From: syzbot <syzbot+0e4ebcc970728e056324@syzkaller.appspotmail.com>
To: johan.hedberg@gmail.com, linux-bluetooth@vger.kernel.org,
linux-kernel@vger.kernel.org, luiz.dentz@gmail.com,
marcel@holtmann.org, syzkaller-bugs@googlegroups.com
Subject: [syzbot] [bluetooth?] KASAN: wild-memory-access Read in l2cap_connect_cfm
Date: Mon, 17 Mar 2025 08:57:23 -0700 [thread overview]
Message-ID: <67d84663.050a0220.2ca2c6.0020.GAE@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: 78e3fd2b7e4b Merge remote-tracking branch 'will/for-next/p..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=15b05874580000
kernel config: https://syzkaller.appspot.com/x/.config?x=ddc962951c395b1d
dashboard link: https://syzkaller.appspot.com/bug?extid=0e4ebcc970728e056324
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/6f8d7598ad09/disk-78e3fd2b.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/493e8429a272/vmlinux-78e3fd2b.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c843736f7c02/Image-78e3fd2b.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0e4ebcc970728e056324@syzkaller.appspotmail.com
kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory.
Bluetooth: hci1: failed to register connection device
==================================================================
BUG: KASAN: wild-memory-access in instrument_atomic_read include/linux/instrumented.h:68 [inline]
BUG: KASAN: wild-memory-access in atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
BUG: KASAN: wild-memory-access in l2cap_chan_lock include/net/bluetooth/l2cap.h:827 [inline]
BUG: KASAN: wild-memory-access in l2cap_conn_ready net/bluetooth/l2cap_core.c:1624 [inline]
BUG: KASAN: wild-memory-access in l2cap_connect_cfm+0x538/0xde4 net/bluetooth/l2cap_core.c:7245
Read of size 4 at addr deacfffffffffc8c by task kworker/u9:3/6449
CPU: 1 UID: 0 PID: 6449 Comm: kworker/u9:3 Not tainted 6.14.0-rc6-syzkaller-g78e3fd2b7e4b #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Workqueue: hci1 hci_rx_work
Call trace:
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C)
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:120
print_report+0xf8/0x550 mm/kasan/report.c:524
kasan_report+0xd8/0x138 mm/kasan/report.c:634
kasan_check_range+0x268/0x2a8 mm/kasan/generic.c:189
__kasan_check_read+0x20/0x30 mm/kasan/shadow.c:31
instrument_atomic_read include/linux/instrumented.h:68 [inline]
atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
l2cap_chan_lock include/net/bluetooth/l2cap.h:827 [inline]
l2cap_conn_ready net/bluetooth/l2cap_core.c:1624 [inline]
l2cap_connect_cfm+0x538/0xde4 net/bluetooth/l2cap_core.c:7245
hci_connect_cfm+0x120/0x1d4 include/net/bluetooth/hci_core.h:2051
le_conn_complete_evt+0xa70/0xf80 net/bluetooth/hci_event.c:5763
hci_le_conn_complete_evt+0x114/0x404 net/bluetooth/hci_event.c:5789
hci_le_meta_evt+0x2a4/0x478 net/bluetooth/hci_event.c:7162
hci_event_func net/bluetooth/hci_event.c:7470 [inline]
hci_event_packet+0x884/0x1060 net/bluetooth/hci_event.c:7525
hci_rx_work+0x31c/0xb04 net/bluetooth/hci_core.c:4015
process_one_work+0x810/0x1638 kernel/workqueue.c:3238
process_scheduled_works kernel/workqueue.c:3319 [inline]
worker_thread+0x97c/0xeec kernel/workqueue.c:3400
kthread+0x65c/0x7b0 kernel/kthread.c:464
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862
==================================================================
Unable to handle kernel paging request at virtual address fbd51fffffffff91
KASAN: maybe wild-memory-access in range [0xdeacfffffffffc88-0xdeacfffffffffc8f]
Mem abort info:
ESR = 0x0000000096000004
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x04: level 0 translation fault
Data abort info:
ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[fbd51fffffffff91] address between user and kernel address ranges
Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 UID: 0 PID: 6449 Comm: kworker/u9:3 Tainted: G B 6.14.0-rc6-syzkaller-g78e3fd2b7e4b #0
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Workqueue: hci1 hci_rx_work
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : raw_atomic_read include/linux/atomic/atomic-arch-fallback.h:457 [inline]
pc : atomic_read include/linux/atomic/atomic-instrumented.h:33 [inline]
pc : l2cap_chan_lock include/net/bluetooth/l2cap.h:827 [inline]
pc : l2cap_conn_ready net/bluetooth/l2cap_core.c:1624 [inline]
pc : l2cap_connect_cfm+0x53c/0xde4 net/bluetooth/l2cap_core.c:7245
lr : instrument_atomic_read include/linux/instrumented.h:68 [inline]
lr : atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
lr : l2cap_chan_lock include/net/bluetooth/l2cap.h:827 [inline]
lr : l2cap_conn_ready net/bluetooth/l2cap_core.c:1624 [inline]
lr : l2cap_connect_cfm+0x538/0xde4 net/bluetooth/l2cap_core.c:7245
sp : ffff8000a1577460
x29: ffff8000a1577500 x28: ffff0000d4756000 x27: 1fffe0001afe1a03
x26: dfff800000000000 x25: ffff0000d47564b0 x24: ffff0000d7f0d01a
x23: dead000000000100 x22: ffff0000d7f0d2c0 x21: 1fffe0001b467007
x20: ffff0000da33803d x19: deacfffffffffc8c x18: 1fffe000366f6086
x17: ffff80008fbbd000 x16: ffff80008b7cba1c x15: 0000000000000001
x14: 1ffff0001262eaf8 x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000100000 x10: 00000000000596ee x9 : 0000000000000000
x8 : 1bd59fffffffff91 x7 : 1fffe000366f6087 x6 : ffff8000803d4bfc
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff8000802f88ec
x2 : 0000000000000001 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
raw_atomic_read include/linux/atomic/atomic-arch-fallback.h:457 [inline] (P)
atomic_read include/linux/atomic/atomic-instrumented.h:33 [inline] (P)
l2cap_chan_lock include/net/bluetooth/l2cap.h:827 [inline] (P)
l2cap_conn_ready net/bluetooth/l2cap_core.c:1624 [inline] (P)
l2cap_connect_cfm+0x53c/0xde4 net/bluetooth/l2cap_core.c:7245 (P)
hci_connect_cfm+0x120/0x1d4 include/net/bluetooth/hci_core.h:2051
le_conn_complete_evt+0xa70/0xf80 net/bluetooth/hci_event.c:5763
hci_le_conn_complete_evt+0x114/0x404 net/bluetooth/hci_event.c:5789
hci_le_meta_evt+0x2a4/0x478 net/bluetooth/hci_event.c:7162
hci_event_func net/bluetooth/hci_event.c:7470 [inline]
hci_event_packet+0x884/0x1060 net/bluetooth/hci_event.c:7525
hci_rx_work+0x31c/0xb04 net/bluetooth/hci_core.c:4015
process_one_work+0x810/0x1638 kernel/workqueue.c:3238
process_scheduled_works kernel/workqueue.c:3319 [inline]
worker_thread+0x97c/0xeec kernel/workqueue.c:3400
kthread+0x65c/0x7b0 kernel/kthread.c:464
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862
Code: 52800081 aa1303e0 97568921 d343fe68 (38fa6908)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: 52800081 mov w1, #0x4 // #4
4: aa1303e0 mov x0, x19
8: 97568921 bl 0xfffffffffd5a248c
c: d343fe68 lsr x8, x19, #3
* 10: 38fa6908 ldrsb w8, [x8, x26] <-- trapping instruction
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
next reply other threads:[~2025-03-17 15:57 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-03-17 15:57 syzbot [this message]
2025-09-12 15:46 ` [syzbot] [bluetooth?] KASAN: wild-memory-access Read in l2cap_connect_cfm syzbot
2025-09-13 4:02 ` Hillf Danton
2025-09-13 4:28 ` syzbot
2025-10-12 10:02 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=67d84663.050a0220.2ca2c6.0020.GAE@google.com \
--to=syzbot+0e4ebcc970728e056324@syzkaller.appspotmail.com \
--cc=johan.hedberg@gmail.com \
--cc=linux-bluetooth@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luiz.dentz@gmail.com \
--cc=marcel@holtmann.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.