kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. Bluetooth: hci3: failed to register connection device Bluetooth: hci1: failed to register connection device ================================================================== kobject_add_internal failed for hci5:201 with -EEXIST, don't try to register things with the same name in the same directory. BUG: KASAN: use-after-free in __lock_acquire+0x31f5/0x4770 kernel/locking/lockdep.c:3290 Read of size 8 at addr ffff8800a81d9a20 by task kworker/u5:0/1563 Bluetooth: hci5: failed to register connection device CPU: 1 PID: 1563 Comm: kworker/u5:0 Not tainted 4.19.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 Workqueue: hci0 hci_rx_work Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x15a/0x20a lib/dump_stack.c:113 print_address_description.cold.6+0x9/0x244 mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report mm/kasan/report.c:412 [inline] kasan_report.cold.7+0x242/0x305 mm/kasan/report.c:396 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433 __lock_acquire+0x31f5/0x4770 kernel/locking/lockdep.c:3290 sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' lock_acquire+0x180/0x3a0 kernel/locking/lockdep.c:3900 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline] _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:168 spin_lock_bh include/linux/spinlock.h:334 [inline] lock_sock_nested+0x3a/0x100 net/core/sock.c:2832 lock_sock include/net/sock.h:1491 [inline] l2cap_sock_new_connection_cb+0x41/0x1c0 net/bluetooth/l2cap_sock.c:1235 l2cap_connect_cfm+0x6e4/0xdc0 net/bluetooth/l2cap_core.c:7339 hci_connect_cfm include/net/bluetooth/hci_core.h:1241 [inline] le_conn_complete_evt+0xe7d/0x1680 net/bluetooth/hci_event.c:4915 hci_le_enh_conn_complete_evt net/bluetooth/hci_event.c:4957 [inline] hci_le_meta_evt+0x357/0x3d40 net/bluetooth/hci_event.c:5636 hci_event_packet+0x179b/0x7767 net/bluetooth/hci_event.c:5866 hci_rx_work+0x368/0xa40 net/bluetooth/hci_core.c:4347 process_one_work+0x7be/0x15b0 kernel/workqueue.c:2153 worker_thread+0x85/0xb60 kernel/workqueue.c:2296 kthread+0x327/0x3f0 kernel/kthread.c:246 ret_from_fork+0x27/0x50 arch/x86/entry/entry_64.S:413 CPU: 0 PID: 5655 Comm: kworker/u5:3 Not tainted 4.19.0-syzkaller #0 Allocated by task 7494: Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 save_stack mm/kasan/kasan.c:448 [inline] set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc.part.1+0x62/0xf0 mm/kasan/kasan.c:553 Workqueue: hci2 hci_rx_work kasan_kmalloc+0xaf/0xc0 mm/kasan/kasan.c:538 __kmalloc+0x157/0x340 mm/slub.c:3751 kmalloc include/linux/slab.h:518 [inline] sk_prot_alloc+0x198/0x240 net/core/sock.c:1468 sk_alloc+0x34/0xc30 net/core/sock.c:1522 Call Trace: l2cap_sock_alloc.constprop.4+0x28/0x1e0 net/bluetooth/l2cap_sock.c:1590 l2cap_sock_create+0xcb/0x160 net/bluetooth/l2cap_sock.c:1636 __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x15a/0x20a lib/dump_stack.c:113 bt_sock_create+0x127/0x270 net/bluetooth/af_bluetooth.c:130 __sock_create+0x267/0x540 net/socket.c:1277 sysfs_warn_dup.cold.0+0x17/0x32 fs/sysfs/dir.c:30 sock_create net/socket.c:1317 [inline] __sys_socket+0xd7/0x1d0 net/socket.c:1347 __do_sys_socket net/socket.c:1356 [inline] __se_sys_socket net/socket.c:1354 [inline] __x64_sys_socket+0x6e/0xb0 net/socket.c:1354 sysfs_create_dir_ns+0x1c2/0x270 fs/sysfs/dir.c:63 do_syscall_64+0xd6/0x540 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 7491: save_stack mm/kasan/kasan.c:448 [inline] set_track mm/kasan/kasan.c:460 [inline] __kasan_slab_free+0x167/0x240 mm/kasan/kasan.c:521 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528 slab_free_hook mm/slub.c:1371 [inline] slab_free_freelist_hook mm/slub.c:1398 [inline] slab_free mm/slub.c:2953 [inline] kfree+0x130/0x370 mm/slub.c:3906 create_dir lib/kobject.c:88 [inline] kobject_add_internal+0x257/0x8d0 lib/kobject.c:247 sk_prot_free