==================================================================
BUG: KASAN: slab-use-after-free in llc_conn_ac_send_sabme_cmd_p_set_x+0x38a/0x420 net/llc/llc_c_ac.c:782
Read of size 1 at addr ffff88802870a010 by task syz.5.2489/13291

CPU: 1 UID: 0 PID: 13291 Comm: syz.5.2489 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description+0x55/0x1e0 mm/kasan/report.c:378
 print_report+0x58/0x70 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 llc_conn_ac_send_sabme_cmd_p_set_x+0x38a/0x420 net/llc/llc_c_ac.c:782
 llc_exec_conn_trans_actions net/llc/llc_conn.c:437 [inline]
 llc_conn_service net/llc/llc_conn.c:362 [inline]
 llc_conn_state_process+0x4fb/0x1380 net/llc/llc_conn.c:66
 llc_process_tmr_ev net/llc/llc_c_ac.c:1442 [inline]
 llc_conn_tmr_common_cb+0x34a/0x780 net/llc/llc_c_ac.c:1325
 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748
 expire_timers kernel/time/timer.c:1799 [inline]
 __run_timers kernel/time/timer.c:2374 [inline]
 __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386
 run_timer_base kernel/time/timer.c:2395 [inline]
 run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405
 handle_softirqs+0x225/0x840 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0xca/0x220 kernel/softirq.c:735
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:strnlen+0x3d/0x90 lib/string.c:414
Code: f6 74 5e 4c 8d 34 37 49 bf 00 00 00 00 00 fc ff df 48 89 fb 48 89 f8 48 89 d9 48 c1 e9 03 42 0f b6 0c 39 84 c9 75 12 80 38 00 <74> 35 48 ff c0 48 ff c3 48 ff ce 75 e0 eb 25 89 da 80 e2 07 38 ca
RSP: 0018:ffffc9000f2f6f88 EFLAGS: 00000202
RAX: ffff888020798920 RBX: ffff888020798920 RCX: 0000000000000000
RDX: ffffc90006a94000 RSI: 0000000000000010 RDI: ffff888020798920
RBP: 0000000000000000 R08: ffffffff823df4ca R09: 0000000000000000
R10: 0000000000000000 R11: ffffffff8eb59c60 R12: 0000000000000000
R13: 0000000000000001 R14: ffff888020798930 R15: dffffc0000000000
 strnlen include/linux/fortify-string.h:183 [inline]
 sized_strscpy include/linux/fortify-string.h:259 [inline]
 __update_page_owner_handle+0x282/0x580 mm/page_owner.c:265
 __set_page_owner+0x10a/0x4c0 mm/page_owner.c:342
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
 prep_new_page mm/page_alloc.c:1867 [inline]
 get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
 __alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
 alloc_pages_mpol+0x212/0x380 mm/mempolicy.c:2490
 folio_alloc_mpol_noprof+0x39/0x160 mm/mempolicy.c:2509
 shmem_alloc_folio mm/shmem.c:1907 [inline]
 shmem_alloc_and_add_folio+0x43e/0xf60 mm/shmem.c:1949
 shmem_get_folio_gfp+0x5da/0x16d0 mm/shmem.c:2502
 shmem_fault+0x179/0x390 mm/shmem.c:2703
 __do_fault+0x138/0x2a0 mm/memory.c:5425
 do_read_fault mm/memory.c:5860 [inline]
 do_fault mm/memory.c:5994 [inline]
 do_pte_missing+0x2215/0x34b0 mm/memory.c:4566
 handle_pte_fault mm/memory.c:6379 [inline]
 __handle_mm_fault mm/memory.c:6517 [inline]
 handle_mm_fault+0x1b36/0x3080 mm/memory.c:6686
 faultin_page mm/gup.c:1126 [inline]
 __get_user_pages+0x1678/0x2720 mm/gup.c:1428
 populate_vma_page_range+0x2be/0x3c0 mm/gup.c:1860
 __mm_populate+0x25f/0x390 mm/gup.c:1963
 mm_populate include/linux/mm.h:4171 [inline]
 vm_mmap_pgoff+0x353/0x4e0 mm/util.c:586
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f136979de99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f136a5f8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007f1369a25fa0 RCX: 00007f136979de99
RDX: b635773f06ebbeeb RSI: 0000000000b36000 RDI: 0000200000000000
RBP: 00007f1369833eaf R08: ffffffffffffffff R09: 0000000000000000
R10: 0000000000008031 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f1369a26038 R14: 00007f1369a25fa0 R15: 00007ffc7160ede8
 </TASK>

Allocated by task 13281:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x32d/0x660 mm/slub.c:5515
 _kmalloc_noprof include/linux/slab.h:969 [inline]
 _kzalloc_noprof include/linux/slab.h:1290 [inline]
 llc_sap_alloc net/llc/llc_core.c:29 [inline]
 llc_sap_open+0xe1/0x3b0 net/llc/llc_core.c:96
 llc_ui_autobind+0x1f1/0x560 net/llc/af_llc.c:301
 llc_ui_connect+0x1d7/0xd50 net/llc/af_llc.c:498
 __sys_connect_file net/socket.c:2135 [inline]
 __sys_connect+0x323/0x460 net/socket.c:2154
 __do_sys_connect net/socket.c:2160 [inline]
 __se_sys_connect net/socket.c:2157 [inline]
 __x64_sys_connect+0x7a/0x90 net/socket.c:2157
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 5627:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2705 [inline]
