wlan1: authentication with 08:02:11:00:00:00 timed out
==================================================================
BUG: KASAN: slab-use-after-free in __lock_acquire+0x10c/0x7904 kernel/locking/lockdep.c:5089
Read of size 8 at addr ffff0000dd312c90 by task kworker/u8:2/34

CPU: 0 UID: 0 PID: 34 Comm: kworker/u8:2 Not tainted 6.13.0-rc3-syzkaller-g573067a5a685 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: events_unbound cfg80211_wiphy_work
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C)
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x198/0x538 mm/kasan/report.c:489
 kasan_report+0xd8/0x138 mm/kasan/report.c:602
 __asan_report_load8_noabort+0x20/0x2c mm/kasan/report_generic.c:381
 __lock_acquire+0x10c/0x7904 kernel/locking/lockdep.c:5089
 lock_acquire+0x23c/0x724 kernel/locking/lockdep.c:5849
 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
 _raw_spin_lock+0x48/0x60 kernel/locking/spinlock.c:154
 spin_lock include/linux/spinlock.h:351 [inline]
 lockref_get+0x20/0x74 lib/lockref.c:50
 dget include/linux/dcache.h:340 [inline]
 simple_recursive_removal+0x40/0x744 fs/libfs.c:618
 debugfs_remove+0x60/0x88 fs/debugfs/inode.c:812
 ieee80211_sta_debugfs_remove+0x44/0x6c net/mac80211/debugfs_sta.c:1284
 __sta_info_destroy_part2+0x31c/0x410 net/mac80211/sta_info.c:1476
 __sta_info_destroy net/mac80211/sta_info.c:1492 [inline]
 sta_info_destroy_addr+0x11c/0x150 net/mac80211/sta_info.c:1504
 ieee80211_destroy_auth_data+0x114/0x23c net/mac80211/mlme.c:4230
 ieee80211_sta_work+0xe60/0x2ebc net/mac80211/mlme.c:7878
 ieee80211_iface_work+0xbec/0xc88 net/mac80211/iface.c:1686
 cfg80211_wiphy_work+0x2b8/0x4f4 net/wireless/core.c:440
 process_one_work+0x7a8/0x15cc kernel/workqueue.c:3229
 process_scheduled_works kernel/workqueue.c:3310 [inline]
 worker_thread+0x97c/0xeec kernel/workqueue.c:3391
 kthread+0x288/0x310 kernel/kthread.c:389
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862

Allocated by task 7039:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x40/0x78 mm/kasan/common.c:68
 kasan_save_alloc_info+0x40/0x50 mm/kasan/generic.c:568
 unpoison_slab_object mm/kasan/common.c:319 [inline]
 __kasan_slab_alloc+0x74/0x8c mm/kasan/common.c:345
 kasan_slab_alloc include/linux/kasan.h:250 [inline]
 slab_post_alloc_hook mm/slub.c:4119 [inline]
 slab_alloc_node mm/slub.c:4168 [inline]
 kmem_cache_alloc_lru_noprof+0x258/0x414 mm/slub.c:4187
 __d_alloc+0x40/0x658 fs/dcache.c:1646
 d_alloc fs/dcache.c:1726 [inline]
 d_alloc_parallel+0xc8/0x1184 fs/dcache.c:2490
 __lookup_slow+0x108/0x374 fs/namei.c:1776
 lookup_one_len+0x178/0x28c fs/namei.c:2905
 start_creating+0x19c/0x2e0 fs/debugfs/inode.c:378
 debugfs_create_dir+0x30/0x3cc fs/debugfs/inode.c:582
 ieee80211_sta_debugfs_add+0x118/0x6c4 net/mac80211/debugfs_sta.c:1259
 sta_info_insert_finish net/mac80211/sta_info.c:881 [inline]
 sta_info_insert_rcu+0xf3c/0x181c net/mac80211/sta_info.c:949
 sta_info_insert+0x20/0xcc net/mac80211/sta_info.c:954
 ieee80211_prep_connection+0xcb8/0x1050 net/mac80211/mlme.c:8396
 ieee80211_mgd_auth+0x9e8/0x1094 net/mac80211/mlme.c:8641
 ieee80211_auth+0x28/0x38 net/mac80211/cfg.c:2949
 rdev_auth net/wireless/rdev-ops.h:486 [inline]
