* [PATCH v1] Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync
@ 2024-11-15 15:59 Luiz Augusto von Dentz
2024-11-15 16:35 ` [v1] " bluez.test.bot
2024-11-15 16:41 ` [PATCH v1] " Luiz Augusto von Dentz
0 siblings, 2 replies; 22+ messages in thread
From: Luiz Augusto von Dentz @ 2024-11-15 15:59 UTC (permalink / raw)
To: linux-bluetooth
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This fixes the following crash:
==================================================================
BUG: KASAN: slab-use-after-free in set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1353
Read of size 8 at addr ffff888029b4dd18 by task kworker/u9:0/54
CPU: 1 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.11.0-rc6-syzkaller-01155-gf723224742fc #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: hci0 hci_cmd_sync_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
q kasan_report+0x143/0x180 mm/kasan/report.c:601
set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1353
hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:328
process_one_work kernel/workqueue.c:3231 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
worker_thread+0x86d/0xd10 kernel/workqueue.c:3389
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Allocated by task 5247:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
__kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387
kasan_kmalloc include/linux/kasan.h:211 [inline]
__kmalloc_cache_noprof+0x19c/0x2c0 mm/slub.c:4193
kmalloc_noprof include/linux/slab.h:681 [inline]
kzalloc_noprof include/linux/slab.h:807 [inline]
mgmt_pending_new+0x65/0x250 net/bluetooth/mgmt_util.c:269
mgmt_pending_add+0x36/0x120 net/bluetooth/mgmt_util.c:296
set_powered+0x3cd/0x5e0 net/bluetooth/mgmt.c:1394
hci_mgmt_cmd+0xc47/0x11d0 net/bluetooth/hci_sock.c:1712
hci_sock_sendmsg+0x7b8/0x11c0 net/bluetooth/hci_sock.c:1832
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0x221/0x270 net/socket.c:745
sock_write_iter+0x2dd/0x400 net/socket.c:1160
new_sync_write fs/read_write.c:497 [inline]
vfs_write+0xa72/0xc90 fs/read_write.c:590
ksys_write+0x1a0/0x2c0 fs/read_write.c:643
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 5246:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
poison_slab_object+0xe0/0x150 mm/kasan/common.c:240
__kasan_slab_free+0x37/0x60 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2256 [inline]
slab_free mm/slub.c:4477 [inline]
kfree+0x149/0x360 mm/slub.c:4598
settings_rsp+0x2bc/0x390 net/bluetooth/mgmt.c:1443
mgmt_pending_foreach+0xd1/0x130 net/bluetooth/mgmt_util.c:259
__mgmt_power_off+0x112/0x420 net/bluetooth/mgmt.c:9455
hci_dev_close_sync+0x665/0x11a0 net/bluetooth/hci_sync.c:5191
hci_dev_do_close net/bluetooth/hci_core.c:483 [inline]
hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508
sock_do_ioctl+0x158/0x460 net/socket.c:1222
sock_ioctl+0x629/0x8e0 net/socket.c:1341
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83gv
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Reported-by: syzbot+03d6270b6425df1605bf@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=03d6270b6425df1605bf
Fixes: 275f3f648702 ("Bluetooth: Fix not checking MGMT cmd pending queue")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
net/bluetooth/mgmt.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 1f6d083682b8..6a26c1ea0d04 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -1441,6 +1441,10 @@ static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
sock_hold(match->sk);
}
+ /* dequeue cmd_sync entries using cmd as data as that is about to be
+ * removed/freed.
+ */
+ hci_cmd_sync_dequeue(match->hdev, NULL, cmd, NULL);
mgmt_pending_free(cmd);
}
--
2.47.0
^ permalink raw reply related [flat|nested] 22+ messages in thread* RE: [v1] Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync
2024-11-15 15:59 [PATCH v1] Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync Luiz Augusto von Dentz
@ 2024-11-15 16:35 ` bluez.test.bot
2024-11-15 16:41 ` [PATCH v1] " Luiz Augusto von Dentz
1 sibling, 0 replies; 22+ messages in thread
From: bluez.test.bot @ 2024-11-15 16:35 UTC (permalink / raw)
To: linux-bluetooth, luiz.dentz
[-- Attachment #1: Type: text/plain, Size: 1903 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=910054
---Test result---
Test Summary:
CheckPatch PENDING 0.55 seconds
GitLint PENDING 0.29 seconds
SubjectPrefix PASS 0.07 seconds
BuildKernel PASS 26.06 seconds
CheckAllWarning PASS 27.99 seconds
CheckSparse PASS 31.45 seconds
BuildKernel32 PASS 25.42 seconds
TestRunnerSetup PASS 447.59 seconds
TestRunner_l2cap-tester PASS 20.79 seconds
TestRunner_iso-tester FAIL 32.84 seconds
TestRunner_bnep-tester PASS 4.84 seconds
TestRunner_mgmt-tester PASS 121.93 seconds
TestRunner_rfcomm-tester PASS 7.70 seconds
TestRunner_sco-tester PASS 11.49 seconds
TestRunner_ioctl-tester PASS 8.23 seconds
TestRunner_mesh-tester PASS 6.04 seconds
TestRunner_smp-tester PASS 7.25 seconds
TestRunner_userchan-tester PASS 5.13 seconds
IncrementalBuild PENDING 0.89 seconds
Details
##############################
Test: CheckPatch - PENDING
Desc: Run checkpatch.pl script
Output:
##############################
Test: GitLint - PENDING
Desc: Run gitlint
Output:
##############################
Test: TestRunner_iso-tester - FAIL
Desc: Run iso-tester with test-runner
Output:
WARNING: possible circular locking dependency detected
Total: 124, Passed: 120 (96.8%), Failed: 0, Not Run: 4
##############################
Test: IncrementalBuild - PENDING
Desc: Incremental build with the patches in the series
Output:
---
Regards,
Linux Bluetooth
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [PATCH v1] Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync
2024-11-15 15:59 [PATCH v1] Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync Luiz Augusto von Dentz
2024-11-15 16:35 ` [v1] " bluez.test.bot
@ 2024-11-15 16:41 ` Luiz Augusto von Dentz
2024-11-15 18:41 ` Luiz Augusto von Dentz
2024-11-15 23:32 ` syzbot
1 sibling, 2 replies; 22+ messages in thread
From: Luiz Augusto von Dentz @ 2024-11-15 16:41 UTC (permalink / raw)
To: linux-bluetooth; +Cc: syzbot
#syz test
On Fri, Nov 15, 2024 at 10:59 AM Luiz Augusto von Dentz
<luiz.dentz@gmail.com> wrote:
>
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
>
> This fixes the following crash:
>
> ==================================================================
> BUG: KASAN: slab-use-after-free in set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1353
> Read of size 8 at addr ffff888029b4dd18 by task kworker/u9:0/54
>
> CPU: 1 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.11.0-rc6-syzkaller-01155-gf723224742fc #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
> Workqueue: hci0 hci_cmd_sync_work
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:93 [inline]
> dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119
> print_address_description mm/kasan/report.c:377 [inline]
> print_report+0x169/0x550 mm/kasan/report.c:488
> q kasan_report+0x143/0x180 mm/kasan/report.c:601
> set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1353
> hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:328
> process_one_work kernel/workqueue.c:3231 [inline]
> process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
> worker_thread+0x86d/0xd10 kernel/workqueue.c:3389
> kthread+0x2f0/0x390 kernel/kthread.c:389
> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> </TASK>
>
> Allocated by task 5247:
> kasan_save_stack mm/kasan/common.c:47 [inline]
> kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
> poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
> __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387
> kasan_kmalloc include/linux/kasan.h:211 [inline]
> __kmalloc_cache_noprof+0x19c/0x2c0 mm/slub.c:4193
> kmalloc_noprof include/linux/slab.h:681 [inline]
> kzalloc_noprof include/linux/slab.h:807 [inline]
> mgmt_pending_new+0x65/0x250 net/bluetooth/mgmt_util.c:269
> mgmt_pending_add+0x36/0x120 net/bluetooth/mgmt_util.c:296
> set_powered+0x3cd/0x5e0 net/bluetooth/mgmt.c:1394
> hci_mgmt_cmd+0xc47/0x11d0 net/bluetooth/hci_sock.c:1712
> hci_sock_sendmsg+0x7b8/0x11c0 net/bluetooth/hci_sock.c:1832
> sock_sendmsg_nosec net/socket.c:730 [inline]
> __sock_sendmsg+0x221/0x270 net/socket.c:745
> sock_write_iter+0x2dd/0x400 net/socket.c:1160
> new_sync_write fs/read_write.c:497 [inline]
> vfs_write+0xa72/0xc90 fs/read_write.c:590
> ksys_write+0x1a0/0x2c0 fs/read_write.c:643
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> Freed by task 5246:
> kasan_save_stack mm/kasan/common.c:47 [inline]
> kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
> kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
> poison_slab_object+0xe0/0x150 mm/kasan/common.c:240
> __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256
> kasan_slab_free include/linux/kasan.h:184 [inline]
> slab_free_hook mm/slub.c:2256 [inline]
> slab_free mm/slub.c:4477 [inline]
> kfree+0x149/0x360 mm/slub.c:4598
> settings_rsp+0x2bc/0x390 net/bluetooth/mgmt.c:1443
> mgmt_pending_foreach+0xd1/0x130 net/bluetooth/mgmt_util.c:259
> __mgmt_power_off+0x112/0x420 net/bluetooth/mgmt.c:9455
> hci_dev_close_sync+0x665/0x11a0 net/bluetooth/hci_sync.c:5191
> hci_dev_do_close net/bluetooth/hci_core.c:483 [inline]
> hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508
> sock_do_ioctl+0x158/0x460 net/socket.c:1222
> sock_ioctl+0x629/0x8e0 net/socket.c:1341
> vfs_ioctl fs/ioctl.c:51 [inline]
> __do_sys_ioctl fs/ioctl.c:907 [inline]
> __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83gv
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> Reported-by: syzbot+03d6270b6425df1605bf@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=03d6270b6425df1605bf
> Fixes: 275f3f648702 ("Bluetooth: Fix not checking MGMT cmd pending queue")
> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> ---
> net/bluetooth/mgmt.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
> index 1f6d083682b8..6a26c1ea0d04 100644
> --- a/net/bluetooth/mgmt.c
> +++ b/net/bluetooth/mgmt.c
> @@ -1441,6 +1441,10 @@ static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
> sock_hold(match->sk);
> }
>
> + /* dequeue cmd_sync entries using cmd as data as that is about to be
> + * removed/freed.
> + */
> + hci_cmd_sync_dequeue(match->hdev, NULL, cmd, NULL);
> mgmt_pending_free(cmd);
> }
>
> --
> 2.47.0
>
--
Luiz Augusto von Dentz
^ permalink raw reply [flat|nested] 22+ messages in thread* Re: [PATCH v1] Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync
2024-11-15 16:41 ` [PATCH v1] " Luiz Augusto von Dentz
@ 2024-11-15 18:41 ` Luiz Augusto von Dentz
2024-11-15 23:57 ` [syzbot] [bluetooth?] KASAN: " syzbot
2024-11-15 23:32 ` syzbot
1 sibling, 1 reply; 22+ messages in thread
From: Luiz Augusto von Dentz @ 2024-11-15 18:41 UTC (permalink / raw)
To: linux-bluetooth; +Cc: syzbot
[-- Attachment #1: Type: text/plain, Size: 5165 bytes --]
#syz test
On Fri, Nov 15, 2024 at 11:41 AM Luiz Augusto von Dentz
<luiz.dentz@gmail.com> wrote:
>
> #syz test
>
> On Fri, Nov 15, 2024 at 10:59 AM Luiz Augusto von Dentz
> <luiz.dentz@gmail.com> wrote:
> >
> > From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> >
> > This fixes the following crash:
> >
> > ==================================================================
> > BUG: KASAN: slab-use-after-free in set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1353
> > Read of size 8 at addr ffff888029b4dd18 by task kworker/u9:0/54
> >
> > CPU: 1 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.11.0-rc6-syzkaller-01155-gf723224742fc #0
> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
> > Workqueue: hci0 hci_cmd_sync_work
> > Call Trace:
> > <TASK>
> > __dump_stack lib/dump_stack.c:93 [inline]
> > dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119
> > print_address_description mm/kasan/report.c:377 [inline]
> > print_report+0x169/0x550 mm/kasan/report.c:488
> > q kasan_report+0x143/0x180 mm/kasan/report.c:601
> > set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1353
> > hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:328
> > process_one_work kernel/workqueue.c:3231 [inline]
> > process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
> > worker_thread+0x86d/0xd10 kernel/workqueue.c:3389
> > kthread+0x2f0/0x390 kernel/kthread.c:389
> > ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> > </TASK>
> >
> > Allocated by task 5247:
> > kasan_save_stack mm/kasan/common.c:47 [inline]
> > kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
> > poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
> > __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387
> > kasan_kmalloc include/linux/kasan.h:211 [inline]
> > __kmalloc_cache_noprof+0x19c/0x2c0 mm/slub.c:4193
> > kmalloc_noprof include/linux/slab.h:681 [inline]
> > kzalloc_noprof include/linux/slab.h:807 [inline]
> > mgmt_pending_new+0x65/0x250 net/bluetooth/mgmt_util.c:269
> > mgmt_pending_add+0x36/0x120 net/bluetooth/mgmt_util.c:296
> > set_powered+0x3cd/0x5e0 net/bluetooth/mgmt.c:1394
> > hci_mgmt_cmd+0xc47/0x11d0 net/bluetooth/hci_sock.c:1712
> > hci_sock_sendmsg+0x7b8/0x11c0 net/bluetooth/hci_sock.c:1832
> > sock_sendmsg_nosec net/socket.c:730 [inline]
> > __sock_sendmsg+0x221/0x270 net/socket.c:745
> > sock_write_iter+0x2dd/0x400 net/socket.c:1160
> > new_sync_write fs/read_write.c:497 [inline]
> > vfs_write+0xa72/0xc90 fs/read_write.c:590
> > ksys_write+0x1a0/0x2c0 fs/read_write.c:643
> > do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> > do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
> > entry_SYSCALL_64_after_hwframe+0x77/0x7f
> >
> > Freed by task 5246:
> > kasan_save_stack mm/kasan/common.c:47 [inline]
> > kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
> > kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
> > poison_slab_object+0xe0/0x150 mm/kasan/common.c:240
> > __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256
> > kasan_slab_free include/linux/kasan.h:184 [inline]
> > slab_free_hook mm/slub.c:2256 [inline]
> > slab_free mm/slub.c:4477 [inline]
> > kfree+0x149/0x360 mm/slub.c:4598
> > settings_rsp+0x2bc/0x390 net/bluetooth/mgmt.c:1443
> > mgmt_pending_foreach+0xd1/0x130 net/bluetooth/mgmt_util.c:259
> > __mgmt_power_off+0x112/0x420 net/bluetooth/mgmt.c:9455
> > hci_dev_close_sync+0x665/0x11a0 net/bluetooth/hci_sync.c:5191
> > hci_dev_do_close net/bluetooth/hci_core.c:483 [inline]
> > hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508
> > sock_do_ioctl+0x158/0x460 net/socket.c:1222
> > sock_ioctl+0x629/0x8e0 net/socket.c:1341
> > vfs_ioctl fs/ioctl.c:51 [inline]
> > __do_sys_ioctl fs/ioctl.c:907 [inline]
> > __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
> > do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> > do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83gv
> > entry_SYSCALL_64_after_hwframe+0x77/0x7f
> >
> > Reported-by: syzbot+03d6270b6425df1605bf@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=03d6270b6425df1605bf
> > Fixes: 275f3f648702 ("Bluetooth: Fix not checking MGMT cmd pending queue")
> > Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> > ---
> > net/bluetooth/mgmt.c | 4 ++++
> > 1 file changed, 4 insertions(+)
> >
> > diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
> > index 1f6d083682b8..6a26c1ea0d04 100644
> > --- a/net/bluetooth/mgmt.c
> > +++ b/net/bluetooth/mgmt.c
> > @@ -1441,6 +1441,10 @@ static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
> > sock_hold(match->sk);
> > }
> >
> > + /* dequeue cmd_sync entries using cmd as data as that is about to be
> > + * removed/freed.
