From: patchwork-bot+bluetooth@kernel.org
To: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Cc: linux-bluetooth@vger.kernel.org
Subject: Re: [PATCH v1] Bluetooth/L2CAP: Fix uaf in l2cap_connect
Date: Wed, 25 Sep 2024 15:20:35 +0000 [thread overview]
Message-ID: <172727763545.630403.8450411112997127998.git-patchwork-notify@kernel.org> (raw)
In-Reply-To: <20240923165116.1540227-1-luiz.dentz@gmail.com>
Hello:
This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
On Mon, 23 Sep 2024 12:51:16 -0400 you wrote:
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
>
> [Syzbot reported]
> BUG: KASAN: slab-use-after-free in l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949
> Read of size 8 at addr ffff8880241e9800 by task kworker/u9:0/54
>
> CPU: 0 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.11.0-rc6-syzkaller-00268-g788220eee30d #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
> Workqueue: hci2 hci_rx_work
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:93 [inline]
> dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
> print_address_description mm/kasan/report.c:377 [inline]
> print_report+0xc3/0x620 mm/kasan/report.c:488
> kasan_report+0xd9/0x110 mm/kasan/report.c:601
> l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949
> l2cap_connect_req net/bluetooth/l2cap_core.c:4080 [inline]
> l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4772 [inline]
> l2cap_sig_channel net/bluetooth/l2cap_core.c:5543 [inline]
> l2cap_recv_frame+0xf0b/0x8eb0 net/bluetooth/l2cap_core.c:6825
> l2cap_recv_acldata+0x9b4/0xb70 net/bluetooth/l2cap_core.c:7514
> hci_acldata_packet net/bluetooth/hci_core.c:3791 [inline]
> hci_rx_work+0xaab/0x1610 net/bluetooth/hci_core.c:4028
> process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
> process_scheduled_works kernel/workqueue.c:3312 [inline]
> worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
> kthread+0x2c1/0x3a0 kernel/kthread.c:389
> ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> ...
>
> [...]
Here is the summary with links:
- [v1] Bluetooth/L2CAP: Fix uaf in l2cap_connect
https://git.kernel.org/bluetooth/bluetooth-next/c/d93544ba0cd8
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
prev parent reply other threads:[~2024-09-25 15:20 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-09-23 16:51 [PATCH v1] Bluetooth/L2CAP: Fix uaf in l2cap_connect Luiz Augusto von Dentz
2024-09-25 15:20 ` patchwork-bot+bluetooth [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=172727763545.630403.8450411112997127998.git-patchwork-notify@kernel.org \
--to=patchwork-bot+bluetooth@kernel.org \
--cc=linux-bluetooth@vger.kernel.org \
--cc=luiz.dentz@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox