Bluetooth: Invalid header checksum Bluetooth: Invalid header checksum Bluetooth: Invalid header checksum Bluetooth: Invalid header checksum ================================================================== BUG: KASAN: use-after-free in skb_release_data+0x563/0x7b0 net/core/skbuff.c:567 Read of size 1 at addr ffff8880994b77c2 by task kworker/u4:7/8147 Bluetooth: Invalid header checksum CPU: 0 PID: 8147 Comm: kworker/u4:7 Not tainted 4.14.172-syzkaller #0 Bluetooth: Invalid header checksum Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Bluetooth: Invalid header checksum Workqueue: events_unbound flush_to_ldisc Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x13e/0x194 lib/dump_stack.c:58 print_address_description.cold+0x7c/0x1e2 mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 [inline] kasan_report mm/kasan/report.c:409 [inline] kasan_report.cold+0xa9/0x2ae mm/kasan/report.c:393 skb_release_data+0x563/0x7b0 net/core/skbuff.c:567 skb_release_all+0x46/0x60 net/core/skbuff.c:631 __kfree_skb net/core/skbuff.c:645 [inline] kfree_skb+0xae/0x340 net/core/skbuff.c:663 h5_reset_rx+0x47/0x100 drivers/bluetooth/hci_h5.c:499 h5_rx_3wire_hdr+0x2a2/0x360 drivers/bluetooth/hci_h5.c:409 Bluetooth: Invalid header checksum h5_recv+0x232/0x3b0 drivers/bluetooth/hci_h5.c:532 Bluetooth: Invalid header checksum hci_uart_tty_receive+0x1ec/0x4c0 drivers/bluetooth/hci_ldisc.c:616 tty_ldisc_receive_buf+0x12e/0x170 drivers/tty/tty_buffer.c:459 tty_port_default_receive_buf+0x6e/0xa0 drivers/tty/tty_port.c:37 receive_buf drivers/tty/tty_buffer.c:475 [inline] flush_to_ldisc+0x1dd/0x3f0 drivers/tty/tty_buffer.c:527 process_one_work+0x813/0x1540 kernel/workqueue.c:2114 worker_thread+0x5d1/0x1070 kernel/workqueue.c:2248 kthread+0x30d/0x420 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 Allocated by task 8147: save_stack+0x32/0xa0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc mm/kasan/kasan.c:551 [inline] kasan_kmalloc+0xbf/0xe0 mm/kasan/kasan.c:529 __do_kmalloc_node mm/slab.c:3682 [inline] __kmalloc_node_track_caller+0x4c/0x70 mm/slab.c:3696 __kmalloc_reserve.isra.0+0x35/0xd0 net/core/skbuff.c:137 __alloc_skb+0xca/0x4c0 net/core/skbuff.c:205 alloc_skb include/linux/skbuff.h:980 [inline] bt_skb_alloc include/net/bluetooth/bluetooth.h:336 [inline] h5_rx_pkt_start+0xbf/0x260 drivers/bluetooth/hci_h5.c:443 h5_recv+0x232/0x3b0 drivers/bluetooth/hci_h5.c:532 hci_uart_tty_receive+0x1ec/0x4c0 drivers/bluetooth/hci_ldisc.c:616 tty_ldisc_receive_buf+0x12e/0x170 drivers/tty/tty_buffer.c:459 tty_port_default_receive_buf+0x6e/0xa0 drivers/tty/tty_port.c:37 receive_buf drivers/tty/tty_buffer.c:475 [inline] flush_to_ldisc+0x1dd/0x3f0 drivers/tty/tty_buffer.c:527 process_one_work+0x813/0x1540 kernel/workqueue.c:2114 worker_thread+0x5d1/0x1070 kernel/workqueue.c:2248 kthread+0x30d/0x420 kernel/kthread.c:232 Bluetooth: Invalid header checksum ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 Bluetooth: Invalid header checksum Freed by task 8494: Bluetooth: Invalid header checksum save_stack+0x32/0xa0 mm/kasan/kasan.c:447 Bluetooth: Invalid header checksum set_track mm/kasan/kasan.c:459 [inline] kasan_slab_free+0x75/0xc0 mm/kasan/kasan.c:524 __cache_free mm/slab.c:3496 [inline] kfree+0xcb/0x260 mm/slab.c:3815 skb_free_head+0x83/0xa0 net/core/skbuff.c:554 skb_release_data+0x528/0x7b0 net/core/skbuff.c:574 skb_release_all+0x46/0x60 net/core/skbuff.c:631 __kfree_skb net/core/skbuff.c:645 [inline] kfree_skb+0xae/0x340 net/core/skbuff.c:663 h5_reset_rx+0x47/0x100 drivers/bluetooth/hci_h5.c:499 h5_rx_3wire_hdr+0x2a2/0x360 drivers/bluetooth/hci_h5.c:409 h5_recv+0x232/0x3b0 drivers/bluetooth/hci_h5.c:532 hci_uart_tty_receive+0x1ec/0x4c0 drivers/bluetooth/hci_ldisc.c:616 tiocsti drivers/tty/tty_io.c:2186 [inline] tty_ioctl+0xd5b/0x1220 drivers/tty/tty_io.c:2572 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:500 [inline] do_vfs_ioctl+0x75a/0xfe0 fs/ioctl.c:684 SYSC_ioctl fs/ioctl.c:701 [inline] SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 The buggy address belongs to the object at ffff8880994b5900 which belongs to the cache kmalloc-8192 of size 8192 The buggy address is located 7874 bytes inside of 8192-byte region [ffff8880994b5900, ffff8880994b7900) The buggy address belongs to the page: page:ffffea0002652d00 count:1 mapcount:0 mapping:ffff8880994b5900 index:0x0 compound_mapcount: 0 flags: 0xfffe0000008100(slab|head) raw: 00fffe0000008100 ffff8880994b5900 0000000000000000 0000000100000001 raw: ffffea0001e04320 ffffea0002613520 ffff88812fe55080 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880994b7680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880994b7700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8880994b7780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880994b7800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880994b7880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================