> > + */
> > + hci_cmd_sync_dequeue(match->hdev, NULL, cmd, NULL);
> > mgmt_pending_free(cmd);
> > }
> >
> > --
> > 2.47.0
> >
>
>
> --
> Luiz Augusto von Dentz
--
Luiz Augusto von Dentz
[-- Attachment #2: v1-0001-Bluetooth-MGMT-Fix-slab-use-after-free-Read-in-se.patch --]
[-- Type: text/x-patch, Size: 4516 bytes --]
From 9852e59e7982cc3f58c3df8dd37504f7c037e920 Mon Sep 17 00:00:00 2001
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: Fri, 15 Nov 2024 10:45:31 -0500
Subject: [PATCH v1] Bluetooth: MGMT: Fix slab-use-after-free Read in
set_powered_sync
This fixes the following crash:
==================================================================
BUG: KASAN: slab-use-after-free in set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1353
Read of size 8 at addr ffff888029b4dd18 by task kworker/u9:0/54
CPU: 1 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.11.0-rc6-syzkaller-01155-gf723224742fc #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: hci0 hci_cmd_sync_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
q kasan_report+0x143/0x180 mm/kasan/report.c:601
set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1353
hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:328
process_one_work kernel/workqueue.c:3231 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
worker_thread+0x86d/0xd10 kernel/workqueue.c:3389
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Allocated by task 5247:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
__kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387
kasan_kmalloc include/linux/kasan.h:211 [inline]
__kmalloc_cache_noprof+0x19c/0x2c0 mm/slub.c:4193
kmalloc_noprof include/linux/slab.h:681 [inline]
kzalloc_noprof include/linux/slab.h:807 [inline]
mgmt_pending_new+0x65/0x250 net/bluetooth/mgmt_util.c:269
mgmt_pending_add+0x36/0x120 net/bluetooth/mgmt_util.c:296
set_powered+0x3cd/0x5e0 net/bluetooth/mgmt.c:1394
hci_mgmt_cmd+0xc47/0x11d0 net/bluetooth/hci_sock.c:1712
hci_sock_sendmsg+0x7b8/0x11c0 net/bluetooth/hci_sock.c:1832
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0x221/0x270 net/socket.c:745
sock_write_iter+0x2dd/0x400 net/socket.c:1160
new_sync_write fs/read_write.c:497 [inline]
vfs_write+0xa72/0xc90 fs/read_write.c:590
ksys_write+0x1a0/0x2c0 fs/read_write.c:643
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 5246:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
poison_slab_object+0xe0/0x150 mm/kasan/common.c:240
__kasan_slab_free+0x37/0x60 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2256 [inline]
slab_free mm/slub.c:4477 [inline]
kfree+0x149/0x360 mm/slub.c:4598
settings_rsp+0x2bc/0x390 net/bluetooth/mgmt.c:1443
mgmt_pending_foreach+0xd1/0x130 net/bluetooth/mgmt_util.c:259
__mgmt_power_off+0x112/0x420 net/bluetooth/mgmt.c:9455
hci_dev_close_sync+0x665/0x11a0 net/bluetooth/hci_sync.c:5191
hci_dev_do_close net/bluetooth/hci_core.c:483 [inline]
hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508
sock_do_ioctl+0x158/0x460 net/socket.c:1222
sock_ioctl+0x629/0x8e0 net/socket.c:1341
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83gv
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Reported-by: syzbot+03d6270b6425df1605bf@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=03d6270b6425df1605bf
Fixes: 275f3f648702 ("Bluetooth: Fix not checking MGMT cmd pending queue")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
net/bluetooth/mgmt.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 1f6d083682b8..6a26c1ea0d04 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -1441,6 +1441,10 @@ static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
sock_hold(match->sk);
}
+ /* dequeue cmd_sync entries using cmd as data as that is about to be
+ * removed/freed.
+ */
+ hci_cmd_sync_dequeue(match->hdev, NULL, cmd, NULL);
mgmt_pending_free(cmd);
}
--
2.47.0
^ permalink raw reply related [flat|nested] 22+ messages in thread* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in set_powered_sync
2024-11-15 18:41 ` Luiz Augusto von Dentz
@ 2024-11-15 23:57 ` syzbot
0 siblings, 0 replies; 22+ messages in thread
From: syzbot @ 2024-11-15 23:57 UTC (permalink / raw)
To: linux-bluetooth, linux-kernel, luiz.dentz, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in set_powered_sync
==================================================================
BUG: KASAN: slab-use-after-free in set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1354
Read of size 8 at addr ffff888026efb218 by task kworker/u9:2/5313
CPU: 1 UID: 0 PID: 5313 Comm: kworker/u9:2 Not tainted 6.12.0-rc7-syzkaller-01628-g025b2bbc5ab1-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024
Workqueue: hci0 hci_cmd_sync_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1354
hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Allocated by task 6078:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:257 [inline]
__kmalloc_cache_noprof+0x19c/0x2c0 mm/slub.c:4295
kmalloc_noprof include/linux/slab.h:878 [inline]
kzalloc_noprof include/linux/slab.h:1014 [inline]
mgmt_pending_new+0x65/0x250 net/bluetooth/mgmt_util.c:269
mgmt_pending_add+0x36/0x120 net/bluetooth/mgmt_util.c:296
set_powered+0x3cd/0x5e0 net/bluetooth/mgmt.c:1395
hci_mgmt_cmd+0xc47/0x11d0 net/bluetooth/hci_sock.c:1712
hci_sock_sendmsg+0x7b8/0x11c0 net/bluetooth/hci_sock.c:1832
sock_sendmsg_nosec net/socket.c:729 [inline]
__sock_sendmsg+0x221/0x270 net/socket.c:744
sock_write_iter+0x2d7/0x3f0 net/socket.c:1165
new_sync_write fs/read_write.c:590 [inline]
vfs_write+0xaeb/0xd30 fs/read_write.c:683
ksys_write+0x183/0x2b0 fs/read_write.c:736
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 6075:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:230 [inline]
slab_free_hook mm/slub.c:2342 [inline]
slab_free mm/slub.c:4579 [inline]
kfree+0x1a0/0x440 mm/slub.c:4727
settings_rsp+0x309/0x3e0 net/bluetooth/mgmt.c:1448
mgmt_pending_foreach+0xd1/0x130 net/bluetooth/mgmt_util.c:259
__mgmt_power_off+0x106/0x430 net/bluetooth/mgmt.c:9524
hci_dev_close_sync+0x6c4/0x11c0 net/bluetooth/hci_sync.c:5208
hci_dev_do_close net/bluetooth/hci_core.c:483 [inline]
hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508
sock_do_ioctl+0x158/0x460 net/socket.c:1227
sock_ioctl+0x626/0x8e0 net/socket.c:1346
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff888026efb200
which belongs to the cache kmalloc-96 of size 96
The buggy address is located 24 bytes inside of
freed 96-byte region [ffff888026efb200, ffff888026efb260)
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x26efb
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000000 ffff88801ac41280 ffffea00009a43c0 dead000000000004
raw: 0000000000000000 0000000000200020 00000001f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 52, tgid 52 (kworker/u8:3), ts 7241169289, free_ts 0
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556
prep_new_page mm/page_alloc.c:1564 [inline]
get_page_from_freelist+0x3649/0x3790 mm/page_alloc.c:3474
__alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4750
alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265
alloc_slab_page+0x6a/0x140 mm/slub.c:2412
allocate_slab+0x5a/0x2f0 mm/slub.c:2578
new_slab mm/slub.c:2631 [inline]
___slab_alloc+0xcd1/0x14b0 mm/slub.c:3818
__slab_alloc+0x58/0xa0 mm/slub.c:3908
__slab_alloc_node mm/slub.c:3961 [inline]
slab_alloc_node mm/slub.c:4122 [inline]
__kmalloc_cache_noprof+0x1d5/0x2c0 mm/slub.c:4290
kmalloc_noprof include/linux/slab.h:878 [inline]
blk_alloc_queue_stats+0x4c/0x100 block/blk-stat.c:210
blk_alloc_queue+0xc1/0x580 block/blk-core.c:403
blk_mq_alloc_queue+0x19e/0x2f0 block/blk-mq.c:4154
scsi_alloc_sdev+0x772/0xb90 drivers/scsi/scsi_scan.c:337
scsi_probe_and_add_lun+0x1db/0x4be0 drivers/scsi/scsi_scan.c:1210
__scsi_scan_target+0x205/0x1080 drivers/scsi/scsi_scan.c:1757
scsi_scan_channel drivers/scsi/scsi_scan.c:1845 [inline]
scsi_scan_host_selected+0x37e/0x690 drivers/scsi/scsi_scan.c:1874
page_owner free stack trace missing
Memory state around the buggy address:
ffff888026efb100: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
ffff888026efb180: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
>ffff888026efb200: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
^
ffff888026efb280: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
ffff888026efb300: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
==================================================================
Tested on:
commit: 025b2bbc net: phy: microchip_t1: Clause-45 PHY loopbac..
git tree: net-next
console output: https://syzkaller.appspot.com/x/log.txt?x=16dc71a7980000
kernel config: https://syzkaller.appspot.com/x/.config?x=d9e1e43bf6b46a4d
dashboard link: https://syzkaller.appspot.com/bug?extid=03d6270b6425df1605bf
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=10976b5f980000
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in set_powered_sync
2024-11-15 16:41 ` [PATCH v1] " Luiz Augusto von Dentz
2024-11-15 18:41 ` Luiz Augusto von Dentz
@ 2024-11-15 23:32 ` syzbot
1 sibling, 0 replies; 22+ messages in thread
From: syzbot @ 2024-11-15 23:32 UTC (permalink / raw)
To: linux-bluetooth, linux-kernel, luiz.dentz, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in set_powered_sync
==================================================================
BUG: KASAN: slab-use-after-free in set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1354
Read of size 8 at addr ffff8880791bd518 by task kworker/u9:0/54
CPU: 1 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.12.0-rc7-syzkaller-01627-g6bbdb903db08 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024
Workqueue: hci0 hci_cmd_sync_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1354
hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Allocated by task 6105:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:257 [inline]
__kmalloc_cache_noprof+0x19c/0x2c0 mm/slub.c:4295
kmalloc_noprof include/linux/slab.h:878 [inline]
kzalloc_noprof include/linux/slab.h:1014 [inline]
mgmt_pending_new+0x65/0x250 net/bluetooth/mgmt_util.c:269
mgmt_pending_add+0x36/0x120 net/bluetooth/mgmt_util.c:296
set_powered+0x3cd/0x5e0 net/bluetooth/mgmt.c:1395
hci_mgmt_cmd+0xc47/0x11d0 net/bluetooth/hci_sock.c:1712
hci_sock_sendmsg+0x7b8/0x11c0 net/bluetooth/hci_sock.c:1832
sock_sendmsg_nosec net/socket.c:729 [inline]
__sock_sendmsg+0x221/0x270 net/socket.c:744
sock_write_iter+0x2d7/0x3f0 net/socket.c:1165
new_sync_write fs/read_write.c:590 [inline]
vfs_write+0xaeb/0xd30 fs/read_write.c:683
ksys_write+0x183/0x2b0 fs/read_write.c:736
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 6099:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:230 [inline]
slab_free_hook mm/slub.c:2342 [inline]
slab_free mm/slub.c:4579 [inline]
kfree+0x1a0/0x440 mm/slub.c:4727
settings_rsp+0x2bc/0x390 net/bluetooth/mgmt.c:1444
mgmt_pending_foreach+0xd1/0x130 net/bluetooth/mgmt_util.c:259
__mgmt_power_off+0x106/0x430 net/bluetooth/mgmt.c:9520
hci_dev_close_sync+0x6c4/0x11c0 net/bluetooth/hci_sync.c:5208
hci_dev_do_close net/bluetooth/hci_core.c:483 [inline]
hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508
sock_do_ioctl+0x158/0x460 net/socket.c:1227
sock_ioctl+0x626/0x8e0 net/socket.c:1346
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff8880791bd500
which belongs to the cache kmalloc-96 of size 96
The buggy address is located 24 bytes inside of
freed 96-byte region [ffff8880791bd500, ffff8880791bd560)
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x791bd
ksm flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000000 ffff88801ac41280 ffffea0001eb13c0 dead000000000003
raw: 0000000000000000 0000000080200020 00000001f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5386, tgid 5386 (kworker/0:5), ts 68941935893, free_ts 68939759623
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556
prep_new_page mm/page_alloc.c:1564 [inline]
get_page_from_freelist+0x3649/0x3790 mm/page_alloc.c:3474
__alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4750
alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265
alloc_slab_page+0x6a/0x140 mm/slub.c:2412
allocate_slab+0x5a/0x2f0 mm/slub.c:2578
new_slab mm/slub.c:2631 [inline]
___slab_alloc+0xcd1/0x14b0 mm/slub.c:3818
__slab_alloc+0x58/0xa0 mm/slub.c:3908
__slab_alloc_node mm/slub.c:3961 [inline]
slab_alloc_node mm/slub.c:4122 [inline]
__kmalloc_cache_noprof+0x1d5/0x2c0 mm/slub.c:4290
kmalloc_noprof include/linux/slab.h:878 [inline]
dst_cow_metrics_generic+0x56/0x1c0 net/core/dst.c:185
dst_metrics_write_ptr include/net/dst.h:133 [inline]
dst_metric_set include/net/dst.h:194 [inline]
icmp6_dst_alloc+0x270/0x420 net/ipv6/route.c:3288
mld_sendpack+0x6a3/0xdb0 net/ipv6/mcast.c:1808
mld_send_cr net/ipv6/mcast.c:2120 [inline]
mld_ifc_work+0x7d9/0xd90 net/ipv6/mcast.c:2651
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
page last free pid 5386 tgid 5386 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1127 [inline]
free_unref_page+0xdf9/0x1140 mm/page_alloc.c:2657
rcu_do_batch kernel/rcu/tree.c:2567 [inline]
rcu_core+0xaaa/0x17a0 kernel/rcu/tree.c:2823
handle_softirqs+0x2c5/0x980 kernel/softirq.c:554
do_softirq+0x11b/0x1e0 kernel/softirq.c:455
__local_bh_enable_ip+0x1bb/0x200 kernel/softirq.c:382
ipv6_get_lladdr+0x295/0x3d0 net/ipv6/addrconf.c:1936
mld_newpack+0x337/0xaf0 net/ipv6/mcast.c:1755
add_grhead net/ipv6/mcast.c:1850 [inline]
add_grec+0x1492/0x19a0 net/ipv6/mcast.c:1988
mld_send_cr net/ipv6/mcast.c:2114 [inline]
mld_ifc_work+0x691/0xd90 net/ipv6/mcast.c:2651
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Memory state around the buggy address:
ffff8880791bd400: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
ffff8880791bd480: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
>ffff8880791bd500: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
^
ffff8880791bd580: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
ffff8880791bd600: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
==================================================================
Tested on:
commit: 6bbdb903 dt-bindings: net: dsa: microchip,ksz: Drop un..
git tree: net-next
console output: https://syzkaller.appspot.com/x/log.txt?x=178b3cc0580000
kernel config: https://syzkaller.appspot.com/x/.config?x=d9e1e43bf6b46a4d
dashboard link: https://syzkaller.appspot.com/bug?extid=03d6270b6425df1605bf
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
Note: no patches were applied.
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [PATCH v5] Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync
@ 2024-11-18 20:50 Luiz Augusto von Dentz
2024-11-18 21:16 ` [syzbot] [bluetooth?] KASAN: " syzbot
0 siblings, 1 reply; 22+ messages in thread
From: Luiz Augusto von Dentz @ 2024-11-18 20:50 UTC (permalink / raw)
To: linux-bluetooth; +Cc: syzbot
[-- Attachment #1: Type: text/plain, Size: 5396 bytes --]
#syz test
On Mon, Nov 18, 2024 at 3:33 PM Luiz Augusto von Dentz
<luiz.dentz@gmail.com> wrote:
>
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
>
> This fixes the following crash:
>
> ==================================================================
> BUG: KASAN: slab-use-after-free in set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1353
> Read of size 8 at addr ffff888029b4dd18 by task kworker/u9:0/54
>
> CPU: 1 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.11.0-rc6-syzkaller-01155-gf723224742fc #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
> Workqueue: hci0 hci_cmd_sync_work
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:93 [inline]
> dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119
> print_address_description mm/kasan/report.c:377 [inline]
> print_report+0x169/0x550 mm/kasan/report.c:488
> q kasan_report+0x143/0x180 mm/kasan/report.c:601
> set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1353
> hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:328
> process_one_work kernel/workqueue.c:3231 [inline]
> process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
> worker_thread+0x86d/0xd10 kernel/workqueue.c:3389
> kthread+0x2f0/0x390 kernel/kthread.c:389
> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> </TASK>
>
> Allocated by task 5247:
> kasan_save_stack mm/kasan/common.c:47 [inline]
> kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
> poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
> __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387
> kasan_kmalloc include/linux/kasan.h:211 [inline]
> __kmalloc_cache_noprof+0x19c/0x2c0 mm/slub.c:4193
> kmalloc_noprof include/linux/slab.h:681 [inline]
> kzalloc_noprof include/linux/slab.h:807 [inline]
> mgmt_pending_new+0x65/0x250 net/bluetooth/mgmt_util.c:269
> mgmt_pending_add+0x36/0x120 net/bluetooth/mgmt_util.c:296
> set_powered+0x3cd/0x5e0 net/bluetooth/mgmt.c:1394
> hci_mgmt_cmd+0xc47/0x11d0 net/bluetooth/hci_sock.c:1712
> hci_sock_sendmsg+0x7b8/0x11c0 net/bluetooth/hci_sock.c:1832
> sock_sendmsg_nosec net/socket.c:730 [inline]
> __sock_sendmsg+0x221/0x270 net/socket.c:745
> sock_write_iter+0x2dd/0x400 net/socket.c:1160
> new_sync_write fs/read_write.c:497 [inline]
> vfs_write+0xa72/0xc90 fs/read_write.c:590
> ksys_write+0x1a0/0x2c0 fs/read_write.c:643
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> Freed by task 5246:
> kasan_save_stack mm/kasan/common.c:47 [inline]
> kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
> kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
> poison_slab_object+0xe0/0x150 mm/kasan/common.c:240
> __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256
> kasan_slab_free include/linux/kasan.h:184 [inline]
> slab_free_hook mm/slub.c:2256 [inline]
> slab_free mm/slub.c:4477 [inline]
> kfree+0x149/0x360 mm/slub.c:4598
> settings_rsp+0x2bc/0x390 net/bluetooth/mgmt.c:1443
> mgmt_pending_foreach+0xd1/0x130 net/bluetooth/mgmt_util.c:259
> __mgmt_power_off+0x112/0x420 net/bluetooth/mgmt.c:9455
> hci_dev_close_sync+0x665/0x11a0 net/bluetooth/hci_sync.c:5191
> hci_dev_do_close net/bluetooth/hci_core.c:483 [inline]
> hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508
> sock_do_ioctl+0x158/0x460 net/socket.c:1222
> sock_ioctl+0x629/0x8e0 net/socket.c:1341
> vfs_ioctl fs/ioctl.c:51 [inline]
> __do_sys_ioctl fs/ioctl.c:907 [inline]
> __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83gv
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> Reported-by: syzbot+03d6270b6425df1605bf@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=03d6270b6425df1605bf
> Fixes: 275f3f648702 ("Bluetooth: Fix not checking MGMT cmd pending queue")
> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> ---
> net/bluetooth/mgmt.c | 11 +++++++++--
> 1 file changed, 9 insertions(+), 2 deletions(-)
>
> diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
> index 1f6d083682b8..e406eb8e4327 100644
> --- a/net/bluetooth/mgmt.c
> +++ b/net/bluetooth/mgmt.c
> @@ -1318,7 +1318,8 @@ static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err)
> struct mgmt_mode *cp;
>
> /* Make sure cmd still outstanding. */
> - if (cmd != pending_find(MGMT_OP_SET_POWERED, hdev))
> + if (err == -ECANCELED ||
> + cmd != pending_find(MGMT_OP_SET_POWERED, hdev))
> return;
>
> cp = cmd->param;
> @@ -1351,7 +1352,13 @@ static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err)
> static int set_powered_sync(struct hci_dev *hdev, void *data)
> {
> struct mgmt_pending_cmd *cmd = data;
> - struct mgmt_mode *cp = cmd->param;
> + struct mgmt_mode *cp;
> +
> + /* Make sure cmd still outstanding. */
> + if (cmd != pending_find(MGMT_OP_SET_POWERED, hdev))
> + return -ECANCELED;
> +
> + cp = cmd->param;
>
> BT_DBG("%s", hdev->name);
>
> --
> 2.47.0
>
--
Luiz Augusto von Dentz
[-- Attachment #2: v5-0001-Bluetooth-MGMT-Fix-slab-use-after-free-Read-in-se.patch --]
[-- Type: text/x-patch, Size: 5016 bytes --]
From 387147dfb88215af342ae5f4445693c3c174c069 Mon Sep 17 00:00:00 2001
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: Fri, 15 Nov 2024 10:45:31 -0500
Subject: [PATCH v5] Bluetooth: MGMT: Fix slab-use-after-free Read in
set_powered_sync
This fixes the following crash:
==================================================================
BUG: KASAN: slab-use-after-free in set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1353
Read of size 8 at addr ffff888029b4dd18 by task kworker/u9:0/54
CPU: 1 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.11.0-rc6-syzkaller-01155-gf723224742fc #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: hci0 hci_cmd_sync_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
q kasan_report+0x143/0x180 mm/kasan/report.c:601
set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1353
hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:328
process_one_work kernel/workqueue.c:3231 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
worker_thread+0x86d/0xd10 kernel/workqueue.c:3389
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Allocated by task 5247:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
__kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387
kasan_kmalloc include/linux/kasan.h:211 [inline]
__kmalloc_cache_noprof+0x19c/0x2c0 mm/slub.c:4193
kmalloc_noprof include/linux/slab.h:681 [inline]
kzalloc_noprof include/linux/slab.h:807 [inline]
mgmt_pending_new+0x65/0x250 net/bluetooth/mgmt_util.c:269
mgmt_pending_add+0x36/0x120 net/bluetooth/mgmt_util.c:296
set_powered+0x3cd/0x5e0 net/bluetooth/mgmt.c:1394
hci_mgmt_cmd+0xc47/0x11d0 net/bluetooth/hci_sock.c:1712
hci_sock_sendmsg+0x7b8/0x11c0 net/bluetooth/hci_sock.c:1832
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0x221/0x270 net/socket.c:745
sock_write_iter+0x2dd/0x400 net/socket.c:1160
new_sync_write fs/read_write.c:497 [inline]
vfs_write+0xa72/0xc90 fs/read_write.c:590
ksys_write+0x1a0/0x2c0 fs/read_write.c:643
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 5246:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
poison_slab_object+0xe0/0x150 mm/kasan/common.c:240
__kasan_slab_free+0x37/0x60 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2256 [inline]
slab_free mm/slub.c:4477 [inline]
kfree+0x149/0x360 mm/slub.c:4598
settings_rsp+0x2bc/0x390 net/bluetooth/mgmt.c:1443
mgmt_pending_foreach+0xd1/0x130 net/bluetooth/mgmt_util.c:259
__mgmt_power_off+0x112/0x420 net/bluetooth/mgmt.c:9455
hci_dev_close_sync+0x665/0x11a0 net/bluetooth/hci_sync.c:5191
hci_dev_do_close net/bluetooth/hci_core.c:483 [inline]
hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508
sock_do_ioctl+0x158/0x460 net/socket.c:1222
sock_ioctl+0x629/0x8e0 net/socket.c:1341
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83gv
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Reported-by: syzbot+03d6270b6425df1605bf@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=03d6270b6425df1605bf
Fixes: 275f3f648702 ("Bluetooth: Fix not checking MGMT cmd pending queue")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
net/bluetooth/mgmt.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 1f6d083682b8..e406eb8e4327 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -1318,7 +1318,8 @@ static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err)
struct mgmt_mode *cp;
/* Make sure cmd still outstanding. */
- if (cmd != pending_find(MGMT_OP_SET_POWERED, hdev))
+ if (err == -ECANCELED ||
+ cmd != pending_find(MGMT_OP_SET_POWERED, hdev))
return;
cp = cmd->param;
@@ -1351,7 +1352,13 @@ static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err)
static int set_powered_sync(struct hci_dev *hdev, void *data)
{
struct mgmt_pending_cmd *cmd = data;
- struct mgmt_mode *cp = cmd->param;
+ struct mgmt_mode *cp;
+
+ /* Make sure cmd still outstanding. */
+ if (cmd != pending_find(MGMT_OP_SET_POWERED, hdev))
+ return -ECANCELED;
+
+ cp = cmd->param;
BT_DBG("%s", hdev->name);
--
2.47.0
^ permalink raw reply related [flat|nested] 22+ messages in thread* Re: [PATCH v3] Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync
2024-11-18 16:04 [PATCH v3] Bluetooth: MGMT: Fix " Luiz Augusto von Dentz
@ 2024-11-18 17:00 Luiz Augusto von Dentz
2024-11-18 17:26 ` [syzbot] [bluetooth?] KASAN: " syzbot
0 siblings, 1 reply; 22+ messages in thread
From: Luiz Augusto von Dentz @ 2024-11-18 17:00 UTC (permalink / raw)
To: linux-bluetooth; +Cc: syzbot
[-- Attachment #1: Type: text/plain, Size: 5819 bytes --]
#syz test
On Mon, Nov 18, 2024 at 11:04 AM Luiz Augusto von Dentz
<luiz.dentz@gmail.com> wrote:
>
> #syz test
>
> On Mon, Nov 18, 2024 at 10:36 AM Luiz Augusto von Dentz
> <luiz.dentz@gmail.com> wrote:
> >
> > From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> >
> > This fixes the following crash:
> >
> > ==================================================================
> > BUG: KASAN: slab-use-after-free in set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1353
> > Read of size 8 at addr ffff888029b4dd18 by task kworker/u9:0/54
> >
> > CPU: 1 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.11.0-rc6-syzkaller-01155-gf723224742fc #0
> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
> > Workqueue: hci0 hci_cmd_sync_work
> > Call Trace:
> > <TASK>
> > __dump_stack lib/dump_stack.c:93 [inline]
> > dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119
> > print_address_description mm/kasan/report.c:377 [inline]
> > print_report+0x169/0x550 mm/kasan/report.c:488
> > q kasan_report+0x143/0x180 mm/kasan/report.c:601
> > set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1353
> > hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:328
> > process_one_work kernel/workqueue.c:3231 [inline]
> > process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
> > worker_thread+0x86d/0xd10 kernel/workqueue.c:3389
> > kthread+0x2f0/0x390 kernel/kthread.c:389
> > ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> > </TASK>
> >
> > Allocated by task 5247:
> > kasan_save_stack mm/kasan/common.c:47 [inline]
> > kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
> > poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
> > __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387
> > kasan_kmalloc include/linux/kasan.h:211 [inline]
> > __kmalloc_cache_noprof+0x19c/0x2c0 mm/slub.c:4193
> > kmalloc_noprof include/linux/slab.h:681 [inline]
> > kzalloc_noprof include/linux/slab.h:807 [inline]
> > mgmt_pending_new+0x65/0x250 net/bluetooth/mgmt_util.c:269
> > mgmt_pending_add+0x36/0x120 net/bluetooth/mgmt_util.c:296
> > set_powered+0x3cd/0x5e0 net/bluetooth/mgmt.c:1394
> > hci_mgmt_cmd+0xc47/0x11d0 net/bluetooth/hci_sock.c:1712
> > hci_sock_sendmsg+0x7b8/0x11c0 net/bluetooth/hci_sock.c:1832
> > sock_sendmsg_nosec net/socket.c:730 [inline]
> > __sock_sendmsg+0x221/0x270 net/socket.c:745
> > sock_write_iter+0x2dd/0x400 net/socket.c:1160
> > new_sync_write fs/read_write.c:497 [inline]
> > vfs_write+0xa72/0xc90 fs/read_write.c:590
> > ksys_write+0x1a0/0x2c0 fs/read_write.c:643
> > do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> > do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
> > entry_SYSCALL_64_after_hwframe+0x77/0x7f
> >
> > Freed by task 5246:
> > kasan_save_stack mm/kasan/common.c:47 [inline]
> > kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
> > kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
> > poison_slab_object+0xe0/0x150 mm/kasan/common.c:240
> > __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256
> > kasan_slab_free include/linux/kasan.h:184 [inline]
> > slab_free_hook mm/slub.c:2256 [inline]
> > slab_free mm/slub.c:4477 [inline]
> > kfree+0x149/0x360 mm/slub.c:4598
> > settings_rsp+0x2bc/0x390 net/bluetooth/mgmt.c:1443
> > mgmt_pending_foreach+0xd1/0x130 net/bluetooth/mgmt_util.c:259
> > __mgmt_power_off+0x112/0x420 net/bluetooth/mgmt.c:9455
> > hci_dev_close_sync+0x665/0x11a0 net/bluetooth/hci_sync.c:5191
> > hci_dev_do_close net/bluetooth/hci_core.c:483 [inline]
> > hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508
> > sock_do_ioctl+0x158/0x460 net/socket.c:1222
> > sock_ioctl+0x629/0x8e0 net/socket.c:1341
> > vfs_ioctl fs/ioctl.c:51 [inline]
> > __do_sys_ioctl fs/ioctl.c:907 [inline]
> > __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
> > do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> > do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83gv
> > entry_SYSCALL_64_after_hwframe+0x77/0x7f
> >
> > Reported-by: syzbot+03d6270b6425df1605bf@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=03d6270b6425df1605bf
> > Fixes: 275f3f648702 ("Bluetooth: Fix not checking MGMT cmd pending queue")
> > Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> > ---
> > net/bluetooth/mgmt.c | 13 ++++++++++++-
> > 1 file changed, 12 insertions(+), 1 deletion(-)
> >
> > diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
> > index 1f6d083682b8..3ec79c69b0ee 100644
> > --- a/net/bluetooth/mgmt.c
> > +++ b/net/bluetooth/mgmt.c
> > @@ -1351,7 +1351,13 @@ static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err)
> > static int set_powered_sync(struct hci_dev *hdev, void *data)
> > {
> > struct mgmt_pending_cmd *cmd = data;
> > - struct mgmt_mode *cp = cmd->param;
> > + struct mgmt_mode *cp;
> > +
> > + /* Make sure cmd still outstanding. */
> > + if (cmd != pending_find(MGMT_OP_SET_POWERED, hdev))
> > + return -ECANCELED;
> > +
> > + cp = cmd->param;
> >
> > BT_DBG("%s", hdev->name);
> >
> > @@ -1432,6 +1438,11 @@ static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
> > {
> > struct cmd_lookup *match = data;
> >
> > + /* dequeue cmd_sync entries using cmd as data as that is about to be
> > + * removed/freed.
