==================================================================
BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
BUG: KASAN: use-after-free in atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:116 [inline]
BUG: KASAN: use-after-free in __refcount_add include/linux/refcount.h:193 [inline]
BUG: KASAN: use-after-free in __refcount_inc include/linux/refcount.h:250 [inline]
BUG: KASAN: use-after-free in refcount_inc include/linux/refcount.h:267 [inline]
BUG: KASAN: use-after-free in sock_hold include/net/sock.h:712 [inline]
BUG: KASAN: use-after-free in sco_sock_timeout+0x64/0x230 net/bluetooth/sco.c:89
Write of size 4 at addr ffff88803ea5c080 by task kworker/0:3/303
CPU: 0 PID: 303 Comm: kworker/0:3 Not tainted 5.16.0-rc6-next-20211224 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Workqueue: events sco_sock_timeout
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106
print_address_description.constprop.0+0x1f/0x180 mm/kasan/report.c:255
__kasan_report mm/kasan/report.c:442 [inline]
kasan_report.cold+0x7f/0x11b mm/kasan/report.c:459
check_region_inline mm/kasan/generic.c:183 [inline]
kasan_check_range+0xf9/0x1e0 mm/kasan/generic.c:189
instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:116 [inline]
__refcount_add include/linux/refcount.h:193 [inline]
__refcount_inc include/linux/refcount.h:250 [inline]
refcount_inc include/linux/refcount.h:267 [inline]
sock_hold include/net/sock.h:712 [inline]
sco_sock_timeout+0x64/0x230 net/bluetooth/sco.c:89
process_one_work+0xa2a/0x16d0 kernel/workqueue.c:2307
worker_thread+0x628/0x1310 kernel/workqueue.c:2454
kthread+0x2f0/0x3a0 kernel/kthread.c:377
ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:295
Allocated by task 5402:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track mm/kasan/common.c:45 [inline]
set_alloc_info mm/kasan/common.c:436 [inline]
____kasan_kmalloc mm/kasan/common.c:515 [inline]
__kasan_kmalloc+0x81/0xa0 mm/kasan/common.c:524
kmalloc include/linux/slab.h:586 [inline]
sk_prot_alloc+0x14c/0x290 net/core/sock.c:1921
sk_alloc+0x30/0x350 net/core/sock.c:1974
l2cap_sock_alloc.constprop.0+0x31/0x230 net/bluetooth/l2cap_sock.c:1848
l2cap_sock_create+0x110/0x1b0 net/bluetooth/l2cap_sock.c:1894
bt_sock_create+0x159/0x2b0 net/bluetooth/af_bluetooth.c:130
__sock_create+0x345/0x750 net/socket.c:1465
sock_create net/socket.c:1516 [inline]
__sys_socket+0xef/0x200 net/socket.c:1558
__do_sys_socket net/socket.c:1567 [inline]
__se_sys_socket net/socket.c:1565 [inline]
__x64_sys_socket+0x6f/0xb0 net/socket.c:1565
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
Freed by task 5396:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track+0x21/0x30 mm/kasan/common.c:45
kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370
____kasan_slab_free mm/kasan/common.c:366 [inline]
____kasan_slab_free mm/kasan/common.c:328 [inline]
__kasan_slab_free+0x108/0x170 mm/kasan/common.c:374
kasan_slab_free include/linux/kasan.h:236 [inline]
slab_free_hook mm/slub.c:1728 [inline]
slab_free_freelist_hook mm/slub.c:1754 [inline]
slab_free mm/slub.c:3509 [inline]
kfree+0xcf/0x330 mm/slub.c:4562
sk_prot_free net/core/sock.c:1957 [inline]
__sk_destruct+0x5e8/0x800 net/core/sock.c:2043
sk_destruct+0xbd/0xe0 net/core/sock.c:2058
__sk_free+0xef/0x3d0 net/core/sock.c:2069
sk_free+0x78/0xa0 net/core/sock.c:2080
sock_put include/net/sock.h:1911 [inline]
l2cap_sock_kill+0x14e/0x180 net/bluetooth/l2cap_sock.c:1254
l2cap_sock_release+0x171/0x1d0 net/bluetooth/l2cap_sock.c:1424
__sock_release+0xd2/0x290 net/socket.c:650
sock_close+0x18/0x20 net/socket.c:1315
__fput+0x281/0x9e0 fs/file_table.c:311
task_work_run+0xe2/0x1a0 kernel/task_work.c:164
tracehook_notify_resume include/linux/tracehook.h:189 [inline]
exit_to_user_mode_loop kernel/entry/common.c:175 [inline]
exit_to_user_mode_prepare+0x1be/0x1c0 kernel/entry/common.c:207
__syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]
syscall_exit_to_user_mode+0x19/0x50 kernel/entry/common.c:300
do_syscall_64+0x48/0x90 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x44/0xae
