Bluetooth: hci0: Opcode 0x0406 failed: -4 Bluetooth: hci0: Opcode 0x0406 failed: -4 Bluetooth: hci0: Opcode 0x0406 failed: -4 ================================================================== BUG: KASAN: slab-out-of-bounds in __list_del_entry_valid_or_report+0x8c/0x1b4 lib/list_debug.c:62 Read of size 8 at addr ffff0000cbea9570 by task syz.2.208/7415 CPU: 0 UID: 0 PID: 7415 Comm: syz.2.208 Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 print_address_description+0xa8/0x238 mm/kasan/report.c:378 print_report+0x68/0x84 mm/kasan/report.c:482 kasan_report+0xb0/0x110 mm/kasan/report.c:595 __asan_report_load8_noabort+0x20/0x2c mm/kasan/report_generic.c:381 __list_del_entry_valid_or_report+0x8c/0x1b4 lib/list_debug.c:62 __list_del_entry_valid include/linux/list.h:132 [inline] __list_del_entry include/linux/list.h:223 [inline] list_del_init include/linux/list.h:295 [inline] bt_accept_unlink+0x40/0x248 net/bluetooth/af_bluetooth.c:259 l2cap_sock_teardown_cb+0x148/0x360 net/bluetooth/l2cap_sock.c:1616 l2cap_chan_del+0xb8/0x470 net/bluetooth/l2cap_core.c:655 l2cap_conn_del+0x2f8/0x5f0 net/bluetooth/l2cap_core.c:1787 l2cap_connect_cfm+0x110/0xd40 net/bluetooth/l2cap_core.c:7259 hci_connect_cfm include/net/bluetooth/hci_core.h:2106 [inline] hci_conn_failed+0x198/0x318 net/bluetooth/hci_conn.c:1312 hci_abort_conn_sync+0x558/0xbb8 net/bluetooth/hci_sync.c:5698 hci_disconnect_all_sync+0x1b0/0x35c net/bluetooth/hci_sync.c:5721 hci_suspend_sync+0x468/0xb3c net/bluetooth/hci_sync.c:6197 hci_suspend_dev+0x1dc/0x3f4 net/bluetooth/hci_core.c:2849 hci_suspend_notifier+0xe4/0x270 net/bluetooth/hci_core.c:2420 notifier_call_chain+0x1b8/0x4e4 kernel/notifier.c:85 notifier_call_chain_robust kernel/notifier.c:120 [inline] blocking_notifier_call_chain_robust+0x88/0x110 kernel/notifier.c:345 pm_notifier_call_chain_robust+0x34/0x60 kernel/power/main.c:103 snapshot_open+0x17c/0x268 kernel/power/user.c:77 misc_open+0x2d0/0x33c drivers/char/misc.c:163 chrdev_open+0x1b0/0x4b0 fs/char_dev.c:414 do_dentry_open+0x7a4/0x10bc fs/open.c:965 vfs_open+0x44/0x2d4 fs/open.c:1097 do_open fs/namei.c:3975 [inline] path_openat+0x2424/0x2c40 fs/namei.c:4134 do_filp_open+0x18c/0x36c fs/namei.c:4161 do_sys_openat2+0x11c/0x1b4 fs/open.c:1437 do_sys_open fs/open.c:1452 [inline] __do_sys_openat fs/open.c:1468 [inline] __se_sys_openat fs/open.c:1463 [inline] __arm64_sys_openat+0x120/0x158 fs/open.c:1463 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x5c/0x254 arch/arm64/kernel/entry-common.c:746 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:765 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596 Allocated by task 7374: kasan_save_stack mm/kasan/common.c:56 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:77 kasan_save_alloc_info+0x44/0x54 mm/kasan/generic.c:573 poison_kmalloc_redzone mm/kasan/common.c:400 [inline] __kasan_kmalloc+0x9c/0xb4 mm/kasan/common.c:417 kasan_kmalloc include/linux/kasan.h:262 [inline] __kmalloc_cache_noprof+0x3a4/0x65c mm/slub.c:5748 kmalloc_noprof include/linux/slab.h:957 [inline] kzalloc_noprof include/linux/slab.h:1094 [inline] device_create_groups_vargs+0xd8/0x26c drivers/base/core.c:4353 device_create+0xe8/0x134 drivers/base/core.c:4410 bdi_register_va+0x13c/0x7e4 mm/backing-dev.c:1099 super_setup_bdi_name+0xec/0x1f0 fs/super.c:1810 fuse_bdi_init fs/fuse/inode.c:1589 [inline] fuse_fill_super_common+0x5fc/0xeec fs/fuse/inode.c:1876 fuse_fill_super+0x17c/0x1e4 fs/fuse/inode.c:1957 vfs_get_super fs/super.c:1324 [inline] get_tree_nodev+0xb4/0x144 fs/super.c:1343 fuse_get_tree+0x2e8/0x448 fs/fuse/inode.c:2034 vfs_get_tree+0x90/0x28c fs/super.c:1751 fc_mount fs/namespace.c:1208 [inline] do_new_mount_fc fs/namespace.c:3651 [inline] do_new_mount+0x284/0x944 fs/namespace.c:3727 path_mount+0x5b4/0xdfc fs/namespace.c:4037 do_mount fs/namespace.c:4050 [inline] __do_sys_mount fs/namespace.c:4238 [inline] __se_sys_mount fs/namespace.c:4215 [inline] __arm64_sys_mount+0x3e8/0x468 fs/namespace.c:4215 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x5c/0x254 arch/arm64/kernel/entry-common.c:746 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:765 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596 The buggy address belongs to the object at ffff0000cbea9000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 240 bytes to the right of allocated 