* [PATCH v2] Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd
@ 2025-01-17 15:56 Luiz Augusto von Dentz
2025-01-17 15:59 ` Luiz Augusto von Dentz
2025-01-17 16:33 ` [v2] Bluetooth: L2CAP: Fix " bluez.test.bot
0 siblings, 2 replies; 4+ messages in thread
From: Luiz Augusto von Dentz @ 2025-01-17 15:56 UTC (permalink / raw)
To: linux-bluetooth
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
After the hci sync command releases l2cap_conn, the hci receive data work
queue references the released l2cap_conn when sending to the upper layer.
Add hci dev lock to the hci receive data work queue to synchronize the two.
[1]
BUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954
Read of size 8 at addr ffff8880271a4000 by task kworker/u9:2/5837
CPU: 0 UID: 0 PID: 5837 Comm: kworker/u9:2 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: hci1 hci_rx_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x169/0x550 mm/kasan/report.c:489
kasan_report+0x143/0x180 mm/kasan/report.c:602
l2cap_build_cmd net/bluetooth/l2cap_core.c:2964 [inline]
l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954
l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline]
l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline]
l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817
hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline]
hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Allocated by task 5837:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329
kmalloc_noprof include/linux/slab.h:901 [inline]
kzalloc_noprof include/linux/slab.h:1037 [inline]
l2cap_conn_add+0xa9/0x8e0 net/bluetooth/l2cap_core.c:6860
l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7239
hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726
hci_event_func net/bluetooth/hci_event.c:7473 [inline]
hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525
hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Freed by task 54:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2353 [inline]
slab_free mm/slub.c:4613 [inline]
kfree+0x196/0x430 mm/slub.c:4761
l2cap_connect_cfm+0xcc/0x1090 net/bluetooth/l2cap_core.c:7235
hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
hci_conn_failed+0x287/0x400 net/bluetooth/hci_conn.c:1266
hci_abort_conn_sync+0x56c/0x11f0 net/bluetooth/hci_sync.c:5603
hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Reported-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734
Tested-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
net/bluetooth/l2cap_core.c | 38 ++++++++++++++++++++++++++++++++++++--
1 file changed, 36 insertions(+), 2 deletions(-)
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 27b4c4a2ba1f..025bb038e304 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -951,11 +951,18 @@ static u8 l2cap_get_ident(struct l2cap_conn *conn)
static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
void *data)
{
- struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
+ struct sk_buff *skb;
u8 flags;
+ /* Check if HCI_CONN_DROP has been set since it means hci_chan_del has
+ * been called.
+ */
+ if (test_bit(HCI_CONN_DROP, &conn->hcon->flags))
+ return;
+
BT_DBG("code 0x%2.2x", code);
+ skb = l2cap_build_cmd(conn, code, ident, len, data);
if (!skb)
return;
@@ -6785,6 +6792,12 @@ static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
u16 cid, len;
__le16 psm;
+ /* Check if hcon has been dropped then drop its packets as well */
+ if (test_bit(HCI_CONN_DROP, &hcon->flags)) {
+ kfree_skb(skb);
+ return;
+ }
+
if (hcon->state != BT_CONNECTED) {
BT_DBG("queueing pending rx skb");
skb_queue_tail(&conn->pending_rx, skb);
@@ -7466,14 +7479,33 @@ static void l2cap_recv_reset(struct l2cap_conn *conn)
conn->rx_len = 0;
}
+static struct l2cap_conn *l2cap_conn_hold_unless_zero(struct l2cap_conn *c)
+{
+ BT_DBG("conn %p orig refcnt %u", c, kref_read(&c->ref));
+
+ if (!kref_get_unless_zero(&c->ref))
+ return NULL;
+
+ return c;
+}
+
void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
{
- struct l2cap_conn *conn = hcon->l2cap_data;
+ struct l2cap_conn *conn;
int len;
+ /* Lock hdev to access l2cap_data to avoid race with l2cap_conn_del */
+ hci_dev_lock(hcon->hdev);
+
+ conn = hcon->l2cap_data;
+
if (!conn)
conn = l2cap_conn_add(hcon);
+ conn = l2cap_conn_hold_unless_zero(conn);
+
+ hci_dev_unlock(hcon->hdev);
+
if (!conn)
goto drop;
@@ -7565,6 +7597,8 @@ void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
break;
}
+ l2cap_conn_put(conn);
+
drop:
kfree_skb(skb);
}
--
2.47.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH v2] Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd
2025-01-17 15:56 [PATCH v2] Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd Luiz Augusto von Dentz
@ 2025-01-17 15:59 ` Luiz Augusto von Dentz
2025-01-17 16:54 ` [syzbot] [bluetooth?] KASAN: " syzbot
2025-01-17 16:33 ` [v2] Bluetooth: L2CAP: Fix " bluez.test.bot
1 sibling, 1 reply; 4+ messages in thread
From: Luiz Augusto von Dentz @ 2025-01-17 15:59 UTC (permalink / raw)
To: linux-bluetooth, syzbot+31c2f641b850a348a734
#syz test
On Fri, Jan 17, 2025 at 10:56 AM Luiz Augusto von Dentz
<luiz.dentz@gmail.com> wrote:
>
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
>
> After the hci sync command releases l2cap_conn, the hci receive data work
> queue references the released l2cap_conn when sending to the upper layer.
