[ OK ] Listening on Load/Save RF Kill Switch Status /dev/rfkill Watch. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Starting Load/Save RF Kill Switch Status... Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.15.193' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 58.374951][ T6828] IPVS: ftp: loaded support on port[0] = 21 [ 58.437169][ T6828] ================================================================== [ 58.445568][ T6828] BUG: KASAN: use-after-free in hci_chan_del+0x14f/0x190 [ 58.452622][ T6828] Read of size 8 at addr ffff8880a1d3df18 by task syz-executor865/6828 [ 58.460827][ T6828] [ 58.463137][ T6828] CPU: 0 PID: 6828 Comm: syz-executor865 Not tainted 5.8.0-syzkaller #0 [ 58.471429][ T6828] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 58.481460][ T6828] Call Trace: [ 58.484732][ T6828] dump_stack+0x18f/0x20d [ 58.489040][ T6828] ? hci_chan_del+0x14f/0x190 [ 58.493713][ T6828] ? hci_chan_del+0x14f/0x190 [ 58.498367][ T6828] print_address_description.constprop.0.cold+0xae/0x497 [ 58.505387][ T6828] ? mutex_lock_io_nested+0xf60/0xf60 [ 58.510738][ T6828] ? vprintk_func+0x97/0x1a6 [ 58.515304][ T6828] ? hci_chan_del+0x14f/0x190 [ 58.519954][ T6828] ? hci_chan_del+0x14f/0x190 [ 58.524638][ T6828] kasan_report.cold+0x1f/0x37 [ 58.529395][ T6828] ? hci_chan_del+0x14f/0x190 [ 58.534052][ T6828] hci_chan_del+0x14f/0x190 [ 58.538533][ T6828] l2cap_conn_del+0x61b/0x9e0 [ 58.543190][ T6828] ? l2cap_conn_del+0x9e0/0x9e0 [ 58.548015][ T6828] l2cap_disconn_cfm+0x85/0xa0 [ 58.552754][ T6828] hci_conn_hash_flush+0x114/0x220 [ 58.557938][ T6828] hci_dev_do_close+0x5c6/0x1080 [ 58.562855][ T6828] ? hci_dev_open+0x350/0x350 [ 58.567506][ T6828] ? do_raw_read_unlock+0x70/0x70 [ 58.572505][ T6828] ? try_to_grab_pending.part.0+0x7d0/0x7d0 [ 58.578377][ T6828] hci_unregister_dev+0x1bd/0xe30 [ 58.583378][ T6828] ? fcntl_setlk+0xf60/0xf60 [ 58.587943][ T6828] ? lock_is_held_type+0xbb/0xf0 [ 58.592958][ T6828] vhci_release+0x70/0xe0 [ 58.597306][ T6828] __fput+0x285/0x920 [ 58.601264][ T6828] ? vhci_close_dev+0x50/0x50 [ 58.605918][ T6828] task_work_run+0xdd/0x190 [ 58.610397][ T6828] do_exit+0xb7d/0x29f0 [ 58.614534][ T6828] ? mm_update_next_owner+0x7a0/0x7a0 [ 58.619913][ T6828] ? vmacache_update+0xce/0x140 [ 58.624744][ T6828] ? lock_is_held_type+0xbb/0xf0 [ 58.629747][ T6828] do_group_exit+0x125/0x310 [ 58.634317][ T6828] __ia32_sys_exit_group+0x3a/0x50 [ 58.639403][ T6828] __do_fast_syscall_32+0x57/0x80 [ 58.644489][ T6828] do_fast_syscall_32+0x2f/0x70 [ 58.649330][ T6828] entry_SYSENTER_compat_after_hwframe+0x4d/0x5c [ 58.655644][ T6828] RIP: 0023:0xf7f73569 [ 58.659697][ T6828] Code: Bad RIP value. [ 58.663735][ T6828] RSP: 002b:00000000ffd51a1c EFLAGS: 00000292 ORIG_RAX: 00000000000000fc [ 58.672132][ T6828] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00000000080fd318 [ 58.680079][ T6828] RDX: 0000000000000000 RSI: 00000000080e32a0 RDI: 00000000080fd320 [ 58.688041][ T6828] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 58.695993][ T6828] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 58.703938][ T6828] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 58.711892][ T6828] [ 58.714196][ T6828] Allocated by task 1546: [ 58.718503][ T6828] kasan_save_stack+0x1b/0x40 [ 58.723153][ T6828] __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 58.728763][ T6828] kmem_cache_alloc_trace+0x16e/0x2c0 [ 58.734110][ T6828] hci_chan_create+0x9b/0x330 [ 58.738761][ T6828] l2cap_conn_add.part.0+0x1e/0xe10 [ 58.743946][ T6828] l2cap_connect_cfm+0x23b/0x1090 [ 58.748942][ T6828] le_conn_complete_evt+0x1153/0x1740 [ 58.754297][ T6828] hci_le_meta_evt+0x745/0x3ff0 [ 58.759135][ T6828] hci_event_packet+0x2e25/0x87a8 [ 58.764132][ T6828] hci_rx_work+0x22e/0xb50 [ 58.768525][ T6828] process_one_work+0x94c/0x1670 [ 58.773434][ T6828] worker_thread+0x64c/0x1120 [ 58.778082][ T6828] kthread+0x3b5/0x4a0 [ 58.782120][ T6828] ret_from_fork+0x1f/0x30 [ 58.786510][ T6828] [ 58.788832][ T6828] Freed by task 6834: [ 58.792788][ T6828] kasan_save_stack+0x1b/0x40 [ 58.797435][ T6828] kasan_set_track+0x1c/0x30 [ 58.801996][ T6828] kasan_set_free_info+0x1b/0x30 [ 58.806906][ T6828] __kasan_slab_free+0xd8/0x120 [ 58.811726][ T6828] kfree+0x103/0x2c0 [ 58.815615][ T6828] hci_event_packet+0x3e33/0x87a8 [ 58.820611][ T6828] hci_rx_work+0x22e/0xb50 [ 58.825001][ T6828] process_one_work+0x94c/0x1670 [ 58.829910][ T6828] worker_thread+0x64c/0x1120 [ 58.834565][ T6828] kthread+0x3b5/0x4a0 [ 58.838608][ T6828] ret_from_fork+0x1f/0x30 [ 58.842991][ T6828] [ 58.845296][ T6828] The buggy address belongs to the object at ffff8880a1d3df00 [ 58.845296][ T6828] which belongs to the cache kmalloc-128 of size 128 [ 58.859841][ T6828] The buggy address is located 24 bytes inside of [ 58.859841][ T6828] 128-byte region [ffff8880a1d3df00, ffff8880a1d3df80) [ 58.872994][ T6828] The buggy address belongs to the page: [ 58.878606][ T6828] page:00000000c9da0632 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880a1d3d200 pfn:0xa1d3d [ 58.890025][ T6828] flags: 0xfffe0000000200(slab) [ 58.894853][ T6828] raw: 00fffe0000000200 ffffea0002a29688 ffffea0002698cc8 ffff8880aa040400 [ 58.903429][ T6828] raw: ffff8880a1d3d200 ffff8880a1d3d000 0000000100000006 0000000000000000 [ 58.911983][ T6828] page dumped because: kasan: bad access detected [ 58.918361][ T6828] [ 58.920661][ T6828] Memory state around the buggy address: [ 58.926265][ T6828] ffff8880a1d3de00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 58.934300][ T6828] ffff8880a1d3de80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 58.942334][ T6828] >ffff8880a1d3df00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 58.950363][ T6828] ^ [ 58.955183][ T6828] ffff8880a1d3df80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 58.963217][ T6828] ffff8880a1d3e000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 58.971246][ T6828] ================================================================== [ 58.979277][ T6828] Disabling lock debugging due to kernel taint [ 58.985935][ T6828] Kernel panic - not syncing: panic_on_warn set ... [ 58.992526][ T6828] CPU: 0 PID: 6828 Comm: syz-executor865 Tainted: G B 5.8.0-syzkaller #0 [ 59.002227][ T6828] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 59.012274][ T6828] Call Trace: [ 59.015560][ T6828] dump_stack+0x18f/0x20d [ 59.019873][ T6828] ? hci_chan_del+0x80/0x190 [ 59.024435][ T6828] panic+0x2e3/0x75c [ 59.028302][ T6828] ? __warn_printk+0xf3/0xf3 [ 59.032865][ T6828] ? preempt_schedule_common+0x59/0xc0 [ 59.038291][ T6828] ? hci_chan_del+0x14f/0x190 [ 59.042940][ T6828] ? preempt_schedule_thunk+0x16/0x18 [ 59.048299][ T6828] ? trace_hardirqs_on+0x55/0x220 [ 59.053294][ T6828] ? hci_chan_del+0x14f/0x190 [ 59.057945][ T6828] ? hci_chan_del+0x14f/0x190 [ 59.062594][ T6828] end_report+0x4d/0x53 [ 59.066721][ T6828] kasan_report.cold+0xd/0x37 [ 59.071373][ T6828] ? hci_chan_del+0x14f/0x190 [ 59.076130][ T6828] hci_chan_del+0x14f/0x190 [ 59.080608][ T6828] l2cap_conn_del+0x61b/0x9e0 [ 59.085275][ T6828] ? l2cap_conn_del+0x9e0/0x9e0 [ 59.090096][ T6828] l2cap_disconn_cfm+0x85/0xa0 [ 59.094832][ T6828] hci_conn_hash_flush+0x114/0x220 [ 59.099914][ T6828] hci_dev_do_close+0x5c6/0x1080 [ 59.104841][ T6828] ? hci_dev_open+0x350/0x350 [ 59.109557][ T6828] ? do_raw_read_unlock+0x70/0x70 [ 59.114587][ T6828] ? try_to_grab_pending.part.0+0x7d0/0x7d0 [ 59.120462][ T6828] hci_unregister_dev+0x1bd/0xe30 [ 59.125466][ T6828] ? fcntl_setlk+0xf60/0xf60 [ 59.130031][ T6828] ? lock_is_held_type+0xbb/0xf0 [ 59.134942][ T6828] vhci_release+0x70/0xe0 [ 59.139246][ T6828] __fput+0x285/0x920 [ 59.143203][ T6828] ? vhci_close_dev+0x50/0x50 [ 59.147867][ T6828] task_work_run+0xdd/0x190 [ 59.152344][ T6828] do_exit+0xb7d/0x29f0 [ 59.156471][ T6828] ? mm_update_next_owner+0x7a0/0x7a0 [ 59.161825][ T6828] ? vmacache_update+0xce/0x140 [ 59.166651][ T6828] ? lock_is_held_type+0xbb/0xf0 [ 59.171558][ T6828] do_group_exit+0x125/0x310 [ 59.176119][ T6828] __ia32_sys_exit_group+0x3a/0x50 [ 59.181237][ T6828] __do_fast_syscall_32+0x57/0x80 [ 59.186232][ T6828] do_fast_syscall_32+0x2f/0x70 [ 59.191054][ T6828] entry_SYSENTER_compat_after_hwframe+0x4d/0x5c [ 59.197351][ T6828] RIP: 0023:0xf7f73569 [ 59.201386][ T6828] Code: Bad RIP value. [ 59.205433][ T6828] RSP: 002b:00000000ffd51a1c EFLAGS: 00000292 ORIG_RAX: 00000000000000fc [ 59.213824][ T6828] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00000000080fd318 [ 59.221858][ T6828] RDX: 0000000000000000 RSI: 00000000080e32a0 RDI: 00000000080fd320 [ 59.229845][ T6828] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 59.237793][ T6828] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 59.245740][ T6828] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 59.254980][ T6828] Kernel Offset: disabled [ 59.259344][ T6828] Rebooting in 86400 seconds..