Warning: Permanently added '10.128.0.50' (ED25519) to the list of known hosts. executing program syzkaller login: [ 41.136726][ T4024] ================================================================== [ 41.138757][ T4024] BUG: KASAN: slab-out-of-bounds in hci_le_meta_evt+0xde8/0x31c0 [ 41.140888][ T4024] Read of size 1 at addr ffff0000d9b83e04 by task kworker/u5:2/4024 [ 41.143023][ T4024] [ 41.143581][ T4024] CPU: 0 PID: 4024 Comm: kworker/u5:2 Not tainted 5.15.178-syzkaller #0 [ 41.145491][ T4024] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 41.147878][ T4024] Workqueue: hci0 hci_rx_work [ 41.149136][ T4024] Call trace: [ 41.149930][ T4024] dump_backtrace+0x0/0x530 [ 41.150936][ T4024] show_stack+0x2c/0x3c [ 41.151977][ T4024] dump_stack_lvl+0x108/0x170 [ 41.153069][ T4024] print_address_description+0x7c/0x3f0 [ 41.154337][ T4024] kasan_report+0x174/0x1e4 [ 41.155368][ T4024] __asan_report_load1_noabort+0x44/0x50 [ 41.156778][ T4024] hci_le_meta_evt+0xde8/0x31c0 [ 41.157961][ T4024] hci_event_packet+0xd34/0x12b4 [ 41.159182][ T4024] hci_rx_work+0x1d0/0x830 [ 41.160380][ T4024] process_one_work+0x790/0x11b8 [ 41.161727][ T4024] worker_thread+0x910/0x1034 [ 41.162938][ T4024] kthread+0x37c/0x45c [ 41.163914][ T4024] ret_from_fork+0x10/0x20 [ 41.165055][ T4024] [ 41.165594][ T4024] Allocated by task 4021: [ 41.166692][ T4024] ____kasan_kmalloc+0xbc/0xfc [ 41.167935][ T4024] __kasan_kmalloc+0x10/0x1c [ 41.169133][ T4024] __kmalloc_node_track_caller+0x234/0x448 [ 41.170542][ T4024] kmalloc_reserve+0xe8/0x270 [ 41.171649][ T4024] __alloc_skb+0x1a4/0x584 [ 41.172702][ T4024] vhci_write+0xb8/0x3b8 [ 41.173671][ T4024] vfs_write+0x884/0xb44 [ 41.174723][ T4024] ksys_write+0x15c/0x26c [ 41.175962][ T4024] __arm64_sys_write+0x7c/0x90 [ 41.177204][ T4024] invoke_syscall+0x98/0x2b8 [ 41.178422][ T4024] el0_svc_common+0x138/0x258 [ 41.179625][ T4024] do_el0_svc+0x58/0x14c [ 41.180703][ T4024] el0_svc+0x7c/0x1f0 [ 41.181809][ T4024] el0t_64_sync_handler+0x84/0xe4 [ 41.183247][ T4024] el0t_64_sync+0x1a0/0x1a4 [ 41.184345][ T4024] [ 41.185030][ T4024] The buggy address belongs to the object at ffff0000d9b83c00 [ 41.185030][ T4024] which belongs to the cache kmalloc-512 of size 512 [ 41.188999][ T4024] The buggy address is located 4 bytes to the right of [ 41.188999][ T4024] 512-byte region [ffff0000d9b83c00, ffff0000d9b83e00) [ 41.192364][ T4024] The buggy address belongs to the page: [ 41.193715][ T4024] page:000000004d775608 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x119b80 [ 41.196320][ T4024] head:000000004d775608 order:2 compound_mapcount:0 compound_pincount:0 [ 41.198516][ T4024] flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 41.200652][ T4024] raw: 05ffc00000010200 fffffc0003294100 0000000400000004 ffff0000c0002600 [ 41.203074][ T4024] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 41.205144][ T4024] page dumped because: kasan: bad access detected [ 41.206792][ T4024] [ 41.207402][ T4024] Memory state around the buggy address: [ 41.208858][ T4024] ffff0000d9b83d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 41.211105][ T4024] ffff0000d9b83d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 41.213313][ T4024] >ffff0000d9b83e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 41.215602][ T4024] ^ [ 41.216705][ T4024] ffff0000d9b83e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 41.218885][ T4024] ffff0000d9b83f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 41.221078][ T4024] ================================================================== [ 41.223014][ T4024] Disabling lock debugging due to kernel taint [ 41.225245][ T4024] Bluetooth: hci0: Unknown advertising packet type: 0x3500 [ 41.225273][ T4024] Bluetooth: hci0: Unknown advertising packet type: 0x3600 [ 41.227005][ T4024] Bluetooth: hci0: Unknown advertising packet type: 0x3500 [ 41.228627][ T4024] Bluetooth: hci0: Unknown advertising packet type: 0x3600 [ 41.230444][ T4024] Bluetooth: hci0: Unknown advertising packet type: 0x3500 [ 41.232503][ T4024] Bluetooth: hci0: Unknown advertising packet type: 0x3600 [ 41.234231][ T4024] Bluetooth: hci0: Unknown advertising packet type: 0x3500 [ 41.235927][ T4024] Bluetooth: hci0: Unknown advertising packet type: 0x3600 [ 41.237799][ T4024] Bluetooth: hci0: Unknown advertising packet type: 0x3500