[syzbot] [bluetooth?] KASAN: null-ptr-deref Read in ida_free (4)

[syzbot] [bluetooth?] KASAN: null-ptr-deref Read in ida_free (4)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    9bacdd8996c7 Merge tag 'for-6.7-rc1-tag' of git://git.kern..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1121f91f680000
kernel config:  https://syzkaller.appspot.com/x/.config?x=84217b7fc4acdc59
dashboard link: https://syzkaller.appspot.com/bug?extid=51baee846ddab52d5230
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8889f0a9f059/disk-9bacdd89.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f78cb4c03467/vmlinux-9bacdd89.xz
kernel image: https://storage.googleapis.com/syzbot-assets/bb88d4b4f745/bzImage-9bacdd89.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+51baee846ddab52d5230@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:68 [inline]
BUG: KASAN: null-ptr-deref in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
BUG: KASAN: null-ptr-deref in ida_free+0x218/0x2e0 lib/idr.c:511
Read of size 8 at addr 0000000000000050 by task kworker/u5:2/5100

CPU: 0 PID: 5100 Comm: kworker/u5:2 Not tainted 6.7.0-rc1-syzkaller-00012-g9bacdd8996c7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
Workqueue: hci4 hci_error_reset
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
 kasan_report+0xda/0x110 mm/kasan/report.c:588
 check_region_inline mm/kasan/generic.c:181 [inline]
 kasan_check_range+0xef/0x190 mm/kasan/generic.c:187
 instrument_atomic_read include/linux/instrumented.h:68 [inline]
 _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
 ida_free+0x218/0x2e0 lib/idr.c:511
 hci_conn_cleanup net/bluetooth/hci_conn.c:157 [inline]
 hci_conn_del+0x78c/0xe10 net/bluetooth/hci_conn.c:1182
 hci_conn_hash_flush+0x189/0x260 net/bluetooth/hci_conn.c:2615
 hci_dev_close_sync+0x5a7/0x1160 net/bluetooth/hci_sync.c:5021
 hci_dev_do_close+0x2e/0x90 net/bluetooth/hci_core.c:554
 hci_error_reset+0xa6/0x190 net/bluetooth/hci_core.c:1059
 process_one_work+0x886/0x15d0 kernel/workqueue.c:2630
 process_scheduled_works kernel/workqueue.c:2703 [inline]
 worker_thread+0x8b9/0x1290 kernel/workqueue.c:2784
 kthread+0x2c6/0x3a0 kernel/kthread.c:388
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242
 </TASK>
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] [bluetooth?] KASAN: null-ptr-deref Read in ida_free (4)

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit:    8c9660f65153 Add linux-next specific files for 20231124
git tree:       linux-next
console+strace: https://syzkaller.appspot.com/x/log.txt?x=1678a3cce80000
kernel config:  https://syzkaller.appspot.com/x/.config?x=ca1e8655505e280
dashboard link: https://syzkaller.appspot.com/bug?extid=51baee846ddab52d5230
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=10d54c08e80000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=160ef1a4e80000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/345ed4af3a0d/disk-8c9660f6.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/191053c69d57/vmlinux-8c9660f6.xz
kernel image: https://storage.googleapis.com/syzbot-assets/aac7ee5e55e0/bzImage-8c9660f6.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+51baee846ddab52d5230@syzkaller.appspotmail.com

Bluetooth: hci0: hardware error 0x00
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:68 [inline]
BUG: KASAN: null-ptr-deref in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
BUG: KASAN: null-ptr-deref in ida_free+0x218/0x2e0 lib/idr.c:511
Read of size 8 at addr 0000000000000078 by task kworker/u5:1/4455

CPU: 1 PID: 4455 Comm: kworker/u5:1 Not tainted 6.7.0-rc2-next-20231124-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
Workqueue: hci0 hci_error_reset
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
 kasan_report+0xd9/0x110 mm/kasan/report.c:588
 check_region_inline mm/kasan/generic.c:182 [inline]
 kasan_check_range+0xef/0x190 mm/kasan/generic.c:188
 instrument_atomic_read include/linux/instrumented.h:68 [inline]
 _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
 ida_free+0x218/0x2e0 lib/idr.c:511
 hci_conn_cleanup net/bluetooth/hci_conn.c:157 [inline]
 hci_conn_del+0x78c/0xe10 net/bluetooth/hci_conn.c:1183
 hci_conn_hash_flush+0x189/0x260 net/bluetooth/hci_conn.c:2643
 hci_dev_close_sync+0x5a7/0x1160 net/bluetooth/hci_sync.c:5021
 hci_dev_do_close+0x2e/0x90 net/bluetooth/hci_core.c:554
 hci_error_reset+0xa6/0x190 net/bluetooth/hci_core.c:1059
 process_one_work+0x8a4/0x15f0 kernel/workqueue.c:2633
 process_scheduled_works kernel/workqueue.c:2706 [inline]
 worker_thread+0x8b6/0x1290 kernel/workqueue.c:2787
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242
 </TASK>
==================================================================


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

Re: [syzbot] [bluetooth?] KASAN: null-ptr-deref Read in ida_free (4)

[syzbot]

syzbot has bisected this issue to:

commit 181a42edddf51d5d9697ecdf365d72ebeab5afb0
Author: Ziyang Xuan <william.xuanziyang@huawei.com>
Date:   Wed Oct 11 09:57:31 2023 +0000

    Bluetooth: Make handle of hci_conn be unique

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=1345177ce80000
start commit:   8c9660f65153 Add linux-next specific files for 20231124
git tree:       linux-next
final oops:     https://syzkaller.appspot.com/x/report.txt?x=10c5177ce80000
console output: https://syzkaller.appspot.com/x/log.txt?x=1745177ce80000
kernel config:  https://syzkaller.appspot.com/x/.config?x=ca1e8655505e280
dashboard link: https://syzkaller.appspot.com/bug?extid=51baee846ddab52d5230
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=10d54c08e80000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=160ef1a4e80000

Reported-by: syzbot+51baee846ddab52d5230@syzkaller.appspotmail.com
Fixes: 181a42edddf5 ("Bluetooth: Make handle of hci_conn be unique")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

Re: [syzbot] [bluetooth?] KASAN: null-ptr-deref Read in ida_free (4)

[Dmitry Vyukov]

On Sat, 25 Nov 2023 at 14:18, syzbot
<syzbot+51baee846ddab52d5230@syzkaller.appspotmail.com> wrote:
>
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit:    8c9660f65153 Add linux-next specific files for 20231124
> git tree:       linux-next
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=1678a3cce80000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=ca1e8655505e280
> dashboard link: https://syzkaller.appspot.com/bug?extid=51baee846ddab52d5230
> compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=10d54c08e80000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=160ef1a4e80000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/345ed4af3a0d/disk-8c9660f6.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/191053c69d57/vmlinux-8c9660f6.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/aac7ee5e55e0/bzImage-8c9660f6.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+51baee846ddab52d5230@syzkaller.appspotmail.com
>
> Bluetooth: hci0: hardware error 0x00
> ==================================================================
> BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:68 [inline]
> BUG: KASAN: null-ptr-deref in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
> BUG: KASAN: null-ptr-deref in ida_free+0x218/0x2e0 lib/idr.c:511
> Read of size 8 at addr 0000000000000078 by task kworker/u5:1/4455
>
> CPU: 1 PID: 4455 Comm: kworker/u5:1 Not tainted 6.7.0-rc2-next-20231124-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
> Workqueue: hci0 hci_error_reset
> Call Trace:
>  <TASK>
>  __dump_stack lib/dump_stack.c:88 [inline]
>  dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
>  kasan_report+0xd9/0x110 mm/kasan/report.c:588
>  check_region_inline mm/kasan/generic.c:182 [inline]
>  kasan_check_range+0xef/0x190 mm/kasan/generic.c:188
>  instrument_atomic_read include/linux/instrumented.h:68 [inline]
>  _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]

Wonder if this is fixed with:

ida: Fix crash in ida_free when the bitmap is empty

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=af73483f4e8b6f5c68c9aa63257bdd929a9c194a

?