 cfg80211_mlme_auth+0x4a4/0x8e4 net/wireless/mlme.c:291
 cfg80211_conn_do_work+0x3bc/0xb98 net/wireless/sme.c:183
 cfg80211_sme_connect net/wireless/sme.c:628 [inline]
 cfg80211_connect+0x1134/0x192c net/wireless/sme.c:1527
 nl80211_connect+0x12bc/0x1924 net/wireless/nl80211.c:12239
 genl_family_rcv_msg_doit net/netlink/genetlink.c:1115 [inline]
 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
 genl_rcv_msg+0x888/0xbb0 net/netlink/genetlink.c:1210
 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2542
 genl_rcv+0x38/0x50 net/netlink/genetlink.c:1219
 netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline]
 netlink_unicast+0x668/0x8a4 net/netlink/af_netlink.c:1347
 netlink_sendmsg+0x7a4/0xa8c net/netlink/af_netlink.c:1891
 sock_sendmsg_nosec net/socket.c:711 [inline]
 __sock_sendmsg net/socket.c:726 [inline]
 ____sys_sendmsg+0x56c/0x840 net/socket.c:2583
 ___sys_sendmsg net/socket.c:2637 [inline]
 __sys_sendmsg+0x238/0x304 net/socket.c:2669
 __do_sys_sendmsg net/socket.c:2674 [inline]
 __se_sys_sendmsg net/socket.c:2672 [inline]
 __arm64_sys_sendmsg+0x80/0x94 net/socket.c:2672
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744
 el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600

Freed by task 16:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x40/0x78 mm/kasan/common.c:68
 kasan_save_free_info+0x54/0x6c mm/kasan/generic.c:582
 poison_slab_object mm/kasan/common.c:247 [inline]
 __kasan_slab_free+0x64/0x8c mm/kasan/common.c:264
 kasan_slab_free include/linux/kasan.h:233 [inline]
 slab_free_hook mm/slub.c:2353 [inline]
 slab_free mm/slub.c:4613 [inline]
 kmem_cache_free+0x198/0x554 mm/slub.c:4715
 __d_free+0x28/0x38 fs/dcache.c:315
 rcu_do_batch kernel/rcu/tree.c:2567 [inline]
 rcu_core+0x898/0x1b5c kernel/rcu/tree.c:2823
 rcu_core_si+0x10/0x1c kernel/rcu/tree.c:2840
 handle_softirqs+0x320/0xd34 kernel/softirq.c:561
 run_ksoftirqd+0x70/0xc0 kernel/softirq.c:950
 smpboot_thread_fn+0x4b0/0x90c kernel/smpboot.c:164
 kthread+0x288/0x310 kernel/kthread.c:389
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862

Last potentially related work creation:
 kasan_save_stack+0x40/0x6c mm/kasan/common.c:47
 __kasan_record_aux_stack+0xb8/0xd0 mm/kasan/generic.c:544
 kasan_record_aux_stack_noalloc+0x14/0x20 mm/kasan/generic.c:554
 __call_rcu_common kernel/rcu/tree.c:3086 [inline]
 call_rcu+0x104/0xb00 kernel/rcu/tree.c:3190
 dentry_free+0xa8/0x174
 __dentry_kill+0x44c/0x5e8 fs/dcache.c:644
 dput+0x1b8/0x290 fs/dcache.c:867
 find_next_child fs/libfs.c:611 [inline]
 simple_recursive_removal+0x254/0x744 fs/libfs.c:626
 debugfs_remove+0x60/0x88 fs/debugfs/inode.c:812
 ieee80211_debugfs_remove_netdev net/mac80211/debugfs_netdev.c:1021 [inline]
 ieee80211_debugfs_recreate_netdev+0xbc/0x125c net/mac80211/debugfs_netdev.c:1043
 drv_remove_interface+0x1b0/0x5c0 net/mac80211/driver-ops.c:120
 _ieee80211_change_mac net/mac80211/iface.c:277 [inline]
 ieee80211_change_mac+0x8f0/0xf80 net/mac80211/iface.c:309
 dev_set_mac_address+0x1f4/0x430 net/core/dev.c:9207
 bond_set_mac_address+0x230/0x674 drivers/net/bonding/bond_main.c:4903
 dev_set_mac_address+0x1f4/0x430 net/core/dev.c:9207
 dev_set_mac_address_user+0x44/0x68 net/core/dev.c:9226
