program:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x8ef, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe)
r1 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4)
ioctl$sock_bt_bnep_BNEPCONNADD(r1, 0x400442c8, &(0x7f00000001c0)={r0, 0x1, 0x2})
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x5c, 0x9, 0xa, 0x409, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x31}, @NFTA_SET_EXPR={0x20, 0x11, 0x0, 0x1, @quota={{0xa}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_QUOTA_BYTES={0xc, 0x1, 0x1, 0x0, 0x8}]}}}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xa4}}, 0x0)
r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_bt_hci(r3, 0x400448ca, 0x0)
bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6)
syz_emit_vhci(&(0x7f0000000100)=@HCI_SCODATA_PKT={0x3, {0xc9}}, 0x4)
ioctl$sock_bt_bnep_BNEPGETCONNLIST(r1, 0x800442d2, &(0x7f0000000180)={0x1, &(0x7f0000000100)=[{0x0, 0x0, 0x0, @remote}]})
[ 85.665334][ T4663] Bluetooth: hci0: command tx timeout
[ 85.810102][ T5320] ==================================================================
[ 85.813762][ T5320] BUG: KASAN: slab-use-after-free in cfusbl_device_notify+0x16b/0x6b0
[ 85.817737][ T5320] Read of size 8 at addr ffff888012224d48 by task syz.0.0/5320
[ 85.821618][ T5320]
[ 85.823028][ T5320] CPU: 0 UID: 0 PID: 5320 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 85.823049][ T5320] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 85.823060][ T5320] Call Trace:
[ 85.823069][ T5320]
[ 85.823077][ T5320] dump_stack_lvl+0xe8/0x150
[ 85.823104][ T5320] print_report+0xba/0x230
[ 85.823121][ T5320] ? cfusbl_device_notify+0x16b/0x6b0
[ 85.823136][ T5320] kasan_report+0x117/0x150
[ 85.823158][ T5320] ? cfusbl_device_notify+0x16b/0x6b0
[ 85.823176][ T5320] cfusbl_device_notify+0x16b/0x6b0
[ 85.823191][ T5320] ? net_generic+0x1e/0x240
[ 85.823202][ T5320] ? net_generic+0x1e/0x240
[ 85.823215][ T5320] ? __pfx_cfusbl_device_notify+0x10/0x10
[ 85.823229][ T5320] ? caif_device_notify+0x250/0xfc0
[ 85.823241][ T5320] ? lockdep_rtnl_is_held+0x26/0x40
[ 85.823262][ T5320] notifier_call_chain+0x1be/0x400
[ 85.823284][ T5320] register_netdevice+0x1268/0x1cf0
[ 85.823302][ T5320] ? __mutex_lock+0x5ac/0x1300
[ 85.823317][ T5320] ? __pfx_register_netdevice+0x10/0x10
[ 85.823332][ T5320] ? dev_addr_check+0x20/0x230
[ 85.823349][ T5320] ? dev_addr_mod+0x354/0x520
[ 85.823366][ T5320] register_netdev+0x40/0x60
[ 85.823382][ T5320] bnep_add_connection+0x6e5/0xca0
[ 85.823397][ T5320] ? __pfx_bnep_add_connection+0x10/0x10
[ 85.823409][ T5320] ? __fget_files+0x3a0/0x420
[ 85.823426][ T5320] do_bnep_sock_ioctl+0x40b/0x650
[ 85.823440][ T5320] ? __pfx_do_bnep_sock_ioctl+0x10/0x10
[ 85.823454][ T5320] ? tomoyo_path_number_perm+0x219/0x630
[ 85.823542][ T5320] sock_do_ioctl+0x101/0x320
[ 85.823556][ T5320] ? __pfx_sock_do_ioctl+0x10/0x10
[ 85.823568][ T5320] ? do_futex+0x395/0x420
[ 85.823587][ T5320] sock_ioctl+0x5c6/0x7f0
[ 85.823607][ T5320] ? __pfx_sock_ioctl+0x10/0x10
[ 85.823624][ T5320] ? __fget_files+0x2a/0x420
[ 85.823639][ T5320] ? __fget_files+0x3a0/0x420
[ 85.823652][ T5320] ? __fget_files+0x2a/0x420
[ 85.823668][ T5320] ? bpf_lsm_file_ioctl+0x9/0x20
[ 85.823683][ T5320] ? __pfx_sock_ioctl+0x10/0x10
[ 85.823702][ T5320] __se_sys_ioctl+0xfc/0x170
[ 85.823716][ T5320] do_syscall_64+0x14d/0xf80
[ 85.823736][ T5320] ? trace_irq_disable+0x3b/0x150