>  ida_free+0x218/0x2e0 lib/idr.c:511
>  hci_conn_cleanup net/bluetooth/hci_conn.c:157 [inline]
>  hci_conn_del+0x78c/0xe10 net/bluetooth/hci_conn.c:1183
>  hci_conn_hash_flush+0x189/0x260 net/bluetooth/hci_conn.c:2643
>  hci_dev_close_sync+0x5a7/0x1160 net/bluetooth/hci_sync.c:5021
>  hci_dev_do_close+0x2e/0x90 net/bluetooth/hci_core.c:554
>  hci_error_reset+0xa6/0x190 net/bluetooth/hci_core.c:1059
>  process_one_work+0x8a4/0x15f0 kernel/workqueue.c:2633
>  process_scheduled_works kernel/workqueue.c:2706 [inline]
>  worker_thread+0x8b6/0x1290 kernel/workqueue.c:2787
>  kthread+0x2c1/0x3a0 kernel/kthread.c:389
>  ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
>  ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242
>  </TASK>
> ==================================================================
>
>
> ---
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/00000000000037f0f3060af9e763%40google.com.

Re: [syzbot] [bluetooth?] KASAN: null-ptr-deref Read in ida_free (4)

[Matthew Wilcox]

On Thu, Jan 18, 2024 at 11:21:34AM +0100, Dmitry Vyukov wrote:
> On Sat, 25 Nov 2023 at 14:18, syzbot
> <syzbot+51baee846ddab52d5230@syzkaller.appspotmail.com> wrote:
> >
> > syzbot has found a reproducer for the following issue on:
> >
> > HEAD commit:    8c9660f65153 Add linux-next specific files for 20231124
> > git tree:       linux-next
> > console+strace: https://syzkaller.appspot.com/x/log.txt?x=1678a3cce80000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=ca1e8655505e280
> > dashboard link: https://syzkaller.appspot.com/bug?extid=51baee846ddab52d5230
> > compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=10d54c08e80000
> > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=160ef1a4e80000
> >
> > Downloadable assets:
> > disk image: https://storage.googleapis.com/syzbot-assets/345ed4af3a0d/disk-8c9660f6.raw.xz
> > vmlinux: https://storage.googleapis.com/syzbot-assets/191053c69d57/vmlinux-8c9660f6.xz
> > kernel image: https://storage.googleapis.com/syzbot-assets/aac7ee5e55e0/bzImage-8c9660f6.xz
> >
> > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > Reported-by: syzbot+51baee846ddab52d5230@syzkaller.appspotmail.com
> >
> > Bluetooth: hci0: hardware error 0x00
> > ==================================================================
> > BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:68 [inline]
> > BUG: KASAN: null-ptr-deref in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
> > BUG: KASAN: null-ptr-deref in ida_free+0x218/0x2e0 lib/idr.c:511
> > Read of size 8 at addr 0000000000000078 by task kworker/u5:1/4455
> >
> > CPU: 1 PID: 4455 Comm: kworker/u5:1 Not tainted 6.7.0-rc2-next-20231124-syzkaller #0
> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
> > Workqueue: hci0 hci_error_reset
> > Call Trace:
> >  <TASK>
> >  __dump_stack lib/dump_stack.c:88 [inline]
> >  dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
> >  kasan_report+0xd9/0x110 mm/kasan/report.c:588
> >  check_region_inline mm/kasan/generic.c:182 [inline]
> >  kasan_check_range+0xef/0x190 mm/kasan/generic.c:188
> >  instrument_atomic_read include/linux/instrumented.h:68 [inline]
> >  _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
> 
> Wonder if this is fixed with:
> 
> ida: Fix crash in ida_free when the bitmap is empty
> 
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=af73483f4e8b6f5c68c9aa63257bdd929a9c194a
> 
> ?

Should be.  The backtrace below looks like it's the same bug that got
reported 3-4 weeks ago.

