[syzbot] [bluetooth?] KMSAN: uninit-value in hci_rx_work

[syzbot] [bluetooth?] KMSAN: uninit-value in hci_rx_work

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    2c9b3512402e Merge tag 'for-linus' of git://git.kernel.org..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12628cad980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=6bfb33a8ad10458f
dashboard link: https://syzkaller.appspot.com/bug?extid=6ea290ba76d8c1eb1ac2
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: i386

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/9593db3ad921/disk-2c9b3512.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/77c4ed0c2bb7/vmlinux-2c9b3512.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b1e492f9354b/bzImage-2c9b3512.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+6ea290ba76d8c1eb1ac2@syzkaller.appspotmail.com

=====================================================
BUG: KMSAN: uninit-value in hci_scodata_packet net/bluetooth/hci_core.c:3835 [inline]
BUG: KMSAN: uninit-value in hci_rx_work+0x10a8/0x1130 net/bluetooth/hci_core.c:4039
 hci_scodata_packet net/bluetooth/hci_core.c:3835 [inline]
 hci_rx_work+0x10a8/0x1130 net/bluetooth/hci_core.c:4039
 process_one_work kernel/workqueue.c:3231 [inline]
 process_scheduled_works+0xae0/0x1c40 kernel/workqueue.c:3312
 worker_thread+0xea5/0x1520 kernel/workqueue.c:3390
 kthread+0x3e2/0x540 kernel/kthread.c:389
 ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Uninit was created at:
 slab_post_alloc_hook mm/slub.c:3985 [inline]
 slab_alloc_node mm/slub.c:4028 [inline]
 kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4071
 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:583
 __alloc_skb+0x363/0x7b0 net/core/skbuff.c:674
 alloc_skb include/linux/skbuff.h:1320 [inline]
 bt_skb_alloc include/net/bluetooth/bluetooth.h:493 [inline]
 vhci_get_user drivers/bluetooth/hci_vhci.c:489 [inline]
 vhci_write+0x128/0x910 drivers/bluetooth/hci_vhci.c:609
 new_sync_write fs/read_write.c:497 [inline]
 vfs_write+0xb2f/0x1550 fs/read_write.c:590
 ksys_write+0x20f/0x4c0 fs/read_write.c:643
 __do_sys_write fs/read_write.c:655 [inline]
 __se_sys_write fs/read_write.c:652 [inline]
 __ia32_sys_write+0x91/0xe0 fs/read_write.c:652
 ia32_sys_call+0x2e34/0x40d0 arch/x86/include/generated/asm/syscalls_32.h:5
 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
 __do_fast_syscall_32+0xb0/0x110 arch/x86/entry/common.c:386
 do_fast_syscall_32+0x38/0x80 arch/x86/entry/common.c:411
 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:449
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e

CPU: 1 PID: 5058 Comm: kworker/u9:6 Not tainted 6.10.0-syzkaller-11185-g2c9b3512402e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Workqueue: hci3 hci_rx_work
=====================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] [bluetooth?] KMSAN: uninit-value in hci_rx_work

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit:    8cf0b93919e1 Linux 6.12-rc2
git tree:       upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=164bc707980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=981fe2ff8a1e457a
dashboard link: https://syzkaller.appspot.com/bug?extid=6ea290ba76d8c1eb1ac2
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=114bc707980000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=17b74327980000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e6ae962426a8/disk-8cf0b939.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6965b62be377/vmlinux-8cf0b939.xz
kernel image: https://storage.googleapis.com/syzbot-assets/1a0056895389/bzImage-8cf0b939.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+6ea290ba76d8c1eb1ac2@syzkaller.appspotmail.com

=====================================================
BUG: KMSAN: uninit-value in hci_acldata_packet net/bluetooth/hci_core.c:3796 [inline]
BUG: KMSAN: uninit-value in hci_rx_work+0x1092/0x11f0 net/bluetooth/hci_core.c:4030
 hci_acldata_packet net/bluetooth/hci_core.c:3796 [inline]
 hci_rx_work+0x1092/0x11f0 net/bluetooth/hci_core.c:4030
 process_one_work kernel/workqueue.c:3229 [inline]
 process_scheduled_works+0xae0/0x1c40 kernel/workqueue.c:3310
 worker_thread+0xea7/0x14f0 kernel/workqueue.c:3391
 kthread+0x3e2/0x540 kernel/kthread.c:389
 ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Uninit was created at:
 slab_post_alloc_hook mm/slub.c:4091 [inline]
 slab_alloc_node mm/slub.c:4134 [inline]
 kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4186
 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:587
 __alloc_skb+0x363/0x7b0 net/core/skbuff.c:678
 alloc_skb include/linux/skbuff.h:1322 [inline]
 bt_skb_alloc include/net/bluetooth/bluetooth.h:493 [inline]
 vhci_get_user drivers/bluetooth/hci_vhci.c:487 [inline]
 vhci_write+0x127/0x900 drivers/bluetooth/hci_vhci.c:607
 new_sync_write fs/read_write.c:590 [inline]
 vfs_write+0xb28/0x1540 fs/read_write.c:683
 ksys_write+0x24f/0x4c0 fs/read_write.c:736
 __do_sys_write fs/read_write.c:748 [inline]
 __se_sys_write fs/read_write.c:745 [inline]
 __x64_sys_write+0x93/0xe0 fs/read_write.c:745
 x64_sys_call+0x306a/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 1 UID: 0 PID: 4565 Comm: kworker/u9:1 Not tainted 6.12.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: hci0 hci_rx_work
=====================================================


