audit: type=1400 audit(1587678917.130:8): avc: denied { execmem } for pid=6342 comm="syz-executor693" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 ================================================================== BUG: KASAN: use-after-free in l2cap_chan_close+0x4f6/0x770 net/bluetooth/l2cap_core.c:727 Read of size 1 at addr ffff88808b2744e0 by task kworker/1:2/3633 CPU: 1 PID: 3633 Comm: kworker/1:2 Not tainted 4.14.176-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events do_enable_set Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x13e/0x194 lib/dump_stack.c:58 print_address_description.cold+0x7c/0x1e2 mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 [inline] kasan_report mm/kasan/report.c:409 [inline] kasan_report.cold+0xa9/0x2ae mm/kasan/report.c:393 l2cap_chan_close+0x4f6/0x770 net/bluetooth/l2cap_core.c:727 do_enable_set+0x45a/0x7f0 net/bluetooth/6lowpan.c:1086 process_one_work+0x813/0x1540 kernel/workqueue.c:2116 worker_thread+0x5d1/0x1070 kernel/workqueue.c:2250 kthread+0x30d/0x420 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 Allocated by task 24: save_stack+0x32/0xa0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc mm/kasan/kasan.c:551 [inline] kasan_kmalloc+0xbf/0xe0 mm/kasan/kasan.c:529 kmem_cache_alloc_trace+0x14d/0x7b0 mm/slab.c:3618 kmalloc include/linux/slab.h:488 [inline] kzalloc include/linux/slab.h:661 [inline] l2cap_chan_create+0x3e/0x3c0 net/bluetooth/l2cap_core.c:441 chan_create+0xc/0xd0 net/bluetooth/6lowpan.c:652 bt_6lowpan_listen net/bluetooth/6lowpan.c:971 [inline] do_enable_set+0x493/0x7f0 net/bluetooth/6lowpan.c:1090 process_one_work+0x813/0x1540 kernel/workqueue.c:2116 worker_thread+0x5d1/0x1070 kernel/workqueue.c:2250 kthread+0x30d/0x420 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 Freed by task 24: save_stack+0x32/0xa0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_slab_free+0x75/0xc0 mm/kasan/kasan.c:524 __cache_free mm/slab.c:3496 [inline] kfree+0xcb/0x260 mm/slab.c:3815 kref_put include/linux/kref.h:70 [inline] l2cap_chan_put+0x27/0x30 net/bluetooth/l2cap_core.c:493 do_enable_set+0x466/0x7f0 net/bluetooth/6lowpan.c:1087 process_one_work+0x813/0x1540 kernel/workqueue.c:2116 worker_thread+0x5d1/0x1070 kernel/workqueue.c:2250 kthread+0x30d/0x420 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 The buggy address belongs to the object at ffff88808b2744c0 which belongs to the cache kmalloc-2048 of size 2048 The buggy address is located 32 bytes inside of 2048-byte region [ffff88808b2744c0, ffff88808b274cc0) The buggy address belongs to the page: page:ffffea00022c9d00 count:1 mapcount:0 mapping:ffff88808b2744c0 index:0x0 compound_mapcount: 0 flags: 0xfffe0000008100(slab|head) raw: 00fffe0000008100 ffff88808b2744c0 0000000000000000 0000000100000003 raw: ffffea000262c220 ffffea0002289520 ffff88812fe56c40 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88808b274380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88808b274400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88808b274480: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb ^ ffff88808b274500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88808b274580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================