> >  ida_free+0x218/0x2e0 lib/idr.c:511
> >  hci_conn_cleanup net/bluetooth/hci_conn.c:157 [inline]
> >  hci_conn_del+0x78c/0xe10 net/bluetooth/hci_conn.c:1183
> >  hci_conn_hash_flush+0x189/0x260 net/bluetooth/hci_conn.c:2643
> >  hci_dev_close_sync+0x5a7/0x1160 net/bluetooth/hci_sync.c:5021
> >  hci_dev_do_close+0x2e/0x90 net/bluetooth/hci_core.c:554
> >  hci_error_reset+0xa6/0x190 net/bluetooth/hci_core.c:1059
> >  process_one_work+0x8a4/0x15f0 kernel/workqueue.c:2633
> >  process_scheduled_works kernel/workqueue.c:2706 [inline]
> >  worker_thread+0x8b6/0x1290 kernel/workqueue.c:2787
> >  kthread+0x2c1/0x3a0 kernel/kthread.c:389
> >  ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
> >  ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242
> >  </TASK>
> > ==================================================================
> >
> >
> > ---
> > If you want syzbot to run the reproducer, reply with:
> > #syz test: git://repo/address.git branch-or-commit-hash
> > If you attach or paste a git patch, syzbot will apply it before testing.
> >
> > --
> > You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> > To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> > To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/00000000000037f0f3060af9e763%40google.com.

Re: [syzbot] [bluetooth?] KASAN: null-ptr-deref Read in ida_free (4)

[Dmitry Vyukov]

On Thu, 18 Jan 2024 at 15:02, Matthew Wilcox <willy@infradead.org> wrote:
>
> On Thu, Jan 18, 2024 at 11:21:34AM +0100, Dmitry Vyukov wrote:
> > On Sat, 25 Nov 2023 at 14:18, syzbot
> > <syzbot+51baee846ddab52d5230@syzkaller.appspotmail.com> wrote:
> > >
> > > syzbot has found a reproducer for the following issue on:
> > >
> > > HEAD commit:    8c9660f65153 Add linux-next specific files for 20231124
> > > git tree:       linux-next
> > > console+strace: https://syzkaller.appspot.com/x/log.txt?x=1678a3cce80000
> > > kernel config:  https://syzkaller.appspot.com/x/.config?x=ca1e8655505e280
> > > dashboard link: https://syzkaller.appspot.com/bug?extid=51baee846ddab52d5230
> > > compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> > > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=10d54c08e80000
> > > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=160ef1a4e80000
> > >
> > > Downloadable assets:
> > > disk image: https://storage.googleapis.com/syzbot-assets/345ed4af3a0d/disk-8c9660f6.raw.xz
> > > vmlinux: https://storage.googleapis.com/syzbot-assets/191053c69d57/vmlinux-8c9660f6.xz
> > > kernel image: https://storage.googleapis.com/syzbot-assets/aac7ee5e55e0/bzImage-8c9660f6.xz
> > >
> > > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > > Reported-by: syzbot+51baee846ddab52d5230@syzkaller.appspotmail.com
> > >
> > > Bluetooth: hci0: hardware error 0x00
> > > ==================================================================
> > > BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:68 [inline]
> > > BUG: KASAN: null-ptr-deref in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
> > > BUG: KASAN: null-ptr-deref in ida_free+0x218/0x2e0 lib/idr.c:511
> > > Read of size 8 at addr 0000000000000078 by task kworker/u5:1/4455
> > >
> > > CPU: 1 PID: 4455 Comm: kworker/u5:1 Not tainted 6.7.0-rc2-next-20231124-syzkaller #0
> > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
> > > Workqueue: hci0 hci_error_reset
> > > Call Trace:
> > >  <TASK>
> > >  __dump_stack lib/dump_stack.c:88 [inline]
> > >  dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
> > >  kasan_report+0xd9/0x110 mm/kasan/report.c:588
> > >  check_region_inline mm/kasan/generic.c:182 [inline]
> > >  kasan_check_range+0xef/0x190 mm/kasan/generic.c:188
> > >  instrument_atomic_read include/linux/instrumented.h:68 [inline]
> > >  _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
> >
> > Wonder if this is fixed with:
> >
> > ida: Fix crash in ida_free when the bitmap is empty
> >
> > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=af73483f4e8b6f5c68c9aa63257bdd929a9c194a
> >
> > ?
>
> Should be.  The backtrace below looks like it's the same bug that got
> reported 3-4 weeks ago.

