* [syzbot] [bluetooth?] KASAN: wild-memory-access Read in l2cap_connect_cfm
@ 2025-03-17 15:57 syzbot
2025-09-12 15:46 ` syzbot
2025-10-12 10:02 ` syzbot
0 siblings, 2 replies; 3+ messages in thread
From: syzbot @ 2025-03-17 15:57 UTC (permalink / raw)
To: johan.hedberg, linux-bluetooth, linux-kernel, luiz.dentz, marcel,
syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 78e3fd2b7e4b Merge remote-tracking branch 'will/for-next/p..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=15b05874580000
kernel config: https://syzkaller.appspot.com/x/.config?x=ddc962951c395b1d
dashboard link: https://syzkaller.appspot.com/bug?extid=0e4ebcc970728e056324
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/6f8d7598ad09/disk-78e3fd2b.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/493e8429a272/vmlinux-78e3fd2b.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c843736f7c02/Image-78e3fd2b.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0e4ebcc970728e056324@syzkaller.appspotmail.com
kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory.
Bluetooth: hci1: failed to register connection device
==================================================================
BUG: KASAN: wild-memory-access in instrument_atomic_read include/linux/instrumented.h:68 [inline]
BUG: KASAN: wild-memory-access in atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
BUG: KASAN: wild-memory-access in l2cap_chan_lock include/net/bluetooth/l2cap.h:827 [inline]
BUG: KASAN: wild-memory-access in l2cap_conn_ready net/bluetooth/l2cap_core.c:1624 [inline]
BUG: KASAN: wild-memory-access in l2cap_connect_cfm+0x538/0xde4 net/bluetooth/l2cap_core.c:7245
Read of size 4 at addr deacfffffffffc8c by task kworker/u9:3/6449
CPU: 1 UID: 0 PID: 6449 Comm: kworker/u9:3 Not tainted 6.14.0-rc6-syzkaller-g78e3fd2b7e4b #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Workqueue: hci1 hci_rx_work
Call trace:
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C)
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:120
print_report+0xf8/0x550 mm/kasan/report.c:524
kasan_report+0xd8/0x138 mm/kasan/report.c:634
kasan_check_range+0x268/0x2a8 mm/kasan/generic.c:189
__kasan_check_read+0x20/0x30 mm/kasan/shadow.c:31
instrument_atomic_read include/linux/instrumented.h:68 [inline]
atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
l2cap_chan_lock include/net/bluetooth/l2cap.h:827 [inline]
l2cap_conn_ready net/bluetooth/l2cap_core.c:1624 [inline]
l2cap_connect_cfm+0x538/0xde4 net/bluetooth/l2cap_core.c:7245
hci_connect_cfm+0x120/0x1d4 include/net/bluetooth/hci_core.h:2051
le_conn_complete_evt+0xa70/0xf80 net/bluetooth/hci_event.c:5763
hci_le_conn_complete_evt+0x114/0x404 net/bluetooth/hci_event.c:5789
hci_le_meta_evt+0x2a4/0x478 net/bluetooth/hci_event.c:7162
hci_event_func net/bluetooth/hci_event.c:7470 [inline]
hci_event_packet+0x884/0x1060 net/bluetooth/hci_event.c:7525
hci_rx_work+0x31c/0xb04 net/bluetooth/hci_core.c:4015
process_one_work+0x810/0x1638 kernel/workqueue.c:3238
process_scheduled_works kernel/workqueue.c:3319 [inline]
worker_thread+0x97c/0xeec kernel/workqueue.c:3400
kthread+0x65c/0x7b0 kernel/kthread.c:464
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862
==================================================================
Unable to handle kernel paging request at virtual address fbd51fffffffff91
KASAN: maybe wild-memory-access in range [0xdeacfffffffffc88-0xdeacfffffffffc8f]
Mem abort info:
ESR = 0x0000000096000004
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x04: level 0 translation fault
Data abort info:
ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[fbd51fffffffff91] address between user and kernel address ranges
Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 UID: 0 PID: 6449 Comm: kworker/u9:3 Tainted: G B 6.14.0-rc6-syzkaller-g78e3fd2b7e4b #0
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Workqueue: hci1 hci_rx_work
