Bluetooth: Wrong link type (-22) ================================================================== BUG: KASAN: slab-use-after-free in l2cap_connect+0xeb1/0x10f0 net/bluetooth/l2cap_core.c:4145 Read of size 8 at addr ffff888179785000 by task kworker/u5:8/8694 CPU: 0 PID: 8694 Comm: kworker/u5:8 Not tainted 6.5.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Workqueue: hci2 hci_rx_work Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x3d/0x70 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:364 [inline] print_report+0xc4/0x620 mm/kasan/report.c:475 kasan_report+0xda/0x110 mm/kasan/report.c:588 l2cap_connect+0xeb1/0x10f0 net/bluetooth/l2cap_core.c:4145 l2cap_connect_req net/bluetooth/l2cap_core.c:4287 [inline] l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:5738 [inline] l2cap_sig_channel net/bluetooth/l2cap_core.c:6523 [inline] l2cap_recv_frame+0x2b27/0x83c0 net/bluetooth/l2cap_core.c:7802 hci_acldata_packet net/bluetooth/hci_core.c:3864 [inline] hci_rx_work+0x79c/0xcb0 net/bluetooth/hci_core.c:4099 process_one_work+0x929/0x1370 kernel/workqueue.c:2600 worker_thread+0xfb/0xe40 kernel/workqueue.c:2751 kthread+0x278/0x340 kernel/kthread.c:389 ret_from_fork+0x2c/0x70 arch/x86/kernel/process.c:145 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:304 Allocated by task 2882: kasan_save_stack+0x33/0x60 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:374 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:383 kmalloc include/linux/slab.h:582 [inline] kzalloc include/linux/slab.h:703 [inline] l2cap_conn_add.part.0+0x53/0xd10 net/bluetooth/l2cap_core.c:7845 l2cap_conn_add net/bluetooth/l2cap_core.c:8239 [inline] l2cap_connect_cfm+0x3a1/0xda0 net/bluetooth/l2cap_core.c:8242 hci_connect_cfm include/net/bluetooth/hci_core.h:1885 [inline] hci_remote_features_evt+0x40c/0x9e0 net/bluetooth/hci_event.c:3756 hci_event_func net/bluetooth/hci_event.c:7570 [inline] hci_event_packet+0x706/0xce0 net/bluetooth/hci_event.c:7622 hci_rx_work+0x3fe/0xcb0 net/bluetooth/hci_core.c:4094 process_one_work+0x929/0x1370 kernel/workqueue.c:2600 worker_thread+0xfb/0xe40 kernel/workqueue.c:2751 kthread+0x278/0x340 kernel/kthread.c:389 ret_from_fork+0x2c/0x70 arch/x86/kernel/process.c:145 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:304 Freed by task 2879: kasan_save_stack+0x33/0x60 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 kasan_save_free_info+0x2b/0x50 mm/kasan/generic.c:522 ____kasan_slab_free mm/kasan/common.c:236 [inline] ____kasan_slab_free+0x166/0x1c0 mm/kasan/common.c:200 kasan_slab_free include/linux/kasan.h:162 [inline] slab_free_hook mm/slub.c:1792 [inline] slab_free_freelist_hook+0x10b/0x1e0 mm/slub.c:1818 slab_free mm/slub.c:3801 [inline] __kmem_cache_free+0xba/0x340 mm/slub.c:3814 l2cap_connect_cfm+0x38b/0xda0 net/bluetooth/l2cap_core.c:8238 hci_connect_cfm include/net/bluetooth/hci_core.h:1885 [inline] hci_conn_failed+0x158/0x2c0 net/bluetooth/hci_conn.c:1230 hci_abort_conn_sync+0x335/0x700 net/bluetooth/hci_sync.c:5433 hci_cmd_sync_work+0x173/0x340 net/bluetooth/hci_sync.c:306 process_one_work+0x929/0x1370 kernel/workqueue.c:2600 worker_thread+0xfb/0xe40 kernel/workqueue.c:2751 kthread+0x278/0x340 kernel/kthread.c:389 ret_from_fork+0x2c/0x70 arch/x86/kernel/process.c:145 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:304 Last potentially related work creation: kasan_save_stack+0x33/0x60 mm/kasan/common.c:45 __kasan_record_aux_stack+0xbc/0xd0 mm/kasan/generic.c:492 insert_work+0x45/0x370 kernel/workqueue.c:1556 __queue_work+0x554/0xdc0 kernel/workqueue.c:1717 call_timer_fn+0x159/0x380 kernel/time/timer.c:1700 expire_timers kernel/time/timer.c:1746 [inline] __run_timers+0x364/0x890 kernel/time/timer.c:2022 run_timer_softirq+0x4d/0xb0 kernel/time/timer.c:2035 __do_softirq+0x253/0x67c kernel/softirq.c:553 Second to last potentially related work creation: kasan_save_stack+0x33/0x60 mm/kasan/common.c:45 __kasan_record_aux_stack+0xbc/0xd0 mm/kasan/generic.c:492 insert_work+0x45/0x370 kernel/workqueue.c:1556 __queue_work+0x554/0xdc0 kernel/workqueue.c:1717 queue_work_on+0x5e/0x80 kernel/workqueue.c:1747 queue_work include/linux/workqueue.h:506 [inline] l2cap_conn_ready net/bluetooth/l2cap_core.c:1779 [inline] l2cap_connect_cfm+0x851/0xda0 net/bluetooth/l2cap_core.c:8283 hci_connect_cfm include/net/bluetooth/hci_core.h:1885 [inline] hci_remote_features_evt+0x40c/0x9e0 