> Add hci dev lock to the hci receive data work queue to synchronize the two.
>
> [1]
> BUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954
> Read of size 8 at addr ffff8880271a4000 by task kworker/u9:2/5837
>
> CPU: 0 UID: 0 PID: 5837 Comm: kworker/u9:2 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
> Workqueue: hci1 hci_rx_work
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:94 [inline]
> dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
> print_address_description mm/kasan/report.c:378 [inline]
> print_report+0x169/0x550 mm/kasan/report.c:489
> kasan_report+0x143/0x180 mm/kasan/report.c:602
> l2cap_build_cmd net/bluetooth/l2cap_core.c:2964 [inline]
> l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954
> l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline]
> l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline]
> l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817
> hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline]
> hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040
> process_one_work kernel/workqueue.c:3229 [inline]
> process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> worker_thread+0x870/0xd30 kernel/workqueue.c:3391
> kthread+0x2f0/0x390 kernel/kthread.c:389
> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> </TASK>
>
> Allocated by task 5837:
> kasan_save_stack mm/kasan/common.c:47 [inline]
> kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
> poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
> __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
> kasan_kmalloc include/linux/kasan.h:260 [inline]
> __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329
> kmalloc_noprof include/linux/slab.h:901 [inline]
> kzalloc_noprof include/linux/slab.h:1037 [inline]
> l2cap_conn_add+0xa9/0x8e0 net/bluetooth/l2cap_core.c:6860
> l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7239
> hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
> hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726
> hci_event_func net/bluetooth/hci_event.c:7473 [inline]
> hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525
> hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035
> process_one_work kernel/workqueue.c:3229 [inline]
> process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> worker_thread+0x870/0xd30 kernel/workqueue.c:3391
> kthread+0x2f0/0x390 kernel/kthread.c:389
> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
>
> Freed by task 54:
> kasan_save_stack mm/kasan/common.c:47 [inline]
> kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
> kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582
> poison_slab_object mm/kasan/common.c:247 [inline]
> __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
> kasan_slab_free include/linux/kasan.h:233 [inline]
> slab_free_hook mm/slub.c:2353 [inline]
> slab_free mm/slub.c:4613 [inline]
> kfree+0x196/0x430 mm/slub.c:4761
> l2cap_connect_cfm+0xcc/0x1090 net/bluetooth/l2cap_core.c:7235
> hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
> hci_conn_failed+0x287/0x400 net/bluetooth/hci_conn.c:1266
> hci_abort_conn_sync+0x56c/0x11f0 net/bluetooth/hci_sync.c:5603
> hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332
> process_one_work kernel/workqueue.c:3229 [inline]
> process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> worker_thread+0x870/0xd30 kernel/workqueue.c:3391
> kthread+0x2f0/0x390 kernel/kthread.c:389
> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
>
> Reported-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734
> Tested-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com
> Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> ---
> net/bluetooth/l2cap_core.c | 38 ++++++++++++++++++++++++++++++++++++--
> 1 file changed, 36 insertions(+), 2 deletions(-)
>
> diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> index 27b4c4a2ba1f..025bb038e304 100644
> --- a/net/bluetooth/l2cap_core.c
> +++ b/net/bluetooth/l2cap_core.c
> @@ -951,11 +951,18 @@ static u8 l2cap_get_ident(struct l2cap_conn *conn)
> static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
> void *data)
> {
> - struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
> + struct sk_buff *skb;
> u8 flags;
>
> + /* Check if HCI_CONN_DROP has been set since it means hci_chan_del has
> + * been called.