 do_setlink+0x564/0x3640 net/core/rtnetlink.c:3064
 rtnl_changelink net/core/rtnetlink.c:3723 [inline]
 __rtnl_newlink net/core/rtnetlink.c:3874 [inline]
 rtnl_newlink+0x11b4/0x1960 net/core/rtnetlink.c:4011
 rtnetlink_rcv_msg+0x670/0xa9c net/core/rtnetlink.c:6921
 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2542
 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6948
 netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline]
 netlink_unicast+0x668/0x8a4 net/netlink/af_netlink.c:1347
 netlink_sendmsg+0x7a4/0xa8c net/netlink/af_netlink.c:1891
 sock_sendmsg_nosec net/socket.c:711 [inline]
 __sock_sendmsg net/socket.c:726 [inline]
 ____sys_sendmsg+0x56c/0x840 net/socket.c:2583
 ___sys_sendmsg net/socket.c:2637 [inline]
 __sys_sendmsg+0x238/0x304 net/socket.c:2669
 __do_sys_sendmsg net/socket.c:2674 [inline]
 __se_sys_sendmsg net/socket.c:2672 [inline]
 __arm64_sys_sendmsg+0x80/0x94 net/socket.c:2672
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744
 el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600

The buggy address belongs to the object at ffff0000dd312bc0
 which belongs to the cache dentry of size 312
The buggy address is located 208 bytes inside of
 freed 312-byte region [ffff0000dd312bc0, ffff0000dd312cf8)

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11d312
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff0000ce0a2c01
flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 05ffc00000000040 ffff0000c1895a00 fffffdffc374cf80 dead000000000002
raw: 0000000000000000 0000000000150015 00000001f5000000 ffff0000ce0a2c01
head: 05ffc00000000040 ffff0000c1895a00 fffffdffc374cf80 dead000000000002
head: 0000000000000000 0000000000150015 00000001f5000000 ffff0000ce0a2c01
head: 05ffc00000000001 fffffdffc374c481 ffffffffffffffff 0000000000000000
head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000dd312b80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
 ffff0000dd312c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff0000dd312c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc
                         ^
 ffff0000dd312d00: fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb fb
 ffff0000dd312d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Unable to handle kernel NULL pointer dereference at virtual address 00000000000000d8
Mem abort info:
  ESR = 0x0000000096000004
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x04: level 0 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=00000001118eb000
[00000000000000d8] pgd=0000000000000000, p4d=0000000000000000
Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 UID: 0 PID: 34 Comm: kworker/u8:2 Tainted: G    B              6.13.0-rc3-syzkaller-g573067a5a685 #0
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: events_unbound cfg80211_wiphy_work
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __lse__cmpxchg_case_acq_64 arch/arm64/include/asm/atomic_lse.h:272 [inline]
pc : __cmpxchg_case_acq_64 arch/arm64/include/asm/cmpxchg.h:121 [inline]
pc : __cmpxchg_acq arch/arm64/include/asm/cmpxchg.h:169 [inline]
pc : raw_atomic64_cmpxchg_acquire include/linux/atomic/atomic-arch-fallback.h:4181 [inline]