net/bluetooth/hci_event.c:3756 hci_event_func net/bluetooth/hci_event.c:7570 [inline] hci_event_packet+0x706/0xce0 net/bluetooth/hci_event.c:7622 hci_rx_work+0x3fe/0xcb0 net/bluetooth/hci_core.c:4094 process_one_work+0x929/0x1370 kernel/workqueue.c:2600 worker_thread+0xfb/0xe40 kernel/workqueue.c:2751 kthread+0x278/0x340 kernel/kthread.c:389 ret_from_fork+0x2c/0x70 arch/x86/kernel/process.c:145 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:304 The buggy address belongs to the object at ffff888179785000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 0 bytes inside of freed 1024-byte region [ffff888179785000, ffff888179785400) The buggy address belongs to the physical page: page:ffffea0005e5e000 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888179784000 pfn:0x179780 head:ffffea0005e5e000 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x100000000010200(slab|head|node=0|zone=2) page_type: 0xffffffff() raw: 0100000000010200 ffff888100041dc0 ffffea0005ce5c00 dead000000000002 raw: ffff888179784000 000000008010000d 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1424, tgid 1424 (S50sshd), ts 9712625160, free_ts 9639642042 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x286/0x300 mm/page_alloc.c:1570 prep_new_page mm/page_alloc.c:1577 [inline] get_page_from_freelist+0x1131/0x3dc0 mm/page_alloc.c:3221 __alloc_pages+0x1d0/0x470 mm/page_alloc.c:4477 alloc_slab_page mm/slub.c:1862 [inline] allocate_slab+0x252/0x360 mm/slub.c:2009 new_slab mm/slub.c:2062 [inline] ___slab_alloc+0x7b5/0x1030 mm/slub.c:3215 __slab_alloc.constprop.0+0x4d/0x90 mm/slub.c:3314 __slab_alloc_node mm/slub.c:3367 [inline] slab_alloc_node mm/slub.c:3460 [inline] __kmem_cache_alloc_node+0x143/0x3a0 mm/slub.c:3509 __do_kmalloc_node mm/slab_common.c:984 [inline] __kmalloc+0x4c/0x160 mm/slab_common.c:998 kmalloc include/linux/slab.h:586 [inline] kzalloc include/linux/slab.h:703 [inline] tomoyo_init_log+0x11b8/0x1ee0 security/tomoyo/audit.c:275 tomoyo_supervisor+0x2a7/0xc40 security/tomoyo/common.c:2088 tomoyo_audit_env_log security/tomoyo/environ.c:36 [inline] tomoyo_env_perm+0x170/0x1e0 security/tomoyo/environ.c:63 tomoyo_environ security/tomoyo/domain.c:672 [inline] tomoyo_find_next_domain+0xf53/0x1db0 security/tomoyo/domain.c:879 tomoyo_bprm_check_security security/tomoyo/tomoyo.c:101 [inline] tomoyo_bprm_check_security+0x101/0x170 security/tomoyo/tomoyo.c:91 security_bprm_check+0x52/0x80 security/security.c:1102 search_binary_handler fs/exec.c:1726 [inline] exec_binprm fs/exec.c:1780 [inline] bprm_execve fs/exec.c:1855 [inline] bprm_execve+0x5f8/0x1440 fs/exec.c:1811 do_execveat_common.isra.0+0x4c0/0x6a0 fs/exec.c:1963 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1161 [inline] free_unref_page_prepare+0x5ac/0xc50 mm/page_alloc.c:2348 free_unref_page+0x33/0x350 mm/page_alloc.c:2443 __unfreeze_partials+0x1f3/0x210 mm/slub.c:2647 qlink_free mm/kasan/quarantine.c:166 [inline] qlist_free_all+0x6a/0x180 mm/kasan/quarantine.c:185 kasan_quarantine_reduce+0x181/0x1b0 mm/kasan/quarantine.c:292 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:305 kasan_slab_alloc include/linux/kasan.h:186 [inline] slab_post_alloc_hook mm/slab.h:762 [inline] slab_alloc_node mm/slub.c:3470 [inline] __kmem_cache_alloc_node+0x1ac/0x3a0 mm/slub.c:3509 kmalloc_trace+0x25/0xb0 mm/slab_common.c:1076 kmalloc include/linux/slab.h:582 [inline] tomoyo_print_header security/tomoyo/audit.c:156 [inline] tomoyo_init_log+0x198/0x1ee0 security/tomoyo/audit.c:255 tomoyo_supervisor+0x2a7/0xc40 security/tomoyo/common.c:2088 tomoyo_audit_path_log security/tomoyo/file.c:168 [inline] tomoyo_path_permission security/tomoyo/file.c:587 [inline] tomoyo_path_permission+0x23d/0x330 security/tomoyo/file.c:573 tomoyo_check_open_permission+0x28b/0x2b0 security/tomoyo/file.c:777 security_file_open+0x52/0x90 security/security.c:2797 do_dentry_open+0x339/0x1210 fs/open.c:901 do_open fs/namei.c:3636 [inline] path_openat+0x18c2/0x27c0 fs/namei.c:3793 do_filp_open+0x1bc/0x400 fs/namei.c:3820 Memory state around the buggy address: ffff888179784f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888179784f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888179785000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888179785080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888179785100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================