> + */
> + if (test_bit(HCI_CONN_DROP, &conn->hcon->flags))
> + return;
> +
> BT_DBG("code 0x%2.2x", code);
>
> + skb = l2cap_build_cmd(conn, code, ident, len, data);
> if (!skb)
> return;
>
> @@ -6785,6 +6792,12 @@ static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
> u16 cid, len;
> __le16 psm;
>
> + /* Check if hcon has been dropped then drop its packets as well */
> + if (test_bit(HCI_CONN_DROP, &hcon->flags)) {
> + kfree_skb(skb);
> + return;
> + }
> +
> if (hcon->state != BT_CONNECTED) {
> BT_DBG("queueing pending rx skb");
> skb_queue_tail(&conn->pending_rx, skb);
> @@ -7466,14 +7479,33 @@ static void l2cap_recv_reset(struct l2cap_conn *conn)
> conn->rx_len = 0;
> }
>
> +static struct l2cap_conn *l2cap_conn_hold_unless_zero(struct l2cap_conn *c)
> +{
> + BT_DBG("conn %p orig refcnt %u", c, kref_read(&c->ref));
> +
> + if (!kref_get_unless_zero(&c->ref))
> + return NULL;
> +
> + return c;
> +}
> +
> void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
> {
> - struct l2cap_conn *conn = hcon->l2cap_data;
> + struct l2cap_conn *conn;
> int len;
>
> + /* Lock hdev to access l2cap_data to avoid race with l2cap_conn_del */
> + hci_dev_lock(hcon->hdev);
> +
> + conn = hcon->l2cap_data;
> +
> if (!conn)
> conn = l2cap_conn_add(hcon);
>
> + conn = l2cap_conn_hold_unless_zero(conn);
> +
> + hci_dev_unlock(hcon->hdev);
> +
> if (!conn)
> goto drop;
>
> @@ -7565,6 +7597,8 @@ void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
> break;
> }
>
> + l2cap_conn_put(conn);
> +
> drop:
> kfree_skb(skb);
> }
> --
> 2.47.1
>
--
Luiz Augusto von Dentz
^ permalink raw reply [flat|nested] 4+ messages in thread
* RE: [v2] Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd
2025-01-17 15:56 [PATCH v2] Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd Luiz Augusto von Dentz
2025-01-17 15:59 ` Luiz Augusto von Dentz
@ 2025-01-17 16:33 ` bluez.test.bot
1 sibling, 0 replies; 4+ messages in thread
From: bluez.test.bot @ 2025-01-17 16:33 UTC (permalink / raw)
To: linux-bluetooth, luiz.dentz
[-- Attachment #1: Type: text/plain, Size: 1948 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=926497
---Test result---
Test Summary:
CheckPatch PENDING 0.34 seconds
GitLint PENDING 0.42 seconds
SubjectPrefix PASS 0.05 seconds
BuildKernel PASS 24.55 seconds
CheckAllWarning PASS 26.77 seconds
CheckSparse PASS 30.58 seconds
BuildKernel32 PASS 24.28 seconds
TestRunnerSetup PASS 434.16 seconds
TestRunner_l2cap-tester PASS 20.91 seconds
TestRunner_iso-tester PASS 34.65 seconds
TestRunner_bnep-tester PASS 4.90 seconds
TestRunner_mgmt-tester FAIL 122.82 seconds
TestRunner_rfcomm-tester PASS 7.65 seconds
TestRunner_sco-tester PASS 9.50 seconds
TestRunner_ioctl-tester PASS 8.31 seconds
TestRunner_mesh-tester PASS 6.14 seconds
TestRunner_smp-tester PASS 7.08 seconds
TestRunner_userchan-tester PASS 5.08 seconds
IncrementalBuild PENDING 0.77 seconds
Details
##############################
Test: CheckPatch - PENDING
Desc: Run checkpatch.pl script
Output:
##############################
Test: GitLint - PENDING
Desc: Run gitlint
Output:
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
Total: 490, Passed: 485 (99.0%), Failed: 1, Not Run: 4
Failed Test Cases
LL Privacy - Set Flags 3 (2 Devices to RL) Failed 0.204 seconds
##############################
Test: IncrementalBuild - PENDING
Desc: Incremental build with the patches in the series
Output:
---
Regards,
Linux Bluetooth
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd
2025-01-17 15:59 ` Luiz Augusto von Dentz