net/core/sock.c:1505 [inline] __sk_destruct+0x493/0x6a0 net/core/sock.c:1587 sk_destruct+0x49/0x60 net/core/sock.c:1595 kobject_add_varg lib/kobject.c:382 [inline] kobject_add+0x10f/0x170 lib/kobject.c:426 __sk_free+0x9e/0x230 net/core/sock.c:1606 sk_free+0x1a/0x20 net/core/sock.c:1617 sock_put include/net/sock.h:1691 [inline] l2cap_sock_kill.part.2+0xe3/0x110 net/bluetooth/l2cap_sock.c:1055 l2cap_sock_kill net/bluetooth/l2cap_sock.c:1046 [inline] l2cap_sock_release+0x154/0x1c0 net/bluetooth/l2cap_sock.c:1204 __sock_release+0xc7/0x230 net/socket.c:579 sock_close+0x10/0x20 net/socket.c:1141 __fput+0x24c/0x800 fs/file_table.c:278 ____fput+0x9/0x10 fs/file_table.c:309 task_work_run+0x10e/0x190 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:193 [inline] exit_to_usermode_loop+0x185/0x1e0 arch/x86/entry/common.c:166 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline] syscall_return_slowpath arch/x86/entry/common.c:268 [inline] do_syscall_64+0x476/0x540 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe device_add+0x33e/0x16b0 drivers/base/core.c:1879 The buggy address belongs to the object at ffff8800a81d9980 which belongs to the cache kmalloc-2048 of size 2048 The buggy address is located 160 bytes inside of 2048-byte region [ffff8800a81d9980, ffff8800a81da180) The buggy address belongs to the page: page:ffffea0002a07600 count:1 mapcount:0 mapping:ffff88013bff4800 index:0x0 hci_conn_add_sysfs+0x8e/0x160 net/bluetooth/hci_sysfs.c:53 compound_mapcount: 0 le_conn_complete_evt+0x98b/0x1680 net/bluetooth/hci_event.c:4891 flags: 0xfff00000008100(slab|head) raw: 00fff00000008100 dead000000000100 dead000000000200 ffff88013bff4800 raw: 0000000000000000 00000000000f000f 00000001ffffffff 0000000000000000 hci_le_enh_conn_complete_evt net/bluetooth/hci_event.c:4957 [inline] hci_le_meta_evt+0x357/0x3d40 net/bluetooth/hci_event.c:5636 page dumped because: kasan: bad access detected page allocated via order 3, migratetype Unmovable, gfp_mask 0x352c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL) set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook mm/page_alloc.c:1906 [inline] prep_new_page mm/page_alloc.c:1914 [inline] get_page_from_freelist+0x3041/0x4540 mm/page_alloc.c:3345 __alloc_pages_nodemask+0x39e/0x2670 mm/page_alloc.c:4370 alloc_pages_current+0xd6/0x1b0 mm/mempolicy.c:2093 alloc_pages include/linux/gfp.h:509 [inline] alloc_slab_page mm/slub.c:1438 [inline] allocate_slab mm/slub.c:1583 [inline] new_slab+0x4a9/0x860 mm/slub.c:1654 new_slab_objects mm/slub.c:2417 [inline] ___slab_alloc+0x648/0x980 mm/slub.c:2569 __slab_alloc.isra.22+0x78/0xe0 mm/slub.c:2609 slab_alloc_node mm/slub.c:2672 [inline] slab_alloc mm/slub.c:2714 [inline] __kmalloc+0x294/0x340 mm/slub.c:3747 kmalloc include/linux/slab.h:518 [inline] kzalloc include/linux/slab.h:707 [inline] __register_sysctl_table+0xaa/0xdf0 fs/proc/proc_sysctl.c:1307 register_net_sysctl+0x10/0x20 net/sysctl_net.c:120 hci_event_packet+0x179b/0x7767 net/bluetooth/hci_event.c:5866 __devinet_sysctl_register+0x146/0x2b0 net/ipv4/devinet.c:2335 devinet_sysctl_register net/ipv4/devinet.c:2375 [inline] devinet_sysctl_register+0x124/0x1e0 net/ipv4/devinet.c:2365 inetdev_init+0x1fe/0x3e0 net/ipv4/devinet.c:264 inetdev_event+0xc90/0x10f0 net/ipv4/devinet.c:1468 notifier_call_chain+0x8f/0x160 kernel/notifier.c:93 __raw_notifier_call_chain kernel/notifier.c:394 [inline] raw_notifier_call_chain+0x11/0x20 kernel/notifier.c:401 call_netdevice_notifiers_info+0x28/0x60 net/core/dev.c:1733 Memory state around the buggy address: ffff8800a81d9900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8800a81d9980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8800a81d9a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8800a81d9a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8800a81d9b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================