[ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Starting Load/Save RF Kill Switch Status... [ OK ] Started Update UTMP about System Runlevel Changes. [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.1.53' (ECDSA) to the list of known hosts. syzkaller login: [ 56.025074][ T6826] IPVS: ftp: loaded support on port[0] = 21 executing program [ 57.172359][ T6850] Bluetooth: Wrong link type (-22) [ 57.178605][ T6848] ================================================================== [ 57.186796][ T6848] BUG: KASAN: use-after-free in hci_chan_del+0x14f/0x190 [ 57.193844][ T6848] Read of size 8 at addr ffff88809de67218 by task syz-executor284/6848 [ 57.202080][ T6848] [ 57.204435][ T6848] CPU: 1 PID: 6848 Comm: syz-executor284 Not tainted 5.8.0-syzkaller #0 [ 57.212780][ T6848] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 57.222946][ T6848] Call Trace: [ 57.226338][ T6848] dump_stack+0x18f/0x20d [ 57.230675][ T6848] ? hci_chan_del+0x14f/0x190 [ 57.235353][ T6848] ? hci_chan_del+0x14f/0x190 [ 57.240039][ T6848] print_address_description.constprop.0.cold+0xae/0x436 [ 57.247136][ T6848] ? mutex_lock_io_nested+0xf60/0xf60 [ 57.252489][ T6848] ? vprintk_func+0x97/0x1a6 [ 57.257056][ T6848] ? hci_chan_del+0x14f/0x190 [ 57.261730][ T6848] kasan_report.cold+0x1f/0x37 [ 57.266474][ T6848] ? hci_chan_del+0x14f/0x190 [ 57.271124][ T6848] hci_chan_del+0x14f/0x190 [ 57.275607][ T6848] l2cap_conn_del+0x61b/0x9e0 [ 57.280262][ T6848] ? l2cap_conn_del+0x9e0/0x9e0 [ 57.285085][ T6848] l2cap_disconn_cfm+0x85/0xa0 [ 57.289825][ T6848] hci_conn_hash_flush+0x114/0x220 [ 57.294918][ T6848] ? vhci_close_dev+0x50/0x50 [ 57.299569][ T6848] hci_dev_do_close+0x5c6/0x1080 [ 57.304484][ T6848] ? hci_dev_open+0x350/0x350 [ 57.309150][ T6848] ? do_raw_read_unlock+0x70/0x70 [ 57.314165][ T6848] ? try_to_grab_pending.part.0+0x7d0/0x7d0 [ 57.320038][ T6848] ? vhci_close_dev+0x50/0x50 [ 57.324691][ T6848] hci_unregister_dev+0x1bd/0xe30 [ 57.329694][ T6848] ? fcntl_setlk+0xf60/0xf60 [ 57.334261][ T6848] ? lock_is_held_type+0xbb/0xf0 [ 57.339179][ T6848] ? vhci_close_dev+0x50/0x50 [ 57.343844][ T6848] vhci_release+0x70/0xe0 [ 57.348163][ T6848] __fput+0x33c/0x880 [ 57.352126][ T6848] task_work_run+0xdd/0x190 [ 57.356605][ T6848] do_exit+0xb7d/0x29f0 [ 57.360754][ T6848] ? swapin_walk_pmd_entry+0x7b0/0x7b0 [ 57.366209][ T6848] ? mm_update_next_owner+0x7a0/0x7a0 [ 57.371572][ T6848] ? lock_is_held_type+0xbb/0xf0 [ 57.376498][ T6848] ? syscall_enter_from_user_mode+0x20/0x290 [ 57.382509][ T6848] ? lockdep_hardirqs_on_prepare+0x354/0x530 [ 57.388477][ T6848] ? trace_hardirqs_on+0x5f/0x220 [ 57.393532][ T6848] __x64_sys_exit+0x3e/0x50 [ 57.398046][ T6848] do_syscall_64+0x2d/0x70 [ 57.402501][ T6848] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 57.408402][ T6848] RIP: 0033:0x402bfe [ 57.412294][ T6848] Code: Bad RIP value. [ 57.416359][ T6848] RSP: 002b:00007f759d1e6de0 EFLAGS: 00000246 ORIG_RAX: 000000000000003c [ 57.424763][ T6848] RAX: ffffffffffffffda RBX: 00007f759d1e7700 RCX: 0000000000402bfe [ 57.432711][ T6848] RDX: 000000000000003c RSI: 00000000007fb000 RDI: 0000000000000000 [ 57.440681][ T6848] RBP: 0000000000000000 R08: 00000000000000f1 R09: 00007f759d1e7700 [ 57.448630][ T6848] R10: 00007f759d1e79d0 R11: 0000000000000246 R12: 0000000000000000 [ 57.456623][ T6848] R13: 00007ffd84c5b06f R14: 00007f759d1e79c0 R15: 0000000000000001 [ 57.464579][ T6848] [ 57.466905][ T6848] Allocated by task 6850: [ 57.471235][ T6848] save_stack+0x1b/0x40 [ 57.475373][ T6848] __kasan_kmalloc.constprop.0+0xc2/0xd0 [ 57.480983][ T6848] kmem_cache_alloc_trace+0x14f/0x2d0 [ 57.486331][ T6848] hci_chan_create+0x9b/0x330 [ 57.491034][ T6848] l2cap_conn_add.part.0+0x1e/0xe10 [ 57.496224][ T6848] l2cap_connect_cfm+0x23b/0x1090 [ 57.501229][ T6848] le_conn_complete_evt+0x1153/0x1740 [ 57.506577][ T6848] hci_le_meta_evt+0x745/0x3ff0 [ 57.511404][ T6848] hci_event_packet+0x2e25/0x87a8 [ 57.516407][ T6848] hci_rx_work+0x22e/0xb50 [ 57.520799][ T6848] process_one_work+0x94c/0x1670 [ 57.525721][ T6848] worker_thread+0x64c/0x1120 [ 57.530373][ T6848] kthread+0x3b5/0x4a0 [ 57.534426][ T6848] ret_from_fork+0x1f/0x30 [ 57.538826][ T6848] [ 57.541137][ T6848] Freed by task 6850: [ 57.545098][ T6848] save_stack+0x1b/0x40 [ 57.549228][ T6848] __kasan_slab_free+0xf5/0x140 [ 57.554162][ T6848] kfree+0x103/0x2c0 [ 57.558068][ T6848] hci_event_packet+0x3e33/0x87a8 [ 57.563080][ T6848] hci_rx_work+0x22e/0xb50 [ 57.567475][ T6848] process_one_work+0x94c/0x1670 [ 57.572393][ T6848] worker_thread+0x64c/0x1120 [ 57.577046][ T6848] kthread+0x3b5/0x4a0 [ 57.581090][ T6848] ret_from_fork+0x1f/0x30 [ 57.585487][ T6848] [ 57.587799][ T6848] The buggy address belongs to the object at ffff88809de67200 [ 57.587799][ T6848] which belongs to the cache kmalloc-128 of size 128 [ 57.601843][ T6848] The buggy address is located 24 bytes inside of [ 57.601843][ T6848] 128-byte region [ffff88809de67200, ffff88809de67280) [ 57.615003][ T6848] The buggy address belongs to the page: [ 57.620637][ T6848] page:ffffea00027799c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88809de67900 [ 57.631045][ T6848] flags: 0xfffe0000000200(slab) [ 57.635874][ T6848] raw: 00fffe0000000200 ffffea000273ff48 ffffea0002795848 ffff8880aa000700 [ 57.644696][ T6848] raw: ffff88809de67900 ffff88809de67000 0000000100000006 0000000000000000 [ 57.653254][ T6848] page dumped because: kasan: bad access detected [ 57.659635][ T6848] [ 57.661940][ T6848] Memory state around the buggy address: [ 57.667569][ T6848] ffff88809de67100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 57.675615][ T6848] ffff88809de67180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 57.683652][ T6848] >ffff88809de67200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 57.691698][ T6848] ^ [ 57.696522][ T6848] ffff88809de67280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 57.704559][ T6848] ffff88809de67300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 57.712590][ T6848] ================================================================== [ 57.720620][ T6848] Disabling lock debugging