On second thought, perhaps the bluetooth stack shouldn't free invalid
ids in the first place.
It may even take these bogus ids from the wire, which would be pretty bad.

> > >  ida_free+0x218/0x2e0 lib/idr.c:511
> > >  hci_conn_cleanup net/bluetooth/hci_conn.c:157 [inline]
> > >  hci_conn_del+0x78c/0xe10 net/bluetooth/hci_conn.c:1183
> > >  hci_conn_hash_flush+0x189/0x260 net/bluetooth/hci_conn.c:2643
> > >  hci_dev_close_sync+0x5a7/0x1160 net/bluetooth/hci_sync.c:5021
> > >  hci_dev_do_close+0x2e/0x90 net/bluetooth/hci_core.c:554
> > >  hci_error_reset+0xa6/0x190 net/bluetooth/hci_core.c:1059
> > >  process_one_work+0x8a4/0x15f0 kernel/workqueue.c:2633
> > >  process_scheduled_works kernel/workqueue.c:2706 [inline]
> > >  worker_thread+0x8b6/0x1290 kernel/workqueue.c:2787
> > >  kthread+0x2c1/0x3a0 kernel/kthread.c:389
> > >  ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
> > >  ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242
> > >  </TASK>
> > > ==================================================================
> > >
> > >
> > > ---
> > > If you want syzbot to run the reproducer, reply with:
> > > #syz test: git://repo/address.git branch-or-commit-hash
> > > If you attach or paste a git patch, syzbot will apply it before testing.

Re: [syzbot] [bluetooth?] KASAN: null-ptr-deref Read in ida_free (4)

[Matthew Wilcox]

On Fri, Jan 19, 2024 at 12:58:21PM +0100, Dmitry Vyukov wrote:
> On Thu, 18 Jan 2024 at 15:02, Matthew Wilcox <willy@infradead.org> wrote:
> >
> > On Thu, Jan 18, 2024 at 11:21:34AM +0100, Dmitry Vyukov wrote:
> > > On Sat, 25 Nov 2023 at 14:18, syzbot
> > > <syzbot+51baee846ddab52d5230@syzkaller.appspotmail.com> wrote:
> > > >
> > > > syzbot has found a reproducer for the following issue on:
> > > >
> > > > HEAD commit:    8c9660f65153 Add linux-next specific files for 20231124
> > > > git tree:       linux-next
> > > > console+strace: https://syzkaller.appspot.com/x/log.txt?x=1678a3cce80000
> > > > kernel config:  https://syzkaller.appspot.com/x/.config?x=ca1e8655505e280
> > > > dashboard link: https://syzkaller.appspot.com/bug?extid=51baee846ddab52d5230
> > > > compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> > > > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=10d54c08e80000
> > > > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=160ef1a4e80000
> > > >
> > > > Downloadable assets:
> > > > disk image: https://storage.googleapis.com/syzbot-assets/345ed4af3a0d/disk-8c9660f6.raw.xz
> > > > vmlinux: https://storage.googleapis.com/syzbot-assets/191053c69d57/vmlinux-8c9660f6.xz
> > > > kernel image: https://storage.googleapis.com/syzbot-assets/aac7ee5e55e0/bzImage-8c9660f6.xz
> > > >
> > > > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > > > Reported-by: syzbot+51baee846ddab52d5230@syzkaller.appspotmail.com
> > > >
> > > > Bluetooth: hci0: hardware error 0x00
> > > > ==================================================================
> > > > BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:68 [inline]
> > > > BUG: KASAN: null-ptr-deref in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
> > > > BUG: KASAN: null-ptr-deref in ida_free+0x218/0x2e0 lib/idr.c:511
> > > > Read of size 8 at addr 0000000000000078 by task kworker/u5:1/4455
> > > >
> > > > CPU: 1 PID: 4455 Comm: kworker/u5:1 Not tainted 6.7.0-rc2-next-20231124-syzkaller #0
> > > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
> > > > Workqueue: hci0 hci_error_reset
> > > > Call Trace:
> > > >  <TASK>
> > > >  __dump_stack lib/dump_stack.c:88 [inline]
> > > >  dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
> > > >  kasan_report+0xd9/0x110 mm/kasan/report.c:588
> > > >  check_region_inline mm/kasan/generic.c:182 [inline]
> > > >  kasan_check_range+0xef/0x190 mm/kasan/generic.c:188
> > > >  instrument_atomic_read include/linux/instrumented.h:68 [inline]
> > > >  _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
> > >
> > > Wonder if this is fixed with:
> > >
> > > ida: Fix crash in ida_free when the bitmap is empty
> > >
> > > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=af73483f4e8b6f5c68c9aa63257bdd929a9c194a
> > >
> > > ?
> >
> > Should be.  The backtrace below looks like it's the same bug that got
> > reported 3-4 weeks ago.
> 
> On second thought, perhaps the bluetooth stack shouldn't free invalid
> ids in the first place.
> It may even take these bogus ids from the wire, which would be pretty bad.

Oh, that was my first response.  Unfortunately, the original reporter was
all "I filed a CVE and this is S3CUR1+Y F!X" so none of that interaction
is public.

What my patch will do is convert this NULL pointer dereference into a
warning (which will still be noticed by syzbot).  The bluetooth stack
still needs to be fixed to not free invalid IDs.

Re: [syzbot] [bluetooth?] KASAN: null-ptr-deref Read in ida_free (4)

[syzbot]

syzbot suspects this issue was fixed by commit:

commit af73483f4e8b6f5c68c9aa63257bdd929a9c194a
Author: Matthew Wilcox (Oracle) <willy@infradead.org>
Date:   Thu Dec 21 16:53:57 2023 +0000

    ida: Fix crash in ida_free when the bitmap is empty

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=12fc6ba2180000
start commit:   b46ae77f6787 Merge tag 'xfs-6.7-fixes-3' of git://git.kern..
git tree:       upstream
kernel config:  https://syzkaller.appspot.com/x/.config?x=6ae1a4ee971a7305
dashboard link: https://syzkaller.appspot.com/bug?extid=51baee846ddab52d5230
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=127837cce80000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=12779dc8e80000

If the result looks correct, please mark the issue as fixed by replying with:

#syz fix: ida: Fix crash in ida_free when the bitmap is empty

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

Re: [syzbot] [bluetooth?] KASAN: null-ptr-deref Read in ida_free (4)

[Aleksandr Nogikh]

Looks reasonable, judging by the commit title.

#syz fix: ida: Fix crash in ida_free when the bitmap is empty


On Sun, Feb 11, 2024 at 10:55 AM syzbot
<syzbot+51baee846ddab52d5230@syzkaller.appspotmail.com> wrote:
>
> syzbot suspects this issue was fixed by commit:
>
> commit af73483f4e8b6f5c68c9aa63257bdd929a9c194a
> Author: Matthew Wilcox (Oracle) <willy@infradead.org>
> Date:   Thu Dec 21 16:53:57 2023 +0000
>
>     ida: Fix crash in ida_free when the bitmap is empty
>
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=12fc6ba2180000
> start commit:   b46ae77f6787 Merge tag 'xfs-6.7-fixes-3' of git://git.kern..
> git tree:       upstream
> kernel config:  https://syzkaller.appspot.com/x/.config?x=6ae1a4ee971a7305
> dashboard link: https://syzkaller.appspot.com/bug?extid=51baee846ddab52d5230
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=127837cce80000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=12779dc8e80000
>
> If the result looks correct, please mark the issue as fixed by replying with:
>
> #syz fix: ida: Fix crash in ida_free when the bitmap is empty
>
> For information about bisection process see: https://goo.gl/tpsmEJ#bisection
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/000000000000d4a29506111827e7%40google.com.