Warning: Permanently added '10.128.0.129' (ECDSA) to the list of known hosts. [ 40.717126][ T6791] IPVS: ftp: loaded support on port[0] = 21 executing program [ 41.853593][ T6791] ================================================================== [ 41.861817][ T6791] BUG: KASAN: use-after-free in hci_chan_del+0x33/0x130 [ 41.868866][ T6791] Read of size 8 at addr ffff888091c47c18 by task syz-executor802/6791 [ 41.877072][ T6791] [ 41.879379][ T6791] CPU: 0 PID: 6791 Comm: syz-executor802 Not tainted 5.8.0-rc7-syzkaller #0 [ 41.888034][ T6791] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 41.898088][ T6791] Call Trace: [ 41.901366][ T6791] dump_stack+0x1f0/0x31e [ 41.905671][ T6791] print_address_description+0x66/0x5a0 [ 41.911255][ T6791] ? printk+0x62/0x83 [ 41.915275][ T6791] ? vprintk_emit+0x339/0x3c0 [ 41.919941][ T6791] kasan_report+0x132/0x1d0 [ 41.924432][ T6791] ? hci_chan_del+0x33/0x130 [ 41.928997][ T6791] hci_chan_del+0x33/0x130 [ 41.933388][ T6791] l2cap_conn_del+0x4c2/0x650 [ 41.938041][ T6791] ? l2cap_connect_cfm+0x12b0/0x12b0 [ 41.943294][ T6791] hci_conn_hash_flush+0x127/0x200 [ 41.948378][ T6791] hci_dev_do_close+0xb7b/0x1040 [ 41.953288][ T6791] ? hci_unregister_dev+0x159/0x1590 [ 41.958593][ T6791] hci_unregister_dev+0x16d/0x1590 [ 41.963678][ T6791] ? vhci_open+0x290/0x290 [ 41.968080][ T6791] vhci_release+0x73/0xc0 [ 41.972380][ T6791] __fput+0x2f0/0x750 [ 41.976336][ T6791] task_work_run+0x137/0x1c0 [ 41.980994][ T6791] do_exit+0x601/0x1f80 [ 41.985119][ T6791] ? call_rcu+0x509/0x840 [ 41.989423][ T6791] do_group_exit+0x161/0x2d0 [ 41.993988][ T6791] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 42.000034][ T6791] __do_sys_exit_group+0x13/0x20 [ 42.004939][ T6791] __se_sys_exit_group+0x10/0x10 [ 42.009847][ T6791] __x64_sys_exit_group+0x37/0x40 [ 42.014856][ T6791] do_syscall_64+0x73/0xe0 [ 42.019341][ T6791] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 42.025204][ T6791] RIP: 0033:0x445038 [ 42.029076][ T6791] Code: Bad RIP value. [ 42.033111][ T6791] RSP: 002b:00007fff926a8a78 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 42.041506][ T6791] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000445038 [ 42.049449][ T6791] RDX: 0000000000000001 RSI: 000000000000003c RDI: 0000000000000001 [ 42.057390][ T6791] RBP: 00000000004cce10 R08: 00000000000000e7 R09: ffffffffffffffd0 [ 42.065333][ T6791] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 42.073291][ T6791] R13: 00000000006e0200 R14: 0000000000000000 R15: 0000000000000000 [ 42.081240][ T6791] [ 42.083538][ T6791] Allocated by task 6818: [ 42.087856][ T6791] __kasan_kmalloc+0x103/0x140 [ 42.092590][ T6791] kmem_cache_alloc_trace+0x234/0x300 [ 42.098038][ T6791] hci_chan_create+0x9a/0x270 [ 42.102697][ T6791] l2cap_conn_add+0x66/0xb00 [ 42.107273][ T6791] l2cap_connect_cfm+0xdb/0x12b0 [ 42.112179][ T6791] le_conn_complete_evt+0x88d/0x1380 [ 42.117433][ T6791] hci_event_packet+0x784a/0x18260 [ 42.122512][ T6791] hci_rx_work+0x236/0x9c0 [ 42.126898][ T6791] process_one_work+0x789/0xfc0 [ 42.131717][ T6791] worker_thread+0xaa4/0x1460 [ 42.136362][ T6791] kthread+0x37e/0x3a0 [ 42.140402][ T6791] ret_from_fork+0x1f/0x30 [ 42.144782][ T6791] [ 42.147088][ T6791] Freed by task 6818: [ 42.151039][ T6791] __kasan_slab_free+0x114/0x170 [ 42.155941][ T6791] kfree+0x10a/0x220 [ 42.159805][ T6791] hci_event_packet+0x304e/0x18260 [ 42.164988][ T6791] hci_rx_work+0x236/0x9c0 [ 42.169390][ T6791] process_one_work+0x789/0xfc0 [ 42.174208][ T6791] worker_thread+0xaa4/0x1460 [ 42.178851][ T6791] kthread+0x37e/0x3a0 [ 42.182900][ T6791] ret_from_fork+0x1f/0x30 [ 42.187279][ T6791] [ 42.189754][ T6791] The buggy address belongs to the object at ffff888091c47c00 [ 42.189754][ T6791] which belongs to the cache kmalloc-128 of size 128 [ 42.203777][ T6791] The buggy address is located 24 bytes inside of [ 42.203777][ T6791] 128-byte region [ffff888091c47c00, ffff888091c47c80) [ 42.216928][ T6791] The buggy address belongs to the page: [ 42.222534][ T6791] page:ffffea00024711c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888091c47700 [ 42.232921][ T6791] flags: 0xfffe0000000200(slab) [ 42.237756][ T6791] raw: 00fffe0000000200 ffffea00027c6a88 ffffea00024a2548 ffff8880aa400700 [ 42.246310][ T6791] raw: ffff888091c47700 ffff888091c47000 0000000100000005 0000000000000000 [ 42.255036][ T6791] page dumped because: kasan: bad access detected [ 42.261427][ T6791] [ 42.263724][ T6791] Memory state around the buggy address: [ 42.269323][ T6791] ffff888091c47b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 42.277352][ T6791] ffff888091c47b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 42.285382][ T6791] >ffff888091c47c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 42.293410][ T6791] ^ [ 42.298226][ T6791] ffff888091c47c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 42.306314][ T6791] ffff888091c47d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 42.314364][ T6791] ================================================================== [ 42.322606][ T6791] Disabling lock debugging due to kernel taint [ 42.355625][ T6791] Kernel panic - not syncing: panic_on_warn set ... [ 42.362228][ T6791] CPU: 0 PID: 6791 Comm: syz-executor802 Tainted: G B 5.8.0-rc7-syzkaller #0 [ 42.372253][ T6791] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 42.382278][ T6791] Call Trace: [ 42.385555][ T6791] dump_stack+0x1f0/0x31e [ 42.389855][ T6791] panic+0x264/0x7a0 [ 42.393978][ T6791] ? trace_hardirqs_on+0x30/0x80 [ 42.398886][ T6791] kasan_report+0x1c9/0x1d0 [ 42.403358][ T6791] ? hci_chan_del+0x33/0x130 [ 42.407914][ T6791] hci_chan_del+0x33/0x130 [ 42.412299][ T6791] l2cap_conn_del+0x4c2/0x650 [ 42.416952][ T6791] ? l2cap_connect_cfm+0x12b0/0x12b0 [ 42.422205][ T6791] hci_conn_hash_flush+0x127/0x200 [ 42.427285][ T6791] hci_dev_do_close+0xb7b/0x1040 [ 42.432193][ T6791] ? hci_unregister_dev+0x159/0x1590 [ 42.437463][ T6791] hci_unregister_dev+0x16d/0x1590 [ 42.442543][ T6791] ? vhci_open+0x290/0x290 [ 42.446924][ T6791] vhci_release+0x73/0xc0 [ 42.451270][ T6791] __fput+0x2f0/0x750 [ 42.455227][ T6791] task_work_run+0x137/0x1c0 [ 42.459785][ T6791] do_exit+0x601/0x1f80 [ 42.463925][ T6791] ? call_rcu+0x509/0x840 [ 42.468222][ T6791] do_group_exit+0x161/0x2d0 [ 42.472875][ T6791] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 42.478919][ T6791] __do_sys_exit_group+0x13/0x20 [ 42.483824][ T6791] __se_sys_exit_group+0x10/0x10 [ 42.488742][ T6791] __x64_sys_exit_group+0x37/0x40 [ 42.493746][ T6791] do_syscall_64+0x73/0xe0 [ 42.498133][ T6791] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 42.503992][ T6791] RIP: 0033:0x445038 [ 42.507874][ T6791] Code: Bad RIP value. [ 42.511907][ T6791] RSP: 002b:00007fff926a8a78 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 42.520282][ T6791] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000445038 [ 42.528223][ T6791] RDX: 0000000000000001 RSI: 000000000000003c RDI: 0000000000000001 [ 42.536163][ T6791] RBP: 00000000004cce10 R08: 00000000000000e7 R09: ffffffffffffffd0 [ 42.544124][ T6791] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 42.552064][ T6791] R13: 00000000006e0200 R14: 0000000000000000 R15: 0000000000000000 [ 42.561348][ T6791] Kernel Offset: disabled [ 42.565668][ T6791] Rebooting in 86400 seconds..