* [PATCH] Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
@ 2026-03-19 11:58 Helen Koike
2026-03-19 12:26 ` bluez.test.bot
2026-03-19 18:10 ` [PATCH] " patchwork-bot+bluetooth
0 siblings, 2 replies; 3+ messages in thread
From: Helen Koike @ 2026-03-19 11:58 UTC (permalink / raw)
To: marcel, luiz.dentz, linux-bluetooth, linux-kernel, kernel-dev,
koike
Before using sk pointer, check if it is null.
Fix the following:
KASAN: null-ptr-deref in range [0x0000000000000260-0x0000000000000267]
CPU: 0 UID: 0 PID: 5985 Comm: kworker/0:5 Not tainted 7.0.0-rc4-00029-ga989fde763f4 #1 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-9.fc43 06/10/2025
Workqueue: events l2cap_info_timeout
RIP: 0010:kasan_byte_accessible+0x12/0x30
Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cce
veth0_macvtap: entered promiscuous mode
RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001
RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000
R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005582615a5008 CR3: 000000007007e000 CR4: 0000000000752ef0
PKRU: 55555554
Call Trace:
<TASK>
__kasan_check_byte+0x12/0x40
lock_acquire+0x79/0x2e0
lock_sock_nested+0x48/0x100
? l2cap_sock_ready_cb+0x46/0x160
l2cap_sock_ready_cb+0x46/0x160
l2cap_conn_start+0x779/0xff0
? __pfx_l2cap_conn_start+0x10/0x10
? l2cap_info_timeout+0x60/0xa0
? __pfx___mutex_lock+0x10/0x10
l2cap_info_timeout+0x68/0xa0
? process_scheduled_works+0xa8d/0x18c0
process_scheduled_works+0xb6e/0x18c0
? __pfx_process_scheduled_works+0x10/0x10
? assign_work+0x3d5/0x5e0
worker_thread+0xa53/0xfc0
kthread+0x388/0x470
? __pfx_worker_thread+0x10/0x10
? __pfx_kthread+0x10/0x10
ret_from_fork+0x51e/0xb90
? __pfx_ret_from_fork+0x10/0x10
veth1_macvtap: entered promiscuous mode
? __switch_to+0xc7d/0x1450
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
batman_adv: batadv0: Interface activated: batadv_slave_0
batman_adv: batadv0: Interface activated: batadv_slave_1
netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
RIP: 0010:kasan_byte_accessible+0x12/0x30
Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cce
ieee80211 phy39: Selected rate control algorithm 'minstrel_ht'
RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001
RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000
R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7e16139e9c CR3: 000000000e74e000 CR4: 0000000000752ef0
PKRU: 55555554
Kernel panic - not syncing: Fatal exception
Signed-off-by: Helen Koike <koike@igalia.com>
---
Hi all,
I noticed this check is used through out the code, and it fixes the
issue I'm hitting.
I'm not very familiar with the Bluetooth subsystem, so please let me
know if I should follow another path to correct this and I can dig
further.
Thanks
Helen
---
net/bluetooth/l2cap_sock.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 597686790371..71e8c1b45bce 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1698,6 +1698,9 @@ static void l2cap_sock_ready_cb(struct l2cap_chan *chan)
struct sock *sk = chan->data;
struct sock *parent;
+ if (!sk)
+ return;
+
lock_sock(sk);
parent = bt_sk(sk)->parent;
--
2.53.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* RE: Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
2026-03-19 11:58 [PATCH] Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb Helen Koike
@ 2026-03-19 12:26 ` bluez.test.bot
2026-03-19 18:10 ` [PATCH] " patchwork-bot+bluetooth
1 sibling, 0 replies; 3+ messages in thread
From: bluez.test.bot @ 2026-03-19 12:26 UTC (permalink / raw)
To: linux-bluetooth, koike
[-- Attachment #1: Type: text/plain, Size: 2833 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1069250
---Test result---
Test Summary:
CheckPatch PENDING 0.34 seconds
GitLint PENDING 0.28 seconds
SubjectPrefix PASS 0.12 seconds
BuildKernel PASS 25.99 seconds
CheckAllWarning PASS 28.48 seconds
CheckSparse PASS 27.29 seconds
BuildKernel32 PASS 25.16 seconds
TestRunnerSetup PASS 564.86 seconds
TestRunner_l2cap-tester PASS 27.38 seconds
TestRunner_iso-tester FAIL 31.73 seconds
TestRunner_bnep-tester PASS 6.26 seconds
TestRunner_mgmt-tester FAIL 115.57 seconds
TestRunner_rfcomm-tester PASS 9.29 seconds
TestRunner_sco-tester FAIL 14.10 seconds
TestRunner_ioctl-tester PASS 10.28 seconds
TestRunner_mesh-tester FAIL 11.48 seconds