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : raw_atomic_read include/linux/atomic/atomic-arch-fallback.h:457 [inline]
pc : atomic_read include/linux/atomic/atomic-instrumented.h:33 [inline]
pc : l2cap_chan_lock include/net/bluetooth/l2cap.h:827 [inline]
pc : l2cap_conn_ready net/bluetooth/l2cap_core.c:1624 [inline]
pc : l2cap_connect_cfm+0x53c/0xde4 net/bluetooth/l2cap_core.c:7245
lr : instrument_atomic_read include/linux/instrumented.h:68 [inline]
lr : atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
lr : l2cap_chan_lock include/net/bluetooth/l2cap.h:827 [inline]
lr : l2cap_conn_ready net/bluetooth/l2cap_core.c:1624 [inline]
lr : l2cap_connect_cfm+0x538/0xde4 net/bluetooth/l2cap_core.c:7245
sp : ffff8000a1577460
x29: ffff8000a1577500 x28: ffff0000d4756000 x27: 1fffe0001afe1a03
x26: dfff800000000000 x25: ffff0000d47564b0 x24: ffff0000d7f0d01a
x23: dead000000000100 x22: ffff0000d7f0d2c0 x21: 1fffe0001b467007
x20: ffff0000da33803d x19: deacfffffffffc8c x18: 1fffe000366f6086
x17: ffff80008fbbd000 x16: ffff80008b7cba1c x15: 0000000000000001
x14: 1ffff0001262eaf8 x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000100000 x10: 00000000000596ee x9 : 0000000000000000
x8 : 1bd59fffffffff91 x7 : 1fffe000366f6087 x6 : ffff8000803d4bfc
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff8000802f88ec
x2 : 0000000000000001 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
raw_atomic_read include/linux/atomic/atomic-arch-fallback.h:457 [inline] (P)
atomic_read include/linux/atomic/atomic-instrumented.h:33 [inline] (P)
l2cap_chan_lock include/net/bluetooth/l2cap.h:827 [inline] (P)
l2cap_conn_ready net/bluetooth/l2cap_core.c:1624 [inline] (P)
l2cap_connect_cfm+0x53c/0xde4 net/bluetooth/l2cap_core.c:7245 (P)
hci_connect_cfm+0x120/0x1d4 include/net/bluetooth/hci_core.h:2051
le_conn_complete_evt+0xa70/0xf80 net/bluetooth/hci_event.c:5763
hci_le_conn_complete_evt+0x114/0x404 net/bluetooth/hci_event.c:5789
hci_le_meta_evt+0x2a4/0x478 net/bluetooth/hci_event.c:7162
hci_event_func net/bluetooth/hci_event.c:7470 [inline]
hci_event_packet+0x884/0x1060 net/bluetooth/hci_event.c:7525
hci_rx_work+0x31c/0xb04 net/bluetooth/hci_core.c:4015
process_one_work+0x810/0x1638 kernel/workqueue.c:3238
process_scheduled_works kernel/workqueue.c:3319 [inline]
worker_thread+0x97c/0xeec kernel/workqueue.c:3400
kthread+0x65c/0x7b0 kernel/kthread.c:464
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862
Code: 52800081 aa1303e0 97568921 d343fe68 (38fa6908)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: 52800081 mov w1, #0x4 // #4
4: aa1303e0 mov x0, x19
8: 97568921 bl 0xfffffffffd5a248c
c: d343fe68 lsr x8, x19, #3
* 10: 38fa6908 ldrsb w8, [x8, x26] <-- trapping instruction
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: wild-memory-access Read in l2cap_connect_cfm
2025-03-17 15:57 [syzbot] [bluetooth?] KASAN: wild-memory-access Read in l2cap_connect_cfm syzbot
@ 2025-09-12 15:46 ` syzbot
2025-10-12 10:02 ` syzbot
1 sibling, 0 replies; 3+ messages in thread
From: syzbot @ 2025-09-12 15:46 UTC (permalink / raw)
To: johan.hedberg, linux-bluetooth, linux-kernel, luiz.dentz, marcel,
syzkaller-bugs
syzbot has found a reproducer for the following issue on:
HEAD commit: 590b221ed425 Add linux-next specific files for 20250912
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=161d1934580000
kernel config: https://syzkaller.appspot.com/x/.config?x=9134e501f17b95a4
dashboard link: https://syzkaller.appspot.com/bug?extid=0e4ebcc970728e056324
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=111d1934580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/872439e79d04/disk-590b221e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/09ebcfd707c1/vmlinux-590b221e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/e3417bc549df/bzImage-590b221e.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0e4ebcc970728e056324@syzkaller.appspotmail.com
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory.
