IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready Bluetooth: hci0: unknown advertising packet type: 0x90 Bluetooth: hci0: Dropping invalid advertising data Bluetooth: hci0: Dropping invalid advertising data ================================================================== BUG: KASAN: slab-out-of-bounds in hci_le_adv_report_evt net/bluetooth/hci_event.c:4946 [inline] BUG: KASAN: slab-out-of-bounds in hci_le_meta_evt+0x3aeb/0x4590 net/bluetooth/hci_event.c:5173 Read of size 1 at addr ffff880096a157c0 by task kworker/u5:6/8094 wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 CPU: 1 PID: 8094 Comm: kworker/u5:6 Not tainted 4.18.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: hci0 hci_rx_work Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x15a/0x20d lib/dump_stack.c:113 print_address_description.cold.6+0x9/0x211 mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report mm/kasan/report.c:412 [inline] kasan_report.cold.7+0x242/0x308 mm/kasan/report.c:396 __asan_report_load1_noabort+0x14/0x20 mm/kasan/report.c:430 hci_le_adv_report_evt net/bluetooth/hci_event.c:4946 [inline] hci_le_meta_evt+0x3aeb/0x4590 net/bluetooth/hci_event.c:5173 hci_event_packet+0x28b3/0x7576 net/bluetooth/hci_event.c:5415 hci_rx_work+0x368/0xa40 net/bluetooth/hci_core.c:4258 process_one_work+0x7b9/0x1580 kernel/workqueue.c:2153 wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 worker_thread+0x85/0xb60 kernel/workqueue.c:2296 wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 kthread+0x316/0x3d0 kernel/kthread.c:246 IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:412 wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 Allocated by task 9521: save_stack mm/kasan/kasan.c:448 [inline] set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc.part.1+0x62/0xf0 mm/kasan/kasan.c:553 kasan_kmalloc+0xaf/0xc0 mm/kasan/kasan.c:538 __do_kmalloc_node mm/slab.c:3682 [inline] __kmalloc_node_track_caller+0x47/0x70 mm/slab.c:3696 __kmalloc_reserve.isra.8+0x2c/0xc0 net/core/skbuff.c:137 __alloc_skb+0xd7/0x580 net/core/skbuff.c:205 alloc_skb include/linux/skbuff.h:987 [inline] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline] vhci_get_user drivers/bluetooth/hci_vhci.c:180 [inline] vhci_write+0xa8/0x3e0 drivers/bluetooth/hci_vhci.c:299 call_write_iter include/linux/fs.h:1793 [inline] new_sync_write fs/read_write.c:474 [inline] __vfs_write+0x446/0x880 fs/read_write.c:487 vfs_write+0x150/0x4f0 fs/read_write.c:549 ksys_write+0xcd/0x1b0 fs/read_write.c:598 __do_sys_write fs/read_write.c:610 [inline] __se_sys_write fs/read_write.c:607 [inline] __x64_sys_write+0x6e/0xb0 fs/read_write.c:607 do_syscall_64+0xda/0x540 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 0: IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready (stack is not available) wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 The buggy address belongs to the object at ffff880096a155c0 which belongs to the cache kmalloc-512 of size 512 IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready The buggy address is located 0 bytes to the right of 512-byte region [ffff880096a155c0, ffff880096a157c0) The buggy address belongs to the page: page:ffffea00025a8540 count:1 mapcount:0 mapping:ffff8800b6000940 index:0x0 flags: 0xfff00000000100(slab) raw: 00fff00000000100 ffffea00025d0e48 ffffea000266fe88 ffff8800b6000940 raw: 0000000000000000 ffff880096a150c0 0000000100000006 0000000000000000 page dumped because: kasan: bad access detected page allocated via order 0, migratetype Unmovable, gfp_mask 0x442c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_COMP|__GFP_THISNODE) set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook mm/page_alloc.c:1906 [inline] prep_new_page mm/page_alloc.c:1914 [inline] get_page_from_freelist+0x2f35/0x46b0 mm/page_alloc.c:3345 __alloc_pages_nodemask+0x39e/0x2780 mm/page_alloc.c:4369 __alloc_pages include/linux/gfp.h:456 [inline] __alloc_pages_node include/linux/gfp.h:469 [inline] kmem_getpages mm/slab.c:1409 [inline] cache_grow_begin+0xa5/0x8c0 mm/slab.c:2677 cache_alloc_refill+0x2ac/0x380 mm/slab.c:3044 ____cache_alloc mm/slab.c:3127 [inline] __do_cache_alloc mm/slab.c:3349 [inline] slab_alloc mm/slab.c:3384 [inline] kmem_cache_alloc_trace+0x361/0x3f0 mm/slab.c:3618 kmalloc include/linux/slab.h:513 [inline] kzalloc include/linux/slab.h:707 [inline] ipv6_add_addr+0x353/0x1bc0 net/ipv6/addrconf.c:1031 addrconf_add_linklocal+0x1a6/0x370 net/ipv6/addrconf.c:3136 wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 addrconf_addr_gen+0x288/0x2f0 net/ipv6/addrconf.c:3263 addrconf_dev_config+0xe9/0x1b0 net/ipv6/addrconf.c:3306 addrconf_notify+0x305/0x20e0 net/ipv6/addrconf.c:3537 notifier_call_chain+0x8a/0x160 kernel/notifier.c:93 __raw_notifier_call_chain kernel/notifier.c:394 [inline] raw_notifier_call_chain+0x11/0x20 kernel/notifier.c:401 call_netdevice_notifiers_info+0x28/0x60 net/core/dev.c:1735 netdev_state_change net/core/dev.c:1340 [inline] netdev_state_change+0xd4/0x100 net/core/dev.c:1333 linkwatch_do_dev+0x72/0xc0 net/core/link_watch.c:164 __linkwatch_run_queue+0x24b/0x470 net/core/link_watch.c:202 wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready Memory state around the buggy address: ffff880096a15680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Bluetooth: hci3: unknown advertising packet type: 0x90 ffff880096a15700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff880096a15780: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc ^ ffff880096a15800: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb ffff880096a15880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Bluetooth: hci4: command 0x0419 tx timeout Bluetooth: hci3: Dropping invalid advertising data