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

Re: [syzbot] [bluetooth?] KMSAN: uninit-value in hci_rx_work

[Edward Adam Davis]

set skb reserve memory to 0.

#syz test

diff --git a/drivers/bluetooth/hci_vhci.c b/drivers/bluetooth/hci_vhci.c
index aa6af351d02d..b2e99a83d6c7 100644
--- a/drivers/bluetooth/hci_vhci.c
+++ b/drivers/bluetooth/hci_vhci.c
@@ -492,6 +492,7 @@ static inline ssize_t vhci_get_user(struct vhci_data *data,
 		kfree_skb(skb);
 		return -EFAULT;
 	}
+	memset(skb + len, 0, BT_SKB_RESERVE);
 
 	pkt_type = *((__u8 *) skb->data);
 	skb_pull(skb, 1);

Re: [syzbot] [bluetooth?] KMSAN: uninit-value in hci_rx_work

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: uninit-value in hci_rx_work

=====================================================
BUG: KMSAN: uninit-value in hci_acldata_packet net/bluetooth/hci_core.c:3796 [inline]
BUG: KMSAN: uninit-value in hci_rx_work+0x1092/0x11f0 net/bluetooth/hci_core.c:4030
 hci_acldata_packet net/bluetooth/hci_core.c:3796 [inline]
 hci_rx_work+0x1092/0x11f0 net/bluetooth/hci_core.c:4030
 process_one_work kernel/workqueue.c:3229 [inline]
 process_scheduled_works+0xae0/0x1c40 kernel/workqueue.c:3310
 worker_thread+0xea7/0x14f0 kernel/workqueue.c:3391
 kthread+0x3e2/0x540 kernel/kthread.c:389
 ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Uninit was created at:
 slab_post_alloc_hook mm/slub.c:4091 [inline]
 slab_alloc_node mm/slub.c:4134 [inline]
 kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4186
 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:587
 __alloc_skb+0x363/0x7b0 net/core/skbuff.c:678
 alloc_skb include/linux/skbuff.h:1322 [inline]
 bt_skb_alloc include/net/bluetooth/bluetooth.h:493 [inline]
 vhci_get_user drivers/bluetooth/hci_vhci.c:487 [inline]
 vhci_write+0x122/0x960 drivers/bluetooth/hci_vhci.c:608
 new_sync_write fs/read_write.c:590 [inline]
 vfs_write+0xb28/0x1540 fs/read_write.c:683
 ksys_write+0x24f/0x4c0 fs/read_write.c:736
 __do_sys_write fs/read_write.c:748 [inline]
 __se_sys_write fs/read_write.c:745 [inline]
 __x64_sys_write+0x93/0xe0 fs/read_write.c:745
 x64_sys_call+0x306a/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 0 UID: 0 PID: 4561 Comm: kworker/u9:1 Tainted: G        W          6.12.0-rc2-syzkaller-g8cf0b93919e1-dirty #0
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: hci0 hci_rx_work
=====================================================


Tested on:

commit:         8cf0b939 Linux 6.12-rc2
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=121adb80580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=981fe2ff8a1e457a
dashboard link: https://syzkaller.appspot.com/bug?extid=6ea290ba76d8c1eb1ac2
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=150fc707980000

Re: [syzbot] [bluetooth?] KMSAN: uninit-value in hci_rx_work

[Edward Adam Davis]

bt device is closed ?

