================================================================== BUG: KASAN: use-after-free in device_for_each_child+0xa8/0x174 drivers/base/core.c:4044 Read of size 8 at addr ffff0000e4f355f8 by task kbnepd bnep0/7824 CPU: 1 PID: 7824 Comm: kbnepd bnep0 Not tainted 6.9.0-rc4-syzkaller-g6a71d2909427 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call trace: dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:317 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:324 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0x198/0x538 mm/kasan/report.c:488 kasan_report+0xd8/0x138 mm/kasan/report.c:601 __asan_report_load8_noabort+0x20/0x2c mm/kasan/report_generic.c:381 device_for_each_child+0xa8/0x174 drivers/base/core.c:4044 pm_runtime_set_memalloc_noio+0xf0/0x210 drivers/base/power/runtime.c:248 netdev_unregister_kobject+0x148/0x208 net/core/net-sysfs.c:2106 unregister_netdevice_many_notify+0x117c/0x1770 net/core/dev.c:11129 unregister_netdevice_many net/core/dev.c:11157 [inline] unregister_netdevice_queue net/core/dev.c:11036 [inline] unregister_netdevice include/linux/netdevice.h:3115 [inline] unregister_netdev+0x180/0x1f8 net/core/dev.c:11175 bnep_session+0x23bc/0x257c net/bluetooth/bnep/core.c:525 kthread+0x288/0x310 kernel/kthread.c:388 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x124f35 flags: 0x5ffe00000000000(node=0|zone=2|lastcpupid=0xfff) page_type: 0xffffffff() raw: 05ffe00000000000 fffffdffc393cd88 fffffdffc393cd08 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000e4f35480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff0000e4f35500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff0000e4f35580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff0000e4f35600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff0000e4f35680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================