==================================================================
BUG: KASAN: use-after-free in hci_send_acl+0xdf4/0xf30 net/bluetooth/hci_core.c:3228
Read of size 8 at addr ffff8880510a4818 by task kworker/2:0/23

CPU: 2 PID: 23 Comm: kworker/2:0 Not tainted 6.5.0-syzkaller-11329-g708283abf896 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Workqueue: events l2cap_info_timeout
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:364 [inline]
 print_report+0xc4/0x620 mm/kasan/report.c:475
 kasan_report+0xda/0x110 mm/kasan/report.c:588
 hci_send_acl+0xdf4/0xf30 net/bluetooth/hci_core.c:3228
 l2cap_send_cmd+0x6dd/0x920 net/bluetooth/l2cap_core.c:977
 l2cap_send_conn_req+0x1e5/0x260 net/bluetooth/l2cap_core.c:1286
 l2cap_start_connection+0x11e/0x420 net/bluetooth/l2cap_core.c:1514
 l2cap_conn_start+0x7ae/0xa40 net/bluetooth/l2cap_core.c:1661
 process_one_work+0x887/0x15d0 kernel/workqueue.c:2630
 process_scheduled_works kernel/workqueue.c:2703 [inline]
 worker_thread+0x8bb/0x1290 kernel/workqueue.c:2784
 kthread+0x33a/0x430 kernel/kthread.c:388
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
 </TASK>

The buggy address belongs to the physical page:
page:ffffea0001442900 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x510a4
flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 04fff00000000000 ffffea00013f3148 ffffea0001caec48 0000000000000000
raw: 0000000000000000 ffff88801d584de0 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x540dc0(GFP_USER|__GFP_COMP|__GFP_ZERO|__GFP_ACCOUNT), pid 12568, tgid 12568 (modprobe), ts 274598479136, free_ts 274650978039
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x2cf/0x340 mm/page_alloc.c:1536
 prep_new_page mm/page_alloc.c:1543 [inline]
 get_page_from_freelist+0x10a9/0x31e0 mm/page_alloc.c:3183
 __alloc_pages+0x1d0/0x4a0 mm/page_alloc.c:4439
 alloc_pages+0x1a9/0x270 mm/mempolicy.c:2298
 pagetable_alloc include/linux/mm.h:2823 [inline]
 __pte_alloc_one include/asm-generic/pgalloc.h:68 [inline]
 pte_alloc_one+0x20/0x370 arch/x86/mm/pgtable.c:33
 do_fault_around mm/memory.c:4519 [inline]
 do_read_fault mm/memory.c:4558 [inline]
 do_fault mm/memory.c:4705 [inline]
 do_pte_missing mm/memory.c:3669 [inline]
 handle_pte_fault mm/memory.c:4978 [inline]
 __handle_mm_fault+0x285f/0x3e20 mm/memory.c:5119
 handle_mm_fault+0x47a/0xa00 mm/memory.c:5284
 do_user_addr_fault+0x30b/0x1010 arch/x86/mm/fault.c:1364
 handle_page_fault arch/x86/mm/fault.c:1505 [inline]
 exc_page_fault+0x5c/0xd0 arch/x86/mm/fault.c:1561
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:570
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1136 [inline]
 free_unref_page_prepare+0x476/0xa40 mm/page_alloc.c:2312
 free_unref_page+0x33/0x3b0 mm/page_alloc.c:2405
 __folio_put_small mm/swap.c:106 [inline]
 __folio_put+0xc3/0x110 mm/swap.c:129
 folio_put include/linux/mm.h:1475 [inline]
 put_page include/linux/mm.h:1544 [inline]
 free_page_and_swap_cache+0x25a/0x2d0 mm/swap_state.c:303
 __tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline]
 __tlb_remove_table_free mm/mmu_gather.c:154 [inline]
 tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:209
 rcu_do_batch kernel/rcu/tree.c:2139 [inline]
 rcu_core+0x7fb/0x1bb0 kernel/rcu/tree.c:2403
 __do_softirq+0x218/0x965 kernel/softirq.c:553

Memory state around the buggy address:
 ffff8880510a4700: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8880510a4780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff8880510a4800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                            ^
 ffff8880510a4880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8880510a4900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================