#syz test

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index d6976db02c06..c55f0ca33b90 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -3791,7 +3791,7 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
 		l2cap_recv_acldata(conn, skb, flags);
 		return;
 	} else {
-		bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
+		BT_ERR("ACL packet for unknown connection handle %d",
 			   handle);
 	}
 

Re: [syzbot] [bluetooth?] KMSAN: uninit-value in hci_rx_work

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: uninit-value in hci_rx_work

=====================================================
BUG: KMSAN: uninit-value in hci_acldata_packet net/bluetooth/hci_core.c:3796 [inline]
BUG: KMSAN: uninit-value in hci_rx_work+0xff7/0x1150 net/bluetooth/hci_core.c:4030
 hci_acldata_packet net/bluetooth/hci_core.c:3796 [inline]
 hci_rx_work+0xff7/0x1150 net/bluetooth/hci_core.c:4030
 process_one_work kernel/workqueue.c:3229 [inline]
 process_scheduled_works+0xae0/0x1c40 kernel/workqueue.c:3310
 worker_thread+0xea7/0x14f0 kernel/workqueue.c:3391
 kthread+0x3e2/0x540 kernel/kthread.c:389
 ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Uninit was created at:
 slab_post_alloc_hook mm/slub.c:4091 [inline]
 slab_alloc_node mm/slub.c:4134 [inline]
 kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4186
 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:587
 __alloc_skb+0x363/0x7b0 net/core/skbuff.c:678
 alloc_skb include/linux/skbuff.h:1322 [inline]
 bt_skb_alloc include/net/bluetooth/bluetooth.h:493 [inline]
 vhci_get_user drivers/bluetooth/hci_vhci.c:487 [inline]
 vhci_write+0x127/0x900 drivers/bluetooth/hci_vhci.c:607
 new_sync_write fs/read_write.c:590 [inline]
 vfs_write+0xb28/0x1540 fs/read_write.c:683
 ksys_write+0x24f/0x4c0 fs/read_write.c:736
 __do_sys_write fs/read_write.c:748 [inline]
 __se_sys_write fs/read_write.c:745 [inline]
 __x64_sys_write+0x93/0xe0 fs/read_write.c:745
 x64_sys_call+0x306a/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 0 UID: 0 PID: 4556 Comm: kworker/u9:1 Not tainted 6.12.0-rc2-syzkaller-g87d6aab2389e-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: hci0 hci_rx_work
=====================================================


Tested on:

commit:         87d6aab2 Merge tag 'for_linus' of git://git.kernel.org..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1602bb80580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=981fe2ff8a1e457a
dashboard link: https://syzkaller.appspot.com/bug?extid=6ea290ba76d8c1eb1ac2
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=12890f9f980000

Re: [syzbot] [bluetooth?] KMSAN: uninit-value in hci_rx_work

[Edward Adam Davis]

If hci_queue_acl is not executed, where does hci_acl_hdr->handle come from ?

#syz test

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index d6976db02c06..6e22eb33fdc7 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -3185,6 +3185,7 @@ static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
 
 	hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
 
+	printk("conn: %p, cnn H: %u, %s\n", conn, conn->handle, __func__);
 	hci_add_acl_hdr(skb, conn->handle, flags);
 
 	list = skb_shinfo(skb)->frag_list;
@@ -3791,8 +3792,7 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
 		l2cap_recv_acldata(conn, skb, flags);
 		return;
 	} else {
-		bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
-			   handle);
+		bt_dev_err(hdev, "ACL packet for unknown connection handle");
 	}
 
 	kfree_skb(skb);

Re: [syzbot] [bluetooth?] KMSAN: uninit-value in hci_rx_work

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+6ea290ba76d8c1eb1ac2@syzkaller.appspotmail.com
Tested-by: syzbot+6ea290ba76d8c1eb1ac2@syzkaller.appspotmail.com

Tested on:

commit:         87d6aab2 Merge tag 'for_linus' of git://git.kernel.org..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14eba327980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=981fe2ff8a1e457a
dashboard link: https://syzkaller.appspot.com/bug?extid=6ea290ba76d8c1eb1ac2
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=11cbbb80580000

Note: testing is done by a robot and is best-effort only.

[PATCH] Bluetooth: hci_core: remove acl hdr handle error message

[Edward Adam Davis]

Syzbot reported a uninit-value in hci_rx_work.This is because l2cap didn't
execute the corresponding connection request to call l2cap_send_cmd() or
l2cap_do_send(), and ultimately called hci_add_acl_hdr() to set hdr->handle.

Therefore, when calling the thread callback function hci_rx_work() to call
hci_acldata_packet, hdr->handle should not be used directly.

Reported-and-tested-by: syzbot+6ea290ba76d8c1eb1ac2@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6ea290ba76d8c1eb1ac2
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
 net/bluetooth/hci_core.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index d6976db02c06..20605a7f3f4e 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -3791,8 +3791,7 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
 		l2cap_recv_acldata(conn, skb, flags);
 		return;
 	} else {
-		bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
-			   handle);
+		bt_dev_err(hdev, "ACL packet for unknown connection handle");
 	}
 
 	kfree_skb(skb);
-- 
2.43.0

Re: [PATCH] Bluetooth: hci_core: remove acl hdr handle error message

[Luiz Augusto von Dentz]

Hi Edward,

On Tue, Oct 8, 2024 at 6:47 AM Edward Adam Davis <eadavis@qq.com> wrote:
>
> Syzbot reported a uninit-value in hci_rx_work.This is because l2cap didn't
> execute the corresponding connection request to call l2cap_send_cmd() or
> l2cap_do_send(), and ultimately called hci_add_acl_hdr() to set hdr->handle.

What are you talking about here, what these functions have to do with
a local handle variable?

> Therefore, when calling the thread callback function hci_rx_work() to call
> hci_acldata_packet, hdr->handle should not be used directly.

It is not being used directly, the handle is a local variable which
get assigned:

    handle = __le16_to_cpu(hdr->handle);

If what you are saying is that there is no guarantee that skb->len >=
HCI_ACL_HDR_SIZE then we probably want to replace skb_pull with
skb_pull_data.

> Reported-and-tested-by: syzbot+6ea290ba76d8c1eb1ac2@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=6ea290ba76d8c1eb1ac2
> Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> ---
>  net/bluetooth/hci_core.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
> index d6976db02c06..20605a7f3f4e 100644
> --- a/net/bluetooth/hci_core.c
> +++ b/net/bluetooth/hci_core.c
> @@ -3791,8 +3791,7 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
>                 l2cap_recv_acldata(conn, skb, flags);
>                 return;
>         } else {
> -               bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
> -                          handle);
> +               bt_dev_err(hdev, "ACL packet for unknown connection handle");
>         }
>
>         kfree_skb(skb);
> --
> 2.43.0
>


-- 
Luiz Augusto von Dentz

Re: [PATCH] Bluetooth: hci_core: remove acl hdr handle error message

[Luiz Augusto von Dentz]

[-- Attachment #1: Type: text/plain, Size: 2068 bytes --]

On Tue, Oct 8, 2024 at 10:12 AM Luiz Augusto von Dentz
<luiz.dentz@gmail.com> wrote:
>
> Hi Edward,
>
> On Tue, Oct 8, 2024 at 6:47 AM Edward Adam Davis <eadavis@qq.com> wrote:
> >
> > Syzbot reported a uninit-value in hci_rx_work.This is because l2cap didn't
> > execute the corresponding connection request to call l2cap_send_cmd() or
> > l2cap_do_send(), and ultimately called hci_add_acl_hdr() to set hdr->handle.
>
> What are you talking about here, what these functions have to do with
> a local handle variable?
>
> > Therefore, when calling the thread callback function hci_rx_work() to call
> > hci_acldata_packet, hdr->handle should not be used directly.
>
> It is not being used directly, the handle is a local variable which
> get assigned:
>
>     handle = __le16_to_cpu(hdr->handle);
>
> If what you are saying is that there is no guarantee that skb->len >=
> HCI_ACL_HDR_SIZE then we probably want to replace skb_pull with
> skb_pull_data.
>
> > Reported-and-tested-by: syzbot+6ea290ba76d8c1eb1ac2@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=6ea290ba76d8c1eb1ac2
> > Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> > ---
> >  net/bluetooth/hci_core.c | 3 +--
> >  1 file changed, 1 insertion(+), 2 deletions(-)
> >
> > diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
> > index d6976db02c06..20605a7f3f4e 100644
> > --- a/net/bluetooth/hci_core.c
> > +++ b/net/bluetooth/hci_core.c
> > @@ -3791,8 +3791,7 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
> >                 l2cap_recv_acldata(conn, skb, flags);
> >                 return;
> >         } else {
> > -               bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
> > -                          handle);
> > +               bt_dev_err(hdev, "ACL packet for unknown connection handle");
> >         }
> >
> >         kfree_skb(skb);
> > --
> > 2.43.0
> >
>
>
> --
> Luiz Augusto von Dentz

#syz test

-- 
Luiz Augusto von Dentz

[-- Attachment #2: v1-0001-Bluetooth-hci_core-Fix-not-checking-skb-length-on.patch --]
[-- Type: text/x-patch, Size: 1684 bytes --]

From cda0135697d86de8a2d732df17e0fa497c2f02ff Mon Sep 17 00:00:00 2001
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: Tue, 8 Oct 2024 10:16:48 -0400
Subject: [PATCH v1] Bluetooth: hci_core: Fix not checking skb length on
 hci_acldata_packet

This fixes not checking if skb really contains an ACL header otherwise
the code may attempt to access some uninitilized/invalid memory past the
actual skb->data.