> > + */
> > + hci_cmd_sync_dequeue(match->hdev, NULL, cmd, NULL);
> > +
> > send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
> >
> > list_del(&cmd->list);
> > --
> > 2.47.0
> >
>
>
> --
> Luiz Augusto von Dentz
--
Luiz Augusto von Dentz
[-- Attachment #2: v3-0001-Bluetooth-MGMT-Fix-slab-use-after-free-Read-in-se.patch --]
[-- Type: text/x-patch, Size: 5046 bytes --]
From 4e7d27f2ec85ff2f3ee9b26668a60abcd6e49544 Mon Sep 17 00:00:00 2001
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: Fri, 15 Nov 2024 10:45:31 -0500
Subject: [PATCH v3] Bluetooth: MGMT: Fix slab-use-after-free Read in
set_powered_sync
This fixes the following crash:
==================================================================
BUG: KASAN: slab-use-after-free in set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1353
Read of size 8 at addr ffff888029b4dd18 by task kworker/u9:0/54
CPU: 1 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.11.0-rc6-syzkaller-01155-gf723224742fc #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: hci0 hci_cmd_sync_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
q kasan_report+0x143/0x180 mm/kasan/report.c:601
set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1353
hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:328
process_one_work kernel/workqueue.c:3231 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
worker_thread+0x86d/0xd10 kernel/workqueue.c:3389
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Allocated by task 5247:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
__kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387
kasan_kmalloc include/linux/kasan.h:211 [inline]
__kmalloc_cache_noprof+0x19c/0x2c0 mm/slub.c:4193
kmalloc_noprof include/linux/slab.h:681 [inline]
kzalloc_noprof include/linux/slab.h:807 [inline]
mgmt_pending_new+0x65/0x250 net/bluetooth/mgmt_util.c:269
mgmt_pending_add+0x36/0x120 net/bluetooth/mgmt_util.c:296
set_powered+0x3cd/0x5e0 net/bluetooth/mgmt.c:1394
hci_mgmt_cmd+0xc47/0x11d0 net/bluetooth/hci_sock.c:1712
hci_sock_sendmsg+0x7b8/0x11c0 net/bluetooth/hci_sock.c:1832
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0x221/0x270 net/socket.c:745
sock_write_iter+0x2dd/0x400 net/socket.c:1160
new_sync_write fs/read_write.c:497 [inline]
vfs_write+0xa72/0xc90 fs/read_write.c:590
ksys_write+0x1a0/0x2c0 fs/read_write.c:643
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 5246:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
poison_slab_object+0xe0/0x150 mm/kasan/common.c:240
__kasan_slab_free+0x37/0x60 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2256 [inline]
slab_free mm/slub.c:4477 [inline]
kfree+0x149/0x360 mm/slub.c:4598
settings_rsp+0x2bc/0x390 net/bluetooth/mgmt.c:1443
mgmt_pending_foreach+0xd1/0x130 net/bluetooth/mgmt_util.c:259
__mgmt_power_off+0x112/0x420 net/bluetooth/mgmt.c:9455
hci_dev_close_sync+0x665/0x11a0 net/bluetooth/hci_sync.c:5191
hci_dev_do_close net/bluetooth/hci_core.c:483 [inline]
hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508
sock_do_ioctl+0x158/0x460 net/socket.c:1222
sock_ioctl+0x629/0x8e0 net/socket.c:1341
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83gv
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Reported-by: syzbot+03d6270b6425df1605bf@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=03d6270b6425df1605bf
Fixes: 275f3f648702 ("Bluetooth: Fix not checking MGMT cmd pending queue")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
net/bluetooth/mgmt.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 1f6d083682b8..3ec79c69b0ee 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -1351,7 +1351,13 @@ static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err)
static int set_powered_sync(struct hci_dev *hdev, void *data)
{
struct mgmt_pending_cmd *cmd = data;
- struct mgmt_mode *cp = cmd->param;
+ struct mgmt_mode *cp;
+
+ /* Make sure cmd still outstanding. */
+ if (cmd != pending_find(MGMT_OP_SET_POWERED, hdev))
+ return -ECANCELED;
+
+ cp = cmd->param;
BT_DBG("%s", hdev->name);
@@ -1432,6 +1438,11 @@ static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
{
struct cmd_lookup *match = data;
+ /* dequeue cmd_sync entries using cmd as data as that is about to be
+ * removed/freed.
+ */
+ hci_cmd_sync_dequeue(match->hdev, NULL, cmd, NULL);
+
send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
list_del(&cmd->list);
--
2.47.0
^ permalink raw reply related [flat|nested] 22+ messages in thread* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in set_powered_sync
2024-11-18 17:00 [PATCH v3] Bluetooth: MGMT: Fix " Luiz Augusto von Dentz
@ 2024-11-18 17:26 ` syzbot
0 siblings, 0 replies; 22+ messages in thread
From: syzbot @ 2024-11-18 17:26 UTC (permalink / raw)
To: linux-bluetooth, linux-kernel, luiz.dentz, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in settings_rsp
==================================================================
BUG: KASAN: slab-use-after-free in settings_rsp+0xd0/0x3c0 net/bluetooth/mgmt.c:1446
Read of size 8 at addr ffff888026bff128 by task syz.0.615/7359
CPU: 0 UID: 0 PID: 7359 Comm: syz.0.615 Not tainted 6.12.0-rc7-syzkaller-01702-gd7ef9eeef072-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
settings_rsp+0xd0/0x3c0 net/bluetooth/mgmt.c:1446
mgmt_pending_foreach+0xd1/0x130 net/bluetooth/mgmt_util.c:259
__mgmt_power_off+0x106/0x430 net/bluetooth/mgmt.c:9531
hci_dev_close_sync+0x6c4/0x11c0 net/bluetooth/hci_sync.c:5208
hci_dev_do_close net/bluetooth/hci_core.c:483 [inline]
hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508
sock_do_ioctl+0x158/0x460 net/socket.c:1227
sock_ioctl+0x626/0x8e0 net/socket.c:1346
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa2e757cef9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa2e8325038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fa2e7736058 RCX: 00007fa2e757cef9
RDX: 0000000000000000 RSI: 00000000400448ca RDI: 0000000000000008
RBP: 00007fa2e75ef046 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fa2e7736058 R15: 00007ffd79fe2218
</TASK>
Allocated by task 7360:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:257 [inline]
__kmalloc_cache_noprof+0x19c/0x2c0 mm/slub.c:4295
kmalloc_noprof include/linux/slab.h:878 [inline]
kzalloc_noprof include/linux/slab.h:1014 [inline]
mgmt_pending_new+0x65/0x250 net/bluetooth/mgmt_util.c:269
mgmt_pending_add+0x36/0x120 net/bluetooth/mgmt_util.c:296
set_powered+0x3cd/0x5e0 net/bluetooth/mgmt.c:1401
hci_mgmt_cmd+0xc47/0x11d0 net/bluetooth/hci_sock.c:1712
hci_sock_sendmsg+0x7b8/0x11c0 net/bluetooth/hci_sock.c:1832
sock_sendmsg_nosec net/socket.c:729 [inline]
__sock_sendmsg+0x221/0x270 net/socket.c:744
sock_write_iter+0x2d7/0x3f0 net/socket.c:1165
new_sync_write fs/read_write.c:590 [inline]
vfs_write+0xaeb/0xd30 fs/read_write.c:683
ksys_write+0x183/0x2b0 fs/read_write.c:736
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 7359:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:230 [inline]
slab_free_hook mm/slub.c:2342 [inline]
slab_free mm/slub.c:4579 [inline]
kfree+0x1a0/0x440 mm/slub.c:4727
mgmt_set_powered_complete+0x4c5/0x6c0 net/bluetooth/mgmt.c:1348
_hci_cmd_sync_cancel_entry net/bluetooth/hci_sync.c:645 [inline]
hci_cmd_sync_dequeue+0x22b/0x3d0 net/bluetooth/hci_sync.c:890
settings_rsp+0xa8/0x3c0 net/bluetooth/mgmt.c:1444
mgmt_pending_foreach+0xd1/0x130 net/bluetooth/mgmt_util.c:259
__mgmt_power_off+0x106/0x430 net/bluetooth/mgmt.c:9531
hci_dev_close_sync+0x6c4/0x11c0 net/bluetooth/hci_sync.c:5208
hci_dev_do_close net/bluetooth/hci_core.c:483 [inline]
hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508
sock_do_ioctl+0x158/0x460 net/socket.c:1227
sock_ioctl+0x626/0x8e0 net/socket.c:1346
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff888026bff100
which belongs to the cache kmalloc-96 of size 96
The buggy address is located 40 bytes inside of
freed 96-byte region [ffff888026bff100, ffff888026bff160)
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x26bff
ksm flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000000 ffff88801ac41280 ffffea0001ea6140 dead000000000003
raw: 0000000000000000 0000000080200020 00000001f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 1, tgid 1 (swapper/0), ts 8941535213, free_ts 7525892719
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556
prep_new_page mm/page_alloc.c:1564 [inline]
get_page_from_freelist+0x3649/0x3790 mm/page_alloc.c:3474
__alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4750
alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265
alloc_slab_page+0x6a/0x140 mm/slub.c:2412
allocate_slab+0x5a/0x2f0 mm/slub.c:2578
new_slab mm/slub.c:2631 [inline]
___slab_alloc+0xcd1/0x14b0 mm/slub.c:3818
__slab_alloc+0x58/0xa0 mm/slub.c:3908
__slab_alloc_node mm/slub.c:3961 [inline]
slab_alloc_node mm/slub.c:4122 [inline]
__kmalloc_cache_noprof+0x1d5/0x2c0 mm/slub.c:4290
kmalloc_noprof include/linux/slab.h:878 [inline]
kzalloc_noprof include/linux/slab.h:1014 [inline]
usb_hub_create_port_device+0xc8/0xc10 drivers/usb/core/port.c:743
hub_configure drivers/usb/core/hub.c:1710 [inline]
hub_probe+0x2503/0x3640 drivers/usb/core/hub.c:1965
usb_probe_interface+0x645/0xbb0 drivers/usb/core/driver.c:399
really_probe+0x2b8/0xad0 drivers/base/dd.c:658
__driver_probe_device+0x1a2/0x390 drivers/base/dd.c:800
driver_probe_device+0x50/0x430 drivers/base/dd.c:830
__device_attach_driver+0x2d6/0x530 drivers/base/dd.c:958
page last free pid 8 tgid 8 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1127 [inline]
free_unref_page+0xdf9/0x1140 mm/page_alloc.c:2657
vfree+0x186/0x2e0 mm/vmalloc.c:3361
delayed_vfree_work+0x56/0x80 mm/vmalloc.c:3282
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Memory state around the buggy address:
ffff888026bff000: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
ffff888026bff080: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
>ffff888026bff100: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
^
ffff888026bff180: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
ffff888026bff200: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
==================================================================
Tested on:
commit: d7ef9eee Merge branch 'am65-cpsw-rx-dscp-prio-map'
git tree: net-next
console output: https://syzkaller.appspot.com/x/log.txt?x=102db378580000
kernel config: https://syzkaller.appspot.com/x/.config?x=d9e1e43bf6b46a4d
dashboard link: https://syzkaller.appspot.com/bug?extid=03d6270b6425df1605bf
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=15ce72e8580000
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [PATCH v3] Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync
@ 2024-11-18 16:04 Luiz Augusto von Dentz
2024-11-18 16:31 ` [syzbot] [bluetooth?] KASAN: " syzbot
0 siblings, 1 reply; 22+ messages in thread
From: Luiz Augusto von Dentz @ 2024-11-18 16:04 UTC (permalink / raw)
To: linux-bluetooth; +Cc: syzbot
