From: JiaHong Su <s11242586@gmail.com>
To: Marcel Holtmann <marcel@holtmann.org>,
Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Cc: linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [BUG] Bluetooth: Use-after-free in hci_uart_write_work
Date: Fri, 16 Jan 2026 07:20:44 +0800 [thread overview]
Message-ID: <6969764f.170a0220.2b9fc4.35a7@mx.google.com> (raw)
[-- Attachment #1: Type: text/plain, Size: 289 bytes --]
Hi,
Found a use-after-free in hci_uart_write_work when running Syzkaller on
Linux 6.19-rc5 (commit 0f61b18).
KASAN reports null-ptr-deref in the workqueue handler, looks like the
work wasn't cancelled before the structure got freed.
C reproducer and dmesg attached.
Thanks,
JiaHong Su
[-- Attachment #2: repro.c --]
[-- Type: text/x-csrc, Size: 5412 bytes --]
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/prctl.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>
static unsigned long long procid;
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}
static bool write_file(const char* file, const char* what, ...)
{
char buf[1024];
va_list args;
va_start(args, what);
vsnprintf(buf, sizeof(buf), what, args);
va_end(args);
buf[sizeof(buf) - 1] = 0;
int len = strlen(buf);
int fd = open(file, O_WRONLY | O_CLOEXEC);
if (fd == -1)
return false;
if (write(fd, buf, len) != len) {
int err = errno;
close(fd);
errno = err;
return false;
}
close(fd);
return true;
}
static void kill_and_wait(int pid, int* status)
{
kill(-pid, SIGKILL);
kill(pid, SIGKILL);
for (int i = 0; i < 100; i++) {
if (waitpid(-1, status, WNOHANG | __WALL) == pid)
return;
usleep(1000);
}
DIR* dir = opendir("/sys/fs/fuse/connections");
if (dir) {
for (;;) {
struct dirent* ent = readdir(dir);
if (!ent)
break;
if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
continue;
char abort[300];
snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name);
int fd = open(abort, O_WRONLY);
if (fd == -1) {
continue;
}
if (write(fd, abort, 1) < 0) {
}
close(fd);
}
closedir(dir);
} else {
}
while (waitpid(-1, status, __WALL) != pid) {
}
}
static void setup_test()
{
prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
setpgrp();
write_file("/proc/self/oom_score_adj", "1000");
}
static void execute_one(void);
#define WAIT_FLAGS __WALL
static void loop(void)
{
int iter = 0;
for (;; iter++) {
int pid = fork();
if (pid < 0)
exit(1);
if (pid == 0) {
setup_test();
execute_one();
exit(0);
}
int status = 0;
uint64_t start = current_time_ms();
for (;;) {
sleep_ms(10);
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
break;
if (current_time_ms() - start < 5000)
continue;
kill_and_wait(pid, &status);
break;
}
}
}
uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};
void execute_one(void)
{
intptr_t res = 0;
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
// openat$ttyprintk arguments: [
// fd: const = 0xffffffffffffff9c (8 bytes)
// file: ptr[in, buffer] {
// buffer: {2f 64 65 76 2f 74 74 79 70 72 69 6e 74 6b 00} (length 0xf)
// }
// flags: open_flags = 0x1 (4 bytes)
// mode: const = 0x0 (2 bytes)
// ]
// returns fd_tty
memcpy((void*)0x200000003040, "/dev/ttyprintk\000", 15);
res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x200000003040ul, /*flags=O_WRONLY*/1, /*mode=*/0);
if (res != -1)
r[0] = res;
// ioctl$TIOCSETD arguments: [
// fd: fd_tty (resource)
// cmd: const = 0x5423 (4 bytes)
// arg: ptr[in, int32] {
// int32 = 0x14 (4 bytes)
// }
// ]
*(uint32_t*)0x200000000000 = 0x14;
syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x5423, /*arg=*/0x200000000000ul);
// ioctl$TIOCVHANGUP arguments: [
// fd: fd_tty (resource)
// cmd: const = 0x5437 (4 bytes)
// arg: const = 0x0 (8 bytes)
// ]
syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x5437, /*arg=*/0ul);
// openat$ttyprintk arguments: [
// fd: const = 0xffffffffffffff9c (8 bytes)
// file: ptr[in, buffer] {
// buffer: {2f 64 65 76 2f 74 74 79 70 72 69 6e 74 6b 00} (length 0xf)
// }
// flags: open_flags = 0x1 (4 bytes)
// mode: const = 0x0 (2 bytes)
// ]
// returns fd_tty
memcpy((void*)0x200000003040, "/dev/ttyprintk\000", 15);
res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x200000003040ul, /*flags=O_WRONLY*/1, /*mode=*/0);
if (res != -1)
r[1] = res;
// ioctl$TIOCSETD arguments: [
// fd: fd_tty (resource)
// cmd: const = 0x5423 (4 bytes)
// arg: ptr[in, int32] {
// int32 = 0xf (4 bytes)
// }
// ]
*(uint32_t*)0x200000000080 = 0xf;