Bluetooth: hci0: failed to register connection device
==================================================================
BUG: KASAN: slab-use-after-free in l2cap_conn_ready net/bluetooth/l2cap_core.c:1623 [inline]
BUG: KASAN: slab-use-after-free in l2cap_connect_cfm+0x6e4/0x1040 net/bluetooth/l2cap_core.c:7304
Read of size 8 at addr ffff888076dfc480 by task kworker/u9:3/5984
CPU: 1 UID: 0 PID: 5984 Comm: kworker/u9:3 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Workqueue: hci0 hci_rx_work
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xca/0x240 mm/kasan/report.c:482
kasan_report+0x118/0x150 mm/kasan/report.c:595
l2cap_conn_ready net/bluetooth/l2cap_core.c:1623 [inline]
l2cap_connect_cfm+0x6e4/0x1040 net/bluetooth/l2cap_core.c:7304
hci_connect_cfm+0x95/0x140 include/net/bluetooth/hci_core.h:2085
le_conn_complete_evt+0xcd3/0x1220 net/bluetooth/hci_event.c:5761
hci_le_conn_complete_evt+0x187/0x450 net/bluetooth/hci_event.c:5787
hci_event_func net/bluetooth/hci_event.c:7532 [inline]
hci_event_packet+0x78f/0x1200 net/bluetooth/hci_event.c:7589
hci_rx_work+0x46a/0xe80 net/bluetooth/hci_core.c:4099
process_one_work kernel/workqueue.c:3263 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Allocated by task 5984:
kasan_save_stack mm/kasan/common.c:56 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:77
poison_kmalloc_redzone mm/kasan/common.c:397 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:414
kasan_kmalloc include/linux/kasan.h:260 [inline]
__kmalloc_cache_noprof+0x3d5/0x6f0 mm/slub.c:5457
kmalloc_noprof include/linux/slab.h:956 [inline]
kzalloc_noprof include/linux/slab.h:1090 [inline]
l2cap_chan_create+0x50/0x760 net/bluetooth/l2cap_core.c:445
l2cap_sock_alloc net/bluetooth/l2cap_sock.c:1906 [inline]
l2cap_sock_new_connection_cb+0x182/0x2b0 net/bluetooth/l2cap_sock.c:1485
l2cap_connect_cfm+0x37a/0x1040 net/bluetooth/l2cap_core.c:7287
hci_connect_cfm+0x95/0x140 include/net/bluetooth/hci_core.h:2085
le_conn_complete_evt+0xcd3/0x1220 net/bluetooth/hci_event.c:5761
hci_le_conn_complete_evt+0x187/0x450 net/bluetooth/hci_event.c:5787
hci_event_func net/bluetooth/hci_event.c:7532 [inline]
hci_event_packet+0x78f/0x1200 net/bluetooth/hci_event.c:7589
hci_rx_work+0x46a/0xe80 net/bluetooth/hci_core.c:4099
process_one_work kernel/workqueue.c:3263 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Freed by task 6106:
kasan_save_stack mm/kasan/common.c:56 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:77
__kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:587
kasan_save_free_info mm/kasan/kasan.h:406 [inline]
poison_slab_object mm/kasan/common.c:252 [inline]
__kasan_slab_free+0x5b/0x80 mm/kasan/common.c:284
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2474 [inline]
slab_free mm/slub.c:6181 [inline]
kfree+0x199/0x6d0 mm/slub.c:6389
l2cap_sock_cleanup_listen+0xea/0x3e0 net/bluetooth/l2cap_sock.c:1468
l2cap_sock_release+0x6a/0x210 net/bluetooth/l2cap_sock.c:1426
__sock_release net/socket.c:649 [inline]
sock_close+0xc3/0x240 net/socket.c:1442
__fput+0x44c/0xa70 fs/file_table.c:468
task_work_run+0x1d4/0x260 kernel/task_work.c:227
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop+0xec/0x130 kernel/entry/common.c:43
exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
do_syscall_64+0x2bd/0xfa0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff888076dfc000
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 1152 bytes inside of
freed 2048-byte region [ffff888076dfc000, ffff888076dfc800)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x76df8
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801a842000 0000000000000000 0000000000000001
raw: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88801a842000 0000000000000000 0000000000000001
head: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000
head: 00fff00000000003 ffffea0001db7e01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 12, tgid 12 (kworker/u8:0), ts 101722977992, free_ts 59750752696
