================================================================== BUG: KASAN: slab-out-of-bounds in __lock_acquire+0x4212/0x5640 kernel/locking/lockdep.c:4300 Read of size 8 at addr ffff8880922ae0a8 by task syz-executor.0/19981 CPU: 0 PID: 19981 Comm: syz-executor.0 Not tainted 5.8.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x18f/0x20d lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xae/0x436 mm/kasan/report.c:383 __kasan_report mm/kasan/report.c:513 [inline] kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530 __lock_acquire+0x4212/0x5640 kernel/locking/lockdep.c:4300 lock_acquire+0x1f1/0xad0 kernel/locking/lockdep.c:5005 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline] _raw_spin_lock_bh+0x2f/0x40 kernel/locking/spinlock.c:175 spin_lock_bh include/linux/spinlock.h:359 [inline] lock_sock_nested+0x3b/0x110 net/core/sock.c:3040 l2cap_sock_teardown_cb+0x88/0x400 net/bluetooth/l2cap_sock.c:1520 l2cap_chan_del+0xad/0x1300 net/bluetooth/l2cap_core.c:618 l2cap_conn_del+0x46a/0x9e0 net/bluetooth/l2cap_core.c:1890 l2cap_disconn_cfm net/bluetooth/l2cap_core.c:8160 [inline] l2cap_disconn_cfm+0x85/0xa0 net/bluetooth/l2cap_core.c:8153 hci_disconn_cfm include/net/bluetooth/hci_core.h:1438 [inline] hci_conn_hash_flush+0x114/0x220 net/bluetooth/hci_conn.c:1557 hci_dev_do_close+0x5c6/0x1080 net/bluetooth/hci_core.c:1770 hci_dev_close+0x171/0x1d0 net/bluetooth/hci_core.c:1851 hci_sock_ioctl+0x549/0x800 net/bluetooth/hci_sock.c:1030 sock_do_ioctl+0xcb/0x2d0 net/socket.c:1047 sock_ioctl+0x3b8/0x730 net/socket.c:1198 vfs_ioctl fs/ioctl.c:48 [inline] ksys_ioctl+0x11a/0x180 fs/ioctl.c:753 __do_sys_ioctl fs/ioctl.c:762 [inline] __se_sys_ioctl fs/ioctl.c:760 [inline] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:760 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45d189 Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fa92d6afc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000000001d340 RCX: 000000000045d189 RDX: 0000000000000000 RSI: 00000000400448ca RDI: 0000000000000004 RBP: 000000000118cf80 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118cf4c R13: 00007ffcf506b74f R14: 00007fa92d6b09c0 R15: 000000000118cf4c Allocated by task 2154: save_stack+0x1b/0x40 mm/kasan/common.c:48 set_track mm/kasan/common.c:56 [inline] __kasan_kmalloc.constprop.0+0xc2/0xd0 mm/kasan/common.c:494 slab_post_alloc_hook mm/slab.h:586 [inline] slab_alloc mm/slab.c:3320 [inline] kmem_cache_alloc+0x12c/0x3b0 mm/slab.c:3484 kmem_cache_zalloc include/linux/slab.h:659 [inline] __kernfs_new_node+0xd4/0x880 fs/kernfs/dir.c:627 kernfs_new_node fs/kernfs/dir.c:689 [inline] kernfs_create_dir_ns+0x9c/0x220 fs/kernfs/dir.c:1026 sysfs_create_dir_ns+0x127/0x290 fs/sysfs/dir.c:59 create_dir lib/kobject.c:89 [inline] kobject_add_internal+0x2c3/0x940 lib/kobject.c:255 kobject_add_varg lib/kobject.c:390 [inline] kobject_init_and_add+0x101/0x160 lib/kobject.c:473 netdev_queue_add_kobject net/core/net-sysfs.c:1551 [inline] netdev_queue_update_kobjects+0x128/0x3c0 net/core/net-sysfs.c:1596 register_queue_kobjects net/core/net-sysfs.c:1657 [inline] netdev_register_kobject+0x2ee/0x3b0 net/core/net-sysfs.c:1900 register_netdevice+0xd29/0x1540 net/core/dev.c:9827 bond_newlink drivers/net/bonding/bond_netlink.c:458 [inline] bond_newlink+0x47/0xa0 drivers/net/bonding/bond_netlink.c:448 __rtnl_newlink+0x108b/0x1740 net/core/rtnetlink.c:3441 rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3500 rtnetlink_rcv_msg+0x44e/0xad0 net/core/rtnetlink.c:5563 netlink_rcv_skb+0x15a/0x430 net/netlink/af_netlink.c:2470 netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline] netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1330 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1919 sock_sendmsg_nosec net/socket.c:651 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:671 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2353 ___sys_sendmsg+0xf3/0x170 net/socket.c:2407 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2440 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Freed by task 0: (stack is not available) The buggy address belongs to the object at ffff8880922ae000 which belongs to the cache kernfs_node_cache of size 168 The buggy address is located 0 bytes to the right of 168-byte region [ffff8880922ae000, ffff8880922ae0a8) The buggy address belongs to the page: page:ffffea000248ab80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 flags: 0xfffe0000000200(slab) raw: 00fffe0000000200 ffffea00023e9608 ffffea00023efec8 ffff88821bc518c0 raw: 0000000000000000 ffff8880922ae000 0000000100000011 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880922adf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8880922ae000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff8880922ae080: 00 00 00 00 00 fc fc fc fc fc fc fc fc 00 00 00 ^ ffff8880922ae100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880922ae180: 00 00 fc fc fc fc fc fc fc fc 00 00 00 00 00 00 ==================================================================