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
 net/bluetooth/hci_core.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index b2f8f9c5b610..d5f917076e0e 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -3765,18 +3765,22 @@ static void hci_tx_work(struct work_struct *work)
 /* ACL data packet */
 static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
 {
-	struct hci_acl_hdr *hdr = (void *) skb->data;
+	struct hci_acl_hdr *hdr;
 	struct hci_conn *conn;
 	__u16 handle, flags;
 
-	skb_pull(skb, HCI_ACL_HDR_SIZE);
+	hdr = skb_pull_data(skb, sizeof(*hdr));
+	if (!hdr) {
+		bt_dev_err(hdev, "ACL packet too small");
+		goto drop;
+	}
 
 	handle = __le16_to_cpu(hdr->handle);
 	flags  = hci_flags(handle);
 	handle = hci_handle(handle);
 
-	BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
-	       handle, flags);
+	bt_dev_dbg(hdev, "len %d handle 0x%4.4x flags 0x%4.4x", skb->len,
+		   handle, flags);
 
 	hdev->stat.acl_rx++;
 
@@ -3797,6 +3801,7 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
 			   handle);
 	}
 
+drop:
 	kfree_skb(skb);
 }
 
-- 
2.46.1

Re: [syzbot] [bluetooth?] KMSAN: uninit-value in hci_rx_work

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+6ea290ba76d8c1eb1ac2@syzkaller.appspotmail.com
Tested-by: syzbot+6ea290ba76d8c1eb1ac2@syzkaller.appspotmail.com

Tested on:

commit:         87d6aab2 Merge tag 'for_linus' of git://git.kernel.org..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14bf8f9f980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=981fe2ff8a1e457a
dashboard link: https://syzkaller.appspot.com/bug?extid=6ea290ba76d8c1eb1ac2
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=14f41780580000

Note: testing is done by a robot and is best-effort only.

Re: [PATCH] Bluetooth: hci_core: remove acl hdr handle error message

[Edward Adam Davis]

On Tue, 8 Oct 2024 10:12:34 -0400, Luiz Augusto von Dentz wrote:
> On Tue, Oct 8, 2024 at 6:47 AM Edward Adam Davis <eadavis@qq.com> wrote:
> >
> > Syzbot reported a uninit-value in hci_rx_work.This is because l2cap didn't
> > execute the corresponding connection request to call l2cap_send_cmd() or
> > l2cap_do_send(), and ultimately called hci_add_acl_hdr() to set hdr->handle.
> 
> What are you talking about here, what these functions have to do with
> a local handle variable?
> 
> > Therefore, when calling the thread callback function hci_rx_work() to call
> > hci_acldata_packet, hdr->handle should not be used directly.
> 
> It is not being used directly, the handle is a local variable which
> get assigned:
> 
>     handle = __le16_to_cpu(hdr->handle);
> 
> If what you are saying is that there is no guarantee that skb->len >=
> HCI_ACL_HDR_SIZE then we probably want to replace skb_pull with
> skb_pull_data.
You are right, skb->len is too small.
But, skb_pull is ok, maybe just need to add a check.

#syz test

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index d6976db02c06..cfb828452a13 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -3769,7 +3769,11 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
 	struct hci_conn *conn;
 	__u16 handle, flags;
 
-	skb_pull(skb, HCI_ACL_HDR_SIZE);
+	if (!skb_pull(skb, HCI_ACL_HDR_SIZE)) {
+		BT_ERR("ACL data packet %d, smaller than ACL HEADER Size %d\n",
+			skb->len, HCI_ACL_HDR_SIZE);
+		goto out;
+	}
 
 	handle = __le16_to_cpu(hdr->handle);
 	flags  = hci_flags(handle);
@@ -3795,6 +3799,7 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
 			   handle);
 	}
 
+out:
 	kfree_skb(skb);
 }
 

Re: [syzbot] [bluetooth?] KMSAN: uninit-value in hci_rx_work

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+6ea290ba76d8c1eb1ac2@syzkaller.appspotmail.com
Tested-by: syzbot+6ea290ba76d8c1eb1ac2@syzkaller.appspotmail.com

Tested on:

commit:         75b607fa Merge tag 'sched_ext-for-6.12-rc2-fixes' of g..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1415f380580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=981fe2ff8a1e457a
dashboard link: https://syzkaller.appspot.com/bug?extid=6ea290ba76d8c1eb1ac2
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=12e37707980000

Note: testing is done by a robot and is best-effort only.