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1850
prep_new_page mm/page_alloc.c:1858 [inline]
get_page_from_freelist+0x21e4/0x22c0 mm/page_alloc.c:3869
__alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5159
alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2416
alloc_slab_page mm/slub.c:2986 [inline]
allocate_slab+0x8a/0x330 mm/slub.c:3154
new_slab mm/slub.c:3208 [inline]
___slab_alloc+0xbd1/0x13f0 mm/slub.c:4480
__slab_alloc+0x55/0xa0 mm/slub.c:4571
__slab_alloc_node mm/slub.c:4646 [inline]
slab_alloc_node mm/slub.c:5056 [inline]
__do_kmalloc_node mm/slub.c:5425 [inline]
__kmalloc_node_track_caller_noprof+0x5c7/0x800 mm/slub.c:5445
kmalloc_reserve+0x136/0x290 net/core/skbuff.c:600
__alloc_skb+0x142/0x2d0 net/core/skbuff.c:669
alloc_skb include/linux/skbuff.h:1377 [inline]
nlmsg_new include/net/netlink.h:1055 [inline]
rtmsg_ifinfo_build_skb+0x84/0x260 net/core/rtnetlink.c:4392
unregister_netdevice_many_notify+0x1556/0x1ff0 net/core/dev.c:12218
ops_exit_rtnl_list net/core/net_namespace.c:186 [inline]
ops_undo_list+0x3dc/0x990 net/core/net_namespace.c:247
cleanup_net+0x4c5/0x800 net/core/net_namespace.c:682
process_one_work kernel/workqueue.c:3263 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
page last free pid 5549 tgid 5549 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1394 [inline]
__free_frozen_pages+0xbc4/0xd30 mm/page_alloc.c:2906
__slab_free+0x2e7/0x390 mm/slub.c:5656
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x97/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:349
kasan_slab_alloc include/linux/kasan.h:250 [inline]
slab_post_alloc_hook mm/slub.c:4770 [inline]
slab_alloc_node mm/slub.c:5068 [inline]
__do_kmalloc_node mm/slub.c:5425 [inline]
__kmalloc_noprof+0x3c3/0x7f0 mm/slub.c:5438
kmalloc_noprof include/linux/slab.h:960 [inline]
tomoyo_realpath_from_path+0xe3/0x5d0 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x213/0x4b0 security/tomoyo/file.c:822
security_inode_getattr+0x12f/0x330 security/security.c:2416
vfs_getattr fs/stat.c:259 [inline]
vfs_fstat fs/stat.c:281 [inline]
__do_sys_newfstat fs/stat.c:555 [inline]
__se_sys_newfstat fs/stat.c:550 [inline]
__x64_sys_newfstat+0xfc/0x200 fs/stat.c:550
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888076dfc380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888076dfc400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888076dfc480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888076dfc500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888076dfc580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: wild-memory-access Read in l2cap_connect_cfm
2025-03-17 15:57 [syzbot] [bluetooth?] KASAN: wild-memory-access Read in l2cap_connect_cfm syzbot
2025-09-12 15:46 ` syzbot
@ 2025-10-12 10:02 ` syzbot
1 sibling, 0 replies; 3+ messages in thread
From: syzbot @ 2025-10-12 10:02 UTC (permalink / raw)
To: hdanton, johan.hedberg, linux-bluetooth, linux-kernel, luiz.dentz,
marcel, syzkaller-bugs
syzbot has found a reproducer for the following issue on:
HEAD commit: 2b763d465239 Add linux-next specific files for 20251010
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=175829e2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=99cb6b007a8889ef
dashboard link: https://syzkaller.appspot.com/bug?extid=0e4ebcc970728e056324
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16f63304580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1384067c580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/6a00344625c3/disk-2b763d46.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/cd34c500f8eb/vmlinux-2b763d46.xz
kernel image: https://storage.googleapis.com/syzbot-assets/660905c62cb2/bzImage-2b763d46.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0e4ebcc970728e056324@syzkaller.appspotmail.com
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory.
