From: patchwork-bot+bluetooth@kernel.org
To: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Cc: linux-bluetooth@vger.kernel.org
Subject: Re: [PATCH v1] Bluetooth/L2CAP: Fix uaf in l2cap_connect
Date: Wed, 25 Sep 2024 15:20:35 +0000 [thread overview]
Message-ID: <172727763545.630403.8450411112997127998.git-patchwork-notify@kernel.org> (raw)
In-Reply-To: <20240923165116.1540227-1-luiz.dentz@gmail.com>
Hello:
This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
On Mon, 23 Sep 2024 12:51:16 -0400 you wrote:
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
>
> [Syzbot reported]
> BUG: KASAN: slab-use-after-free in l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949
> Read of size 8 at addr ffff8880241e9800 by task kworker/u9:0/54
>
> CPU: 0 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.11.0-rc6-syzkaller-00268-g788220eee30d #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
> Workqueue: hci2 hci_rx_work
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:93 [inline]
> dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
> print_address_description mm/kasan/report.c:377 [inline]
> print_report+0xc3/0x620 mm/kasan/report.c:488
> kasan_report+0xd9/0x110 mm/kasan/report.c:601
> l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949
> l2cap_connect_req net/bluetooth/l2cap_core.c:4080 [inline]
> l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4772 [inline]
> l2cap_sig_channel net/bluetooth/l2cap_core.c:5543 [inline]
> l2cap_recv_frame+0xf0b/0x8eb0 net/bluetooth/l2cap_core.c:6825
> l2cap_recv_acldata+0x9b4/0xb70 net/bluetooth/l2cap_core.c:7514
> hci_acldata_packet net/bluetooth/hci_core.c:3791 [inline]
> hci_rx_work+0xaab/0x1610 net/bluetooth/hci_core.c:4028
> process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
> process_scheduled_works kernel/workqueue.c:3312 [inline]
> worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
> kthread+0x2c1/0x3a0 kernel/kthread.c:389
> ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> ...
>
> [...]
Here is the summary with links:
- [v1] Bluetooth/L2CAP: Fix uaf in l2cap_connect
https://git.kernel.org/bluetooth/bluetooth-next/c/d93544ba0cd8
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
prev parent reply other threads:[~2024-09-25 15:20 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-09-23 16:51 [PATCH v1] Bluetooth/L2CAP: Fix uaf in l2cap_connect Luiz Augusto von Dentz
2024-09-25 15:20 ` patchwork-bot+bluetooth [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=172727763545.630403.8450411112997127998.git-patchwork-notify@kernel.org \
--to=patchwork-bot+bluetooth@kernel.org \
--cc=linux-bluetooth@vger.kernel.org \
--cc=luiz.dentz@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.