[ 85.823759][ T5320] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.823772][ T5320] ? clear_bhb_loop+0x40/0x90
[ 85.823786][ T5320] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.823798][ T5320] RIP: 0033:0x7febbcb9c799
[ 85.823814][ T5320] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 85.823824][ T5320] RSP: 002b:00007febb8ff5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 85.823862][ T5320] RAX: ffffffffffffffda RBX: 00007febbce15fa0 RCX: 00007febbcb9c799
[ 85.823874][ T5320] RDX: 00002000000001c0 RSI: 00000000400442c8 RDI: 0000000000000005
[ 85.823884][ T5320] RBP: 00007febbcc32bd9 R08: 0000000000000000 R09: 0000000000000000
[ 85.823893][ T5320] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 85.823901][ T5320] R13: 00007febbce16038 R14: 00007febbce15fa0 R15: 00007fffa8374458
[ 85.823917][ T5320]
[ 85.823922][ T5320]
[ 85.972084][ T5320] Allocated by task 4663:
[ 85.974447][ T5320] kasan_save_track+0x3e/0x80
[ 85.976784][ T5320] __kasan_kmalloc+0x93/0xb0
[ 85.978874][ T5320] __kmalloc_cache_noprof+0x31c/0x660
[ 85.981460][ T5320] __hci_conn_add+0x3c4/0x1e00
[ 85.983757][ T5320] hci_conn_request_evt+0x5b1/0xc40
[ 85.986513][ T5320] hci_event_packet+0x805/0x12c0
[ 85.988747][ T5320] hci_rx_work+0x3ee/0x1030
[ 85.991145][ T5320] process_scheduled_works+0xb02/0x1830
[ 85.993822][ T5320] worker_thread+0xa50/0xfc0
[ 85.995975][ T5320] kthread+0x388/0x470
[ 85.997835][ T5320] ret_from_fork+0x51e/0xb90
[ 86.000019][ T5320] ret_from_fork_asm+0x1a/0x30
[ 86.002308][ T5320]
[ 86.003628][ T5320] Freed by task 5321:
[ 86.005898][ T5320] kasan_save_track+0x3e/0x80
[ 86.008392][ T5320] kasan_save_free_info+0x46/0x50
[ 86.010833][ T5320] __kasan_slab_free+0x5c/0x80
[ 86.012892][ T5320] kfree+0x1c1/0x630
[ 86.014682][ T5320] device_release+0x9e/0x1d0
[ 86.016737][ T5320] kobject_put+0x228/0x560
[ 86.018782][ T5320] hci_conn_del+0xc36/0x1230
[ 86.021044][ T5320] hci_conn_hash_flush+0x191/0x260
[ 86.024040][ T5320] hci_dev_close_sync+0x821/0x10e0
[ 86.026853][ T5320] hci_dev_close+0x108/0x260
[ 86.029121][ T5320] sock_do_ioctl+0x101/0x320
[ 86.031262][ T5320] sock_ioctl+0x5c6/0x7f0
[ 86.033064][ T5320] __se_sys_ioctl+0xfc/0x170
[ 86.035221][ T5320] do_syscall_64+0x14d/0xf80
[ 86.037274][ T5320] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.040106][ T5320]
[ 86.041427][ T5320] Last potentially related work creation:
[ 86.044716][ T5320] kasan_save_stack+0x3e/0x60
[ 86.047272][ T5320] kasan_record_aux_stack+0xbd/0xd0
[ 86.050015][ T5320] insert_work+0x3d/0x330
[ 86.052282][ T5320] __queue_work+0xd03/0x1020
[ 86.054469][ T5320] queue_delayed_work_on+0x11a/0x1e0
[ 86.056777][ T5320] l2cap_chan_del+0x285/0x610
[ 86.059115][ T5320] l2cap_conn_del+0x333/0x5c0
[ 86.061896][ T5320] hci_conn_hash_flush+0x10d/0x260
[ 86.064959][ T5320] hci_dev_close_sync+0x821/0x10e0
[ 86.067775][ T5320] hci_dev_close+0x108/0x260
[ 86.070283][ T5320] sock_do_ioctl+0x101/0x320
[ 86.072880][ T5320] sock_ioctl+0x5c6/0x7f0
[ 86.075140][ T5320] __se_sys_ioctl+0xfc/0x170
[ 86.077577][ T5320] do_syscall_64+0x14d/0xf80
[ 86.080094][ T5320] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.083334][ T5320]
[ 86.084683][ T5320] The buggy address belongs to the object at ffff888012224000
[ 86.084683][ T5320] which belongs to the cache kmalloc-8k of size 8192
[ 86.091206][ T5320] The buggy address is located 3400 bytes inside of
[ 86.091206][ T5320] freed 8192-byte region [ffff888012224000, ffff888012226000)
