Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4
Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3
Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2
==================================================================
BUG: KASAN: use-after-free in inet_twsk_kill+0x358/0x3c0 net/ipv4/inet_timewait_sock.c:46
Read of size 8 at addr ffff888041529900 by task systemd/1
CPU: 0 PID: 1 Comm: systemd Not tainted 5.17.0-rc1-next-20220127 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106
print_address_description.constprop.0+0x1f/0x190 mm/kasan/report.c:255
__kasan_report mm/kasan/report.c:442 [inline]
kasan_report.cold+0x7f/0x11b mm/kasan/report.c:459
inet_twsk_kill+0x358/0x3c0 net/ipv4/inet_timewait_sock.c:46
call_timer_fn+0x182/0x600 kernel/time/timer.c:1421
expire_timers kernel/time/timer.c:1466 [inline]
__run_timers.part.0+0x666/0xa00 kernel/time/timer.c:1734
__run_timers kernel/time/timer.c:1715 [inline]
run_timer_softirq+0xae/0x1a0 kernel/time/timer.c:1747
__do_softirq+0x270/0x8c7 kernel/softirq.c:558
invoke_softirq kernel/softirq.c:432 [inline]
__irq_exit_rcu+0x113/0x170 kernel/softirq.c:637
irq_exit_rcu+0x5/0x20 kernel/softirq.c:649
sysvec_apic_timer_interrupt+0x8e/0xc0 arch/x86/kernel/apic/apic.c:1097
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:copy_page+0x7/0x10 arch/x86/lib/copy_page_64.S:19
Code: 01 d1 89 c8 eb f6 c1 e1 03 01 d1 89 ca e9 61 fe ff ff 90 48 89 f8 48 89 d1 f3 a4 31 c0 c3 48 89 c8 c3 cc 66 90 b9 00 02 00 00 48 a5 c3 0f 1f 44 00 00 48 83 ec 10 48 89 1c 24 4c 89 64 24 08
RSP: 0000:ffff88800813fb98 EFLAGS: 00000286
RAX: 1ffffffff09df764 RBX: ffff88800813fd88 RCX: 00000000000001fc
RDX: dffffc0000000000 RSI: ffff88804c858020 RDI: ffff88804c88d020
RBP: ffffea0001322340 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff8172cb2f R11: 0000000000000000 R12: ffff88800859d200
R13: ffffea0000000000 R14: 00000000000062ce R15: ffffea0001321600
copy_user_page arch/x86/include/asm/page.h:34 [inline]
copy_user_highpage include/linux/highmem.h:279 [inline]
cow_user_page mm/memory.c:2764 [inline]
wp_page_copy+0x24a/0x2720 mm/memory.c:3017
do_wp_page+0x285/0x1d50 mm/memory.c:3322
handle_pte_fault mm/memory.c:4588 [inline]
__handle_mm_fault+0x1183/0x3570 mm/memory.c:4705
handle_mm_fault+0x2e6/0xa20 mm/memory.c:4803
do_user_addr_fault+0x54a/0x12a0 arch/x86/mm/fault.c:1397
handle_page_fault arch/x86/mm/fault.c:1484 [inline]
exc_page_fault+0xa2/0x1a0 arch/x86/mm/fault.c:1540
asm_exc_page_fault+0x1e/0x30 arch/x86/include/asm/idtentry.h:568
RIP: 0033:0x7ff99fee0f68
Code: ff ff e9 0d f7 ff ff 0f 1f 00 48 8b 71 18 48 83 4c 29 08 01 4d 39 d4 74 05 48 83 49 08 04 48 89 72 08 48 83 c1 10 41 83 c3 01 <48> 89 46 10 4b 8b 34 e9 4c 89 49 08 48 89 31 4b 89 0c e9 66 47 89
RSP: 002b:00007ffe2a573ba0 EFLAGS: 00010202
RAX: 00007ff9a0016bf0 RBX: 000000000000000a RCX: 00007ff9a11f4560
RDX: 00007ff9a0016c00 RSI: 00007ff9a122e190 RDI: 0000000000000007
RBP: 0000000000000020 R08: 0000000000000000 R09: 00007ff9a0977010