#syz test
On Mon, Nov 18, 2024 at 10:36 AM Luiz Augusto von Dentz
<luiz.dentz@gmail.com> wrote:
>
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
>
> This fixes the following crash:
>
> ==================================================================
> BUG: KASAN: slab-use-after-free in set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1353
> Read of size 8 at addr ffff888029b4dd18 by task kworker/u9:0/54
>
> CPU: 1 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.11.0-rc6-syzkaller-01155-gf723224742fc #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
> Workqueue: hci0 hci_cmd_sync_work
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:93 [inline]
> dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119
> print_address_description mm/kasan/report.c:377 [inline]
> print_report+0x169/0x550 mm/kasan/report.c:488
> q kasan_report+0x143/0x180 mm/kasan/report.c:601
> set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1353
> hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:328
> process_one_work kernel/workqueue.c:3231 [inline]
> process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
> worker_thread+0x86d/0xd10 kernel/workqueue.c:3389
> kthread+0x2f0/0x390 kernel/kthread.c:389
> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> </TASK>
>
> Allocated by task 5247:
> kasan_save_stack mm/kasan/common.c:47 [inline]
> kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
> poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
> __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387
> kasan_kmalloc include/linux/kasan.h:211 [inline]
> __kmalloc_cache_noprof+0x19c/0x2c0 mm/slub.c:4193
> kmalloc_noprof include/linux/slab.h:681 [inline]
> kzalloc_noprof include/linux/slab.h:807 [inline]
> mgmt_pending_new+0x65/0x250 net/bluetooth/mgmt_util.c:269
> mgmt_pending_add+0x36/0x120 net/bluetooth/mgmt_util.c:296
> set_powered+0x3cd/0x5e0 net/bluetooth/mgmt.c:1394
> hci_mgmt_cmd+0xc47/0x11d0 net/bluetooth/hci_sock.c:1712
> hci_sock_sendmsg+0x7b8/0x11c0 net/bluetooth/hci_sock.c:1832
> sock_sendmsg_nosec net/socket.c:730 [inline]
> __sock_sendmsg+0x221/0x270 net/socket.c:745
> sock_write_iter+0x2dd/0x400 net/socket.c:1160
> new_sync_write fs/read_write.c:497 [inline]
> vfs_write+0xa72/0xc90 fs/read_write.c:590
> ksys_write+0x1a0/0x2c0 fs/read_write.c:643
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> Freed by task 5246:
> kasan_save_stack mm/kasan/common.c:47 [inline]
> kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
> kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
> poison_slab_object+0xe0/0x150 mm/kasan/common.c:240
> __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256
> kasan_slab_free include/linux/kasan.h:184 [inline]
> slab_free_hook mm/slub.c:2256 [inline]
> slab_free mm/slub.c:4477 [inline]
> kfree+0x149/0x360 mm/slub.c:4598
> settings_rsp+0x2bc/0x390 net/bluetooth/mgmt.c:1443
> mgmt_pending_foreach+0xd1/0x130 net/bluetooth/mgmt_util.c:259
> __mgmt_power_off+0x112/0x420 net/bluetooth/mgmt.c:9455
> hci_dev_close_sync+0x665/0x11a0 net/bluetooth/hci_sync.c:5191
> hci_dev_do_close net/bluetooth/hci_core.c:483 [inline]
> hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508
> sock_do_ioctl+0x158/0x460 net/socket.c:1222
> sock_ioctl+0x629/0x8e0 net/socket.c:1341
> vfs_ioctl fs/ioctl.c:51 [inline]
> __do_sys_ioctl fs/ioctl.c:907 [inline]
> __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83gv
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> Reported-by: syzbot+03d6270b6425df1605bf@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=03d6270b6425df1605bf
> Fixes: 275f3f648702 ("Bluetooth: Fix not checking MGMT cmd pending queue")
> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> ---
> net/bluetooth/mgmt.c | 13 ++++++++++++-
> 1 file changed, 12 insertions(+), 1 deletion(-)
>
> diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
> index 1f6d083682b8..3ec79c69b0ee 100644
> --- a/net/bluetooth/mgmt.c
> +++ b/net/bluetooth/mgmt.c
> @@ -1351,7 +1351,13 @@ static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err)
> static int set_powered_sync(struct hci_dev *hdev, void *data)
> {
> struct mgmt_pending_cmd *cmd = data;
> - struct mgmt_mode *cp = cmd->param;
> + struct mgmt_mode *cp;
> +
> + /* Make sure cmd still outstanding. */
> + if (cmd != pending_find(MGMT_OP_SET_POWERED, hdev))
> + return -ECANCELED;
> +
> + cp = cmd->param;
>
> BT_DBG("%s", hdev->name);
>
> @@ -1432,6 +1438,11 @@ static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
> {
> struct cmd_lookup *match = data;
>
> + /* dequeue cmd_sync entries using cmd as data as that is about to be
> + * removed/freed.
> + */
> + hci_cmd_sync_dequeue(match->hdev, NULL, cmd, NULL);
> +
> send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
>
> list_del(&cmd->list);
> --
> 2.47.0
>
--
Luiz Augusto von Dentz
^ permalink raw reply [flat|nested] 22+ messages in thread* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in set_powered_sync
2024-11-18 16:04 [PATCH v3] Bluetooth: MGMT: Fix " Luiz Augusto von Dentz
@ 2024-11-18 16:31 ` syzbot
0 siblings, 0 replies; 22+ messages in thread
From: syzbot @ 2024-11-18 16:31 UTC (permalink / raw)
To: linux-bluetooth, linux-kernel, luiz.dentz, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in set_powered_sync
==================================================================
BUG: KASAN: slab-use-after-free in set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1354
Read of size 8 at addr ffff888022f18818 by task kworker/u9:0/54
CPU: 1 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.12.0-rc7-syzkaller-01702-gd7ef9eeef072 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024
Workqueue: hci0 hci_cmd_sync_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1354
hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Allocated by task 5993:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:257 [inline]
__kmalloc_cache_noprof+0x19c/0x2c0 mm/slub.c:4295
kmalloc_noprof include/linux/slab.h:878 [inline]
kzalloc_noprof include/linux/slab.h:1014 [inline]
mgmt_pending_new+0x65/0x250 net/bluetooth/mgmt_util.c:269
mgmt_pending_add+0x36/0x120 net/bluetooth/mgmt_util.c:296
set_powered+0x3cd/0x5e0 net/bluetooth/mgmt.c:1395
hci_mgmt_cmd+0xc47/0x11d0 net/bluetooth/hci_sock.c:1712
hci_sock_sendmsg+0x7b8/0x11c0 net/bluetooth/hci_sock.c:1832
sock_sendmsg_nosec net/socket.c:729 [inline]
__sock_sendmsg+0x221/0x270 net/socket.c:744
sock_write_iter+0x2d7/0x3f0 net/socket.c:1165
new_sync_write fs/read_write.c:590 [inline]
vfs_write+0xaeb/0xd30 fs/read_write.c:683
ksys_write+0x183/0x2b0 fs/read_write.c:736
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 5989:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:230 [inline]
slab_free_hook mm/slub.c:2342 [inline]
slab_free mm/slub.c:4579 [inline]
kfree+0x1a0/0x440 mm/slub.c:4727
settings_rsp+0x2bc/0x390 net/bluetooth/mgmt.c:1444
mgmt_pending_foreach+0xd1/0x130 net/bluetooth/mgmt_util.c:259
__mgmt_power_off+0x106/0x430 net/bluetooth/mgmt.c:9520
hci_dev_close_sync+0x6c4/0x11c0 net/bluetooth/hci_sync.c:5208
hci_dev_do_close net/bluetooth/hci_core.c:483 [inline]
hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508
sock_do_ioctl+0x158/0x460 net/socket.c:1227
sock_ioctl+0x626/0x8e0 net/socket.c:1346
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff888022f18800
which belongs to the cache kmalloc-96 of size 96
The buggy address is located 24 bytes inside of
freed 96-byte region [ffff888022f18800, ffff888022f18860)
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x22f18
ksm flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000000 ffff88801ac41280 ffffea00009d9840 dead000000000003
raw: 0000000000000000 0000000080200020 00000001f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 58, tgid 58 (kworker/1:2), ts 69902458132, free_ts 69192164737
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556
prep_new_page mm/page_alloc.c:1564 [inline]
get_page_from_freelist+0x3649/0x3790 mm/page_alloc.c:3474
__alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4750
alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265
alloc_slab_page+0x6a/0x140 mm/slub.c:2412
allocate_slab+0x5a/0x2f0 mm/slub.c:2578
new_slab mm/slub.c:2631 [inline]
___slab_alloc+0xcd1/0x14b0 mm/slub.c:3818
__slab_alloc+0x58/0xa0 mm/slub.c:3908
__slab_alloc_node mm/slub.c:3961 [inline]
slab_alloc_node mm/slub.c:4122 [inline]
__kmalloc_cache_noprof+0x1d5/0x2c0 mm/slub.c:4290
kmalloc_noprof include/linux/slab.h:878 [inline]
dst_cow_metrics_generic+0x56/0x1c0 net/core/dst.c:185
dst_metrics_write_ptr include/net/dst.h:133 [inline]
dst_metric_set include/net/dst.h:194 [inline]
icmp6_dst_alloc+0x270/0x420 net/ipv6/route.c:3288
mld_sendpack+0x6a3/0xdb0 net/ipv6/mcast.c:1808
mld_dad_work+0x44/0x500 net/ipv6/mcast.c:2260
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
page last free pid 25 tgid 25 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1127 [inline]
free_unref_page+0xdf9/0x1140 mm/page_alloc.c:2657
discard_slab mm/slub.c:2677 [inline]
__put_partials+0xeb/0x130 mm/slub.c:3145
put_cpu_partial+0x17c/0x250 mm/slub.c:3220
__slab_free+0x2ea/0x3d0 mm/slub.c:4449
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x9a/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x23/0x80 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4085 [inline]
slab_alloc_node mm/slub.c:4134 [inline]
kmem_cache_alloc_node_noprof+0x16b/0x320 mm/slub.c:4186
__alloc_skb+0x1c3/0x440 net/core/skbuff.c:668
alloc_skb include/linux/skbuff.h:1323 [inline]
alloc_skb_with_frags+0xc3/0x820 net/core/skbuff.c:6612
sock_alloc_send_pskb+0x91a/0xa60 net/core/sock.c:2881
sock_alloc_send_skb include/net/sock.h:1797 [inline]
mld_newpack+0x1c3/0xaf0 net/ipv6/mcast.c:1747
add_grhead net/ipv6/mcast.c:1850 [inline]
add_grec+0x1492/0x19a0 net/ipv6/mcast.c:1988
mld_send_initial_cr+0x228/0x4b0 net/ipv6/mcast.c:2234
mld_dad_work+0x44/0x500 net/ipv6/mcast.c:2260
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310
Memory state around the buggy address:
ffff888022f18700: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc
ffff888022f18780: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
>ffff888022f18800: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
^
ffff888022f18880: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
ffff888022f18900: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
==================================================================
Tested on:
commit: d7ef9eee Merge branch 'am65-cpsw-rx-dscp-prio-map'
git tree: net-next
console output: https://syzkaller.appspot.com/x/log.txt?x=117bbb5f980000
kernel config: https://syzkaller.appspot.com/x/.config?x=d9e1e43bf6b46a4d
dashboard link: https://syzkaller.appspot.com/bug?extid=03d6270b6425df1605bf
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
Note: no patches were applied.
