==================================================================
BUG: KASAN: use-after-free in __lock_acquire+0x3ad2/0x5050 kernel/locking/lockdep.c:4770
Read of size 8 at addr ffff88810840c0a0 by task kworker/0:0/5

CPU: 0 PID: 5 Comm: kworker/0:0 Not tainted 5.12.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events l2cap_chan_timeout
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x10c/0x14b lib/dump_stack.c:120
 print_address_description.constprop.0.cold+0x5b/0x2c6 mm/kasan/report.c:232
 __kasan_report mm/kasan/report.c:399 [inline]
 kasan_report.cold+0x7c/0xd8 mm/kasan/report.c:416
 __lock_acquire+0x3ad2/0x5050 kernel/locking/lockdep.c:4770
 lock_acquire kernel/locking/lockdep.c:5510 [inline]
 lock_acquire+0x212/0x850 kernel/locking/lockdep.c:5475
 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
 _raw_spin_lock_bh+0x2f/0x40 kernel/locking/spinlock.c:175
 spin_lock_bh include/linux/spinlock.h:359 [inline]
 lock_sock_nested+0x39/0xf0 net/core/sock.c:3063
 l2cap_sock_teardown_cb+0x83/0x3a0 net/bluetooth/l2cap_sock.c:1520
 l2cap_chan_del+0x96/0x1010 net/bluetooth/l2cap_core.c:618
 l2cap_chan_close+0xe2/0x9d0 net/bluetooth/l2cap_core.c:823
 l2cap_chan_timeout+0x122/0x3a0 net/bluetooth/l2cap_core.c:436
 process_one_work+0x84c/0x13b0 kernel/workqueue.c:2275
 worker_thread+0x598/0xf80 kernel/workqueue.c:2421
 kthread+0x36f/0x450 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294

Allocated by task 6105:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:427 [inline]
 ____kasan_kmalloc mm/kasan/common.c:506 [inline]
 __kasan_kmalloc+0x78/0x90 mm/kasan/common.c:515
 kvmalloc include/linux/mm.h:785 [inline]
 kvmalloc_array include/linux/mm.h:803 [inline]
 alloc_fdtable+0xb7/0x270 fs/file.c:120
 dup_fd+0x62c/0xb70 fs/file.c:325
 copy_files kernel/fork.c:1466 [inline]
 copy_process+0x1b99/0x6710 kernel/fork.c:2087
 kernel_clone+0xb8/0x7f0 kernel/fork.c:2493
 __do_sys_clone+0xaf/0xf0 kernel/fork.c:2610
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Freed by task 8426:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38
 kasan_set_track+0x1c/0x30 mm/kasan/common.c:46
 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:357
 ____kasan_slab_free mm/kasan/common.c:360 [inline]
 ____kasan_slab_free mm/kasan/common.c:325 [inline]
 __kasan_slab_free+0xac/0xe0 mm/kasan/common.c:367
 kasan_slab_free include/linux/kasan.h:199 [inline]
 __cache_free mm/slab.c:3440 [inline]
 kfree+0x10f/0x2d0 mm/slab.c:3796
 __free_fdtable fs/file.c:36 [inline]
 put_files_struct fs/file.c:422 [inline]
 put_files_struct+0x1e0/0x2c0 fs/file.c:415
 do_exit+0xaa2/0x25b0 kernel/exit.c:820
 do_group_exit+0xe7/0x290 kernel/exit.c:922
 get_signal+0x37f/0x1b10 kernel/signal.c:2773
 arch_do_signal_or_restart+0x2a8/0x1f80 arch/x86/kernel/signal.c:811
 handle_signal_work kernel/entry/common.c:147 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
 exit_to_user_mode_prepare+0x1d6/0x250 kernel/entry/common.c:208
 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline]
 syscall_exit_to_user_mode+0x40/0x80 kernel/entry/common.c:301
 entry_SYSCALL_64_after_hwframe+0x44/0xae