pc : raw_atomic64_try_cmpxchg_acquire include/linux/atomic/atomic-arch-fallback.h:4299 [inline]
pc : raw_atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-long.h:1482 [inline]
pc : atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:4458 [inline]
pc : rwsem_write_trylock+0xc8/0x420 kernel/locking/rwsem.c:267
lr : instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
lr : atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:4457 [inline]
lr : rwsem_write_trylock+0xa8/0x420 kernel/locking/rwsem.c:267
sp : ffff800097ff7420
x29: ffff800097ff7490 x28: dfff800000000000 x27: ffff0000d0d25720
x26: 1fffe0001b18f82f x25: dfff800000000000 x24: 0000000000000000
x23: 0000000000000000 x22: 1ffff00012ffee88 x21: dfff800000000000
x20: ffff800097ff7460 x19: 00000000000000d8 x18: 1fffe000366fc27e
x17: ffff80008f99d000 x16: ffff80008045e934 x15: 0000000000000001
x14: 1ffff00012ffee8c x13: 0000000000000000 x12: 0000000000000000
x11: ffff700012ffee8d x10: 1ffff00012ffee8c x9 : dfff800000000000
x8 : 0000000000000001 x7 : 1fffe000366fc27f x6 : ffff800080da4f4c
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff80008045e9dc
x2 : 0000000000000001 x1 : 0000000000000008 x0 : 0000000000000001
Call trace:
 __lse__cmpxchg_case_acq_64 arch/arm64/include/asm/atomic_lse.h:272 [inline] (P)
 __cmpxchg_case_acq_64 arch/arm64/include/asm/cmpxchg.h:121 [inline] (P)
 __cmpxchg_acq arch/arm64/include/asm/cmpxchg.h:169 [inline] (P)
 raw_atomic64_cmpxchg_acquire include/linux/atomic/atomic-arch-fallback.h:4181 [inline] (P)
 raw_atomic64_try_cmpxchg_acquire include/linux/atomic/atomic-arch-fallback.h:4299 [inline] (P)
 raw_atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-long.h:1482 [inline] (P)
 atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:4458 [inline] (P)
 rwsem_write_trylock+0xc8/0x420 kernel/locking/rwsem.c:267 (P)
 __down_write_common kernel/locking/rwsem.c:1303 [inline]
 __down_write kernel/locking/rwsem.c:1313 [inline]
 down_write+0x60/0xc0 kernel/locking/rwsem.c:1578
 inode_lock include/linux/fs.h:818 [inline]
 simple_recursive_removal+0x90/0x744 fs/libfs.c:623
 debugfs_remove+0x60/0x88 fs/debugfs/inode.c:812
 ieee80211_sta_debugfs_remove+0x44/0x6c net/mac80211/debugfs_sta.c:1284
 __sta_info_destroy_part2+0x31c/0x410 net/mac80211/sta_info.c:1476
 __sta_info_destroy net/mac80211/sta_info.c:1492 [inline]
 sta_info_destroy_addr+0x11c/0x150 net/mac80211/sta_info.c:1504
 ieee80211_destroy_auth_data+0x114/0x23c net/mac80211/mlme.c:4230
 ieee80211_sta_work+0xe60/0x2ebc net/mac80211/mlme.c:7878
 ieee80211_iface_work+0xbec/0xc88 net/mac80211/iface.c:1686
 cfg80211_wiphy_work+0x2b8/0x4f4 net/wireless/core.c:440
 process_one_work+0x7a8/0x15cc kernel/workqueue.c:3229
 process_scheduled_works kernel/workqueue.c:3310 [inline]
 worker_thread+0x97c/0xeec kernel/workqueue.c:3391
 kthread+0x288/0x310 kernel/kthread.c:389
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862
Code: f94023f7 d503201f aa1703f8 52800028 (c8f87e68) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	f94023f7 	ldr	x23, [sp, #64]
   4:	d503201f 	nop
   8:	aa1703f8 	mov	x24, x23
   c:	52800028 	mov	w8, #0x1                   	// #1
* 10:	c8f87e68 	casa	x24, x8, [x19] <-- trapping instruction