Warning: Permanently added '10.128.1.91' (ED25519) to the list of known hosts. executing program [ 44.690116][ T144] BUG: sleeping function called from invalid context at net/core/sock.c:3252 [ 44.692998][ T144] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 144, name: kworker/u5:0 [ 44.695396][ T144] 6 locks held by kworker/u5:0/144: executing program [ 44.696786][ T144] #0: ffff0000c8c58938 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_one_work+0x66c/0x11b8 [ 44.699546][ T144] #1: ffff80001a3e7c00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6ac/0x11b8 [ 44.703014][ T144] #2: ffff0000c89ec078 (&hdev->lock){+.+.}-{3:3}, at: hci_sync_conn_complete_evt+0xb4/0x8c0 [ 44.705749][ T144] #3: ffff800016b8af68 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_sync_conn_complete_evt+0x404/0x8c0 executing program [ 44.708632][ T144] #4: ffff0000c0ff3c20 (&conn->lock#2){+.+.}-{2:2}, at: sco_connect_cfm+0x260/0x908 [ 44.711264][ T144] #5: ffff0000c9219120 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at: sco_connect_cfm+0x3e8/0x908 [ 44.714355][ T144] Preemption disabled at: [ 44.714368][ T144] [] sco_connect_cfm+0x260/0x908 [ 44.717176][ T144] CPU: 0 PID: 144 Comm: kworker/u5:0 Not tainted 5.15.163-syzkaller #0 [ 44.719374][ T144] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 44.722114][ T144] Workqueue: hci0 hci_rx_work [ 44.723396][ T144] Call trace: [ 44.724261][ T144] dump_backtrace+0x0/0x530 [ 44.725468][ T144] show_stack+0x2c/0x3c [ 44.726580][ T144] dump_stack_lvl+0x108/0x170 [ 44.727994][ T144] dump_stack+0x1c/0x58 [ 44.729100][ T144] ___might_sleep+0x380/0x4dc [ 44.730359][ T144] __might_sleep+0x98/0xf0 executing program executing program [ 44.731544][ T144] lock_sock_nested+0x100/0x1ec [ 44.732843][ T144] sco_connect_cfm+0x3e8/0x908 [ 44.734154][ T144] hci_sync_conn_complete_evt+0x468/0x8c0 [ 44.735691][ T144] hci_event_packet+0x8e0/0x12b4 [ 44.737040][ T144] hci_rx_work+0x1c0/0x7c4 [ 44.738215][ T144] process_one_work+0x790/0x11b8 [ 44.739568][ T144] worker_thread+0x910/0x1034 [ 44.740811][ T144] kthread+0x37c/0x45c [ 44.741900][ T144] ret_from_fork+0x10/0x20 [ 44.743163][ T144] ================================================================== [ 44.745269][ T144] BUG: KASAN: use-after-free in __lock_acquire+0x114/0x7638 [ 44.747282][ T144] Read of size 8 at addr ffff0000c92190a0 by task kworker/u5:0/144 [ 44.749443][ T144] executing program [ 44.750046][ T144] CPU: 0 PID: 144 Comm: kworker/u5:0 Tainted: G W 5.15.163-syzkaller #0 [ 44.752604][ T144] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 44.755398][ T144] Workqueue: hci0 hci_rx_work [ 44.756679][ T144] Call trace: [ 44.757549][ T144] dump_backtrace+0x0/0x530 [ 44.758759][ T144] show_stack+0x2c/0x3c [ 44.759870][ T144] dump_stack_lvl+0x108/0x170 [ 44.761102][ T144] print_address_description+0x7c/0x3f0 [ 44.762570][ T144] kasan_report+0x174/0x1e4 [ 44.763761][ T144] __asan_report_load8_noabort+0x44/0x50 [ 44.765236][ T144] __lock_acquire+0x114/0x7638 [ 44.766526][ T144] lock_acquire+0x240/0x77c [ 44.767709][ T144] _raw_spin_lock_bh+0x124/0x1c4 [ 44.769076][ T144] lock_sock_nested+0x108/0x1ec [ 44.770422][ T144] sco_connect_cfm+0x3e8/0x908 [ 44.771714][ T144] hci_sync_conn_complete_evt+0x468/0x8c0 [ 