================================================================== BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline] BUG: KASAN: slab-use-after-free in atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:252 [inline] BUG: KASAN: slab-use-after-free in __refcount_add include/linux/refcount.h:184 [inline] BUG: KASAN: slab-use-after-free in __refcount_inc include/linux/refcount.h:241 [inline] BUG: KASAN: slab-use-after-free in refcount_inc include/linux/refcount.h:258 [inline] BUG: KASAN: slab-use-after-free in sock_hold include/net/sock.h:774 [inline] BUG: KASAN: slab-use-after-free in sco_sock_timeout+0x67/0x240 net/bluetooth/sco.c:88 Write of size 4 at addr ffff88801bf3f080 by task kworker/0:6/5145 CPU: 0 PID: 5145 Comm: kworker/0:6 Not tainted 6.8.0-syzkaller-05203-g19c5c04d3178 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 Workqueue: events sco_sock_timeout Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 instrument_atomic_read_write include/linux/instrumented.h:96 [inline] atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:252 [inline] __refcount_add include/linux/refcount.h:184 [inline] __refcount_inc include/linux/refcount.h:241 [inline] refcount_inc include/linux/refcount.h:258 [inline] sock_hold include/net/sock.h:774 [inline] sco_sock_timeout+0x67/0x240 net/bluetooth/sco.c:88 process_one_work kernel/workqueue.c:3254 [inline] process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335 worker_thread+0x86d/0xd70 kernel/workqueue.c:3416 kthread+0x2f0/0x390 kernel/kthread.c:388 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 Allocated by task 7526: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:370 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slub.c:3981 [inline] __kmalloc_node_track_caller+0x24c/0x4e0 mm/slub.c:4001 kmalloc_reserve+0x111/0x2a0 net/core/skbuff.c:599 __alloc_skb+0x1f3/0x440 net/core/skbuff.c:668 alloc_skb include/linux/skbuff.h:1318 [inline] alloc_skb_with_frags+0xc3/0x770 net/core/skbuff.c:6504 sock_alloc_send_pskb+0x91a/0xa60 net/core/sock.c:2795 sock_alloc_send_skb include/net/sock.h:1835 [inline] mld_newpack+0x1c3/0xa90 net/ipv6/mcast.c:1746 add_grhead net/ipv6/mcast.c:1849 [inline] add_grec+0x1492/0x19a0 net/ipv6/mcast.c:1987 mld_send_initial_cr+0x228/0x4b0 net/ipv6/mcast.c:2233 mld_dad_work+0x44/0x500 net/ipv6/mcast.c:2259 process_one_work kernel/workqueue.c:3254 [inline] process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335 worker_thread+0x86d/0xd70 kernel/workqueue.c:3416 kthread+0x2f0/0x390 kernel/kthread.c:388 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 Freed by task 7526: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:589 poison_slab_object+0xa6/0xe0 mm/kasan/common.c:240 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2121 [inline] slab_free mm/slub.c:4299 [inline] kfree+0x14a/0x380 mm/slub.c:4409 skb_kfree_head net/core/skbuff.c:1096 [inline] skb_free_head net/core/skbuff.c:1108 [inline] skb_release_data+0x585/0x870 net/core/skbuff.c:1136 skb_release_all net/core/skbuff.c:1202 [inline] __kfree_skb net/core/skbuff.c:1216 [inline] kfree_skb_reason+0x195/0x390 net/core/skbuff.c:1252 kfree_skb include/linux/skbuff.h:1267 [inline] ip6_mc_input+0xa1b/0xc30 net/ipv6/ip6_input.c:589 NF_HOOK+0x3a4/0x450 include/linux/netfilter.h:314 __netif_receive_skb_one_core net/core/dev.c:5538 [inline] __netif_receive_skb+0x1ea/0x6a0 net/core/dev.c:5652 process_backlog+0x39d/0x7a0 net/core/dev.c:5981 __napi_poll+0xcb/0x490 net/core/dev.c:6632 napi_poll net/core/dev.c:6701 [inline] net_rx_action+0x7bb/0x1090 net/core/dev.c:6813 __do_softirq+0x2bc/0x943 kernel/softirq.c:554 The buggy address belongs to the object at ffff88801bf3f000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 128 bytes inside of freed 2048-byte region [ffff88801bf3f000, ffff88801bf3f800) The buggy address belongs to the physical page: page:ffffea00006fce00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1bf38 head:ffffea00006fce00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000000840 ffff888014c42000 dead000000000100 dead000000000122 raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 6220335740, free_ts 0 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1533 prep_new_page mm/page_alloc.c:1540 [inline] get_page_from_freelist+0x33ea/0x3580 mm/page_alloc.c:3311 __alloc_pages+0x256/0x680 mm/page_alloc.c:4569 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] alloc_slab_page+0x5f/0x160 mm/slub.c:2190 allocate_slab mm/slub.c:2354 [inline] new_slab+0x84/0x2f0 mm/slub.c:2407 ___slab_alloc+0xd1b/0x13e0 mm/slub.c:3540 __slab_alloc mm/slub.c:3625 [inline] __slab_alloc_node mm/slub.c:3678 [inline] slab_alloc_node mm/slub.c:3850 [inline] kmalloc_trace+0x267/0x360 mm/slub.c:4007 kmalloc include/linux/slab.h:590 [inline] kzalloc include/linux/slab.h:711 [inline] acpi_os_allocate_zeroed include/acpi/platform/aclinuxex.h:57 [inline] acpi_ds_create_walk_state+0x103/0x2a0 drivers/acpi/acpica/dswstate.c:518 acpi_ps_execute_method+0x245/0x880 drivers/acpi/acpica/psxface.c:134 acpi_ns_evaluate+0x5df/0xa40 drivers/acpi/acpica/nseval.c:205 acpi_evaluate_object+0x59b/0xaf0 drivers/acpi/acpica/nsxfeval.c:354 acpi_evaluate_integer+0x11b/0x300 drivers/acpi/utils.c:260 acpi_bus_get_status_handle drivers/acpi/bus.c:82 [inline] acpi_bus_get_status+0x174/0x3a0 drivers/acpi/bus.c:111 acpi_pci_link_set+0x5ad/0xaa0 drivers/acpi/pci_link.c:353 acpi_pci_link_allocate drivers/acpi/pci_link.c:584 [inline] acpi_pci_link_allocate_irq+0x6a9/0xc50 drivers/acpi/pci_link.c:630 acpi_pci_irq_enable+0x2af/0x9a0 drivers/acpi/pci_irq.c:426 page_owner free stack trace missing Memory state around the buggy address: ffff88801bf3ef80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88801bf3f000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88801bf3f080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88801bf3f100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88801bf3f180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================