^ permalink raw reply [flat|nested] 22+ messages in thread
* [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in set_powered_sync
@ 2024-07-15 9:36 syzbot
2024-09-08 9:07 ` syzbot
` (2 more replies)
0 siblings, 3 replies; 22+ messages in thread
From: syzbot @ 2024-07-15 9:36 UTC (permalink / raw)
To: johan.hedberg, linux-bluetooth, linux-kernel, luiz.dentz, marcel,
syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 0c3836482481 Linux 6.10
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16e50766980000
kernel config: https://syzkaller.appspot.com/x/.config?x=a18058d86df5936b
dashboard link: https://syzkaller.appspot.com/bug?extid=03d6270b6425df1605bf
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: i386
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7bc7510fe41f/non_bootable_disk-0c383648.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/871d2f2915c4/vmlinux-0c383648.xz
kernel image: https://storage.googleapis.com/syzbot-assets/5582453293c4/bzImage-0c383648.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+03d6270b6425df1605bf@syzkaller.appspotmail.com
Bluetooth: hci0: Opcode 0x206a failed: -110
==================================================================
BUG: KASAN: slab-use-after-free in set_powered_sync+0xc1/0xd0 net/bluetooth/mgmt.c:1354
Read of size 8 at addr ffff88804642e318 by task kworker/u33:2/5212
CPU: 3 PID: 5212 Comm: kworker/u33:2 Not tainted 6.10.0-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: hci0 hci_cmd_sync_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114
print_address_description mm/kasan/report.c:377 [inline]
print_report+0xc3/0x620 mm/kasan/report.c:488
kasan_report+0xd9/0x110 mm/kasan/report.c:601
set_powered_sync+0xc1/0xd0 net/bluetooth/mgmt.c:1354
hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:323
process_one_work+0x958/0x1ad0 kernel/workqueue.c:3248
process_scheduled_works kernel/workqueue.c:3329 [inline]
worker_thread+0x6c8/0xf30 kernel/workqueue.c:3409
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Allocated by task 673:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:387
kmalloc_noprof include/linux/slab.h:660 [inline]
kzalloc_noprof include/linux/slab.h:778 [inline]
mgmt_pending_new+0x5b/0x290 net/bluetooth/mgmt_util.c:269
mgmt_pending_add+0x36/0x160 net/bluetooth/mgmt_util.c:296
set_powered+0x28c/0x5c0 net/bluetooth/mgmt.c:1395
hci_mgmt_cmd net/bluetooth/hci_sock.c:1712 [inline]
hci_sock_sendmsg+0x1526/0x25e0 net/bluetooth/hci_sock.c:1832
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
sock_write_iter+0x50a/0x5c0 net/socket.c:1160
new_sync_write fs/read_write.c:497 [inline]
vfs_write+0x6b6/0x1140 fs/read_write.c:590
ksys_write+0x1f8/0x260 fs/read_write.c:643
do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
__do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386
do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
Freed by task 674:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
poison_slab_object+0xf7/0x160 mm/kasan/common.c:240
__kasan_slab_free+0x32/0x50 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2196 [inline]
slab_free mm/slub.c:4438 [inline]
kfree+0x12a/0x3b0 mm/slub.c:4559
cmd_status_rsp net/bluetooth/mgmt.c:1452 [inline]
cmd_complete_rsp+0x119/0x160 net/bluetooth/mgmt.c:1466
mgmt_pending_foreach+0xdf/0x140 net/bluetooth/mgmt_util.c:259
mgmt_index_removed+0x11f/0x2e0 net/bluetooth/mgmt.c:9346
hci_sock_bind+0xc6d/0x1810 net/bluetooth/hci_sock.c:1307
__sys_bind+0x1f3/0x220 net/socket.c:1847
__do_sys_bind net/socket.c:1858 [inline]
__se_sys_bind net/socket.c:1856 [inline]
__ia32_sys_bind+0x71/0xb0 net/socket.c:1856
do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
__do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386
do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
The buggy address belongs to the object at ffff88804642e300
which belongs to the cache kmalloc-96 of size 96
The buggy address is located 24 bytes inside of
freed 96-byte region [ffff88804642e300, ffff88804642e360)
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88804642e280 pfn:0x4642e
flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
page_type: 0xffffefff(slab)
raw: 04fff00000000000 ffff888015442280 ffffea000073c300 dead000000000002
raw: ffff88804642e280 0000000080200017 00000001ffffefff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5205, tgid 5205 (syz-executor), ts 60618600133, free_ts 58387633005
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1473
prep_new_page mm/page_alloc.c:1481 [inline]
get_page_from_freelist+0x1353/0x2e50 mm/page_alloc.c:3425
__alloc_pages_noprof+0x22b/0x2460 mm/page_alloc.c:4683
__alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
alloc_slab_page+0x56/0x110 mm/slub.c:2265
allocate_slab mm/slub.c:2428 [inline]
new_slab+0x84/0x260 mm/slub.c:2481
___slab_alloc+0xdac/0x1870 mm/slub.c:3667
__slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3757
__slab_alloc_node mm/slub.c:3810 [inline]
slab_alloc_node mm/slub.c:3990 [inline]
__do_kmalloc_node mm/slub.c:4122 [inline]
__kmalloc_noprof+0x37f/0x420 mm/slub.c:4136
kmalloc_noprof include/linux/slab.h:664 [inline]
kzalloc_noprof include/linux/slab.h:778 [inline]
tnode_alloc net/ipv4/fib_trie.c:333 [inline]
tnode_new+0x25a/0x340 net/ipv4/fib_trie.c:386
inflate net/ipv4/fib_trie.c:546 [inline]
resize+0xa2b/0x2250 net/ipv4/fib_trie.c:870
trie_rebalance net/ipv4/fib_trie.c:1107 [inline]
fib_insert_node net/ipv4/fib_trie.c:1151 [inline]
fib_insert_alias+0x9c0/0xe30 net/ipv4/fib_trie.c:1165
fib_table_insert+0xaab/0x1d70 net/ipv4/fib_trie.c:1379
fib_magic+0x4d6/0x5c0 net/ipv4/fib_frontend.c:1104
fib_add_ifaddr+0x174/0x560 net/ipv4/fib_frontend.c:1126
fib_inetaddr_event+0x174/0x2c0 net/ipv4/fib_frontend.c:1440
notifier_call_chain+0xb9/0x410 kernel/notifier.c:93
page last free pid 5207 tgid 5207 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1093 [inline]
free_unref_page+0x64a/0xe40 mm/page_alloc.c:2588
__put_partials+0x14c/0x170 mm/slub.c:2995
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:322
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3940 [inline]
slab_alloc_node mm/slub.c:4002 [inline]
kmalloc_trace_noprof+0x11e/0x310 mm/slub.c:4149
kmalloc_noprof include/linux/slab.h:660 [inline]
kzalloc_noprof include/linux/slab.h:778 [inline]
ref_tracker_alloc+0x17c/0x5b0 lib/ref_tracker.c:203
__netdev_tracker_alloc include/linux/netdevice.h:4038 [inline]
netdev_hold include/linux/netdevice.h:4067 [inline]
netdev_hold include/linux/netdevice.h:4062 [inline]
netdev_queue_add_kobject net/core/net-sysfs.c:1783 [inline]
netdev_queue_update_kobjects+0x281/0x640 net/core/net-sysfs.c:1838
register_queue_kobjects net/core/net-sysfs.c:1900 [inline]
netdev_register_kobject+0x290/0x3f0 net/core/net-sysfs.c:2140
register_netdevice+0x12ce/0x1c40 net/core/dev.c:10375
veth_newlink+0x4f6/0xa10 drivers/net/veth.c:1860
rtnl_newlink_create net/core/rtnetlink.c:3510 [inline]
__rtnl_newlink+0x119c/0x1960 net/core/rtnetlink.c:3730
rtnl_newlink+0x67/0xa0 net/core/rtnetlink.c:3743
rtnetlink_rcv_msg+0x3c7/0xea0 net/core/rtnetlink.c:6635
netlink_rcv_skb+0x165/0x410 net/netlink/af_netlink.c:2564
netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
netlink_unicast+0x542/0x820 net/netlink/af_netlink.c:1361
Memory state around the buggy address:
ffff88804642e200: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc
ffff88804642e280: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
>ffff88804642e300: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
^
ffff88804642e380: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc
ffff88804642e400: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 22+ messages in thread* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in set_powered_sync
2024-07-15 9:36 syzbot
@ 2024-09-08 9:07 ` syzbot
2024-09-08 16:43 ` syzbot
2024-10-03 14:28 ` Qianqiang Liu
2 siblings, 0 replies; 22+ messages in thread
From: syzbot @ 2024-09-08 9:07 UTC (permalink / raw)
To: johan.hedberg, linux-bluetooth, linux-kernel, luiz.dentz, marcel,
netdev, syzkaller-bugs
syzbot has found a reproducer for the following issue on:
HEAD commit: f723224742fc Merge tag 'nf-next-24-09-06' of git://git.ker..
git tree: net-next
console+strace: https://syzkaller.appspot.com/x/log.txt?x=16678877980000
kernel config: https://syzkaller.appspot.com/x/.config?x=37742f4fda0d1b09
dashboard link: https://syzkaller.appspot.com/bug?extid=03d6270b6425df1605bf
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=110c589f980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=139b0e00580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e61c7f434312/disk-f7232247.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/70b00f168d68/vmlinux-f7232247.xz
kernel image: https://storage.googleapis.com/syzbot-assets/4186da6223fd/bzImage-f7232247.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+03d6270b6425df1605bf@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: slab-use-after-free in set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1353
Read of size 8 at addr ffff888029b4dd18 by task kworker/u9:0/54
CPU: 1 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.11.0-rc6-syzkaller-01155-gf723224742fc #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: hci0 hci_cmd_sync_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1353
hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:328
process_one_work kernel/workqueue.c:3231 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
worker_thread+0x86d/0xd10 kernel/workqueue.c:3389
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Allocated by task 5247:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
__kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387
kasan_kmalloc include/linux/kasan.h:211 [inline]
__kmalloc_cache_noprof+0x19c/0x2c0 mm/slub.c:4193
kmalloc_noprof include/linux/slab.h:681 [inline]
kzalloc_noprof include/linux/slab.h:807 [inline]
mgmt_pending_new+0x65/0x250 net/bluetooth/mgmt_util.c:269
mgmt_pending_add+0x36/0x120 net/bluetooth/mgmt_util.c:296
set_powered+0x3cd/0x5e0 net/bluetooth/mgmt.c:1394
hci_mgmt_cmd+0xc47/0x11d0 net/bluetooth/hci_sock.c:1712
hci_sock_sendmsg+0x7b8/0x11c0 net/bluetooth/hci_sock.c:1832
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0x221/0x270 net/socket.c:745
sock_write_iter+0x2dd/0x400 net/socket.c:1160
new_sync_write fs/read_write.c:497 [inline]
vfs_write+0xa72/0xc90 fs/read_write.c:590
ksys_write+0x1a0/0x2c0 fs/read_write.c:643
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 5246:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
poison_slab_object+0xe0/0x150 mm/kasan/common.c:240
__kasan_slab_free+0x37/0x60 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2256 [inline]
slab_free mm/slub.c:4477 [inline]
kfree+0x149/0x360 mm/slub.c:4598
settings_rsp+0x2bc/0x390 net/bluetooth/mgmt.c:1443
mgmt_pending_foreach+0xd1/0x130 net/bluetooth/mgmt_util.c:259
__mgmt_power_off+0x112/0x420 net/bluetooth/mgmt.c:9455
hci_dev_close_sync+0x665/0x11a0 net/bluetooth/hci_sync.c:5191
hci_dev_do_close net/bluetooth/hci_core.c:483 [inline]
hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508
sock_do_ioctl+0x158/0x460 net/socket.c:1222
sock_ioctl+0x629/0x8e0 net/socket.c:1341
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff888029b4dd00
which belongs to the cache kmalloc-96 of size 96
The buggy address is located 24 bytes inside of
freed 96-byte region [ffff888029b4dd00, ffff888029b4dd60)
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x29b4d
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xfdffffff(slab)
raw: 00fff00000000000 ffff88801ac41280 dead000000000100 dead000000000122
raw: 0000000000000000 0000000080200020 00000001fdffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 1, tgid 1 (swapper/0), ts 9062203522, free_ts 0
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1500
prep_new_page mm/page_alloc.c:1508 [inline]
get_page_from_freelist+0x2e4c/0x2f10 mm/page_alloc.c:3446
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4702
__alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
alloc_slab_page+0x5f/0x120 mm/slub.c:2325
allocate_slab+0x5a/0x2f0 mm/slub.c:2488
new_slab mm/slub.c:2541 [inline]
___slab_alloc+0xcd1/0x14b0 mm/slub.c:3727
__slab_alloc+0x58/0xa0 mm/slub.c:3817
__slab_alloc_node mm/slub.c:3870 [inline]
slab_alloc_node mm/slub.c:4029 [inline]
__kmalloc_cache_noprof+0x1d5/0x2c0 mm/slub.c:4188
kmalloc_noprof include/linux/slab.h:681 [inline]
kzalloc_noprof include/linux/slab.h:807 [inline]
usb_hub_create_port_device+0xc8/0xc10 drivers/usb/core/port.c:743
hub_configure drivers/usb/core/hub.c:1710 [inline]
hub_probe+0x2503/0x3640 drivers/usb/core/hub.c:1965
usb_probe_interface+0x645/0xbb0 drivers/usb/core/driver.c:399
really_probe+0x2b8/0xad0 drivers/base/dd.c:657
__driver_probe_device+0x1a2/0x390 drivers/base/dd.c:799
driver_probe_device+0x50/0x430 drivers/base/dd.c:829
__device_attach_driver+0x2d6/0x530 drivers/base/dd.c:957
bus_for_each_drv+0x24e/0x2e0 drivers/base/bus.c:457
page_owner free stack trace missing
Memory state around the buggy address:
ffff888029b4dc00: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc
ffff888029b4dc80: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
>ffff888029b4dd00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
^
ffff888029b4dd80: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
ffff888029b4de00: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
==================================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 22+ messages in thread* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in set_powered_sync
2024-07-15 9:36 syzbot
2024-09-08 9:07 ` syzbot
@ 2024-09-08 16:43 ` syzbot
2024-10-03 14:28 ` Qianqiang Liu
2 siblings, 0 replies; 22+ messages in thread
From: syzbot @ 2024-09-08 16:43 UTC (permalink / raw)
To: brian.gix, davem, johan.hedberg, kuba, linux-bluetooth,
linux-kernel, luiz.dentz, luiz.von.dentz, marcel, mlevitsk,
netdev, syzkaller-bugs
syzbot has bisected this issue to:
commit 275f3f64870245b06188f24bdf917e55a813d294
Author: Brian Gix <brian.gix@intel.com>
Date: Tue Mar 1 22:34:57 2022 +0000
Bluetooth: Fix not checking MGMT cmd pending queue
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=138c743b980000
start commit: f723224742fc Merge tag 'nf-next-24-09-06' of git://git.ker..