Last potentially related work creation:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
__kasan_record_aux_stack+0x97/0xa0 mm/kasan/generic.c:348
call_rcu+0x82/0xa20 kernel/rcu/tree.c:3072
netlink_release+0xf06/0x1db0 net/netlink/af_netlink.c:811
__sock_release+0xd2/0x290 net/socket.c:650
sock_close+0x18/0x20 net/socket.c:1315
__fput+0x281/0x9e0 fs/file_table.c:311
task_work_run+0xe2/0x1a0 kernel/task_work.c:164
tracehook_notify_resume include/linux/tracehook.h:189 [inline]
exit_to_user_mode_loop kernel/entry/common.c:175 [inline]
exit_to_user_mode_prepare+0x1be/0x1c0 kernel/entry/common.c:207
__syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]
syscall_exit_to_user_mode+0x19/0x50 kernel/entry/common.c:300
do_syscall_64+0x48/0x90 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x44/0xae
Second to last potentially related work creation:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
__kasan_record_aux_stack+0x97/0xa0 mm/kasan/generic.c:348
call_rcu+0x82/0xa20 kernel/rcu/tree.c:3072
netlink_release+0xf06/0x1db0 net/netlink/af_netlink.c:811
__sock_release+0xd2/0x290 net/socket.c:650
sock_close+0x18/0x20 net/socket.c:1315
__fput+0x281/0x9e0 fs/file_table.c:311
task_work_run+0xe2/0x1a0 kernel/task_work.c:164
tracehook_notify_resume include/linux/tracehook.h:189 [inline]
exit_to_user_mode_loop kernel/entry/common.c:175 [inline]
exit_to_user_mode_prepare+0x1be/0x1c0 kernel/entry/common.c:207
__syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]
syscall_exit_to_user_mode+0x19/0x50 kernel/entry/common.c:300
do_syscall_64+0x48/0x90 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x44/0xae
The buggy address belongs to the object at ffff88803ea5c000
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 128 bytes inside of
2048-byte region [ffff88803ea5c000, ffff88803ea5c800)
The buggy address belongs to the page:
page:00000000d94ebc61 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3ea58
head:00000000d94ebc61 order:3 compound_mapcount:0 compound_pincount:0
flags: 0x100000000010200(slab|head|node=0|zone=1)
mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
raw: 0100000000010200 0000000000000000 dead000000000001 ffff888007842000
raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88803ea5bf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88803ea5c000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
>ffff88803ea5c080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88803ea5c100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88803ea5c180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 0 PID: 303 at lib/refcount.c:25 refcount_warn_saturate+0x178/0x1f0 lib/refcount.c:25
Modules linked in:
CPU: 0 PID: 303 Comm: kworker/0:3 Tainted: G B 5.16.0-rc6-next-20211224 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Workqueue: events sco_sock_timeout
RIP: 0010:refcount_warn_saturate+0x178/0x1f0 lib/refcount.c:25
Code: 03 31 ff 89 de e8 98 00 44 ff 84 db 0f 85 2e ff ff ff e8 ab fc 43 ff 48 c7 c7 e0 c2 7c 84 c6 05 fe 8a 8a 03 01 e8 34 f6 f7 01 <0f> 0b e9 0f ff ff ff e8 8c fc 43 ff 0f b6 1d e8 8a 8a 03 31 ff 89
mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
RSP: 0018:ffff88801831fce0 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff8880173e0000 RSI: ffffffff812b2828 RDI: ffffed1003063f8e
RBP: ffff88803ea5c080 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff812ac22c R11: 0000000000000000 R12: ffff88803dc84008
R13: ffff88803ea5c080 R14: ffff88806ce37280 R15: ffff88801d576200
FS: 0000000000000000(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe853120c50 CR3: 000000003e3b2000 CR4: 0000000000350ef0
Call Trace:
__refcount_add include/linux/refcount.h:199 [inline]
__refcount_inc include/linux/refcount.h:250 [inline]
refcount_inc include/linux/refcount.h:267 [inline]
sock_hold include/net/sock.h:712 [inline]
sco_sock_timeout+0x1ca/0x230 net/bluetooth/sco.c:89
process_one_work+0xa2a/0x16d0 kernel/workqueue.c:2307
mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