[ 86.097581][ T5320]
[ 86.098883][ T5320] The buggy address belongs to the physical page:
[ 86.101942][ T5320] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12220
[ 86.105659][ T5320] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 86.110112][ T5320] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 86.114374][ T5320] page_type: f5(slab)
[ 86.116405][ T5320] raw: 00fff00000000040 ffff88801ac42280 dead000000000122 0000000000000000
[ 86.120440][ T5320] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
[ 86.124738][ T5320] head: 00fff00000000040 ffff88801ac42280 dead000000000122 0000000000000000
[ 86.128787][ T5320] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
[ 86.133725][ T5320] head: 00fff00000000003 ffffea0000488801 00000000ffffffff 00000000ffffffff
[ 86.138047][ T5320] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 86.141957][ T5320] page dumped because: kasan: bad access detected
[ 86.144540][ T5320] page_owner tracks the page as allocated
[ 86.146732][ T5320] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4663, tgid 4663 (kworker/u5:1), ts 81062140929, free_ts 52866591648
[ 86.156835][ T5320] post_alloc_hook+0x231/0x280
[ 86.159500][ T5320] get_page_from_freelist+0x24dc/0x2580
[ 86.162040][ T5320] __alloc_frozen_pages_noprof+0x18d/0x380
[ 86.164679][ T5320] allocate_slab+0x77/0x660
[ 86.166735][ T5320] refill_objects+0x331/0x3c0
[ 86.168693][ T5320] __pcs_replace_empty_main+0x2b9/0x620
[ 86.171070][ T5320] __kmalloc_cache_noprof+0x392/0x660
[ 86.173652][ T5320] __hci_conn_add+0x3c4/0x1e00
[ 86.176359][ T5320] hci_conn_request_evt+0x5b1/0xc40
[ 86.179115][ T5320] hci_event_packet+0x805/0x12c0
[ 86.181483][ T5320] hci_rx_work+0x3ee/0x1030
[ 86.183847][ T5320] process_scheduled_works+0xb02/0x1830
[ 86.186675][ T5320] worker_thread+0xa50/0xfc0
[ 86.188851][ T5320] kthread+0x388/0x470
[ 86.191073][ T5320] ret_from_fork+0x51e/0xb90
[ 86.193714][ T5320] ret_from_fork_asm+0x1a/0x30
[ 86.196629][ T5320] page last free pid 5007 tgid 5007 stack trace:
[ 86.199774][ T5320] __free_frozen_pages+0xc2b/0xdb0
[ 86.202205][ T5320] __slab_free+0x263/0x2b0
[ 86.204413][ T5320] qlist_free_all+0x97/0x100
[ 86.206671][ T5320] kasan_quarantine_reduce+0x148/0x160
[ 86.209098][ T5320] __kasan_slab_alloc+0x22/0x80
[ 86.211321][ T5320] kmem_cache_alloc_node_noprof+0x384/0x690
[ 86.214016][ T5320] __alloc_skb+0x27d/0x7d0
[ 86.216277][ T5320] netlink_sendmsg+0x5d4/0xb40
[ 86.219390][ T5320] __sys_sendto+0x709/0x7a0
[ 86.222024][ T5320] __x64_sys_sendto+0xde/0x100
[ 86.224386][ T5320] do_syscall_64+0x14d/0xf80
[ 86.226316][ T5320] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.228911][ T5320]
[ 86.230036][ T5320] Memory state around the buggy address:
[ 86.232580][ T5320] ffff888012224c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 86.236415][ T5320] ffff888012224c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 86.240075][ T5320] >ffff888012224d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 86.244337][ T5320] ^
[ 86.247507][ T5320] ffff888012224d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 86.251041][ T5320] ffff888012224e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 86.254724][ T5320] ==================================================================
[ 86.307024][ T5320] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 86.310099][ T5320] CPU: 0 UID: 0 PID: 5320 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 86.315118][ T5320] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 86.320602][ T5320] Call Trace:
[ 86.322389][ T5320]
[ 86.324024][ T5320] vpanic+0x56c/0xa60
[ 86.326248][ T5320] ? __pfx_vpanic+0x10/0x10
[ 86.328730][ T5320] panic+0xc5/0xd0
[ 86.330839][ T5320] ? __pfx_panic+0x10/0x10
[ 86.333358][ T5320] ? preempt_schedule_thunk+0x16/0x30
[ 86.336490][ T5320] ? cfusbl_device_notify+0x16b/0x6b0
[ 86.339389][ T5320] ? preempt_schedule_thunk+0x16/0x30
[ 86.342291][ T5320] ? cfusbl_device_notify+0x16b/0x6b0
[ 86.345566][ T5320] check_panic_on_warn+0x89/0xb0
[ 86.348551][ T5320] ? cfusbl_device_notify+0x16b/0x6b0
[ 86.352240][ T5320] end_report+0x73/0x180
[ 86.354667][ T5320] ? cfusbl_device_notify+0x16b/0x6b0
[ 86.357580][ T5320] kasan_report+0x128/0x150
[ 86.359609][ T5320] ? cfusbl_device_notify+0x16b/0x6b0
[ 86.362388][ T5320] cfusbl_device_notify+0x16b/0x6b0
[ 86.365701][ T5320] ? net_generic+0x1e/0x240
[ 86.368791][ T5320] ? net_generic+0x1e/0x240
[ 86.371470][ T5320] ? __pfx_cfusbl_device_notify+0x10/0x10
[ 86.373984][ T5320] ? caif_device_notify+0x250/0xfc0
[ 86.376309][ T5320] ? lockdep_rtnl_is_held+0x26/0x40
[ 86.378552][ T5320] notifier_call_chain+0x1be/0x400
[ 86.380769][ T5320] register_netdevice+0x1268/0x1cf0
[ 86.383237][ T5320] ? __mutex_lock+0x5ac/0x1300
[ 86.385451][ T5320] ? __pfx_register_netdevice+0x10/0x10
[ 86.388265][ T5320] ? dev_addr_check+0x20/0x230
[ 86.390423][ T5320] ? dev_addr_mod+0x354/0x520
[ 86.392451][ T5320] register_netdev+0x40/0x60
[ 86.394271][ T5320] bnep_add_connection+0x6e5/0xca0
[ 86.396358][ T5320] ? __pfx_bnep_add_connection+0x10/0x10
[ 86.398921][ T5320] ? __fget_files+0x3a0/0x420
[ 86.401379][ T5320] do_bnep_sock_ioctl+0x40b/0x650
[ 86.404164][ T5320] ? __pfx_do_bnep_sock_ioctl+0x10/0x10
[ 86.406846][ T5320] ? tomoyo_path_number_perm+0x219/0x630
[ 86.409411][ T5320] sock_do_ioctl+0x101/0x320
[ 86.411530][ T5320] ? __pfx_sock_do_ioctl+0x10/0x10
[ 86.413744][ T5320] ? do_futex+0x395/0x420
[ 86.415763][ T5320] sock_ioctl+0x5c6/0x7f0
[ 86.417879][ T5320] ? __pfx_sock_ioctl+0x10/0x10
[ 86.420439][ T5320] ? __fget_files+0x2a/0x420
[ 86.422685][ T5320] ? __fget_files+0x3a0/0x420
[ 86.424853][ T5320] ? __fget_files+0x2a/0x420
[ 86.426883][ T5320] ? bpf_lsm_file_ioctl+0x9/0x20
[ 86.429598][ T5320] ? __pfx_sock_ioctl+0x10/0x10
[ 86.431754][ T5320] __se_sys_ioctl+0xfc/0x170
[ 86.433846][ T5320] do_syscall_64+0x14d/0xf80
[ 86.436060][ T5320] ? trace_irq_disable+0x3b/0x150
[ 86.438476][ T5320] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.441354][ T5320] ? clear_bhb_loop+0x40/0x90
[ 86.443731][ T5320] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.446983][ T5320] RIP: 0033:0x7febbcb9c799
[ 86.449203][ T5320] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 86.460125][ T5320] RSP: 002b:00007febb8ff5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 86.463751][ T5320] RAX: ffffffffffffffda RBX: 00007febbce15fa0 RCX: 00007febbcb9c799
[ 86.467167][ T5320] RDX: 00002000000001c0 RSI: 00000000400442c8 RDI: 0000000000000005
[ 86.470726][ T5320] RBP: 00007febbcc32bd9 R08: 0000000000000000 R09: 0000000000000000
[ 86.474312][ T5320] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 86.477892][ T5320] R13: 00007febbce16038 R14: 00007febbce15fa0 R15: 00007fffa8374458
[ 86.482707][ T5320]
[ 86.485764][ T5320] Kernel Offset: disabled
[ 86.487948][ T5320] Rebooting in 86400 seconds..