@ 2025-01-17 16:54 ` syzbot
0 siblings, 0 replies; 4+ messages in thread
From: syzbot @ 2025-01-17 16:54 UTC (permalink / raw)
To: linux-bluetooth, linux-kernel, luiz.dentz, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in l2cap_send_cmd
Bluetooth: Wrong link type (-22)
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000064: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000320-0x0000000000000327]
CPU: 0 UID: 0 PID: 8403 Comm: kworker/u9:10 Not tainted 6.13.0-rc7-syzkaller-g9bffa1ad25b8 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Workqueue: hci4 hci_rx_work
RIP: 0010:l2cap_send_cmd+0x563/0x8d0 net/bluetooth/l2cap_core.c:964
Code: fc ff df 80 3c 08 00 74 08 48 89 df e8 f6 54 42 f7 bd 22 03 00 00 48 03 2b 48 89 e8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 11 01 00 00 0f b6 5d 00 89 de 83 e6 40 31
RSP: 0018:ffffc9000557f378 EFLAGS: 00010202
RAX: 0000000000000064 RBX: ffff88801eb23c78 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff888034724000
RBP: 0000000000000322 R08: ffffffff8ac395c4 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed100f588363 R12: ffff888034724000
R13: ffff888034724010 R14: ffff88801eb22c80 R15: ffff888063932140
FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055558b7da5c8 CR3: 000000002974a000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline]
l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline]
l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817
hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline]
hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040
process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317
worker_thread+0x870/0xd30 kernel/workqueue.c:3398
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:l2cap_send_cmd+0x563/0x8d0 net/bluetooth/l2cap_core.c:964
Code: fc ff df 80 3c 08 00 74 08 48 89 df e8 f6 54 42 f7 bd 22 03 00 00 48 03 2b 48 89 e8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 11 01 00 00 0f b6 5d 00 89 de 83 e6 40 31
RSP: 0018:ffffc9000557f378 EFLAGS: 00010202
RAX: 0000000000000064 RBX: ffff88801eb23c78 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff888034724000
----------------
Code disassembly (best guess), 2 bytes skipped:
0: df 80 3c 08 00 74 filds 0x7400083c(%rax)
6: 08 48 89 or %cl,-0x77(%rax)
9: df e8 fucomip %st(0),%st
b: f6 54 42 f7 notb -0x9(%rdx,%rax,2)
f: bd 22 03 00 00 mov $0x322,%ebp
14: 48 03 2b add (%rbx),%rbp
17: 48 89 e8 mov %rbp,%rax
1a: 48 c1 e8 03 shr $0x3,%rax
1e: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx
25: fc ff df
* 28: 0f b6 04 08 movzbl (%rax,%rcx,1),%eax <-- trapping instruction
2c: 84 c0 test %al,%al
2e: 0f 85 11 01 00 00 jne 0x145
34: 0f b6 5d 00 movzbl 0x0(%rbp),%ebx
38: 89 de mov %ebx,%esi
3a: 83 e6 40 and $0x40,%esi
3d: 31 .byte 0x31
Tested on:
commit: 9bffa1ad Merge tag 'drm-fixes-2025-01-17' of https://g..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16139fc4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=aadf89e2f6db86cc
dashboard link: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
Note: no patches were applied.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2025-01-17 16:54 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-01-17 15:56 [PATCH v2] Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd Luiz Augusto von Dentz
2025-01-17 15:59 ` Luiz Augusto von Dentz
2025-01-17 16:54 ` [syzbot] [bluetooth?] KASAN: " syzbot
2025-01-17 16:33 ` [v2] Bluetooth: L2CAP: Fix " bluez.test.bot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).