 __rcu_free_sheaf_prepare+0x12d/0x2a0 mm/slub.c:2956
 rcu_free_sheaf+0x31/0x200 mm/slub.c:6004
 rcu_do_batch kernel/rcu/tree.c:2645 [inline]
 rcu_core+0x78b/0x10a0 kernel/rcu/tree.c:2897
 handle_softirqs+0x225/0x840 kernel/softirq.c:622
 do_softirq+0x76/0xd0 kernel/softirq.c:523
 __local_bh_enable_ip+0xf8/0x130 kernel/softirq.c:450
 tcp_close+0x28/0x110 net/ipv4/tcp.c:3311
 inet_release+0x143/0x190 net/ipv4/af_inet.c:442
 __sock_release net/socket.c:710 [inline]
 sock_close+0xad/0x220 net/socket.c:1501
 __fput+0x418/0xa50 fs/file_table.c:512
 fput_close_sync+0x11f/0x240 fs/file_table.c:617
 __do_sys_close fs/open.c:1511 [inline]
 __se_sys_close fs/open.c:1496 [inline]
 __x64_sys_close+0x7e/0x110 fs/open.c:1496
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff88802870a000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 16 bytes inside of
 freed 2048-byte region [ffff88802870a000, ffff88802870a800)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x28708
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801b005000 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88801b005000 dead000000000100 dead000000000122
head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 153, tgid 153 (kworker/u8:8), ts 6673698570, free_ts 6658923115
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
 prep_new_page mm/page_alloc.c:1867 [inline]
 get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
 __alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
 alloc_slab_page mm/slub.c:3294 [inline]
 allocate_slab+0x79/0x5e0 mm/slub.c:3408
 new_slab mm/slub.c:3454 [inline]
 refill_objects+0x2d5/0x350 mm/slub.c:7338
 refill_sheaf mm/slub.c:2832 [inline]
 __pcs_replace_empty_main+0x2bf/0x6b0 mm/slub.c:4703
 alloc_from_pcs mm/slub.c:4801 [inline]
 slab_alloc_node mm/slub.c:4933 [inline]
 __do_kmalloc_node mm/slub.c:5361 [inline]
 __kmalloc_noprof+0x485/0x720 mm/slub.c:5387
 _kmalloc_noprof include/linux/slab.h:973 [inline]
 _kzalloc_noprof include/linux/slab.h:1290 [inline]
 scsi_alloc_target+0x138/0xbd0 drivers/scsi/scsi_scan.c:505
 __scsi_scan_target+0x164/0xe10 drivers/scsi/scsi_scan.c:1780
 scsi_scan_channel drivers/scsi/scsi_scan.c:1885 [inline]
 scsi_scan_host_selected+0x3d3/0x7a0 drivers/scsi/scsi_scan.c:1914
 do_scsi_scan_host drivers/scsi/scsi_scan.c:2047 [inline]
 do_scan_async+0x10e/0x660 drivers/scsi/scsi_scan.c:2057
 async_run_entry_fn+0x9d/0x430 kernel/async.c:129
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
page last free pid 24 tgid 24 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1406 [inline]
 free_pages_prepare+0x960/0xa60 mm/page_alloc.c:1451
 __free_contig_range_common+0x174/0x340 mm/page_alloc.c:6897
 __free_contig_range mm/page_alloc.c:6942 [inline]
 free_pages_bulk+0x48/0x120 mm/page_alloc.c:5257
 vm_area_free_pages mm/vmalloc.c:3439 [inline]
 vfree+0x224/0x4a0 mm/vmalloc.c:3488
 delayed_vfree_work+0x55/0x80 mm/vmalloc.c:3392
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Memory state around the buggy address:
 ffff888028709f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888028709f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88802870a000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                         ^
 ffff88802870a080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88802870a100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess):
   0:	f6 74 5e 4c          	divb   0x4c(%rsi,%rbx,2)
   4:	8d 34 37             	lea    (%rdi,%rsi,1),%esi
   7:	49 bf 00 00 00 00 00 	movabs $0xdffffc0000000000,%r15
   e:	fc ff df
  11:	48 89 fb             	mov    %rdi,%rbx
  14:	48 89 f8             	mov    %rdi,%rax
  17:	48 89 d9             	mov    %rbx,%rcx
  1a:	48 c1 e9 03          	shr    $0x3,%rcx
  1e:	42 0f b6 0c 39       	movzbl (%rcx,%r15,1),%ecx
  23:	84 c9                	test   %cl,%cl
  25:	75 12                	jne    0x39
  27:	80 38 00             	cmpb   $0x0,(%rax)
* 2a:	74 35                	je     0x61 <-- trapping instruction
  2c:	48 ff c0             	inc    %rax
  2f:	48 ff c3             	inc    %rbx
  32:	48 ff ce             	dec    %rsi
  35:	75 e0                	jne    0x17
  37:	eb 25                	jmp    0x5e
  39:	89 da                	mov    %ebx,%edx
  3b:	80 e2 07             	and    $0x7,%dl
  3e:	38 ca                	cmp    %cl,%dl