Warning: Permanently added '10.128.0.130' (ECDSA) to the list of known hosts. [ 42.805557][ T4055] Bluetooth: hci0: Unknown advertising packet type: 0x6678 [ 42.805633][ T4055] ================================================================== [ 42.809329][ T4055] BUG: KASAN: slab-out-of-bounds in hci_le_meta_evt+0xe70/0x2f38 [ 42.811181][ T4055] Read of size 1 at addr ffff0000ceba740a by task kworker/u5:1/4055 [ 42.812983][ T4055] [ 42.813545][ T4055] CPU: 0 PID: 4055 Comm: kworker/u5:1 Not tainted 5.15.101-syzkaller #0 executing program [ 42.815512][ T4055] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023 [ 42.817860][ T4055] Workqueue: hci0 hci_rx_work [ 42.818952][ T4055] Call trace: [ 42.819793][ T4055] dump_backtrace+0x0/0x530 [ 42.820884][ T4055] show_stack+0x2c/0x3c [ 42.821868][ T4055] dump_stack_lvl+0x108/0x170 [ 42.823056][ T4055] print_address_description+0x7c/0x3f0 [ 42.824379][ T4055] kasan_report+0x174/0x1e4 [ 42.825457][ T4055] __asan_report_load1_noabort+0x44/0x50 [ 42.826802][ T4055] hci_le_meta_evt+0xe70/0x2f38 [ 42.827994][ T4055] hci_event_packet+0xe04/0x1258 [ 42.829189][ T4055] hci_rx_work+0x1d0/0x6d0 [ 42.830339][ T4055] process_one_work+0x84c/0x14b8 [ 42.831615][ T4055] worker_thread+0x910/0x1034 [ 42.832736][ T4055] kthread+0x37c/0x45c [ 42.833744][ T4055] ret_from_fork+0x10/0x20 [ 42.834752][ T4055] [ 42.835315][ T4055] Allocated by task 4053: [ 42.836404][ T4055] ____kasan_kmalloc+0xbc/0xfc [ 42.837589][ T4055] __kasan_kmalloc+0x10/0x1c [ 42.838743][ T4055] __kmalloc_node_track_caller+0x20c/0x384 [ 42.840161][ T4055] kmalloc_reserve+0xe8/0x270 [ 42.841261][ T4055] __alloc_skb+0x1a4/0x584 [ 42.842345][ T4055] vhci_write+0xb8/0x3b8 [ 42.843392][ T4055] vfs_write+0x87c/0xb3c [ 42.844427][ T4055] ksys_write+0x15c/0x26c [ 42.845465][ T4055] __arm64_sys_write+0x7c/0x90 [ 42.846633][ T4055] invoke_syscall+0x98/0x2b8 [ 42.847782][ T4055] el0_svc_common+0x138/0x258 [ 42.848896][ T4055] do_el0_svc+0x58/0x14c [ 42.849999][ T4055] el0_svc+0x7c/0x1f0 [ 42.850955][ T4055] el0t_64_sync_handler+0x84/0xe4 [ 42.852175][ T4055] el0t_64_sync+0x1a0/0x1a4 [ 42.853331][ T4055] [ 42.853902][ T4055] The buggy address belongs to the object at ffff0000ceba7000 [ 42.853902][ T4055] which belongs to the cache kmalloc-1k of size 1024 [ 42.857400][ T4055] The buggy address is located 10 bytes to the right of [ 42.857400][ T4055] 1024-byte region [ffff0000ceba7000, ffff0000ceba7400) [ 42.860911][ T4055] The buggy address belongs to the page: [ 42.862220][ T4055] page:00000000065839b5 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10eba0 [ 42.864750][ T4055] head:00000000065839b5 order:3 compound_mapcount:0 compound_pincount:0 [ 42.866867][ T4055] flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 42.868884][ T4055] raw: 05ffc00000010200 0000000000000000 dead000000000122 ffff0000c0002780 [ 42.871063][ T4055] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 42.873273][ T4055] page dumped because: kasan: bad access detected [ 42.874874][ T4055] [ 42.875437][ T4055] Memory state around the buggy address: [ 42.876752][ T4055] ffff0000ceba7300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 42.878793][ T4055] ffff0000ceba7380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 42.880782][ T4055] >ffff0000ceba7400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 42.882707][ T4055] ^ [ 42.883740][ T4055] ffff0000ceba7480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 42.885728][ T4055] ffff0000ceba7500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 42.887706][ T4055] ================================================================== [ 42.889684][ T4055] Disabling lock debugging due to kernel taint