================================================================== BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline] BUG: KASAN: slab-use-after-free in atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:252 [inline] BUG: KASAN: slab-use-after-free in __refcount_add include/linux/refcount.h:184 [inline] BUG: KASAN: slab-use-after-free in __refcount_inc include/linux/refcount.h:241 [inline] BUG: KASAN: slab-use-after-free in refcount_inc include/linux/refcount.h:258 [inline] BUG: KASAN: slab-use-after-free in sock_hold include/net/sock.h:781 [inline] BUG: KASAN: slab-use-after-free in sco_sock_timeout+0x84/0x284 net/bluetooth/sco.c:92 Write of size 4 at addr ffff0000d5157080 by task kworker/0:0/8 CPU: 0 UID: 0 PID: 8 Comm: kworker/0:0 Not tainted 6.12.0-rc3-syzkaller-gd2b1b3bccef6 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: events sco_sock_timeout Call trace: dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:319 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:326 __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x198/0x538 mm/kasan/report.c:488 kasan_report+0xd8/0x138 mm/kasan/report.c:601 kasan_check_range+0x268/0x2a8 mm/kasan/generic.c:189 __kasan_check_write+0x20/0x30 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:96 [inline] atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:252 [inline] __refcount_add include/linux/refcount.h:184 [inline] __refcount_inc include/linux/refcount.h:241 [inline] refcount_inc include/linux/refcount.h:258 [inline] sock_hold include/net/sock.h:781 [inline] sco_sock_timeout+0x84/0x284 net/bluetooth/sco.c:92 process_one_work+0x7bc/0x1600 kernel/workqueue.c:3229 process_scheduled_works kernel/workqueue.c:3310 [inline] worker_thread+0x97c/0xeec kernel/workqueue.c:3391 kthread+0x288/0x310 kernel/kthread.c:389 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 Allocated by task 6505: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:68 kasan_save_alloc_info+0x40/0x50 mm/kasan/generic.c:565 unpoison_slab_object mm/kasan/common.c:319 [inline] __kasan_slab_alloc+0x74/0x8c mm/kasan/common.c:345 kasan_slab_alloc include/linux/kasan.h:247 [inline] slab_post_alloc_hook mm/slub.c:4085 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_node_noprof+0x204/0x3a8 mm/slub.c:4186 __alloc_skb+0x1e0/0x420 net/core/skbuff.c:668 alloc_skb include/linux/skbuff.h:1322 [inline] nsim_dev_trap_skb_build drivers/net/netdevsim/dev.c:748 [inline] nsim_dev_trap_report drivers/net/netdevsim/dev.c:805 [inline] nsim_dev_trap_report_work+0x1f0/0x924 drivers/net/netdevsim/dev.c:850 process_one_work+0x7bc/0x1600 kernel/workqueue.c:3229 process_scheduled_works kernel/workqueue.c:3310 [inline] worker_thread+0x97c/0xeec kernel/workqueue.c:3391 kthread+0x288/0x310 kernel/kthread.c:389 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 Freed by task 6505: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:68 kasan_save_free_info+0x54/0x6c mm/kasan/generic.c:579 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x64/0x8c mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:2342 [inline] slab_free mm/slub.c:4579 [inline] kmem_cache_free+0x19c/0x560 mm/slub.c:4681 kfree_skbmem+0x15c/0x1ec __kfree_skb net/core/skbuff.c:1205 [inline] consume_skb+0xb8/0x130 net/core/skbuff.c:1436 nsim_dev_trap_report drivers/net/netdevsim/dev.c:821 [inline] nsim_dev_trap_report_work+0x628/0x924 drivers/net/netdevsim/dev.c:850 process_one_work+0x7bc/0x1600 kernel/workqueue.c:3229 process_scheduled_works kernel/workqueue.c:3310 [inline] worker_thread+0x97c/0xeec kernel/workqueue.c:3391 kthread+0x288/0x310 kernel/kthread.c:389 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 The buggy address belongs to the object at ffff0000d5157000 which belongs to the cache skbuff_head_cache of size 240 The buggy address is located 128 bytes inside of freed 240-byte region [ffff0000d5157000, ffff0000d51570f0) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x115157 ksm flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) page_type: f5(slab) raw: 05ffc00000000000 ffff0000c1bdf780 fffffdffc3439140 0000000000000003 raw: 0000000000000000 00000000000c000c 00000001f5000000 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000d5156f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff0000d5157000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff0000d5157080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc ^ ffff0000d5157100: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb ffff0000d5157180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== ------------[ cut here ]------------ refcount_t: addition on 0; use-after-free. WARNING: CPU: 0 PID: 8 at lib/refcount.c:25 refcount_warn_saturate+0x1a8/0x20c lib/refcount.c:25 Modules linked in: CPU: 0 UID: 0 PID: 8 Comm: kworker/0:0 Tainted: G B 6.12.0-rc3-syzkaller-gd2b1b3bccef6 #0 Tainted: [B]=BAD_PAGE Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: events sco_sock_timeout pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : refcount_warn_saturate+0x1a8/0x20c lib/refcount.c:25 lr : refcount_warn_saturate+0x1a8/0x20c lib/refcount.c:25 sp : ffff800097877ab0 x29: ffff800097877ab0 x28: ffff700012f0ef80 x27: ffff0000c1a0b618 x26: ffff0000c1a0b610 x25: ffff0000c1080000 x24: dfff800000000000 x23: dfff800000000000 x22: 0000000000000000 x21: 0000000000000002 x20: ffff0000d5157080 x19: ffff800092a82000 x18: 0000000000000008 x17: 0000000000000000 x16: ffff80008b3c891c x15: ffff700011f0d620 x14: 1ffff00011f0d620 x13: 0000000000000004 x12: ffffffffffffffff x11: 0000000000000003 x10: 0000000000ff0100 x9 : a0c5563a91c7ca00 x8 : a0c5563a91c7ca00 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff8000978771d8 x4 : ffff80008f8dd800 x3 : ffff800080396478 x2 : 0000000000000000 x1 : 0000000000000001 x0 : 0000000000000000 Call trace: refcount_warn_saturate+0x1a8/0x20c lib/refcount.c:25 __refcount_inc include/linux/refcount.h:241 [inline] refcount_inc include/linux/refcount.h:258 [inline] sock_hold include/net/sock.h:781 [inline] sco_sock_timeout+0x1c4/0x284 net/bluetooth/sco.c:92 process_one_work+0x7bc/0x1600 kernel/workqueue.c:3229 process_scheduled_works kernel/workqueue.c:3310 [inline] worker_thread+0x97c/0xeec kernel/workqueue.c:3391 kthread+0x288/0x310 kernel/kthread.c:389 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 irq event stamp: 156475 hardirqs last enabled at (156475): [] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:85 [inline] hardirqs last enabled at (156475): [] exit_to_kernel_mode+0xdc/0x10c arch/arm64/kernel/entry-common.c:95 hardirqs last disabled at (156474): [] handle_softirqs+0x8b8/0xbf8 kernel/softirq.c:569 softirqs last enabled at (156350): [] spin_unlock_bh include/linux/spinlock.h:396 [inline] softirqs last enabled at (156350): [] ptr_ring_consume_bh include/linux/ptr_ring.h:367 [inline] softirqs last enabled at (156350): [] wg_packet_encrypt_worker+0x10a4/0x1134 drivers/net/wireguard/send.c:293 softirqs last disabled at (156348): [] spin_lock_bh include/linux/spinlock.h:356 [inline] softirqs last disabled at (156348): [] ptr_ring_consume_bh include/linux/ptr_ring.h:365 [inline] softirqs last disabled at (156348): [] wg_packet_encrypt_worker+0xe5c/0x1134 drivers/net/wireguard/send.c:293 ---[ end trace 0000000000000000 ]--- Unable to handle kernel paging request at virtual address 005a03a500001b84 Mem abort info: ESR = 0x0000000086000004 EC = 0x21: IABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault [005a03a500001b84] address between user and kernel address ranges Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP Modules linked in: CPU: 0 UID: 0 PID: 8 Comm: kworker/0:0 Tainted: G B W 6.12.0-rc3-syzkaller-gd2b1b3bccef6 #0 Tainted: [B]=BAD_PAGE, [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: events sco_sock_timeout pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : 0x5a03a500001b84 lr : sco_sock_timeout+0x114/0x284 net/bluetooth/sco.c:102 sp : ffff800097877ae0 x29: ffff800097877ae0 x28: ffff700012f0ef80 x27: ffff0000c1a0b618 x26: ffff0000c1a0b610 x25: ffff0000c1080000 x24: dfff800000000000 x23: dfff800000000000 x22: 0000000000000000 x21: ffff0000d4445808 x20: ffff0000d5157000 x19: ffff0000d5157080 x18: 1fffe000366c7876 x17: ffff80008b56d68c x16: ffff800080ac8db4 x15: ffff60001aa2ae38 x14: 1fffe0001aa2ae38 x13: 00000000000000fb x12: ffffffffffffffff x11: ffff80009786ffff x10: 0000000000ff0100 x9 : ffff8000973770e0 x8 : 025a03a500001b84 x7 : ffff800080ac8654 x6 : ffff80008958c8f4 x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff80008a6cbae8 x2 : 0000000000000000 x1 : 0000000000000008 x0 : ffff0000d5157000 Call trace: 0x5a03a500001b84 process_one_work+0x7bc/0x1600 kernel/workqueue.c:3229 process_scheduled_works kernel/workqueue.c:3310 [inline] worker_thread+0x97c/0xeec kernel/workqueue.c:3391 kthread+0x288/0x310 kernel/kthread.c:389 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 Code: ???????? ???????? ???????? ???????? (????????) ---[ end trace 0000000000000000 ]---