IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready ================================================================== IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready BUG: KASAN: slab-out-of-bounds in memcpy include/linux/string.h:347 [inline] BUG: KASAN: slab-out-of-bounds in bacpy include/net/bluetooth/bluetooth.h:233 [inline] BUG: KASAN: slab-out-of-bounds in hci_extended_inquiry_result_evt net/bluetooth/hci_event.c:3840 [inline] BUG: KASAN: slab-out-of-bounds in hci_event_packet+0x8e05/0x9a1f net/bluetooth/hci_event.c:5375 Read of size 6 at addr ffff888098f027c8 by task kworker/u5:0/1179 CPU: 1 PID: 1179 Comm: kworker/u5:0 Not tainted 4.14.172-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: hci0 hci_rx_work Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0xf7/0x13b lib/dump_stack.c:58 print_address_description.cold.7+0x9/0x1c9 mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 [inline] kasan_report.cold.8+0x11a/0x2d3 mm/kasan/report.c:409 __asan_report_load_n_noabort+0xf/0x20 mm/kasan/report.c:440 memcpy include/linux/string.h:347 [inline] bacpy include/net/bluetooth/bluetooth.h:233 [inline] hci_extended_inquiry_result_evt net/bluetooth/hci_event.c:3840 [inline] hci_event_packet+0x8e05/0x9a1f net/bluetooth/hci_event.c:5375 IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready hci_rx_work+0x356/0x8e0 net/bluetooth/hci_core.c:4244 process_one_work+0x79e/0x16c0 kernel/workqueue.c:2114 IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready worker_thread+0xcc/0xee0 kernel/workqueue.c:2248 IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready kthread+0x338/0x400 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 Allocated by task 7330: save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59 save_stack+0x43/0xd0 mm/kasan/kasan.c:447 hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:551 __do_kmalloc_node mm/slab.c:3682 [inline] __kmalloc_node_track_caller+0x50/0x70 mm/slab.c:3696 __kmalloc_reserve.isra.38+0x2c/0xc0 net/core/skbuff.c:137 __alloc_skb+0xc1/0x500 net/core/skbuff.c:205 alloc_skb include/linux/skbuff.h:980 [inline] bt_skb_alloc include/net/bluetooth/bluetooth.h:336 [inline] vhci_get_user drivers/bluetooth/hci_vhci.c:180 [inline] vhci_write+0xa8/0x3e2 drivers/bluetooth/hci_vhci.c:299 call_write_iter include/linux/fs.h:1777 [inline] new_sync_write fs/read_write.c:469 [inline] __vfs_write+0x413/0x840 fs/read_write.c:482 vfs_write+0x150/0x4f0 fs/read_write.c:544 SYSC_write fs/read_write.c:590 [inline] SyS_write+0x100/0x250 fs/read_write.c:582 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 Freed by task 0: hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network (stack is not available) The buggy address belongs to the object at ffff888098f025c0 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 8 bytes to the right of 512-byte region [ffff888098f025c0, ffff888098f027c0) The buggy address belongs to the page: page:ffffea000263c080 count:1 mapcount:0 mapping:ffff888098f020c0 index:0x0 flags: 0xfffe0000000100(slab) raw: 00fffe0000000100 ffff888098f020c0 0000000000000000 0000000100000006 raw: ffffea0002531060 ffffea000284e760 ffff8880aa800940 0000000000000000 page dumped because: kasan: bad access detected IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready Memory state around the buggy address: ffff888098f02680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888098f02700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff888098f02780: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc ^ ffff888098f02800: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready ffff888098f02880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready