================================================================== BUG: KASAN: out-of-bounds in __mutex_waiter_is_first kernel/locking/mutex.c:199 [inline] BUG: KASAN: out-of-bounds in __mutex_lock_common kernel/locking/mutex.c:694 [inline] BUG: KASAN: out-of-bounds in __mutex_lock+0x812/0x1300 kernel/locking/mutex.c:776 Read of size 8 at addr ffff8880203480a8 by task khidpd_16bf5505/10303 CPU: 0 UID: 0 PID: 10303 Comm: khidpd_16bf5505 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xba/0x230 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 __mutex_waiter_is_first kernel/locking/mutex.c:199 [inline] __mutex_lock_common kernel/locking/mutex.c:694 [inline] __mutex_lock+0x812/0x1300 kernel/locking/mutex.c:776 l2cap_unregister_user+0x6a/0x1b0 net/bluetooth/l2cap_core.c:1729 hidp_session_thread+0x3cb/0x440 net/bluetooth/hidp/core.c:1304 kthread+0x726/0x8b0 kernel/kthread.c:463 ret_from_fork+0x51b/0xa40 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888020349d40 pfn:0x20348 head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f8(unknown) raw: 00fff00000000040 0000000000000000 dead000000000122 0000000000000000 raw: ffff888020349d40 0000000000000000 00000000f8000000 0000000000000000 head: 00fff00000000040 0000000000000000 dead000000000122 0000000000000000 head: ffff888020349d40 0000000000000000 00000000f8000000 0000000000000000 head: 00fff00000000002 ffffea000080d201 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0x40dc0(GFP_KERNEL|__GFP_ZERO|__GFP_COMP), pid 14716, tgid 14716 (syz-executor), ts 253749229919, free_ts 253744987725 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x228/0x280 mm/page_alloc.c:1884 prep_new_page mm/page_alloc.c:1892 [inline] get_page_from_freelist+0x24dc/0x2580 mm/page_alloc.c:3945 __alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5240 alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2486 ___kmalloc_large_node+0x4e/0x150 mm/slub.c:5598 __kmalloc_large_node_noprof+0x18/0x90 mm/slub.c:5629 __do_kmalloc_node mm/slub.c:5645 [inline] __kmalloc_noprof+0x4b8/0x7e0 mm/slub.c:5669 kmalloc_noprof include/linux/slab.h:961 [inline] kmalloc_array_noprof include/linux/slab.h:1003 [inline] alloc_port_table_group drivers/infiniband/core/sysfs.c:1097 [inline] setup_gid_attrs drivers/infiniband/core/sysfs.c:1143 [inline] ib_setup_port_attrs+0xfb2/0x2140 drivers/infiniband/core/sysfs.c:1439 add_one_compat_dev+0x448/0x650 drivers/infiniband/core/device.c:1005 rdma_dev_init_net+0x243/0x2f0 drivers/infiniband/core/device.c:1221 ops_init+0x35c/0x5c0 net/core/net_namespace.c:137 setup_net+0x118/0x340 net/core/net_namespace.c:446 copy_net_ns+0x50e/0x730 net/core/net_namespace.c:581 create_new_namespaces+0x3e7/0x6a0 kernel/nsproxy.c:130 unshare_nsproxy_namespaces+0x11a/0x160 kernel/nsproxy.c:226 ksys_unshare+0x4f4/0x900 kernel/fork.c:3171 page last free pid 5841 tgid 5841 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1433 [inline] __free_frozen_pages+0xbf8/0xd70 mm/page_alloc.c:2973 bt_host_release+0x82/0x90 net/bluetooth/hci_sysfs.c:87 device_release+0x9e/0x1d0 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x228/0x560 lib/kobject.c:737 vhci_release+0x15a/0x1a0 drivers/bluetooth/hci_vhci.c:691 __fput+0x44f/0xa70 fs/file_table.c:468 task_work_run+0x1d9/0x270 kernel/task_work.c:233 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x69b/0x2310 kernel/exit.c:971 do_group_exit+0x21b/0x2d0 kernel/exit.c:1112 get_signal+0x1284/0x1330 kernel/signal.c:3034 arch_do_signal_or_restart+0xbc/0x830 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:41 [inline] exit_to_user_mode_loop+0x86/0x480 kernel/entry/common.c:75 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline] do_syscall_64+0x2b7/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff888020347f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888020348000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff888020348080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ^ ffff888020348100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888020348180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================