syscall(__NR_ioctl, /*fd=*/r[1], /*cmd=*/0x5423, /*arg=*/0x200000000080ul);
// ioctl$TCFLSH arguments: [
// fd: fd_tty (resource)
// cmd: const = 0x400455c8 (4 bytes)
// arg: intptr = 0xb (8 bytes)
// ]
syscall(__NR_ioctl, /*fd=*/r[1], /*cmd=*/0x400455c8, /*arg=*/0xbul);
}
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
const char* reason;
(void)reason;
for (procid = 0; procid < 8; procid++) {
if (fork() == 0) {
loop();
}
}
sleep(1000000);
return 0;
}
[-- Attachment #3: report --]
[-- Type: text/plain, Size: 4707 bytes --]
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000007: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f]
CPU: 0 UID: 0 PID: 11930 Comm: kworker/0:8 Tainted: G L 6.19.0-rc5 #11 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
Workqueue: events hci_uart_write_work
RIP: 0010:kasan_byte_accessible+0x15/0x30 mm/kasan/generic.c:210
Code: 00 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 b8 00 00 00 00 00 fc ff df 48 c1 ef 03 48 01 c7 <0f> b6 07 3c 07 0f 96 c0 e9 8e a0 37 09 66 66 2e 0f 1f 84 00 00 00
RSP: 0018:ffffc900029ffa60 EFLAGS: 00010082
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8b5b2d9d RDI: dffffc0000000007
RBP: 0000000000000038 R08: 0000000000000001 R09: 0000000000000000
R10: ffffffff906888d7 R11: 0000000000000002 R12: 0000000000000000
R13: ffffffff8b5b2d9d R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff888097d23000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3e61db0bd8 CR3: 0000000026850000 CR4: 0000000000752ef0
DR0: 00000000000007ff DR1: 0000000000000005 DR2: 0000000000000000
DR3: 00000000000084e9 DR6: 00000000ffff0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
<TASK>
__kasan_check_byte+0x14/0x50 mm/kasan/common.c:573
kasan_check_byte include/linux/kasan.h:402 [inline]
lock_acquire kernel/locking/lockdep.c:5842 [inline]
lock_acquire+0xfd/0x330 kernel/locking/lockdep.c:5825
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x3d/0x60 kernel/locking/spinlock.c:162
skb_dequeue+0x20/0x180 net/core/skbuff.c:3937
mrvl_dequeue+0x3f/0xb0 drivers/bluetooth/hci_mrvl.c:126
hci_uart_dequeue drivers/bluetooth/hci_ldisc.c:107 [inline]
hci_uart_write_work+0x4d5/0x940 drivers/bluetooth/hci_ldisc.c:161
process_one_work+0x992/0x1b00 kernel/workqueue.c:3257
process_scheduled_works kernel/workqueue.c:3340 [inline]
worker_thread+0x67e/0xe90 kernel/workqueue.c:3421
kthread+0x3d0/0x780 kernel/kthread.c:463
ret_from_fork+0x966/0xaf0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:kasan_byte_accessible+0x15/0x30 mm/kasan/generic.c:210
Code: 00 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 b8 00 00 00 00 00 fc ff df 48 c1 ef 03 48 01 c7 <0f> b6 07 3c 07 0f 96 c0 e9 8e a0 37 09 66 66 2e 0f 1f 84 00 00 00
RSP: 0018:ffffc900029ffa60 EFLAGS: 00010082
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8b5b2d9d RDI: dffffc0000000007
RBP: 0000000000000038 R08: 0000000000000001 R09: 0000000000000000
R10: ffffffff906888d7 R11: 0000000000000002 R12: 0000000000000000
R13: ffffffff8b5b2d9d R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff888097d23000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3e61db0bd8 CR3: 0000000026850000 CR4: 0000000000752ef0
DR0: 00000000000007ff DR1: 0000000000000005 DR2: 0000000000000000
DR3: 00000000000084e9 DR6: 00000000ffff0ff0 DR7: 0000000000000400
PKRU: 55555554
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: 0f 1f 00 nopl (%rax)
5: 90 nop
6: 90 nop
7: 90 nop
8: 90 nop
9: 90 nop
a: 90 nop
b: 90 nop
c: 90 nop
d: 90 nop
e: 90 nop
f: 90 nop
10: 90 nop
11: 90 nop
12: 90 nop
13: 90 nop
14: 90 nop
15: 0f 1f 40 d6 nopl -0x2a(%rax)
19: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
20: fc ff df
23: 48 c1 ef 03 shr $0x3,%rdi
27: 48 01 c7 add %rax,%rdi
* 2a: 0f b6 07 movzbl (%rdi),%eax <-- trapping instruction
2d: 3c 07 cmp $0x7,%al
2f: 0f 96 c0 setbe %al
32: e9 8e a0 37 09 jmpq 0x937a0c5
37: 66 data16
38: 66 data16
39: 2e cs
3a: 0f .byte 0xf
3b: 1f (bad)
3c: 84 00 test %al,(%rax)
<<<<<<<<<<<<<<< tail report >>>>>>>>>>>>>>>
reply other threads:[~2026-01-15 23:20 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6969764f.170a0220.2b9fc4.35a7@mx.google.com \
--to=s11242586@gmail.com \
--cc=linux-bluetooth@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luiz.dentz@gmail.com \
--cc=marcel@holtmann.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.