git tree: net-next
final oops: https://syzkaller.appspot.com/x/report.txt?x=104c743b980000
console output: https://syzkaller.appspot.com/x/log.txt?x=178c743b980000
kernel config: https://syzkaller.appspot.com/x/.config?x=37742f4fda0d1b09
dashboard link: https://syzkaller.appspot.com/bug?extid=03d6270b6425df1605bf
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=110c589f980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=139b0e00580000
Reported-by: syzbot+03d6270b6425df1605bf@syzkaller.appspotmail.com
Fixes: 275f3f648702 ("Bluetooth: Fix not checking MGMT cmd pending queue")
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
^ permalink raw reply [flat|nested] 22+ messages in thread* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in set_powered_sync
2024-07-15 9:36 syzbot
2024-09-08 9:07 ` syzbot
2024-09-08 16:43 ` syzbot
@ 2024-10-03 14:28 ` Qianqiang Liu
2024-10-03 14:45 ` syzbot
2 siblings, 1 reply; 22+ messages in thread
From: Qianqiang Liu @ 2024-10-03 14:28 UTC (permalink / raw)
To: syzbot
Cc: johan.hedberg, linux-bluetooth, linux-kernel, luiz.dentz, marcel,
syzkaller-bugs
#syz test
diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index 5533e6f561b3..259b18eb0b20 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -5187,8 +5187,11 @@ int hci_dev_close_sync(struct hci_dev *hdev)
auto_off = hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF);
if (!auto_off && !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
- hci_dev_test_flag(hdev, HCI_MGMT))
+ hci_dev_test_flag(hdev, HCI_MGMT)) {
+ hci_req_sync_lock(hdev);
__mgmt_power_off(hdev);
+ hci_req_sync_unlock(hdev);
+ }
hci_inquiry_cache_flush(hdev);
hci_pend_le_actions_clear(hdev);
--
Best,
Qianqiang Liu
^ permalink raw reply related [flat|nested] 22+ messages in thread* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in set_powered_sync
2024-10-03 14:28 ` Qianqiang Liu
@ 2024-10-03 14:45 ` syzbot
2024-10-03 15:41 ` Qianqiang Liu
0 siblings, 1 reply; 22+ messages in thread
From: syzbot @ 2024-10-03 14:45 UTC (permalink / raw)
To: johan.hedberg, linux-bluetooth, linux-kernel, luiz.dentz, marcel,
qianqiang.liu, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
possible deadlock in hci_dev_close_sync
============================================
WARNING: possible recursive locking detected
6.11.0-syzkaller-11519-gc30a3f54e661-dirty #0 Not tainted
--------------------------------------------
syz.0.15/6089 is trying to acquire lock:
ffff88802cd3cd80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x66e/0x11b0 net/bluetooth/hci_sync.c:5191
but task is already holding lock:
ffff88802cd3cd80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:481 [inline]
ffff88802cd3cd80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_close+0x10a/0x210 net/bluetooth/hci_core.c:508
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&hdev->req_lock);
lock(&hdev->req_lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
2 locks held by syz.0.15/6089:
#0: ffff88802cd3cd80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:481 [inline]
#0: ffff88802cd3cd80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_close+0x10a/0x210 net/bluetooth/hci_core.c:508
#1: ffff88802cd3c078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x572/0x11b0 net/bluetooth/hci_sync.c:5183
stack backtrace:
CPU: 1 UID: 0 PID: 6089 Comm: syz.0.15 Not tainted 6.11.0-syzkaller-11519-gc30a3f54e661-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_deadlock_bug+0x483/0x620 kernel/locking/lockdep.c:3034
check_deadlock kernel/locking/lockdep.c:3086 [inline]
validate_chain+0x15e2/0x5920 kernel/locking/lockdep.c:3888
__lock_acquire+0x1384/0x2050 kernel/locking/lockdep.c:5199
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5822
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x136/0xd70 kernel/locking/mutex.c:752
hci_dev_close_sync+0x66e/0x11b0 net/bluetooth/hci_sync.c:5191
hci_dev_do_close net/bluetooth/hci_core.c:483 [inline]
hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508
sock_do_ioctl+0x158/0x460 net/socket.c:1228
sock_ioctl+0x626/0x8e0 net/socket.c:1347
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe0fa37cef9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fe0fb0e2038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fe0fa536058 RCX: 00007fe0fa37cef9
RDX: 0000000000000000 RSI: 00000000400448ca RDI: 0000000000000008
RBP: 00007fe0fa3ef046 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fe0fa536058 R15: 00007fff1e0b61e8
</TASK>
Tested on:
commit: c30a3f54 net: mana: Add get_link and get_link_ksetting..
git tree: net-next
console output: https://syzkaller.appspot.com/x/log.txt?x=13ea7580580000
kernel config: https://syzkaller.appspot.com/x/.config?x=b2d4fdf18a83ec0b
dashboard link: https://syzkaller.appspot.com/bug?extid=03d6270b6425df1605bf
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=16806307980000
^ permalink raw reply [flat|nested] 22+ messages in thread* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in set_powered_sync
2024-10-03 14:45 ` syzbot
@ 2024-10-03 15:41 ` Qianqiang Liu
2024-10-03 16:22 ` syzbot
0 siblings, 1 reply; 22+ messages in thread
From: Qianqiang Liu @ 2024-10-03 15:41 UTC (permalink / raw)
To: syzbot
Cc: johan.hedberg, linux-bluetooth, linux-kernel, luiz.dentz, marcel,
syzkaller-bugs
#syz test
diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index 5533e6f561b3..353fa423c36c 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -321,7 +321,7 @@ static void hci_cmd_sync_work(struct work_struct *work)
bt_dev_dbg(hdev, "entry %p", entry);
- if (entry->func) {
+ if (entry->func && entry->data) {
int err;
hci_req_sync_lock(hdev);
diff --git a/net/bluetooth/mgmt_util.c b/net/bluetooth/mgmt_util.c
index 0115f783bde8..eccc51bfaf2e 100644
--- a/net/bluetooth/mgmt_util.c
+++ b/net/bluetooth/mgmt_util.c
@@ -307,6 +307,7 @@ void mgmt_pending_free(struct mgmt_pending_cmd *cmd)
sock_put(cmd->sk);
kfree(cmd->param);
kfree(cmd);
+ cmd = NULL;
}
void mgmt_pending_remove(struct mgmt_pending_cmd *cmd)
--
Best,
Qianqiang Liu
^ permalink raw reply related [flat|nested] 22+ messages in thread* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in set_powered_sync
2024-10-03 15:41 ` Qianqiang Liu
@ 2024-10-03 16:22 ` syzbot
2024-10-03 16:45 ` Qianqiang Liu
0 siblings, 1 reply; 22+ messages in thread
From: syzbot @ 2024-10-03 16:22 UTC (permalink / raw)
To: johan.hedberg, linux-bluetooth, linux-kernel, luiz.dentz, marcel,
qianqiang.liu, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in set_powered_sync
==================================================================
BUG: KASAN: slab-use-after-free in set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1353
Read of size 8 at addr ffff888025cf9198 by task kworker/u9:0/55
CPU: 0 UID: 0 PID: 55 Comm: kworker/u9:0 Not tainted 6.11.0-syzkaller-11519-gc30a3f54e661-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: hci0 hci_cmd_sync_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1353
hci_cmd_sync_work+0x21b/0x3c0 net/bluetooth/hci_sync.c:328
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Allocated by task 6099:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:257 [inline]
__kmalloc_cache_noprof+0x19c/0x2c0 mm/slub.c:4296
kmalloc_noprof include/linux/slab.h:878 [inline]
kzalloc_noprof include/linux/slab.h:1014 [inline]
mgmt_pending_new+0x65/0x250 net/bluetooth/mgmt_util.c:269
mgmt_pending_add+0x36/0x120 net/bluetooth/mgmt_util.c:296
set_powered+0x3cd/0x5e0 net/bluetooth/mgmt.c:1394
hci_mgmt_cmd+0xc47/0x11d0 net/bluetooth/hci_sock.c:1712
hci_sock_sendmsg+0x7b8/0x11c0 net/bluetooth/hci_sock.c:1832
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0x221/0x270 net/socket.c:745
sock_write_iter+0x2d7/0x3f0 net/socket.c:1166
new_sync_write fs/read_write.c:590 [inline]
vfs_write+0xa6d/0xc90 fs/read_write.c:683
ksys_write+0x183/0x2b0 fs/read_write.c:736
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 6096:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:230 [inline]
slab_free_hook mm/slub.c:2343 [inline]
slab_free mm/slub.c:4580 [inline]
kfree+0x1a0/0x440 mm/slub.c:4728
settings_rsp+0x2bc/0x390 net/bluetooth/mgmt.c:1443
mgmt_pending_foreach+0xd1/0x130 net/bluetooth/mgmt_util.c:259
__mgmt_power_off+0x112/0x420 net/bluetooth/mgmt.c:9455
hci_dev_close_sync+0x665/0x11a0 net/bluetooth/hci_sync.c:5191
hci_dev_do_close net/bluetooth/hci_core.c:483 [inline]
hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508
sock_do_ioctl+0x158/0x460 net/socket.c:1228
sock_ioctl+0x626/0x8e0 net/socket.c:1347
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff888025cf9180
which belongs to the cache kmalloc-96 of size 96
The buggy address is located 24 bytes inside of
freed 96-byte region [ffff888025cf9180, ffff888025cf91e0)
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x25cf9
ksm flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000000 ffff88801ac41280 ffffea0000a092c0 dead000000000003
raw: 0000000000000000 0000000000200020 00000001f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 53, tgid 53 (kworker/u8:3), ts 7343210726, free_ts 7330995796
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x3045/0x3190 mm/page_alloc.c:3457
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4733
alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265
alloc_slab_page+0x6a/0x120 mm/slub.c:2413
allocate_slab+0x5a/0x2f0 mm/slub.c:2579
new_slab mm/slub.c:2632 [inline]
___slab_alloc+0xcd1/0x14b0 mm/slub.c:3819
__slab_alloc+0x58/0xa0 mm/slub.c:3909
__slab_alloc_node mm/slub.c:3962 [inline]
slab_alloc_node mm/slub.c:4123 [inline]
__kmalloc_cache_noprof+0x1d5/0x2c0 mm/slub.c:4291
kmalloc_noprof include/linux/slab.h:878 [inline]
blk_alloc_queue_stats+0x4c/0x100 block/blk-stat.c:210
blk_alloc_queue+0xc1/0x580 block/blk-core.c:403
blk_mq_alloc_queue+0x19e/0x2f0 block/blk-mq.c:4154
scsi_alloc_sdev+0x772/0xb90 drivers/scsi/scsi_scan.c:337
scsi_probe_and_add_lun+0x1db/0x4be0 drivers/scsi/scsi_scan.c:1210
__scsi_scan_target+0x205/0x1080 drivers/scsi/scsi_scan.c:1757
scsi_scan_channel drivers/scsi/scsi_scan.c:1845 [inline]
scsi_scan_host_selected+0x37e/0x690 drivers/scsi/scsi_scan.c:1874
page last free pid 938 tgid 938 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0xcfb/0xf20 mm/page_alloc.c:2638
vfree+0x186/0x2e0 mm/vmalloc.c:3361
delayed_vfree_work+0x56/0x80 mm/vmalloc.c:3282
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Memory state around the buggy address:
ffff888025cf9080: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc
ffff888025cf9100: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc
>ffff888025cf9180: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
^
ffff888025cf9200: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc
ffff888025cf9280: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc
==================================================================
Tested on:
commit: c30a3f54 net: mana: Add get_link and get_link_ksetting..
git tree: net-next
console output: https://syzkaller.appspot.com/x/log.txt?x=171c6307980000
kernel config: https://syzkaller.appspot.com/x/.config?x=b2d4fdf18a83ec0b
dashboard link: https://syzkaller.appspot.com/bug?extid=03d6270b6425df1605bf
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=16ce7580580000
^ permalink raw reply [flat|nested] 22+ messages in thread* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in set_powered_sync
2024-10-03 16:22 ` syzbot
@ 2024-10-03 16:45 ` Qianqiang Liu
2024-10-03 16:54 ` Luiz Augusto von Dentz
2024-10-03 17:13 ` syzbot
0 siblings, 2 replies; 22+ messages in thread
From: Qianqiang Liu @ 2024-10-03 16:45 UTC (permalink / raw)
To: syzbot
Cc: johan.hedberg, linux-bluetooth, linux-kernel, luiz.dentz, marcel,
syzkaller-bugs
#syz test
diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index 5533e6f561b3..20d0793d3832 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -325,9 +325,11 @@ static void hci_cmd_sync_work(struct work_struct *work)
int err;
hci_req_sync_lock(hdev);
- err = entry->func(hdev, entry->data);
- if (entry->destroy)
- entry->destroy(hdev, entry->data, err);
+ if (entry->data) {
+ err = entry->func(hdev, entry->data);
+ if (entry->destroy)
+ entry->destroy(hdev, entry->data, err);
+ }
hci_req_sync_unlock(hdev);
}
diff --git a/net/bluetooth/mgmt_util.c b/net/bluetooth/mgmt_util.c
index 0115f783bde8..eccc51bfaf2e 100644
--- a/net/bluetooth/mgmt_util.c
+++ b/net/bluetooth/mgmt_util.c
@@ -307,6 +307,7 @@ void mgmt_pending_free(struct mgmt_pending_cmd *cmd)
sock_put(cmd->sk);
kfree(cmd->param);
kfree(cmd);
+ cmd = NULL;
}
void mgmt_pending_remove(struct mgmt_pending_cmd *cmd)
--
Best,
Qianqiang Liu
^ permalink raw reply related [flat|nested] 22+ messages in thread* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in set_powered_sync
2024-10-03 16:45 ` Qianqiang Liu
@ 2024-10-03 16:54 ` Luiz Augusto von Dentz
2024-10-03 17:15 ` Qianqiang Liu
2024-10-03 17:13 ` syzbot
1 sibling, 1 reply; 22+ messages in thread
From: Luiz Augusto von Dentz @ 2024-10-03 16:54 UTC (permalink / raw)
To: Qianqiang Liu
Cc: syzbot, johan.hedberg, linux-bluetooth, linux-kernel, marcel,
syzkaller-bugs
Hi Qianqiang,
On Thu, Oct 3, 2024 at 12:46 PM Qianqiang Liu <qianqiang.liu@163.com> wrote:
>
> #syz test
>
> diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
> index 5533e6f561b3..20d0793d3832 100644
> --- a/net/bluetooth/hci_sync.c
> +++ b/net/bluetooth/hci_sync.c
> @@ -325,9 +325,11 @@ static void hci_cmd_sync_work(struct work_struct *work)
> int err;
>
> hci_req_sync_lock(hdev);
> - err = entry->func(hdev, entry->data);
> - if (entry->destroy)
> - entry->destroy(hdev, entry->data, err);
> + if (entry->data) {
> + err = entry->func(hdev, entry->data);
> + if (entry->destroy)
> + entry->destroy(hdev, entry->data, err);
> + }
> hci_req_sync_unlock(hdev);
> }
>
> diff --git a/net/bluetooth/mgmt_util.c b/net/bluetooth/mgmt_util.c
> index 0115f783bde8..eccc51bfaf2e 100644
> --- a/net/bluetooth/mgmt_util.c
> +++ b/net/bluetooth/mgmt_util.c
> @@ -307,6 +307,7 @@ void mgmt_pending_free(struct mgmt_pending_cmd *cmd)
> sock_put(cmd->sk);
> kfree(cmd->param);
> kfree(cmd);
> + cmd = NULL;
> }
>
> void mgmt_pending_remove(struct mgmt_pending_cmd *cmd)
>
> --
> Best,
> Qianqiang Liu
Are you sure this hasn't been already fixed by Bluetooth: MGMT: Fix
possible crash on mgmt_index_removed?
