From: syzbot <syzbot+5c915dc5dd417b83b348@syzkaller.appspotmail.com>
To: hdanton@sina.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_recv_frame
Date: Sun, 01 Sep 2024 03:13:03 -0700 [thread overview]
Message-ID: <000000000000ddc0b606210c11a0@google.com> (raw)
In-Reply-To: <20240901090400.1493-1-hdanton@sina.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: uninit-value in l2cap_recv_frame
Bluetooth: hci0: command tx timeout
=====================================================
BUG: KMSAN: uninit-value in l2cap_conless_channel net/bluetooth/l2cap_core.c:6758 [inline]
BUG: KMSAN: uninit-value in l2cap_recv_frame+0xc9c5/0x18b10 net/bluetooth/l2cap_core.c:6832
l2cap_conless_channel net/bluetooth/l2cap_core.c:6758 [inline]
l2cap_recv_frame+0xc9c5/0x18b10 net/bluetooth/l2cap_core.c:6832
l2cap_recv_acldata+0xdd9/0x2ac0 net/bluetooth/l2cap_core.c:7515
hci_acldata_packet net/bluetooth/hci_core.c:3791 [inline]
hci_rx_work+0xb38/0x1130 net/bluetooth/hci_core.c:4028
process_one_work kernel/workqueue.c:3231 [inline]
process_scheduled_works+0xae0/0x1c40 kernel/workqueue.c:3312
worker_thread+0xea7/0x14d0 kernel/workqueue.c:3389
kthread+0x3e2/0x540 kernel/kthread.c:389
ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Uninit was created at:
slab_post_alloc_hook mm/slub.c:3994 [inline]
slab_alloc_node mm/slub.c:4037 [inline]
kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4080
kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:583
__alloc_skb+0x363/0x7b0 net/core/skbuff.c:674
alloc_skb include/linux/skbuff.h:1320 [inline]
bt_skb_alloc include/net/bluetooth/bluetooth.h:493 [inline]
vhci_get_user drivers/bluetooth/hci_vhci.c:487 [inline]
vhci_write+0x128/0x910 drivers/bluetooth/hci_vhci.c:607
new_sync_write fs/read_write.c:497 [inline]
vfs_write+0xb2f/0x1550 fs/read_write.c:590
ksys_write+0x20f/0x4c0 fs/read_write.c:643
__do_sys_write fs/read_write.c:655 [inline]
__se_sys_write fs/read_write.c:652 [inline]
__x64_sys_write+0x93/0xe0 fs/read_write.c:652
x64_sys_call+0x306a/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:2
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
CPU: 0 UID: 0 PID: 5289 Comm: kworker/u9:2 Not tainted 6.11.0-rc5-syzkaller-00310-ge8784b0aef62-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: hci0 hci_rx_work
=====================================================
Tested on:
commit: e8784b0a Merge tag 'usb-6.11-rc6' of git://git.kernel...
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=1721e347980000
kernel config: https://syzkaller.appspot.com/x/.config?x=b3e19fd08b312452
dashboard link: https://syzkaller.appspot.com/bug?extid=5c915dc5dd417b83b348
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=155009eb980000
next prev parent reply other threads:[~2024-09-01 10:13 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-27 7:44 [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_recv_frame syzbot
2024-09-01 7:39 ` syzbot
2024-09-01 9:04 ` Hillf Danton
2024-09-01 10:13 ` syzbot [this message]
2024-09-01 11:13 ` Hillf Danton
2024-09-01 12:33 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000ddc0b606210c11a0@google.com \
--to=syzbot+5c915dc5dd417b83b348@syzkaller.appspotmail.com \
--cc=hdanton@sina.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.