I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0
==================================================================
BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
BUG: KASAN: use-after-free in atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:116 [inline]
BUG: KASAN: use-after-free in __refcount_add include/linux/refcount.h:193 [inline]
BUG: KASAN: use-after-free in __refcount_inc include/linux/refcount.h:250 [inline]
BUG: KASAN: use-after-free in refcount_inc include/linux/refcount.h:267 [inline]
BUG: KASAN: use-after-free in sock_hold include/net/sock.h:712 [inline]
BUG: KASAN: use-after-free in sco_sock_timeout+0x64/0x230 net/bluetooth/sco.c:89
Write of size 4 at addr ffff88803ef42080 by task kworker/0:3/10320
CPU: 0 PID: 10320 Comm: kworker/0:3 Not tainted 5.16.0-next-20220120 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Workqueue: events sco_sock_timeout
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106
print_address_description.constprop.0+0x1f/0x190 mm/kasan/report.c:255
__kasan_report mm/kasan/report.c:442 [inline]
kasan_report.cold+0x7f/0x11b mm/kasan/report.c:459
check_region_inline mm/kasan/generic.c:183 [inline]
kasan_check_range+0xf9/0x1e0 mm/kasan/generic.c:189
instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:116 [inline]
__refcount_add include/linux/refcount.h:193 [inline]
__refcount_inc include/linux/refcount.h:250 [inline]
refcount_inc include/linux/refcount.h:267 [inline]
sock_hold include/net/sock.h:712 [inline]
sco_sock_timeout+0x64/0x230 net/bluetooth/sco.c:89
process_one_work+0xa14/0x1690 kernel/workqueue.c:2289
worker_thread+0x637/0x1260 kernel/workqueue.c:2436
kthread+0x2f0/0x3a0 kernel/kthread.c:377
ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:295
Allocated by task 10755:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track mm/kasan/common.c:45 [inline]
set_alloc_info mm/kasan/common.c:436 [inline]
____kasan_kmalloc mm/kasan/common.c:515 [inline]
__kasan_kmalloc+0x81/0xa0 mm/kasan/common.c:524
kmalloc include/linux/slab.h:586 [inline]
sk_prot_alloc+0x14c/0x290 net/core/sock.c:1923
sk_alloc+0x30/0x350 net/core/sock.c:1976
sco_sock_alloc.constprop.0+0x31/0x330 net/bluetooth/sco.c:483
sco_sock_create+0xc6/0x150 net/bluetooth/sco.c:522
bt_sock_create+0x159/0x2b0 net/bluetooth/af_bluetooth.c:130
__sock_create+0x345/0x750 net/socket.c:1468
sock_create net/socket.c:1519 [inline]
__sys_socket+0xef/0x200 net/socket.c:1561
__do_sys_socket net/socket.c:1570 [inline]
__se_sys_socket net/socket.c:1568 [inline]
__x64_sys_socket+0x6f/0xb0 net/socket.c:1568
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
Last potentially related work creation:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
__kasan_record_aux_stack+0x97/0xa0 mm/kasan/generic.c:348
insert_work kernel/workqueue.c:1358 [inline]
__queue_work+0x62b/0x1330 kernel/workqueue.c:1517
queue_work_on+0xae/0xc0 kernel/workqueue.c:1545
queue_work include/linux/workqueue.h:502 [inline]
io_ring_ctx_wait_and_kill+0x2a1/0x2d6 fs/io_uring.c:9671
io_uring_release+0x42/0x46 fs/io_uring.c:9679
__fput+0x281/0x9e0 fs/file_table.c:311
task_work_run+0xe2/0x1a0 kernel/task_work.c:164
tracehook_notify_resume include/linux/tracehook.h:188 [inline]
exit_to_user_mode_loop kernel/entry/common.c:175 [inline]
exit_to_user_mode_prepare+0x1be/0x1c0 kernel/entry/common.c:207
__syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]
syscall_exit_to_user_mode+0x19/0x50 kernel/entry/common.c:300
do_syscall_64+0x48/0x90 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x44/0xae
Second to last potentially related work creation:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
__kasan_record_aux_stack+0x97/0xa0 mm/kasan/generic.c:348
__call_rcu kernel/rcu/tree.c:3026 [inline]
call_rcu+0x82/0xa30 kernel/rcu/tree.c:3106
netlink_release+0xf06/0x1db0 net/netlink/af_netlink.c:813
__sock_release+0xd2/0x290 net/socket.c:650
sock_close+0x18/0x20 net/socket.c:1318
__fput+0x281/0x9e0 fs/file_table.c:311
task_work_run+0xe2/0x1a0 kernel/task_work.c:164
exit_task_work include/linux/task_work.h:32 [inline]
do_exit+0xb05/0x2830 kernel/exit.c:806
do_group_exit+0xd2/0x2f0 kernel/exit.c:935
__do_sys_exit_group kernel/exit.c:946 [inline]
__se_sys_exit_group kernel/exit.c:944 [inline]
__x64_sys_exit_group+0x3a/0x50 kernel/exit.c:944
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
The buggy address belongs to the object at ffff88803ef42000
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 128 bytes inside of
2048-byte region [ffff88803ef42000, ffff88803ef42800)
The buggy address belongs to the page:
page:000000005e235e2c refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88803ef43000 pfn:0x3ef40
head:000000005e235e2c order:3 compound_mapcount:0 compound_pincount:0
flags: 0x100000000010200(slab|head|node=0|zone=1)
raw: 0100000000010200 ffffea0000e4d808 ffffea0000ddb008 ffff888007842000