worker_thread+0x628/0x1310 kernel/workqueue.c:2454
kthread+0x2f0/0x3a0 kernel/kthread.c:377
ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:295
irq event stamp: 748688
hardirqs last enabled at (748687): [] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:159 [inline]
hardirqs last enabled at (748687): [] _raw_spin_unlock_irq+0x1f/0x40 kernel/locking/spinlock.c:202
hardirqs last disabled at (748688): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]
hardirqs last disabled at (748688): [] _raw_spin_lock_irqsave+0x4e/0x50 kernel/locking/spinlock.c:162
softirqs last enabled at (748676): [] srcu_invoke_callbacks+0x1e5/0x3a0 kernel/rcu/srcutree.c:1272
softirqs last disabled at (748672): [] spin_unlock_irq include/linux/spinlock.h:404 [inline]
softirqs last disabled at (748672): [] srcu_invoke_callbacks+0x1b5/0x3a0 kernel/rcu/srcutree.c:1267
---[ end trace 0000000000000000 ]---
loop7: detected capacity change from 0 to 256
FAT-fs (loop7): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1)
audit: type=1326 audit(1640720649.411:11): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=5443 comm="syz-executor.5" exe="/syz-executor.5" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb1801d6b19 code=0x0
loop6: detected capacity change from 0 to 1294
FAT-fs (loop6): Unrecognized mount option "nnonumtail=1" or missing value
loop6: detected capacity change from 0 to 1294
FAT-fs (loop6): Unrecognized mount option "nnonumtail=1" or missing value
------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 0 PID: 303 at lib/refcount.c:28 refcount_warn_saturate+0x103/0x1f0 lib/refcount.c:28
Modules linked in:
CPU: 0 PID: 303 Comm: kworker/0:3 Tainted: G B W 5.16.0-rc6-next-20211224 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Workqueue: events sco_sock_timeout
RIP: 0010:refcount_warn_saturate+0x103/0x1f0 lib/refcount.c:28
Code: 1d 92 8b 8a 03 31 ff 89 de e8 09 01 44 ff 84 db 75 a3 e8 20 fd 43 ff 48 c7 c7 40 c3 7c 84 c6 05 72 8b 8a 03 01 e8 a9 f6 f7 01 <0f> 0b eb 87 e8 04 fd 43 ff 0f b6 1d 5b 8b 8a 03 31 ff 89 de e8 d4
RSP: 0018:ffff88801831fce0 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff8880173e0000 RSI: ffffffff812b2828 RDI: ffffed1003063f8e
RBP: ffff88803ea5c080 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff812ac22c R11: 0000000000000000 R12: ffff88803dc84008
R13: ffff88803ea5c080 R14: ffff88806ce37280 R15: ffff88801d576200
FS: 0000000000000000(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffd7c6caff8 CR3: 000000001d486000 CR4: 0000000000350ef0
Call Trace:
__refcount_sub_and_test include/linux/refcount.h:283 [inline]
__refcount_dec_and_test include/linux/refcount.h:315 [inline]
refcount_dec_and_test include/linux/refcount.h:333 [inline]
sock_put include/net/sock.h:1910 [inline]
sco_sock_timeout+0x1e1/0x230 net/bluetooth/sco.c:101
process_one_work+0xa2a/0x16d0 kernel/workqueue.c:2307
worker_thread+0x628/0x1310 kernel/workqueue.c:2454
kthread+0x2f0/0x3a0 kernel/kthread.c:377
ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:295
irq event stamp: 748688
hardirqs last enabled at (748687): [] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:159 [inline]
hardirqs last enabled at (748687): [] _raw_spin_unlock_irq+0x1f/0x40 kernel/locking/spinlock.c:202
hardirqs last disabled at (748688): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]
hardirqs last disabled at (748688): [] _raw_spin_lock_irqsave+0x4e/0x50 kernel/locking/spinlock.c:162
softirqs last enabled at (748676): [] srcu_invoke_callbacks+0x1e5/0x3a0 kernel/rcu/srcutree.c:1272
softirqs last disabled at (748672): [] spin_unlock_irq include/linux/spinlock.h:404 [inline]
softirqs last disabled at (748672): [] srcu_invoke_callbacks+0x1b5/0x3a0 kernel/rcu/srcutree.c:1267
---[ end trace 0000000000000000 ]---
FAT-fs (loop7): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1)
audit: type=1326 audit(1640720650.244:12): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=5443 comm="syz-executor.5" exe="/syz-executor.5" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb1801d6b19 code=0x0