R10: 00007ff9a0016b80 R11: 0000000000000007 R12: 00007ff9a0016b80
R13: 0000000000000010 R14: 00007ff9a11bc7e8 R15: 00007ff9a12aea30
Allocated by task 8217:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track mm/kasan/common.c:45 [inline]
set_alloc_info mm/kasan/common.c:436 [inline]
__kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:469
kasan_slab_alloc include/linux/kasan.h:260 [inline]
slab_post_alloc_hook mm/slab.h:732 [inline]
slab_alloc_node mm/slub.c:3230 [inline]
slab_alloc mm/slub.c:3238 [inline]
kmem_cache_alloc+0x1aa/0x480 mm/slub.c:3243
kmem_cache_zalloc include/linux/slab.h:705 [inline]
net_alloc net/core/net_namespace.c:407 [inline]
copy_net_ns+0x125/0x760 net/core/net_namespace.c:462
create_new_namespaces+0x3f6/0xb30 kernel/nsproxy.c:110
unshare_nsproxy_namespaces+0xc1/0x1f0 kernel/nsproxy.c:226
ksys_unshare+0x445/0x8d0 kernel/fork.c:3048
__do_sys_unshare kernel/fork.c:3119 [inline]
__se_sys_unshare kernel/fork.c:3117 [inline]
__x64_sys_unshare+0x2d/0x40 kernel/fork.c:3117
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
The buggy address belongs to the object at ffff8880415294c0
which belongs to the cache net_namespace of size 5056
The buggy address is located 1088 bytes inside of
5056-byte region [ffff8880415294c0, ffff88804152a880)
The buggy address belongs to the page:
page:00000000797ab588 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880415294c0 pfn:0x41528
head:00000000797ab588 order:3 compound_mapcount:0 compound_pincount:0
memcg:ffff8880418e7781
flags: 0x100000000010200(slab|head|node=0|zone=1)
raw: 0100000000010200 0000000000000000 dead000000000122 ffff88800805d640
raw: ffff8880415294c0 0000000080060002 00000001ffffffff ffff8880418e7781
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888041529800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888041529880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888041529900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888041529980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888041529a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Bluetooth: hci7: command 0x0409 tx timeout
Bluetooth: hci7: command 0x041b tx timeout
wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
Bluetooth: hci7: command 0x040f tx timeout
Bluetooth: hci7: command 0x0419 tx timeout
----------------
Code disassembly (best guess):
0: 01 d1 add %edx,%ecx
2: 89 c8 mov %ecx,%eax
4: eb f6 jmp 0xfffffffc
6: c1 e1 03 shl $0x3,%ecx
9: 01 d1 add %edx,%ecx
b: 89 ca mov %ecx,%edx
d: e9 61 fe ff ff jmpq 0xfffffe73
12: 90 nop
13: 48 89 f8 mov %rdi,%rax
16: 48 89 d1 mov %rdx,%rcx
19: f3 a4 rep movsb %ds:(%rsi),%es:(%rdi)
1b: 31 c0 xor %eax,%eax
1d: c3 retq
1e: 48 89 c8 mov %rcx,%rax
21: c3 retq
22: cc int3
23: 66 90 xchg %ax,%ax
25: b9 00 02 00 00 mov $0x200,%ecx
* 2a: f3 48 a5 rep movsq %ds:(%rsi),%es:(%rdi) <-- trapping instruction
2d: c3 retq
2e: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
33: 48 83 ec 10 sub $0x10,%rsp
37: 48 89 1c 24 mov %rbx,(%rsp)
3b: 4c 89 64 24 08 mov %r12,0x8(%rsp)