--
Luiz Augusto von Dentz
^ permalink raw reply [flat|nested] 22+ messages in thread* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in set_powered_sync
2024-10-03 16:54 ` Luiz Augusto von Dentz
@ 2024-10-03 17:15 ` Qianqiang Liu
2024-10-04 20:50 ` Luiz Augusto von Dentz
0 siblings, 1 reply; 22+ messages in thread
From: Qianqiang Liu @ 2024-10-03 17:15 UTC (permalink / raw)
To: Luiz Augusto von Dentz
Cc: syzbot, johan.hedberg, linux-bluetooth, linux-kernel, marcel,
syzkaller-bugs
Hi Luiz,
> Are you sure this hasn't been already fixed by Bluetooth: MGMT: Fix
> possible crash on mgmt_index_removed?
Oh, it looks like it's already fixed by your patch, thanks!
--
Best,
Qianqiang Liu
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in set_powered_sync
2024-10-03 17:15 ` Qianqiang Liu
@ 2024-10-04 20:50 ` Luiz Augusto von Dentz
2024-10-04 20:54 ` syzbot
0 siblings, 1 reply; 22+ messages in thread
From: Luiz Augusto von Dentz @ 2024-10-04 20:50 UTC (permalink / raw)
To: Qianqiang Liu
Cc: syzbot, johan.hedberg, linux-bluetooth, linux-kernel, marcel,
syzkaller-bugs
[-- Attachment #1: Type: text/plain, Size: 368 bytes --]
Hi,
On Thu, Oct 3, 2024 at 1:16 PM Qianqiang Liu <qianqiang.liu@163.com> wrote:
>
> Hi Luiz,
>
> > Are you sure this hasn't been already fixed by Bluetooth: MGMT: Fix
> > possible crash on mgmt_index_removed?
>
> Oh, it looks like it's already fixed by your patch, thanks!
>
> --
> Best,
> Qianqiang Liu
>
#syz test
--
Luiz Augusto von Dentz
[-- Attachment #2: v1-0001-Bluetooth-MGMT-Fix-possible-crash-on-mgmt_index_r.patch --]
[-- Type: text/x-patch, Size: 3177 bytes --]
From eb3ad76a07b6cdaaa156766da5fe6c384a12930b Mon Sep 17 00:00:00 2001
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: Thu, 12 Sep 2024 12:34:42 -0400
Subject: [PATCH v1 01/23] Bluetooth: MGMT: Fix possible crash on
mgmt_index_removed
If mgmt_index_removed is called while there are commands queued on
cmd_sync it could lead to crashes like the bellow trace:
0x0000053D: __list_del_entry_valid_or_report+0x98/0xdc
0x0000053D: mgmt_pending_remove+0x18/0x58 [bluetooth]
0x0000053E: mgmt_remove_adv_monitor_complete+0x80/0x108 [bluetooth]
0x0000053E: hci_cmd_sync_work+0xbc/0x164 [bluetooth]
So while handling mgmt_index_removed this attempts to dequeue
commands passed as user_data to cmd_sync.
Fixes: 7cf5c2978f23 ("Bluetooth: hci_sync: Refactor remove Adv Monitor")
Reported-by: jiaymao <quic_jiaymao@quicinc.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
net/bluetooth/mgmt.c | 23 ++++++++++++++---------
1 file changed, 14 insertions(+), 9 deletions(-)
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index e4f564d6f6fb..4157d9f23f46 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -1453,10 +1453,15 @@ static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
{
- if (cmd->cmd_complete) {
- u8 *status = data;
+ struct cmd_lookup *match = data;
- cmd->cmd_complete(cmd, *status);
+ /* dequeue cmd_sync entries using cmd as data as that is about to be
+ * removed/freed.
+ */
+ hci_cmd_sync_dequeue(match->hdev, NULL, cmd, NULL);
+
+ if (cmd->cmd_complete) {
+ cmd->cmd_complete(cmd, match->mgmt_status);
mgmt_pending_remove(cmd);
return;
@@ -9394,12 +9399,12 @@ void mgmt_index_added(struct hci_dev *hdev)
void mgmt_index_removed(struct hci_dev *hdev)
{
struct mgmt_ev_ext_index ev;
- u8 status = MGMT_STATUS_INVALID_INDEX;
+ struct cmd_lookup match = { NULL, hdev, MGMT_STATUS_INVALID_INDEX };
if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
return;
- mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
+ mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &match);
if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0,
@@ -9450,7 +9455,7 @@ void mgmt_power_on(struct hci_dev *hdev, int err)
void __mgmt_power_off(struct hci_dev *hdev)
{
struct cmd_lookup match = { NULL, hdev };
- u8 status, zero_cod[] = { 0, 0, 0 };
+ u8 zero_cod[] = { 0, 0, 0 };
mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
@@ -9462,11 +9467,11 @@ void __mgmt_power_off(struct hci_dev *hdev)
* status responses.
*/
if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
- status = MGMT_STATUS_INVALID_INDEX;
+ match.mgmt_status = MGMT_STATUS_INVALID_INDEX;
else
- status = MGMT_STATUS_NOT_POWERED;
+ match.mgmt_status = MGMT_STATUS_NOT_POWERED;
- mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
+ mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &match);
if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
--
2.46.1
^ permalink raw reply related [flat|nested] 22+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in set_powered_sync
2024-10-03 16:45 ` Qianqiang Liu
2024-10-03 16:54 ` Luiz Augusto von Dentz
@ 2024-10-03 17:13 ` syzbot
1 sibling, 0 replies; 22+ messages in thread
From: syzbot @ 2024-10-03 17:13 UTC (permalink / raw)
To: johan.hedberg, linux-bluetooth, linux-kernel, luiz.dentz, marcel,
qianqiang.liu, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in set_powered_sync
Bluetooth: hci0: command tx timeout
==================================================================
BUG: KASAN: slab-use-after-free in set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1353
Read of size 8 at addr ffff88802d879298 by task kworker/u9:1/4622
CPU: 0 UID: 0 PID: 4622 Comm: kworker/u9:1 Not tainted 6.11.0-syzkaller-11519-gc30a3f54e661-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: hci0 hci_cmd_sync_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1353
hci_cmd_sync_work+0x220/0x3f0 net/bluetooth/hci_sync.c:329
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Allocated by task 6093:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:257 [inline]
__kmalloc_cache_noprof+0x19c/0x2c0 mm/slub.c:4296
kmalloc_noprof include/linux/slab.h:878 [inline]
kzalloc_noprof include/linux/slab.h:1014 [inline]
mgmt_pending_new+0x65/0x250 net/bluetooth/mgmt_util.c:269
mgmt_pending_add+0x36/0x120 net/bluetooth/mgmt_util.c:296
set_powered+0x3cd/0x5e0 net/bluetooth/mgmt.c:1394
hci_mgmt_cmd+0xc47/0x11d0 net/bluetooth/hci_sock.c:1712
hci_sock_sendmsg+0x7b8/0x11c0 net/bluetooth/hci_sock.c:1832
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0x221/0x270 net/socket.c:745
sock_write_iter+0x2d7/0x3f0 net/socket.c:1166
new_sync_write fs/read_write.c:590 [inline]
vfs_write+0xa6d/0xc90 fs/read_write.c:683
ksys_write+0x183/0x2b0 fs/read_write.c:736
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 6087:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:230 [inline]
slab_free_hook mm/slub.c:2343 [inline]
slab_free mm/slub.c:4580 [inline]
kfree+0x1a0/0x440 mm/slub.c:4728
settings_rsp+0x2bc/0x390 net/bluetooth/mgmt.c:1443
mgmt_pending_foreach+0xd1/0x130 net/bluetooth/mgmt_util.c:259
__mgmt_power_off+0x112/0x420 net/bluetooth/mgmt.c:9455
hci_dev_close_sync+0x665/0x11a0 net/bluetooth/hci_sync.c:5193
hci_dev_do_close net/bluetooth/hci_core.c:483 [inline]
hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508
sock_do_ioctl+0x158/0x460 net/socket.c:1228
sock_ioctl+0x626/0x8e0 net/socket.c:1347
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff88802d879280
which belongs to the cache kmalloc-96 of size 96
The buggy address is located 24 bytes inside of
freed 96-byte region [ffff88802d879280, ffff88802d8792e0)
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2d879
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000000 ffff88801ac41280 ffffea0000bf4c00 dead000000000004
raw: 0000000000000000 0000000000200020 00000001f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 4690, tgid 4690 (udevd), ts 19144464989, free_ts 19132945155
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x3045/0x3190 mm/page_alloc.c:3457
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4733
alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265
alloc_slab_page+0x6a/0x120 mm/slub.c:2413
allocate_slab+0x5a/0x2f0 mm/slub.c:2579
new_slab mm/slub.c:2632 [inline]
___slab_alloc+0xcd1/0x14b0 mm/slub.c:3819
__slab_alloc+0x58/0xa0 mm/slub.c:3909
__slab_alloc_node mm/slub.c:3962 [inline]
slab_alloc_node mm/slub.c:4123 [inline]
__do_kmalloc_node mm/slub.c:4264 [inline]
__kmalloc_noprof+0x25a/0x400 mm/slub.c:4277
kmalloc_noprof include/linux/slab.h:882 [inline]
kzalloc_noprof include/linux/slab.h:1014 [inline]
tomoyo_encode2 security/tomoyo/realpath.c:45 [inline]
tomoyo_encode+0x26f/0x540 security/tomoyo/realpath.c:80
tomoyo_realpath_from_path+0x59e/0x5e0 security/tomoyo/realpath.c:283
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x2b7/0x740 security/tomoyo/file.c:822
security_inode_getattr+0x130/0x330 security/security.c:2371
vfs_getattr+0x45/0x430 fs/stat.c:204
vfs_fstat fs/stat.c:229 [inline]
vfs_fstatat+0xe4/0x190 fs/stat.c:338
__do_sys_newfstatat fs/stat.c:505 [inline]
__se_sys_newfstatat fs/stat.c:499 [inline]
__x64_sys_newfstatat+0x11d/0x1a0 fs/stat.c:499
page last free pid 4686 tgid 4686 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0xcfb/0xf20 mm/page_alloc.c:2638
discard_slab mm/slub.c:2678 [inline]
__put_partials+0xeb/0x130 mm/slub.c:3146
put_cpu_partial+0x17c/0x250 mm/slub.c:3221
__slab_free+0x2ea/0x3d0 mm/slub.c:4450
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x9a/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x23/0x80 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4086 [inline]
slab_alloc_node mm/slub.c:4135 [inline]
__kmalloc_cache_noprof+0x132/0x2c0 mm/slub.c:4291
kmalloc_noprof include/linux/slab.h:878 [inline]
kzalloc_noprof include/linux/slab.h:1014 [inline]
kernfs_fop_open+0x3e0/0xd10 fs/kernfs/file.c:623
do_dentry_open+0x978/0x1460 fs/open.c:958
vfs_open+0x3e/0x330 fs/open.c:1088
do_open fs/namei.c:3774 [inline]
path_openat+0x2c84/0x3590 fs/namei.c:3933
do_filp_open+0x235/0x490 fs/namei.c:3960
do_sys_openat2+0x13e/0x1d0 fs/open.c:1415
do_sys_open fs/open.c:1430 [inline]
__do_sys_openat fs/open.c:1446 [inline]
__se_sys_openat fs/open.c:1441 [inline]
__x64_sys_openat+0x247/0x2a0 fs/open.c:1441
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
Memory state around the buggy address:
ffff88802d879180: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
ffff88802d879200: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
>ffff88802d879280: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
^
ffff88802d879300: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc
ffff88802d879380: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
==================================================================
Tested on:
commit: c30a3f54 net: mana: Add get_link and get_link_ksetting..
git tree: net-next
console output: https://syzkaller.appspot.com/x/log.txt?x=146a6307980000
kernel config: https://syzkaller.appspot.com/x/.config?x=b2d4fdf18a83ec0b
dashboard link: https://syzkaller.appspot.com/bug?extid=03d6270b6425df1605bf
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=12cecb9f980000
^ permalink raw reply [flat|nested] 22+ messages in thread
end of thread, other threads:[~2024-11-18 21:16 UTC | newest]
Thread overview: 22+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-11-15 15:59 [PATCH v1] Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync Luiz Augusto von Dentz
2024-11-15 16:35 ` [v1] " bluez.test.bot
2024-11-15 16:41 ` [PATCH v1] " Luiz Augusto von Dentz
2024-11-15 18:41 ` Luiz Augusto von Dentz
2024-11-15 23:57 ` [syzbot] [bluetooth?] KASAN: " syzbot
2024-11-15 23:32 ` syzbot
-- strict thread matches above, loose matches on Subject: below --
2024-11-18 20:50 [PATCH v5] Bluetooth: MGMT: Fix " Luiz Augusto von Dentz
2024-11-18 21:16 ` [syzbot] [bluetooth?] KASAN: " syzbot
2024-11-18 17:00 [PATCH v3] Bluetooth: MGMT: Fix " Luiz Augusto von Dentz
2024-11-18 17:26 ` [syzbot] [bluetooth?] KASAN: " syzbot
2024-11-18 16:04 [PATCH v3] Bluetooth: MGMT: Fix " Luiz Augusto von Dentz
2024-11-18 16:31 ` [syzbot] [bluetooth?] KASAN: " syzbot
2024-07-15 9:36 syzbot
2024-09-08 9:07 ` syzbot
2024-09-08 16:43 ` syzbot
2024-10-03 14:28 ` Qianqiang Liu
2024-10-03 14:45 ` syzbot
2024-10-03 15:41 ` Qianqiang Liu
2024-10-03 16:22 ` syzbot
2024-10-03 16:45 ` Qianqiang Liu
2024-10-03 16:54 ` Luiz Augusto von Dentz
2024-10-03 17:15 ` Qianqiang Liu
2024-10-04 20:50 ` Luiz Augusto von Dentz
2024-10-04 20:54 ` syzbot
2024-10-03 17:13 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).