due to kernel taint [ 57.727369][ T6848] Kernel panic - not syncing: panic_on_warn set ... [ 57.733961][ T6848] CPU: 1 PID: 6848 Comm: syz-executor284 Tainted: G B 5.8.0-syzkaller #0 [ 57.743661][ T6848] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 57.753707][ T6848] Call Trace: [ 57.756992][ T6848] dump_stack+0x18f/0x20d [ 57.761308][ T6848] ? hci_chan_del+0x140/0x190 [ 57.765976][ T6848] panic+0x2e3/0x75c [ 57.769857][ T6848] ? __warn_printk+0xf3/0xf3 [ 57.774436][ T6848] ? preempt_schedule_common+0x59/0xc0 [ 57.779868][ T6848] ? hci_chan_del+0x14f/0x190 [ 57.784534][ T6848] ? preempt_schedule_thunk+0x16/0x18 [ 57.789887][ T6848] ? trace_hardirqs_on+0x55/0x220 [ 57.794895][ T6848] ? hci_chan_del+0x14f/0x190 [ 57.799542][ T6848] ? hci_chan_del+0x14f/0x190 [ 57.804204][ T6848] end_report+0x4d/0x53 [ 57.808330][ T6848] kasan_report.cold+0xd/0x37 [ 57.812980][ T6848] ? hci_chan_del+0x14f/0x190 [ 57.817626][ T6848] hci_chan_del+0x14f/0x190 [ 57.822112][ T6848] l2cap_conn_del+0x61b/0x9e0 [ 57.826765][ T6848] ? l2cap_conn_del+0x9e0/0x9e0 [ 57.831603][ T6848] l2cap_disconn_cfm+0x85/0xa0 [ 57.836351][ T6848] hci_conn_hash_flush+0x114/0x220 [ 57.841434][ T6848] ? vhci_close_dev+0x50/0x50 [ 57.846082][ T6848] hci_dev_do_close+0x5c6/0x1080 [ 57.850990][ T6848] ? hci_dev_open+0x350/0x350 [ 57.855642][ T6848] ? do_raw_read_unlock+0x70/0x70 [ 57.860639][ T6848] ? try_to_grab_pending.part.0+0x7d0/0x7d0 [ 57.866509][ T6848] ? vhci_close_dev+0x50/0x50 [ 57.871156][ T6848] hci_unregister_dev+0x1bd/0xe30 [ 57.876153][ T6848] ? fcntl_setlk+0xf60/0xf60 [ 57.880715][ T6848] ? lock_is_held_type+0xbb/0xf0 [ 57.885630][ T6848] ? vhci_close_dev+0x50/0x50 [ 57.890276][ T6848] vhci_release+0x70/0xe0 [ 57.894583][ T6848] __fput+0x33c/0x880 [ 57.898550][ T6848] task_work_run+0xdd/0x190 [ 57.903028][ T6848] do_exit+0xb7d/0x29f0 [ 57.907157][ T6848] ? swapin_walk_pmd_entry+0x7b0/0x7b0 [ 57.912605][ T6848] ? mm_update_next_owner+0x7a0/0x7a0 [ 57.917950][ T6848] ? lock_is_held_type+0xbb/0xf0 [ 57.922875][ T6848] ? syscall_enter_from_user_mode+0x20/0x290 [ 57.928827][ T6848] ? lockdep_hardirqs_on_prepare+0x354/0x530 [ 57.934789][ T6848] ? trace_hardirqs_on+0x5f/0x220 [ 57.939800][ T6848] __x64_sys_exit+0x3e/0x50 [ 57.944283][ T6848] do_syscall_64+0x2d/0x70 [ 57.948674][ T6848] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 57.954558][ T6848] RIP: 0033:0x402bfe [ 57.958442][ T6848] Code: Bad RIP value. [ 57.962485][ T6848] RSP: 002b:00007f759d1e6de0 EFLAGS: 00000246 ORIG_RAX: 000000000000003c [ 57.970870][ T6848] RAX: ffffffffffffffda RBX: 00007f759d1e7700 RCX: 0000000000402bfe [ 57.978816][ T6848] RDX: 000000000000003c RSI: 00000000007fb000 RDI: 0000000000000000 [ 57.986767][ T6848] RBP: 0000000000000000 R08: 00000000000000f1 R09: 00007f759d1e7700 [ 57.994714][ T6848] R10: 00007f759d1e79d0 R11: 0000000000000246 R12: 0000000000000000 [ 58.002664][ T6848] R13: 00007ffd84c5b06f R14: 00007f759d1e79c0 R15: 0000000000000001 [ 58.011689][ T6848] Kernel Offset: disabled [ 58.016004][ T6848] Rebooting in 86400 seconds..