internal error: Oops: 0000000096000004 [#1]  SMP
Modules linked in:
CPU: 1 UID: 0 PID: 4680 Comm: kworker/u9:7 Tainted: G    B               syzkaller #0 PREEMPT 
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Workqueue: hci0 hci_rx_work
pstate: 03400005 (nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : raw_atomic_read include/linux/atomic/atomic-arch-fallback.h:457 [inline]
pc : atomic_read include/linux/atomic/atomic-instrumented.h:33 [inline]
pc : l2cap_chan_lock include/net/bluetooth/l2cap.h:829 [inline]
pc : l2cap_conn_ready net/bluetooth/l2cap_core.c:1641 [inline]
pc : l2cap_connect_cfm+0x508/0xb94 net/bluetooth/l2cap_core.c:7427
lr : instrument_atomic_read include/linux/instrumented.h:82 [inline]
lr : atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
lr : l2cap_chan_lock include/net/bluetooth/l2cap.h:829 [inline]
lr : l2cap_conn_ready net/bluetooth/l2cap_core.c:1641 [inline]
lr : l2cap_connect_cfm+0x4fc/0xb94 net/bluetooth/l2cap_core.c:7427
sp : ffff800099ca75e0
x29: ffff800099ca7660 x28: dfff800000000000 x27: 1fffe0001e42f500
x26: 1fffe0001e42f503 x25: 0000000000000080 x24: deacfffffffffc8c
x23: ffff0000f217a81a x22: dead000000000100 x21: ffff0000f217aa88
x20: ffff0000fc67003d x19: 1fffe0001f8ce007 x18: 1fffe00035c25820
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: fffffffffffffff8 x9 : 0000000000000007
x8 : 1bd59fffffffff91 x7 : 0000000000000000 x6 : ffff8000804886d0
x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000020
x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000001
Call trace:
 raw_atomic_read include/linux/atomic/atomic-arch-fallback.h:457 [inline] (P)
 atomic_read include/linux/atomic/atomic-instrumented.h:33 [inline] (P)
 l2cap_chan_lock include/net/bluetooth/l2cap.h:829 [inline] (P)
 l2cap_conn_ready net/bluetooth/l2cap_core.c:1641 [inline] (P)
 l2cap_connect_cfm+0x508/0xb94 net/bluetooth/l2cap_core.c:7427 (P)
 hci_connect_cfm+0x98/0x134 include/net/bluetooth/hci_core.h:2139
 le_conn_complete_evt+0xc78/0x109c net/bluetooth/hci_event.c:5865
 hci_le_conn_complete_evt+0x114/0x40c net/bluetooth/hci_event.c:5891
 hci_le_meta_evt+0x2d4/0x49c net/bluetooth/hci_event.c:7506
 hci_event_func net/bluetooth/hci_event.c:7770 [inline]
 hci_event_packet+0x4e4/0xa00 net/bluetooth/hci_event.c:7824
 hci_rx_work+0x2fc/0xd1c net/bluetooth/hci_core.c:4077
 process_one_work+0x78c/0x173c kernel/workqueue.c:3302
 process_scheduled_works+0xdc/0x13c kernel/workqueue.c:3385
 worker_thread+0x770/0xbd0 kernel/workqueue.c:3466
 kthread+0x2f0/0x3c0 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:842
Code: 96c4c1be d343ff08 12000b09 11000d29 (38fc6908) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	96c4c1be 	bl	0xfffffffffb1306f8
   4:	d343ff08 	lsr	x8, x24, #3
   8:	12000b09 	and	w9, w24, #0x7
   c:	11000d29 	add	w9, w9, #0x3
* 10:	38fc6908 	ldrsb	w8, [x8, x28] <-- trapping instruction