================================================================== BUG: KASAN: slab-out-of-bounds in memcpy include/linux/string.h:359 [inline] BUG: KASAN: slab-out-of-bounds in bacpy+0x23/0x30 include/net/bluetooth/bluetooth.h:236 Read of size 6 at addr ffff8880a176a23b by task kworker/u5:0/1519 CPU: 1 PID: 1519 Comm: kworker/u5:0 Not tainted 5.3.0-rc5+ #118 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: hci0 hci_rx_work Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x172/0x1f0 lib/dump_stack.c:113 print_address_description.cold+0xd4/0x306 mm/kasan/report.c:351 __kasan_report.cold+0x1b/0x36 mm/kasan/report.c:482 kasan_report+0x12/0x17 mm/kasan/common.c:612 check_memory_region_inline mm/kasan/generic.c:185 [inline] check_memory_region+0x134/0x1a0 mm/kasan/generic.c:192 memcpy+0x24/0x50 mm/kasan/common.c:122 memcpy include/linux/string.h:359 [inline] bacpy+0x23/0x30 include/net/bluetooth/bluetooth.h:236 hci_inquiry_result_with_rssi_evt net/bluetooth/hci_event.c:4070 [inline] hci_event_packet+0x455c/0xa8fb net/bluetooth/hci_event.c:5952 hci_rx_work+0x47e/0xae0 net/bluetooth/hci_core.c:4462 process_one_work+0x9af/0x1740 kernel/workqueue.c:2269 worker_thread+0x98/0xe40 kernel/workqueue.c:2415 kthread+0x361/0x430 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Allocated by task 20254: save_stack+0x23/0x90 mm/kasan/common.c:69 set_track mm/kasan/common.c:77 [inline] __kasan_kmalloc mm/kasan/common.c:487 [inline] __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:460 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:501 __do_kmalloc_node mm/slab.c:3615 [inline] __kmalloc_node_track_caller+0x4e/0x70 mm/slab.c:3629 __kmalloc_reserve.isra.0+0x40/0xf0 net/core/skbuff.c:141 __alloc_skb+0x10b/0x5e0 net/core/skbuff.c:209 alloc_skb include/linux/skbuff.h:1055 [inline] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline] vhci_get_user drivers/bluetooth/hci_vhci.c:165 [inline] vhci_write+0xc4/0x470 drivers/bluetooth/hci_vhci.c:284 call_write_iter include/linux/fs.h:1870 [inline] new_sync_write+0x4d3/0x770 fs/read_write.c:483 __vfs_write+0xe1/0x110 fs/read_write.c:496 vfs_write+0x268/0x5d0 fs/read_write.c:558 ksys_write+0x14f/0x290 fs/read_write.c:611 __do_sys_write fs/read_write.c:623 [inline] __se_sys_write fs/read_write.c:620 [inline] __x64_sys_write+0x73/0xb0 fs/read_write.c:620 do_syscall_64+0xfd/0x6a0 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 12481: save_stack+0x23/0x90 mm/kasan/common.c:69 set_track mm/kasan/common.c:77 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/common.c:449 kasan_slab_free+0xe/0x10 mm/kasan/common.c:457 __cache_free mm/slab.c:3425 [inline] kfree+0x10a/0x2c0 mm/slab.c:3756 free_bprm+0x198/0x200 fs/exec.c:1433 __do_execve_file.isra.0+0x1b41/0x2340 fs/exec.c:1832 do_execveat_common fs/exec.c:1868 [inline] do_execve fs/exec.c:1885 [inline] __do_sys_execve fs/exec.c:1961 [inline] __se_sys_execve fs/exec.c:1956 [inline] __x64_sys_execve+0x8f/0xc0 fs/exec.c:1956 do_syscall_64+0xfd/0x6a0 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff8880a176a040 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 507 bytes inside of 512-byte region [ffff8880a176a040, ffff8880a176a240) The buggy address belongs to the page: page:ffffea000285da80 refcount:1 mapcount:0 mapping:ffff8880aa400a80 index:0x0 flags: 0x1fffc0000000200(slab) raw: 01fffc0000000200 ffffea0002419648 ffffea00027e1a08 ffff8880aa400a80 raw: 0000000000000000 ffff8880a176a040 0000000100000006 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880a176a100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880a176a180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff8880a176a200: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc ^ ffff8880a176a280: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 ffff8880a176a300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================