================================================================== BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline] BUG: KASAN: use-after-free in atomic_inc include/asm-generic/atomic-instrumented.h:240 [inline] BUG: KASAN: use-after-free in hci_sock_bind+0x433/0xfb0 net/bluetooth/hci_sock.c:1249 Write of size 4 at addr ffff888101bb1278 by task syz-executor.3/19598 CPU: 1 PID: 19598 Comm: syz-executor.3 Not tainted 5.12.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x10c/0x14b lib/dump_stack.c:120 print_address_description.constprop.0.cold+0x5b/0x2c6 mm/kasan/report.c:232 __kasan_report mm/kasan/report.c:399 [inline] kasan_report.cold+0x7c/0xd8 mm/kasan/report.c:416 check_region_inline mm/kasan/generic.c:180 [inline] kasan_check_range+0x13d/0x180 mm/kasan/generic.c:186 instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic_inc include/asm-generic/atomic-instrumented.h:240 [inline] hci_sock_bind+0x433/0xfb0 net/bluetooth/hci_sock.c:1249 __sys_bind+0x16b/0x1d0 net/socket.c:1637 __do_sys_bind net/socket.c:1648 [inline] __se_sys_bind net/socket.c:1646 [inline] __x64_sys_bind+0x6a/0xb0 net/socket.c:1646 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x4642f9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007eff9c94f198 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004642f9 RDX: 0000000000000006 RSI: 0000000020000080 RDI: 0000000000000005 RBP: 00000000004f3220 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000055bf00 R13: 00007eff9c94f6bc R14: 00000000ffffffff R15: 0000000000000003 Allocated by task 19609: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:427 [inline] ____kasan_kmalloc mm/kasan/common.c:506 [inline] __kasan_kmalloc+0x78/0x90 mm/kasan/common.c:515 kasan_kmalloc include/linux/kasan.h:233 [inline] kmem_cache_alloc_trace+0x203/0x400 mm/slab.c:3570 kmalloc include/linux/slab.h:554 [inline] kzalloc include/linux/slab.h:684 [inline] hci_alloc_dev+0x39/0x2400 net/bluetooth/hci_core.c:3731 __vhci_create_device+0xd2/0x520 drivers/bluetooth/hci_vhci.c:99 vhci_create_device drivers/bluetooth/hci_vhci.c:148 [inline] vhci_get_user drivers/bluetooth/hci_vhci.c:205 [inline] vhci_write+0x264/0x3e0 drivers/bluetooth/hci_vhci.c:285 call_write_iter include/linux/fs.h:1977 [inline] new_sync_write+0x35d/0x5f0 fs/read_write.c:518 vfs_write+0x5c3/0x870 fs/read_write.c:605 ksys_write+0xf4/0x1d0 fs/read_write.c:658 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xae Freed by task 19594: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38 kasan_set_track+0x1c/0x30 mm/kasan/common.c:46 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:357 ____kasan_slab_free mm/kasan/common.c:360 [inline] ____kasan_slab_free mm/kasan/common.c:325 [inline] __kasan_slab_free+0xac/0xe0 mm/kasan/common.c:367 kasan_slab_free include/linux/kasan.h:199 [inline] __cache_free mm/slab.c:3440 [inline] kfree+0x10f/0x2d0 mm/slab.c:3796 bt_host_release+0xc/0x20 net/bluetooth/hci_sysfs.c:86 device_release+0x93/0x200 drivers/base/core.c:2108 kobject_cleanup lib/kobject.c:705 [inline] kobject_release lib/kobject.c:736 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0xf6/0x1d0 lib/kobject.c:753 vhci_release+0x6a/0xd0 drivers/bluetooth/hci_vhci.c:341 __fput+0x209/0x870 fs/file_table.c:280 task_work_run+0xc0/0x160 kernel/task_work.c:140 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop kernel/entry/common.c:174 [inline] exit_to_user_mode_prepare+0x240/0x250 kernel/entry/common.c:208 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline] syscall_exit_to_user_mode+0x40/0x80 kernel/entry/common.c:301 entry_SYSCALL_64_after_hwframe+0x44/0xae Last potentially related work creation: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38 kasan_record_aux_stack+0x87/0xb0 mm/kasan/generic.c:345 insert_work+0x42/0x300 kernel/workqueue.c:1331 __queue_work+0x48d/0xc70 kernel/workqueue.c:1497 queue_work_on+0x101/0x140 kernel/workqueue.c:1524 queue_work include/linux/workqueue.h:507 [inline] hci_register_dev+0x529/0x990 net/bluetooth/hci_core.c:3950 __vhci_create_device+0x25e/0x520 drivers/bluetooth/hci_vhci.c:124 vhci_create_device drivers/bluetooth/hci_vhci.c:148 [inline] vhci_get_user drivers/bluetooth/hci_vhci.c:205 [inline] vhci_write+0x264/0x3e0 drivers/bluetooth/hci_vhci.c:285 call_write_iter include/linux/fs.h:1977 [inline] new_sync_write+0x35d/0x5f0 fs/read_write.c:518 vfs_write+0x5c3/0x870 fs/read_write.c:605 ksys_write+0xf4/0x1d0 fs/read_write.c:658 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xae Second to last potentially related work creation: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38 kasan_record_aux_stack+0x87/0xb0 mm/kasan/generic.c:345 insert_work+0x42/0x300 kernel/workqueue.c:1331 __queue_work+0x48d/0xc70 kernel/workqueue.c:1497 queue_work_on+0x101/0x140 kernel/workqueue.c:1524 queue_work include/linux/workqueue.h:507 [inline] hci_register_dev+0x529/0x990 net/bluetooth/hci_core.c:3950 __vhci_create_device+0x25e/0x520 drivers/bluetooth/hci_vhci.c:124 vhci_create_device drivers/bluetooth/hci_vhci.c:148 [inline] vhci_get_user drivers/bluetooth/hci_vhci.c:205 [inline] vhci_write+0x264/0x3e0 drivers/bluetooth/hci_vhci.c:285 call_write_iter include/linux/fs.h:1977 [inline] new_sync_write+0x35d/0x5f0 fs/read_write.c:518 vfs_write+0x5c3/0x870 fs/read_write.c:605 ksys_write+0xf4/0x1d0 fs/read_write.c:658 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xae The buggy address belongs to the object at ffff888101bb0000 which belongs to the cache kmalloc-8k of size 8192 The buggy address is located 4728 bytes inside of 8192-byte region [ffff888101bb0000, ffff888101bb2000) The buggy address belongs to the page: page:0000000004da3e89 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101bb0 head:0000000004da3e89 order:2 compound_mapcount:0 compound_pincount:0 flags: 0x17ffe0000010200(slab|head) raw: 017ffe0000010200 ffffea00049d5b08 ffffea00049e3608 ffff888100040a00 raw: 0000000000000000 ffff888101bb0000 0000000100000001 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888101bb1100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888101bb1180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888101bb1200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888101bb1280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888101bb1300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================