Bluetooth: hci0: failed to register connection device
==================================================================
BUG: KASAN: slab-use-after-free in l2cap_conn_ready net/bluetooth/l2cap_core.c:1623 [inline]
BUG: KASAN: slab-use-after-free in l2cap_connect_cfm+0x6e4/0x1040 net/bluetooth/l2cap_core.c:7304
Read of size 8 at addr ffff888071324480 by task kworker/u9:1/5146
CPU: 1 UID: 0 PID: 5146 Comm: kworker/u9:1 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Workqueue: hci0 hci_rx_work
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xca/0x240 mm/kasan/report.c:482
kasan_report+0x118/0x150 mm/kasan/report.c:595
l2cap_conn_ready net/bluetooth/l2cap_core.c:1623 [inline]
l2cap_connect_cfm+0x6e4/0x1040 net/bluetooth/l2cap_core.c:7304
hci_connect_cfm+0x95/0x140 include/net/bluetooth/hci_core.h:2106
le_conn_complete_evt+0xfb8/0x1500 net/bluetooth/hci_event.c:5789
hci_le_conn_complete_evt+0x187/0x450 net/bluetooth/hci_event.c:5815
hci_event_func net/bluetooth/hci_event.c:7560 [inline]
hci_event_packet+0x78f/0x1200 net/bluetooth/hci_event.c:7617
hci_rx_work+0x46a/0xe80 net/bluetooth/hci_core.c:4099
process_one_work kernel/workqueue.c:3263 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Allocated by task 5146:
kasan_save_stack mm/kasan/common.c:56 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:77
poison_kmalloc_redzone mm/kasan/common.c:400 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:417
kasan_kmalloc include/linux/kasan.h:262 [inline]
__kmalloc_cache_noprof+0x3d5/0x6f0 mm/slub.c:5725
kmalloc_noprof include/linux/slab.h:957 [inline]
kzalloc_noprof include/linux/slab.h:1094 [inline]
l2cap_chan_create+0x50/0x760 net/bluetooth/l2cap_core.c:445
l2cap_sock_alloc net/bluetooth/l2cap_sock.c:1906 [inline]
l2cap_sock_new_connection_cb+0x182/0x2b0 net/bluetooth/l2cap_sock.c:1485
l2cap_connect_cfm+0x37a/0x1040 net/bluetooth/l2cap_core.c:7287
hci_connect_cfm+0x95/0x140 include/net/bluetooth/hci_core.h:2106
le_conn_complete_evt+0xfb8/0x1500 net/bluetooth/hci_event.c:5789
hci_le_conn_complete_evt+0x187/0x450 net/bluetooth/hci_event.c:5815
hci_event_func net/bluetooth/hci_event.c:7560 [inline]
hci_event_packet+0x78f/0x1200 net/bluetooth/hci_event.c:7617
hci_rx_work+0x46a/0xe80 net/bluetooth/hci_core.c:4099
process_one_work kernel/workqueue.c:3263 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Freed by task 6092:
kasan_save_stack mm/kasan/common.c:56 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:77
__kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:587
kasan_save_free_info mm/kasan/kasan.h:406 [inline]
poison_slab_object mm/kasan/common.c:252 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:284
kasan_slab_free include/linux/kasan.h:234 [inline]
slab_free_hook mm/slub.c:2515 [inline]
slab_free mm/slub.c:6574 [inline]
kfree+0x19a/0x6d0 mm/slub.c:6781
l2cap_sock_cleanup_listen+0xea/0x3e0 net/bluetooth/l2cap_sock.c:1468
l2cap_sock_release+0x6a/0x210 net/bluetooth/l2cap_sock.c:1426
__sock_release net/socket.c:662 [inline]
sock_close+0xc3/0x240 net/socket.c:1455
__fput+0x44c/0xa70 fs/file_table.c:468
task_work_run+0x1d4/0x260 kernel/task_work.c:227
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop+0xe9/0x130 kernel/entry/common.c:43
exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
do_syscall_64+0x2bd/0xfa0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff888071324000
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 1152 bytes inside of
freed 2048-byte region [ffff888071324000, ffff888071324800)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x71320
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88813fe27000 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88813fe27000 dead000000000122 0000000000000000
head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
head: 00fff00000000003 ffffea0001c4c801 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5935, tgid 5935 (kworker/1:4), ts 91888484672, free_ts 91755679836
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1850
prep_new_page mm/page_alloc.c:1858 [inline]
get_page_from_freelist+0x2365/0x2440 mm/page_alloc.c:3884
__alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5183
alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2416
alloc_slab_page mm/slub.c:3031 [inline]
allocate_slab+0x96/0x3a0 mm/slub.c:3204
new_slab mm/slub.c:3258 [inline]
___slab_alloc+0xe94/0x18a0 mm/slub.c:4628
__slab_alloc+0x65/0x100 mm/slub.c:4747
__slab_alloc_node mm/slub.c:4823 [inline]
slab_alloc_node mm/slub.c:5234 [inline]
__do_kmalloc_node mm/slub.c:5603 [inline]
__kmalloc_node_track_caller_noprof+0x5c7/0x800 mm/slub.c:5713
kmalloc_reserve+0x136/0x290 net/core/skbuff.c:601
__alloc_skb+0x142/0x2d0 net/core/skbuff.c:670
alloc_skb include/linux/skbuff.h:1383 [inline]
mld_newpack+0x13c/0xc40 net/ipv6/mcast.c:1775
add_grhead+0x5a/0x2a0 net/ipv6/mcast.c:1886
add_grec+0x1452/0x1740 net/ipv6/mcast.c:2025
mld_send_cr net/ipv6/mcast.c:2148 [inline]
mld_ifc_work+0x6ed/0xd60 net/ipv6/mcast.c:2693
process_one_work kernel/workqueue.c:3263 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
page last free pid 6090 tgid 6090 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1394 [inline]
__free_frozen_pages+0xbc4/0xd30 mm/page_alloc.c:2906
__slab_free+0x2e7/0x390 mm/slub.c:5924
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x97/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:352
kasan_slab_alloc include/linux/kasan.h:252 [inline]
slab_post_alloc_hook mm/slub.c:4947 [inline]
slab_alloc_node mm/slub.c:5246 [inline]
kmem_cache_alloc_noprof+0x367/0x6e0 mm/slub.c:5253
getname_flags+0xb8/0x540 fs/namei.c:146
getname include/linux/fs.h:2922 [inline]
do_sys_openat2+0xbc/0x1c0 fs/open.c:1431
do_sys_open fs/open.c:1452 [inline]
__do_sys_openat fs/open.c:1468 [inline]
__se_sys_openat fs/open.c:1463 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1463
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888071324380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888071324400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888071324480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888071324500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888071324580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2025-10-12 10:02 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-03-17 15:57 [syzbot] [bluetooth?] KASAN: wild-memory-access Read in l2cap_connect_cfm syzbot
2025-09-12 15:46 ` syzbot
2025-10-12 10:02 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).