TestRunner_smp-tester PASS 8.45 seconds
TestRunner_userchan-tester PASS 6.65 seconds
IncrementalBuild PENDING 0.99 seconds
Details
##############################
Test: CheckPatch - PENDING
Desc: Run checkpatch.pl script
Output:
##############################
Test: GitLint - PENDING
Desc: Run gitlint
Output:
##############################
Test: TestRunner_iso-tester - FAIL
Desc: Run iso-tester with test-runner
Output:
BUG: KASAN: slab-use-after-free in le_read_features_complete+0x7e/0x2b0
Total: 141, Passed: 141 (100.0%), Failed: 0, Not Run: 0
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
Total: 494, Passed: 489 (99.0%), Failed: 1, Not Run: 4
Failed Test Cases
Read Exp Feature - Success Failed 0.108 seconds
##############################
Test: TestRunner_sco-tester - FAIL
Desc: Run sco-tester with test-runner
Output:
WARNING: possible circular locking dependency detected
BUG: sleeping function called from invalid context at net/core/sock.c:3782
Total: 30, Passed: 30 (100.0%), Failed: 0, Not Run: 0
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner
Output:
Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0
Failed Test Cases
Mesh - Send cancel - 1 Timed out 1.980 seconds
Mesh - Send cancel - 2 Timed out 2.006 seconds
##############################
Test: IncrementalBuild - PENDING
Desc: Incremental build with the patches in the series
Output:
---
Regards,
Linux Bluetooth
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
2026-03-19 11:58 [PATCH] Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb Helen Koike
2026-03-19 12:26 ` bluez.test.bot
@ 2026-03-19 18:10 ` patchwork-bot+bluetooth
1 sibling, 0 replies; 3+ messages in thread
From: patchwork-bot+bluetooth @ 2026-03-19 18:10 UTC (permalink / raw)
To: Helen Koike; +Cc: marcel, luiz.dentz, linux-bluetooth, linux-kernel, kernel-dev
Hello:
This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
On Thu, 19 Mar 2026 08:58:01 -0300 you wrote:
> Before using sk pointer, check if it is null.
>
> Fix the following:
>
> KASAN: null-ptr-deref in range [0x0000000000000260-0x0000000000000267]
> CPU: 0 UID: 0 PID: 5985 Comm: kworker/0:5 Not tainted 7.0.0-rc4-00029-ga989fde763f4 #1 PREEMPT(full)
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-9.fc43 06/10/2025
> Workqueue: events l2cap_info_timeout
> RIP: 0010:kasan_byte_accessible+0x12/0x30
> Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cce
> veth0_macvtap: entered promiscuous mode
> RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202
> RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001
> RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c
> RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
> R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000
> R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001
> FS: 0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00005582615a5008 CR3: 000000007007e000 CR4: 0000000000752ef0
> PKRU: 55555554
> Call Trace:
> <TASK>
> __kasan_check_byte+0x12/0x40
> lock_acquire+0x79/0x2e0
> lock_sock_nested+0x48/0x100
> ? l2cap_sock_ready_cb+0x46/0x160
> l2cap_sock_ready_cb+0x46/0x160
> l2cap_conn_start+0x779/0xff0
> ? __pfx_l2cap_conn_start+0x10/0x10
> ? l2cap_info_timeout+0x60/0xa0
> ? __pfx___mutex_lock+0x10/0x10
> l2cap_info_timeout+0x68/0xa0
> ? process_scheduled_works+0xa8d/0x18c0
> process_scheduled_works+0xb6e/0x18c0
> ? __pfx_process_scheduled_works+0x10/0x10
> ? assign_work+0x3d5/0x5e0
> worker_thread+0xa53/0xfc0
> kthread+0x388/0x470
> ? __pfx_worker_thread+0x10/0x10
> ? __pfx_kthread+0x10/0x10
> ret_from_fork+0x51e/0xb90
> ? __pfx_ret_from_fork+0x10/0x10
> veth1_macvtap: entered promiscuous mode
> ? __switch_to+0xc7d/0x1450
> ? __pfx_kthread+0x10/0x10
> ret_from_fork_asm+0x1a/0x30
> </TASK>
> Modules linked in:
>
> [...]
Here is the summary with links:
- Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
https://git.kernel.org/bluetooth/bluetooth-next/c/bc280a5ed9ef
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-03-19 18:10 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-03-19 11:58 [PATCH] Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb Helen Koike
2026-03-19 12:26 ` bluez.test.bot
2026-03-19 18:10 ` [PATCH] " patchwork-bot+bluetooth
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox