================================================================== BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline] BUG: KASAN: slab-use-after-free in atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:252 [inline] BUG: KASAN: slab-use-after-free in __refcount_add include/linux/refcount.h:184 [inline] BUG: KASAN: slab-use-after-free in __refcount_inc include/linux/refcount.h:241 [inline] BUG: KASAN: slab-use-after-free in refcount_inc include/linux/refcount.h:258 [inline] BUG: KASAN: slab-use-after-free in sock_hold include/net/sock.h:774 [inline] BUG: KASAN: slab-use-after-free in sco_sock_timeout+0x67/0x240 net/bluetooth/sco.c:88 Write of size 4 at addr ffff888021a35080 by task kworker/1:0/24 CPU: 1 PID: 24 Comm: kworker/1:0 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 Workqueue: events sco_sock_timeout Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 instrument_atomic_read_write include/linux/instrumented.h:96 [inline] atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:252 [inline] __refcount_add include/linux/refcount.h:184 [inline] __refcount_inc include/linux/refcount.h:241 [inline] refcount_inc include/linux/refcount.h:258 [inline] sock_hold include/net/sock.h:774 [inline] sco_sock_timeout+0x67/0x240 net/bluetooth/sco.c:88 process_one_work kernel/workqueue.c:3254 [inline] process_scheduled_works+0xa02/0x1770 kernel/workqueue.c:3335 worker_thread+0x86d/0xd70 kernel/workqueue.c:3416 kthread+0x2f2/0x390 kernel/kthread.c:388 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 Allocated by task 4512: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:370 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387 kasan_kmalloc include/linux/kasan.h:211 [inline] kmalloc_trace+0x1db/0x360 mm/slub.c:3997 kmalloc include/linux/slab.h:628 [inline] syslog_print+0x121/0x9c0 kernel/printk/printk.c:1556 do_syslog+0x3bb/0x810 kernel/printk/printk.c:1734 __do_sys_syslog kernel/printk/printk.c:1826 [inline] __se_sys_syslog kernel/printk/printk.c:1824 [inline] __x64_sys_syslog+0x7c/0x90 kernel/printk/printk.c:1824 do_syscall_64+0xfd/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 Freed by task 4512: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object+0xa6/0xe0 mm/kasan/common.c:240 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2106 [inline] slab_free mm/slub.c:4280 [inline] kfree+0x14a/0x380 mm/slub.c:4390 syslog_print+0x91d/0x9c0 kernel/printk/printk.c:1648 do_syslog+0x3bb/0x810 kernel/printk/printk.c:1734 __do_sys_syslog kernel/printk/printk.c:1826 [inline] __se_sys_syslog kernel/printk/printk.c:1824 [inline] __x64_sys_syslog+0x7c/0x90 kernel/printk/printk.c:1824 do_syscall_64+0xfd/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 The buggy address belongs to the object at ffff888021a35000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 128 bytes inside of freed 2048-byte region [ffff888021a35000, ffff888021a35800) The buggy address belongs to the physical page: page:ffffea0000868c00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888021a35000 pfn:0x21a30 head:ffffea0000868c00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000a40(workingset|slab|head|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000000a40 ffff888014c42000 ffffea000078be10 ffffea00007dcc10 raw: ffff888021a35000 0000000000080006 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 9605876169, free_ts 0 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1533 prep_new_page mm/page_alloc.c:1540 [inline] get_page_from_freelist+0x33ea/0x3580 mm/page_alloc.c:3311 __alloc_pages+0x256/0x680 mm/page_alloc.c:4569 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] alloc_slab_page+0x5f/0x160 mm/slub.c:2175 allocate_slab mm/slub.c:2338 [inline] new_slab+0x84/0x2f0 mm/slub.c:2391 ___slab_alloc+0xc73/0x1260 mm/slub.c:3525 __slab_alloc mm/slub.c:3610 [inline] __slab_alloc_node mm/slub.c:3663 [inline] slab_alloc_node mm/slub.c:3835 [inline] kmalloc_trace+0x269/0x360 mm/slub.c:3992 kmalloc include/linux/slab.h:628 [inline] kzalloc include/linux/slab.h:749 [inline] nvmem_register+0xde/0x1350 drivers/nvmem/core.c:901 mtd_nvmem_add drivers/mtd/mtdcore.c:566 [inline] add_mtd_device+0xf01/0x1950 drivers/mtd/mtdcore.c:755 mtd_device_parse_register+0xdec/0x1000 drivers/mtd/mtdcore.c:1075 mtdram_init_device+0x1e7/0x290 drivers/mtd/devices/mtdram.c:146 init_mtdram+0xae/0x170 drivers/mtd/devices/mtdram.c:171 do_one_initcall+0x23a/0x830 init/main.c:1241 do_initcall_level+0x157/0x210 init/main.c:1303 do_initcalls+0x3f/0x80 init/main.c:1319 kernel_init_freeable+0x435/0x5d0 init/main.c:1550 page_owner free stack trace missing Memory state around the buggy address: ffff888021a34f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888021a35000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888021a35080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888021a35100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888021a35180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================