==================================================================
BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
BUG: KASAN: slab-use-after-free in atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:252 [inline]
BUG: KASAN: slab-use-after-free in __refcount_add include/linux/refcount.h:184 [inline]
BUG: KASAN: slab-use-after-free in __refcount_inc include/linux/refcount.h:241 [inline]
BUG: KASAN: slab-use-after-free in refcount_inc include/linux/refcount.h:258 [inline]
BUG: KASAN: slab-use-after-free in sock_hold include/net/sock.h:774 [inline]
BUG: KASAN: slab-use-after-free in sco_sock_timeout+0x68/0x2c0 net/bluetooth/sco.c:88
Write of size 4 at addr ffff88801caac080 by task kworker/1:2/5078

CPU: 1 PID: 5078 Comm: kworker/1:2 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: events sco_sock_timeout
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0xc3/0x620 mm/kasan/report.c:488
 kasan_report+0xd9/0x110 mm/kasan/report.c:601
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189
 instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
 atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:252 [inline]
 __refcount_add include/linux/refcount.h:184 [inline]
 __refcount_inc include/linux/refcount.h:241 [inline]
 refcount_inc include/linux/refcount.h:258 [inline]
 sock_hold include/net/sock.h:774 [inline]
 sco_sock_timeout+0x68/0x2c0 net/bluetooth/sco.c:88
 process_one_work+0x9a9/0x1a60 kernel/workqueue.c:3254
 process_scheduled_works kernel/workqueue.c:3335 [inline]
 worker_thread+0x6c8/0xf70 kernel/workqueue.c:3416
 kthread+0x2c1/0x3a0 kernel/kthread.c:388
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
 </TASK>

Allocated by task 13768:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:387
 kasan_kmalloc include/linux/kasan.h:211 [inline]
 __do_kmalloc_node mm/slub.c:3966 [inline]
 __kmalloc_node_track_caller+0x220/0x470 mm/slub.c:3986
 kmalloc_reserve+0xef/0x2c0 net/core/skbuff.c:599
 __alloc_skb+0x164/0x380 net/core/skbuff.c:668
 alloc_skb include/linux/skbuff.h:1318 [inline]
 nlmsg_new include/net/netlink.h:1010 [inline]
 audit_buffer_alloc kernel/audit.c:1794 [inline]
 audit_log_start+0x2e0/0x7d0 kernel/audit.c:1912
 integrity_audit_message+0x10d/0x460 security/integrity/integrity_audit.c:47
 integrity_audit_msg+0x41/0x60 security/integrity/integrity_audit.c:32
 ima_add_violation+0x1c7/0x3d0 security/integrity/ima/ima_api.c:159
 ima_rdwr_violation_check security/integrity/ima/ima_main.c:149 [inline]
 process_measurement+0x1678/0x2100 security/integrity/ima/ima_main.c:257
 ima_file_check+0xc1/0x110 security/integrity/ima/ima_main.c:559
 security_file_post_open+0x6d/0xc0 security/security.c:2975
 do_open fs/namei.c:3644 [inline]
 path_openat+0x17ad/0x2990 fs/namei.c:3799
 do_filp_open+0x1dc/0x430 fs/namei.c:3826
 do_sys_openat2+0x17a/0x1e0 fs/open.c:1406
 do_sys_open fs/open.c:1421 [inline]
 __do_sys_creat fs/open.c:1497 [inline]
 __se_sys_creat fs/open.c:1491 [inline]
 __x64_sys_creat+0xcd/0x120 fs/open.c:1491
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xd2/0x260 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x6d/0x75

Freed by task 28:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
 poison_slab_object mm/kasan/common.c:240 [inline]
 __kasan_slab_free+0x11d/0x1a0 mm/kasan/common.c:256
 kasan_slab_free include/linux/kasan.h:184 [inline]
 slab_free_hook mm/slub.c:2106 [inline]
 slab_free mm/slub.c:4280 [inline]
 kfree+0x129/0x370 mm/slub.c:4390
 skb_kfree_head net/core/skbuff.c:1096 [inline]
 skb_free_head+0x110/0x1e0 net/core/skbuff.c:1108
 skb_release_data+0x76c/0x990 net/core/skbuff.c:1136
 skb_release_all net/core/skbuff.c:1202 [inline]
 __kfree_skb net/core/skbuff.c:1216 [inline]
 kfree_skb_reason+0x12d/0x210 net/core/skbuff.c:1252
 kfree_skb include/linux/skbuff.h:1267 [inline]
 kauditd_hold_skb+0x135/0x240 kernel/audit.c:611
 kauditd_send_queue+0x236/0x290 kernel/audit.c:766
 kauditd_thread+0x61e/0xa80 kernel/audit.c:890
 kthread+0x2c1/0x3a0 kernel/kthread.c:388
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243

The buggy address belongs to the object at ffff88801caac000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 128 bytes inside of
 freed 2048-byte region [ffff88801caac000, ffff88801caac800)

The buggy address belongs to the physical page:
page:ffffea000072aa00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1caa8
head:ffffea000072aa00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000840 ffff888015042000 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 5149494959, free_ts 0
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x2d4/0x350 mm/page_alloc.c:1533
 prep_new_page mm/page_alloc.c:1540 [inline]
 get_page_from_freelist+0xa28/0x3780 mm/page_alloc.c:3311
 __alloc_pages+0x22b/0x2410 mm/page_alloc.c:4569
 __alloc_pages_node include/linux/gfp.h:238 [inline]
 alloc_pages_node include/linux/gfp.h:261 [inline]
 alloc_slab_page mm/slub.c:2175 [inline]
 allocate_slab mm/slub.c:2338 [inline]
 new_slab+0xcc/0x3a0 mm/slub.c:2391
 ___slab_alloc+0x66d/0x1790 mm/slub.c:3525
 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3610
 __slab_alloc_node mm/slub.c:3663 [inline]
 slab_alloc_node mm/slub.c:3835 [inline]
 __do_kmalloc_node mm/slub.c:3965 [inline]
 __kmalloc_node_track_caller+0x367/0x470 mm/slub.c:3986
 kmalloc_reserve+0xef/0x2c0 net/core/skbuff.c:599
 pskb_expand_head+0x240/0x11f0 net/core/skbuff.c:2245
 netlink_trim+0x1ef/0x250 net/netlink/af_netlink.c:1317
 netlink_broadcast_filtered+0xc7/0xf10 net/netlink/af_netlink.c:1523
 nlmsg_multicast_filtered include/net/netlink.h:1111 [inline]
 nlmsg_multicast include/net/netlink.h:1130 [inline]
 genlmsg_mcast net/netlink/genetlink.c:1956 [inline]
 genlmsg_multicast_allns+0x25f/0x350 net/netlink/genetlink.c:1975
 genl_ctrl_event.isra.0+0x204/0x9e0 net/netlink/genetlink.c:1507
 genl_register_family.part.0+0x924/0x11a0 net/netlink/genetlink.c:828
 genl_register_family+0x32/0x50 net/netlink/genetlink.c:784
 wpan_phy_class_init+0xb6/0xf0 net/ieee802154/core.c:383
page_owner free stack trace missing

Memory state around the buggy address:
 ffff88801caabf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88801caac000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88801caac080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff88801caac100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88801caac180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================