44.773236][ T144] hci_event_packet+0x8e0/0x12b4 [ 44.774593][ T144] hci_rx_work+0x1c0/0x7c4 [ 44.775766][ T144] process_one_work+0x790/0x11b8 [ 44.777106][ T144] worker_thread+0x910/0x1034 [ 44.778351][ T144] kthread+0x37c/0x45c [ 44.779391][ T144] ret_from_fork+0x10/0x20 [ 44.780566][ T144] [ 44.781202][ T144] Allocated by task 3973: [ 44.782372][ T144] ____kasan_kmalloc+0xbc/0xfc [ 44.783666][ T144] __kasan_kmalloc+0x10/0x1c [ 44.784907][ T144] __kmalloc+0x29c/0x4c8 [ 44.786041][ T144] sk_prot_alloc+0xc4/0x1f0 [ 44.787239][ T144] sk_alloc+0x40/0x3e0 [ 44.788340][ T144] sco_sock_create+0xb8/0x2d4 [ 44.789578][ T144] bt_sock_create+0x14c/0x248 [ 44.790814][ T144] __sock_create+0x43c/0x884 [ 44.792021][ T144] __sys_socket+0x168/0x310 [ 44.793210][ T144] __arm64_sys_socket+0x7c/0x94 [ 44.794503][ T144] invoke_syscall+0x98/0x2b8 [ 44.795746][ T144] el0_svc_common+0x138/0x258 [ 44.796990][ T144] do_el0_svc+0x58/0x14c [ 44.798190][ T144] el0_svc+0x7c/0x1f0 [ 44.799254][ T144] el0t_64_sync_handler+0x84/0xe4 [ 44.800582][ T144] el0t_64_sync+0x1a0/0x1a4 [ 44.801763][ T144] [ 44.802359][ T144] Freed by task 3973: [ 44.803405][ T144] kasan_set_track+0x4c/0x84 [ 44.804582][ T144] kasan_set_free_info+0x28/0x4c [ 44.805890][ T144] ____kasan_slab_free+0x118/0x164 [ 44.807283][ T144] __kasan_slab_free+0x18/0x28 [ 44.808564][ T144] slab_free_freelist_hook+0x128/0x1ec [ 44.810005][ T144] kfree+0x178/0x410 [ 44.811038][ T144] __sk_destruct+0x418/0x600 [ 44.812261][ T144] __sk_free+0x37c/0x4e8 [ 44.813394][ T144] sk_free+0x68/0xdc [ 44.814470][ T144] sco_sock_kill+0x104/0x1c8 [ 44.815718][ T144] sco_sock_release+0x1fc/0x2c0 [ 44.816992][ T144] sock_close+0xb8/0x1fc [ 44.818112][ T144] __fput+0x1c4/0x800 [ 44.819225][ T144] ____fput+0x20/0x30 [ 44.820254][ T144] task_work_run+0x130/0x1e4 [ 44.821495][ T144] do_notify_resume+0x262c/0x32b8 [ 44.822847][ T144] el0_svc+0xfc/0x1f0 [ 44.823937][ T144] el0t_64_sync_handler+0x84/0xe4 [ 44.825285][ T144] el0t_64_sync+0x1a0/0x1a4 [ 44.826508][ T144] [ 44.827118][ T144] The buggy address belongs to the object at ffff0000c9219000 [ 44.827118][ T144] which belongs to the cache kmalloc-2k of size 2048 [ 44.830915][ T144] The buggy address is located 160 bytes inside of [ 44.830915][ T144] 2048-byte region [ffff0000c9219000, ffff0000c9219800) [ 44.834474][ T144] The buggy address belongs to the page: [ 44.835991][ T144] page:00000000ecec829d refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109218 [ 44.838732][ T144] head:00000000ecec829d order:3 compound_mapcount:0 compound_pincount:0 [ 44.840965][ T144] flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 44.843180][ T144] raw: 05ffc00000010200 0000000000000000 dead000000000122 ffff0000c0002900 [ 44.845451][ T144] raw: 0000000000000000 0000000080080008 00000001ffffffff 0000000000000000 [ 44.847766][ T144] page dumped because: kasan: bad access detected [ 44.849530][ T144] [ 44.850133][ T144] Memory state around the buggy address: [ 44.851646][ T144] ffff0000c9218f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.853814][ T144] ffff0000c9219000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 44.856019][ T144] >ffff0000c9219080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 44.858182][ T144] ^ [ 44.859544][ T144] ffff0000c9219100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 44.861729][ T144] ffff0000c9219180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 44.863920][ T144] ================================================================== [ 44.866102][ T144] Disabling lock debugging due to kernel taint [ 44.867840][ T144] Unable to handle kernel paging request at virtual address dfff800000000000 [ 44.870168][ T144] Mem abort info: [ 44.871155][ T144] ESR = 0x0000000096000006 [ 44.872363][ T144] EC = 0x25: DABT (current EL), IL = 32 bits [ 44.873951][ T144] SET = 0, FnV = 0 [ 44.874993][ T144] EA = 0, S1PTW = 0 [ 44.876049][ T144] FSC = 0x06: level 2 translation fault [ 44.877526][ T144] Data abort info: [ 44.878529][ T144] ISV = 0, ISS = 0x00000006 [ 44.879717][ T144] CM = 0, WnR = 0 [ 44.880748][ T144] [dfff800000000000] address between user and kernel address ranges [ 44.882789][ T144] Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP [ 44.884614][ T144] Modules linked in: [ 44.885622][ T144] CPU: 0 PID: 144 Comm: kworker/u5:0 Tainted: G B W 5.15.163-syzkaller #0 [ 44.888189][ T144] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 44.890816][ T144] Workqueue: hci0 hci_rx_work [ 44.892088][ T144] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 44.894178][ T144] pc : apparmor_sk_clone_security+0xf0/0x3d8 [ 44.895935][ T144] lr : apparmor_sk_clone_security+0xd0/0x3d8 [ 44.897654][ T144] sp : ffff80001a3e7730 [ 44.898818][ T144] x29: ffff80001a3e7730 x28: dfff800000000000 x27: 1ffff0000347cefc [ 44.901060][ T144] x26: ffff0000c921a3aa x25: ffff0000c9219530 x24: 1fffe0001aac87a0 [ 44.903338][ T144] x23: dfff800000000000 x22: dfff800000000000 x21: 0000000000000000 [ 44.905605][ T144] x20: 0000000000000000 x19: ffff0000d5643d00 x18: 0000000000000204 [ 44.907820][ T144] x17: ffff800010d8081c x16: ffff8000088cd8b4 x15: ffff80000fd64278 [ 44.910113][ T144] x14: ffff80000a5cac84 x13: ffff80000802b56c x12: 0000000000000001 [ 44.912341][ T144] x11: 0000000000000001 x10: 0000000000000000 x9 : ffff0000c2c13680 [ 44.914671][ T144] x8 : 0000000000000000 x7 : ffffffffffffffff x6 : ffff800010c744a8 [ 44.916890][ T144] x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff80000a645ac8 [ 44.919150][ T144] x2 : 0000000000000000 x1 : 0000000000000008 x0 : 0000000000000000 [ 44.921336][ T144] Call trace: [ 44.922197][ T144] apparmor_sk_clone_security+0xf0/0x3d8 [ 44.923845][ T144] security_sk_clone+0x58/0x9c [ 44.925174][ T144] sco_connect_cfm+0x58c/0x908 [ 44.926484][ T144] hci_sync_conn_complete_evt+0x468/0x8c0 [ 44.928108][ T144] hci_event_packet+0x8e0/0x12b4 [ 44.929526][ T144] hci_rx_work+0x1c0/0x7c4 [ 44.930781][ T144] process_one_work+0x790/0x11b8 [ 44.932130][ T144] worker_thread+0x910/0x1034 [ 44.933475][ T144] kthread+0x37c/0x45c [ 44.934633][ T144] ret_from_fork+0x10/0x20 [ 44.935876][ T144] Code: 710006df 540010ab 9779f740 d343fe88 (38776908) [ 44.937749][ T144] ---[ end trace 8fbecba04ebb2580 ]--- [ 45.250654][ T144] Kernel panic - not syncing: Oops: Fatal exception [ 45.252616][ T144] SMP: stopping secondary CPUs [ 45.253980][ T144] Kernel Offset: disabled [ 45.255146][ T144] CPU features: 0x0,000081c1,21302e40 [ 45.256699][ T144] Memory Limit: none [ 45.551609][ T144] Rebooting in 86400 seconds..