The buggy address belongs to the object at ffff88810840c000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 160 bytes inside of
 2048-byte region [ffff88810840c000, ffff88810840c800)
The buggy address belongs to the page:
page:00000000c7519199 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10840c
flags: 0x17ffe0000000200(slab)
raw: 017ffe0000000200 ffffea0004210348 ffffea0004852688 ffff888100040800
raw: 0000000000000000 ffff88810840c000 0000000100000001 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88810840bf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88810840c000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88810840c080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                               ^
 ffff88810840c100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88810840c180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
INFO: trying to register non-static key.
the code is fine but needs lockdep annotation.
turning off the locking correctness validator.
CPU: 0 PID: 5 Comm: kworker/0:0 Tainted: G    B             5.12.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events l2cap_chan_timeout
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x10c/0x14b lib/dump_stack.c:120
 assign_lock_key kernel/locking/lockdep.c:935 [inline]
 register_lock_class+0x111e/0x11f0 kernel/locking/lockdep.c:1247
 __lock_acquire+0xfc/0x5050 kernel/locking/lockdep.c:4779
 lock_acquire kernel/locking/lockdep.c:5510 [inline]
 lock_acquire+0x212/0x850 kernel/locking/lockdep.c:5475
 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
 _raw_spin_lock_bh+0x2f/0x40 kernel/locking/spinlock.c:175
 spin_lock_bh include/linux/spinlock.h:359 [inline]
 lock_sock_nested+0x39/0xf0 net/core/sock.c:3063
 l2cap_sock_teardown_cb+0x83/0x3a0 net/bluetooth/l2cap_sock.c:1520
 l2cap_chan_del+0x96/0x1010 net/bluetooth/l2cap_core.c:618
 l2cap_chan_close+0xe2/0x9d0 net/bluetooth/l2cap_core.c:823
 l2cap_chan_timeout+0x122/0x3a0 net/bluetooth/l2cap_core.c:436
 process_one_work+0x84c/0x13b0 kernel/workqueue.c:2275
 worker_thread+0x598/0xf80 kernel/workqueue.c:2421
 kthread+0x36f/0x450 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 11686e067 P4D 11686e067 PUD 10a88b067 PMD 0 
Oops: 0010 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 5 Comm: kworker/0:0 Tainted: G    B             5.12.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events l2cap_chan_timeout
RIP: 0010:0x0
Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
RSP: 0018:ffffc9000006fb88 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffff88810840c000 RCX: ffffffff8690020c
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88810840c000
RBP: 000000000000006f R08: 0000000000000000 R09: 0000000000000000
R10: ffffed102007db40 R11: 0000000000000135 R12: 0000000000000000
R13: ffff88810840d000 R14: ffff88810840d110 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8881f6400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 000000010e771000 CR4: 0000000000350ef0
Call Trace:
 l2cap_sock_teardown_cb+0x316/0x3a0 net/bluetooth/l2cap_sock.c:1545
 l2cap_chan_del+0x96/0x1010 net/bluetooth/l2cap_core.c:618
 l2cap_chan_close+0xe2/0x9d0 net/bluetooth/l2cap_core.c:823
 l2cap_chan_timeout+0x122/0x3a0 net/bluetooth/l2cap_core.c:436
 process_one_work+0x84c/0x13b0 kernel/workqueue.c:2275
 worker_thread+0x598/0xf80 kernel/workqueue.c:2421
 kthread+0x36f/0x450 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
Modules linked in:
CR2: 0000000000000000
---[ end trace cfc5101cec10ea62 ]---
RIP: 0010:0x0
Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
RSP: 0018:ffffc9000006fb88 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffff88810840c000 RCX: ffffffff8690020c
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88810840c000
RBP: 000000000000006f R08: 0000000000000000 R09: 0000000000000000
R10: ffffed102007db40 R11: 0000000000000135 R12: 0000000000000000
R13: ffff88810840d000 R14: ffff88810840d110 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8881f6400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 000000010e771000 CR4: 0000000000350ef0