================================================================== BUG: KASAN: slab-out-of-bounds in memcpy include/linux/string.h:380 [inline] BUG: KASAN: slab-out-of-bounds in bacpy+0x23/0x30 include/net/bluetooth/bluetooth.h:236 Read of size 6 at addr ffff88809b62d208 by task kworker/u5:1/9213 CPU: 1 PID: 9213 Comm: kworker/u5:1 Not tainted 5.5.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: hci0 hci_rx_work Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x197/0x210 lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374 __kasan_report.cold+0x1b/0x41 mm/kasan/report.c:506 kasan_report+0x12/0x20 mm/kasan/common.c:639 check_memory_region_inline mm/kasan/generic.c:185 [inline] check_memory_region+0x134/0x1a0 mm/kasan/generic.c:192 memcpy+0x24/0x50 mm/kasan/common.c:125 memcpy include/linux/string.h:380 [inline] bacpy+0x23/0x30 include/net/bluetooth/bluetooth.h:236 hci_extended_inquiry_result_evt net/bluetooth/hci_event.c:4281 [inline] hci_event_packet+0x506d/0xa8fb net/bluetooth/hci_event.c:5959 hci_rx_work+0x4b7/0xb20 net/bluetooth/hci_core.c:4491 process_one_work+0x9af/0x1740 kernel/workqueue.c:2264 worker_thread+0x98/0xe40 kernel/workqueue.c:2410 kthread+0x361/0x430 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Allocated by task 9238: save_stack+0x23/0x90 mm/kasan/common.c:72 set_track mm/kasan/common.c:80 [inline] __kasan_kmalloc mm/kasan/common.c:513 [inline] __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:486 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:527 __do_kmalloc_node mm/slab.c:3616 [inline] __kmalloc_node_track_caller+0x4e/0x70 mm/slab.c:3630 __kmalloc_reserve.isra.0+0x40/0xf0 net/core/skbuff.c:141 __alloc_skb+0x10b/0x5e0 net/core/skbuff.c:209 alloc_skb include/linux/skbuff.h:1049 [inline] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline] vhci_get_user drivers/bluetooth/hci_vhci.c:165 [inline] vhci_write+0xc4/0x470 drivers/bluetooth/hci_vhci.c:284 call_write_iter include/linux/fs.h:1902 [inline] new_sync_write+0x4d3/0x770 fs/read_write.c:483 __vfs_write+0xe1/0x110 fs/read_write.c:496 vfs_write+0x268/0x5d0 fs/read_write.c:558 ksys_write+0x14f/0x290 fs/read_write.c:611 __do_sys_write fs/read_write.c:623 [inline] __se_sys_write fs/read_write.c:620 [inline] __ia32_sys_write+0x71/0xb0 fs/read_write.c:620 do_syscall_32_irqs_on arch/x86/entry/common.c:337 [inline] do_fast_syscall_32+0x27b/0xe16 arch/x86/entry/common.c:408 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139 Freed by task 8967: save_stack+0x23/0x90 mm/kasan/common.c:72 set_track mm/kasan/common.c:80 [inline] kasan_set_free_info mm/kasan/common.c:335 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/common.c:474 kasan_slab_free+0xe/0x10 mm/kasan/common.c:483 __cache_free mm/slab.c:3426 [inline] kfree+0x10a/0x2c0 mm/slab.c:3757 tomoyo_find_next_domain+0x76a/0x1f6c security/tomoyo/domain.c:885 tomoyo_bprm_check_security security/tomoyo/tomoyo.c:107 [inline] tomoyo_bprm_check_security+0x124/0x1a0 security/tomoyo/tomoyo.c:97 security_bprm_check+0x63/0xb0 security/security.c:784 search_binary_handler+0x71/0x570 fs/exec.c:1645 exec_binprm fs/exec.c:1701 [inline] __do_execve_file.isra.0+0x1329/0x22b0 fs/exec.c:1821 do_execveat_common fs/exec.c:1867 [inline] do_execve fs/exec.c:1884 [inline] __do_sys_execve fs/exec.c:1960 [inline] __se_sys_execve fs/exec.c:1955 [inline] __x64_sys_execve+0x8f/0xc0 fs/exec.c:1955 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff88809b62d000 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 8 bytes to the right of 512-byte region [ffff88809b62d000, ffff88809b62d200) The buggy address belongs to the page: page:ffffea00026d8b40 refcount:1 mapcount:0 mapping:ffff8880aa400a80 index:0x0 raw: 00fffe0000000200 ffffea00025fcb08 ffffea00026f67c8 ffff8880aa400a80 raw: 0000000000000000 ffff88809b62d000 0000000100000004 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88809b62d100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88809b62d180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff88809b62d200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff88809b62d280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88809b62d300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================