raw: ffff88803ef43000 0000000000080005 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88803ef41f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88803ef42000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88803ef42080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88803ef42100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88803ef42180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 0 PID: 10320 at lib/refcount.c:25 refcount_warn_saturate+0x178/0x1f0 lib/refcount.c:25
Modules linked in:
CPU: 0 PID: 10320 Comm: kworker/0:3 Tainted: G B 5.16.0-next-20220120 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Workqueue: events sco_sock_timeout
RIP: 0010:refcount_warn_saturate+0x178/0x1f0 lib/refcount.c:25
Code: 03 31 ff 89 de e8 78 e0 43 ff 84 db 0f 85 2e ff ff ff e8 8b dc 43 ff 48 c7 c7 60 c3 7c 84 c6 05 9c 13 8b 03 01 e8 1d 56 f9 01 <0f> 0b e9 0f ff ff ff e8 6c dc 43 ff 0f b6 1d 86 13 8b 03 31 ff 89
RSP: 0018:ffff88801704fce0 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff888017f15040 RSI: ffffffff812b24a8 RDI: ffffed1002e09f8e
RBP: ffff88803ef42080 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff812abeac R11: 0000000000000000 R12: ffff888032610a08
R13: ffff88803ef42080 R14: ffff88806ce37280 R15: ffff888032899b00
FS: 0000000000000000(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff87fb5080 CR3: 0000000024e54000 CR4: 0000000000350ef0
Call Trace:
__refcount_add include/linux/refcount.h:199 [inline]
__refcount_inc include/linux/refcount.h:250 [inline]
refcount_inc include/linux/refcount.h:267 [inline]
sock_hold include/net/sock.h:712 [inline]
sco_sock_timeout+0x1ca/0x230 net/bluetooth/sco.c:89
process_one_work+0xa14/0x1690 kernel/workqueue.c:2289
worker_thread+0x637/0x1260 kernel/workqueue.c:2436
kthread+0x2f0/0x3a0 kernel/kthread.c:377
ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:295
irq event stamp: 51032
hardirqs last enabled at (51031): [] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:159 [inline]
hardirqs last enabled at (51031): [] _raw_spin_unlock_irq+0x1f/0x40 kernel/locking/spinlock.c:202
hardirqs last disabled at (51032): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]
hardirqs last disabled at (51032): [] _raw_spin_lock_irqsave+0x4e/0x50 kernel/locking/spinlock.c:162
softirqs last enabled at (50850): [] invoke_softirq kernel/softirq.c:432 [inline]
softirqs last enabled at (50850): [] __irq_exit_rcu+0x113/0x170 kernel/softirq.c:637
softirqs last disabled at (50845): [] invoke_softirq kernel/softirq.c:432 [inline]
softirqs last disabled at (50845): [] __irq_exit_rcu+0x113/0x170 kernel/softirq.c:637
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 0 PID: 10320 at lib/refcount.c:28 refcount_warn_saturate+0x103/0x1f0 lib/refcount.c:28
Modules linked in:
CPU: 0 PID: 10320 Comm: kworker/0:3 Tainted: G B W 5.16.0-next-20220120 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Workqueue: events sco_sock_timeout
RIP: 0010:refcount_warn_saturate+0x103/0x1f0 lib/refcount.c:28
Code: 1d 30 14 8b 03 31 ff 89 de e8 e9 e0 43 ff 84 db 75 a3 e8 00 dd 43 ff 48 c7 c7 c0 c3 7c 84 c6 05 10 14 8b 03 01 e8 92 56 f9 01 <0f> 0b eb 87 e8 e4 dc 43 ff 0f b6 1d f9 13 8b 03 31 ff 89 de e8 b4
RSP: 0018:ffff88801704fce0 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff888017f15040 RSI: ffffffff812b24a8 RDI: ffffed1002e09f8e
RBP: ffff88803ef42080 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff812abeac R11: 0000000000000000 R12: ffff888032610a08
R13: ffff88803ef42080 R14: ffff88806ce37280 R15: ffff888032899b00
FS: 0000000000000000(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff87fb5080 CR3: 0000000024e54000 CR4: 0000000000350ef0
Call Trace:
__refcount_sub_and_test include/linux/refcount.h:283 [inline]
__refcount_dec_and_test include/linux/refcount.h:315 [inline]
refcount_dec_and_test include/linux/refcount.h:333 [inline]
sock_put include/net/sock.h:1911 [inline]
sco_sock_timeout+0x1e1/0x230 net/bluetooth/sco.c:101
process_one_work+0xa14/0x1690 kernel/workqueue.c:2289
worker_thread+0x637/0x1260 kernel/workqueue.c:2436
kthread+0x2f0/0x3a0 kernel/kthread.c:377
ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:295
irq event stamp: 51032
hardirqs last enabled at (51031): [] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:159 [inline]
hardirqs last enabled at (51031): [] _raw_spin_unlock_irq+0x1f/0x40 kernel/locking/spinlock.c:202
hardirqs last disabled at (51032): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]
hardirqs last disabled at (51032): [] _raw_spin_lock_irqsave+0x4e/0x50 kernel/locking/spinlock.c:162
softirqs last enabled at (50850): [] invoke_softirq kernel/softirq.c:432 [inline]
softirqs last enabled at (50850): [] __irq_exit_rcu+0x113/0x170 kernel/softirq.c:637
softirqs last disabled at (50845): [] invoke_softirq kernel/softirq.c:432 [inline]
softirqs last disabled at (50845): [] __irq_exit_rcu+0x113/0x170 kernel/softirq.c:637
---[ end trace 0000000000000000 ]---
loop5: detected capacity change from 0 to 732
I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0