Bluetooth: hci2: command 0x0409 tx timeout Bluetooth: hci2: command 0x041b tx timeout Bluetooth: hci2: command 0x040f tx timeout ================================================================== BUG: KASAN: use-after-free in inet_twsk_kill+0x358/0x3c0 net/ipv4/inet_timewait_sock.c:46 Read of size 8 at addr ffff88804164adc0 by task modprobe/22671 CPU: 0 PID: 22671 Comm: modprobe Not tainted 5.17.0-rc1-next-20220127 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106 print_address_description.constprop.0+0x1f/0x190 mm/kasan/report.c:255 __kasan_report mm/kasan/report.c:442 [inline] kasan_report.cold+0x7f/0x11b mm/kasan/report.c:459 inet_twsk_kill+0x358/0x3c0 net/ipv4/inet_timewait_sock.c:46 call_timer_fn+0x182/0x600 kernel/time/timer.c:1421 expire_timers kernel/time/timer.c:1466 [inline] __run_timers.part.0+0x666/0xa00 kernel/time/timer.c:1734 __run_timers kernel/time/timer.c:1715 [inline] run_timer_softirq+0xae/0x1a0 kernel/time/timer.c:1747 __do_softirq+0x270/0x8c7 kernel/softirq.c:558 invoke_softirq kernel/softirq.c:432 [inline] __irq_exit_rcu+0x113/0x170 kernel/softirq.c:637 irq_exit_rcu+0x5/0x20 kernel/softirq.c:649 sysvec_apic_timer_interrupt+0x40/0xc0 arch/x86/kernel/apic/apic.c:1097 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638 RIP: 0033:0x7f113f54cdce Code: 00 4a 63 04 a6 48 01 f0 ff e0 66 90 4c 89 f1 4d 89 fb 0f b7 71 06 66 83 fe f1 0f 84 26 01 00 00 4d 8b 13 83 e2 0f 4c 03 51 08 <80> fa 0a 0f 85 90 fa ff ff 66 85 f6 0f 84 87 fa ff ff 8b 85 44 ff RSP: 002b:00007ffd60e837f0 EFLAGS: 00000202 RAX: 0000000000000000 RBX: 00007f113f293158 RCX: 00007f113f22c688 RDX: 0000000000000001 RSI: 0000000000000014 RDI: 00007f113f02f000 RBP: 00007ffd60e838f0 R08: 0000000000000000 R09: 00007f113f22c688 R10: 00007f113f4ddf80 R11: 00007f113f53a510 R12: 0000000000000001 R13: 0000034e00000001 R14: 00007f113f22c688 R15: 00007f113f53a510 Allocated by task 292: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:436 [inline] __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:469 kasan_slab_alloc include/linux/kasan.h:260 [inline] slab_post_alloc_hook mm/slab.h:732 [inline] slab_alloc_node mm/slub.c:3230 [inline] slab_alloc mm/slub.c:3238 [inline] kmem_cache_alloc+0x1aa/0x480 mm/slub.c:3243 kmem_cache_zalloc include/linux/slab.h:705 [inline] net_alloc net/core/net_namespace.c:407 [inline] copy_net_ns+0x125/0x760 net/core/net_namespace.c:462 create_new_namespaces+0x3f6/0xb30 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0xc1/0x1f0 kernel/nsproxy.c:226 ksys_unshare+0x445/0x8d0 kernel/fork.c:3048 __do_sys_unshare kernel/fork.c:3119 [inline] __se_sys_unshare kernel/fork.c:3117 [inline] __x64_sys_unshare+0x2d/0x40 kernel/fork.c:3117 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae The buggy address belongs to the object at ffff88804164a980 which belongs to the cache net_namespace of size 5056 The buggy address is located 1088 bytes inside of 5056-byte region [ffff88804164a980, ffff88804164bd40) The buggy address belongs to the page: page:0000000041616301 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88804164a980 pfn:0x41648 head:0000000041616301 order:3 compound_mapcount:0 compound_pincount:0 memcg:ffff88800e85fa01 flags: 0x100000000010200(slab|head|node=0|zone=1) raw: 0100000000010200 ffffea00005f1a00 dead000000000002 ffff88800805d640 raw: ffff88804164a980 0000000080060004 00000001ffffffff ffff88800e85fa01 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88804164ac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88804164ad00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88804164ad80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88804164ae00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88804164ae80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready Bluetooth: hci2: command 0x0419 tx timeout