1152-byte region [ffff0000cbea9000, ffff0000cbea9480) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff0000cbea8000 pfn:0x10bea8 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x5ffc00000000240(workingset|head|node=0|zone=2|lastcpupid=0x7ff) page_type: f5(slab) raw: 05ffc00000000240 ffff0000c0002000 ffff0000c0000948 fffffdffc3254c10 raw: ffff0000cbea8000 0000000000080006 00000000f5000000 0000000000000000 head: 05ffc00000000240 ffff0000c0002000 ffff0000c0000948 fffffdffc3254c10 head: ffff0000cbea8000 0000000000080006 00000000f5000000 0000000000000000 head: 05ffc00000000003 fffffdffc32faa01 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000cbea9400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff0000cbea9480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff0000cbea9500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff0000cbea9580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff0000cbea9600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== slab kmalloc-2k start ffff0000cbea9000 pointer offset 1392 size 2048 list_del corruption. prev->next should be ffff0000d6917570, but was 0000000000000000. (prev=ffff0000cbea9570) ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:64! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP Modules linked in: CPU: 0 UID: 0 PID: 7415 Comm: syz.2.208 Tainted: G B syzkaller #0 PREEMPT Tainted: [B]=BAD_PAGE Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : __list_del_entry_valid_or_report+0x17c/0x1b4 lib/list_debug.c:62 lr : __list_del_entry_valid_or_report+0x17c/0x1b4 lib/list_debug.c:62 sp : ffff80009e1f6da0 x29: ffff80009e1f6da0 x28: 0000000000000003 x27: ffff0000d691200c x26: ffff0000d6912000 x25: 1fffe0001ad22402 x24: dfff800000000000 x23: 1fffe000197d52ae x22: dfff800000000000 x21: ffff0000cbea9570 x20: ffff0000cbea9570 x19: ffff0000d6917570 x18: 00000000ffffffff x17: 20747562202c3037 x16: ffff800082de9540 x15: 0000000000000001 x14: 1ffff00013c3ed30 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000080000 x10: 000000000007ffff x9 : 1abf99272ecf3600 x8 : 1abf99272ecf3600 x7 : 0000000000000001 x6 : ffff8000805638d4 x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000807d5158 x2 : 0000000000000002 x1 : 0000000100000000 x0 : 000000000000006d Call trace: __list_del_entry_valid_or_report+0x17c/0x1b4 lib/list_debug.c:62 (P) __list_del_entry_valid include/linux/list.h:132 [inline] __list_del_entry include/linux/list.h:223 [inline] list_del_init include/linux/list.h:295 [inline] bt_accept_unlink+0x40/0x248 net/bluetooth/af_bluetooth.c:259 l2cap_sock_teardown_cb+0x148/0x360 net/bluetooth/l2cap_sock.c:1616 l2cap_chan_del+0xb8/0x470 net/bluetooth/l2cap_core.c:655 l2cap_conn_del+0x2f8/0x5f0 net/bluetooth/l2cap_core.c:1787 l2cap_connect_cfm+0x110/0xd40 net/bluetooth/l2cap_core.c:7259 hci_connect_cfm include/net/bluetooth/hci_core.h:2106 [inline] hci_conn_failed+0x198/0x318 net/bluetooth/hci_conn.c:1312 hci_abort_conn_sync+0x558/0xbb8 net/bluetooth/hci_sync.c:5698 hci_disconnect_all_sync+0x1b0/0x35c net/bluetooth/hci_sync.c:5721 hci_suspend_sync+0x468/0xb3c net/bluetooth/hci_sync.c:6197 hci_suspend_dev+0x1dc/0x3f4 net/bluetooth/hci_core.c:2849 hci_suspend_notifier+0xe4/0x270 net/bluetooth/hci_core.c:2420 notifier_call_chain+0x1b8/0x4e4 kernel/notifier.c:85 notifier_call_chain_robust kernel/notifier.c:120 [inline] blocking_notifier_call_chain_robust+0x88/0x110 kernel/notifier.c:345 pm_notifier_call_chain_robust+0x34/0x60 kernel/power/main.c:103 snapshot_open+0x17c/0x268 kernel/power/user.c:77 misc_open+0x2d0/0x33c drivers/char/misc.c:163 chrdev_open+0x1b0/0x4b0 fs/char_dev.c:414 do_dentry_open+0x7a4/0x10bc fs/open.c:965 vfs_open+0x44/0x2d4 fs/open.c:1097 do_open fs/namei.c:3975 [inline] path_openat+0x2424/0x2c40 fs/namei.c:4134 do_filp_open+0x18c/0x36c fs/namei.c:4161 do_sys_openat2+0x11c/0x1b4 fs/open.c:1437 do_sys_open fs/open.c:1452 [inline] __do_sys_openat fs/open.c:1468 [inline] __se_sys_openat fs/open.c:1463 [inline] __arm64_sys_openat+0x120/0x158 fs/open.c:1463 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x5c/0x254 arch/arm64/kernel/entry-common.c:746 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:765 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596 Code: 91210000 aa1303e1 aa1503e3 974c7189 (d4210000) ---[ end trace 0000000000000000 ]---