* [syzbot] [bluetooth?] BUG: sleeping function called from invalid context in hci_le_create_big_complete_evt
@ 2024-04-07 11:33 syzbot
2024-04-07 12:16 ` Hillf Danton
` (4 more replies)
0 siblings, 5 replies; 10+ messages in thread
From: syzbot @ 2024-04-07 11:33 UTC (permalink / raw)
To: johan.hedberg, linux-bluetooth, linux-kernel, luiz.dentz, marcel,
syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 480e035fc4c7 Merge tag 'drm-next-2024-03-13' of https://gi..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=12154da9180000
kernel config: https://syzkaller.appspot.com/x/.config?x=1e5b814e91787669
dashboard link: https://syzkaller.appspot.com/bug?extid=2fb0835e0c9cefc34614
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14136223180000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11ee2e75180000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/5f73b6ef963d/disk-480e035f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/46c949396aad/vmlinux-480e035f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/e3b4d0f5a5f8/bzImage-480e035f.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+2fb0835e0c9cefc34614@syzkaller.appspotmail.com
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:585
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 5070, name: kworker/u9:2
preempt_count: 0, expected: 0
RCU nest depth: 1, expected: 0
4 locks held by kworker/u9:2/5070:
#0: ffff888015be3948 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3229 [inline]
#0: ffff888015be3948 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_scheduled_works+0x8e0/0x1770 kernel/workqueue.c:3335
#1: ffffc90003b6fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3230 [inline]
#1: ffffc90003b6fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x91b/0x1770 kernel/workqueue.c:3335
#2: ffff8880665d0078 (&hdev->lock){+.+.}-{3:3}, at: hci_le_create_big_complete_evt+0xcf/0xae0 net/bluetooth/hci_event.c:6914
#3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline]
#3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline]
#3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: hci_le_create_big_complete_evt+0xdb/0xae0 net/bluetooth/hci_event.c:6915
CPU: 0 PID: 5070 Comm: kworker/u9:2 Not tainted 6.8.0-syzkaller-08073-g480e035fc4c7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: hci0 hci_rx_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
__might_resched+0x5d4/0x780 kernel/sched/core.c:10187
__mutex_lock_common kernel/locking/mutex.c:585 [inline]
__mutex_lock+0xc1/0xd70 kernel/locking/mutex.c:752
hci_connect_cfm include/net/bluetooth/hci_core.h:2004 [inline]
hci_le_create_big_complete_evt+0x3d9/0xae0 net/bluetooth/hci_event.c:6939
hci_event_func net/bluetooth/hci_event.c:7514 [inline]
hci_event_packet+0xa53/0x1540 net/bluetooth/hci_event.c:7569
hci_rx_work+0x3e8/0xca0 net/bluetooth/hci_core.c:4171
process_one_work kernel/workqueue.c:3254 [inline]
process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335
worker_thread+0x86d/0xd70 kernel/workqueue.c:3416
kthread+0x2f0/0x390 kernel/kthread.c:388
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
</TASK>
=============================
[ BUG: Invalid wait context ]
6.8.0-syzkaller-08073-g480e035fc4c7 #0 Tainted: G W
-----------------------------
kworker/u9:2/5070 is trying to lock:
ffffffff8f4f5aa8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2004 [inline]
ffffffff8f4f5aa8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_le_create_big_complete_evt+0x3d9/0xae0 net/bluetooth/hci_event.c:6939
other info that might help us debug this:
context-{4:4}
4 locks held by kworker/u9:2/5070:
#0: ffff888015be3948 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3229 [inline]
#0: ffff888015be3948 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_scheduled_works+0x8e0/0x1770 kernel/workqueue.c:3335
#1: ffffc90003b6fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3230 [inline]
#1: ffffc90003b6fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x91b/0x1770 kernel/workqueue.c:3335
#2: ffff8880665d0078 (&hdev->lock){+.+.}-{3:3}, at: hci_le_create_big_complete_evt+0xcf/0xae0 net/bluetooth/hci_event.c:6914
#3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline]
#3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline]
#3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: hci_le_create_big_complete_evt+0xdb/0xae0 net/bluetooth/hci_event.c:6915
stack backtrace:
CPU: 0 PID: 5070 Comm: kworker/u9:2 Tainted: G W 6.8.0-syzkaller-08073-g480e035fc4c7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: hci0 hci_rx_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
print_lock_invalid_wait_context kernel/locking/lockdep.c:4751 [inline]
check_wait_context kernel/locking/lockdep.c:4821 [inline]
__lock_acquire+0x1507/0x1fd0 kernel/locking/lockdep.c:5087
lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x136/0xd70 kernel/locking/mutex.c:752
hci_connect_cfm include/net/bluetooth/hci_core.h:2004 [inline]
hci_le_create_big_complete_evt+0x3d9/0xae0 net/bluetooth/hci_event.c:6939
hci_event_func net/bluetooth/hci_event.c:7514 [inline]
hci_event_packet+0xa53/0x1540 net/bluetooth/hci_event.c:7569
hci_rx_work+0x3e8/0xca0 net/bluetooth/hci_core.c:4171
process_one_work kernel/workqueue.c:3254 [inline]
process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335
worker_thread+0x86d/0xd70 kernel/workqueue.c:3416
kthread+0x2f0/0x390 kernel/kthread.c:388
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
</TASK>
==================================================================
BUG: KASAN: slab-use-after-free in hci_le_create_big_complete_evt+0x383/0xae0
Read of size 8 at addr ffff88807cb1c000 by task kworker/u9:2/5070
CPU: 0 PID: 5070 Comm: kworker/u9:2 Tainted: G W 6.8.0-syzkaller-08073-g480e035fc4c7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: hci0 hci_rx_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
hci_le_create_big_complete_evt+0x383/0xae0
hci_event_func net/bluetooth/hci_event.c:7514 [inline]
hci_event_packet+0xa53/0x1540 net/bluetooth/hci_event.c:7569
hci_rx_work+0x3e8/0xca0 net/bluetooth/hci_core.c:4171
process_one_work kernel/workqueue.c:3254 [inline]
process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335
worker_thread+0x86d/0xd70 kernel/workqueue.c:3416
kthread+0x2f0/0x390 kernel/kthread.c:388
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
</TASK>
Allocated by task 5070:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
__kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387
kasan_kmalloc include/linux/kasan.h:211 [inline]
kmalloc_trace+0x1db/0x360 mm/slub.c:3997
kmalloc include/linux/slab.h:628 [inline]
kzalloc include/linux/slab.h:749 [inline]
hci_conn_add+0xc7/0x13a0 net/bluetooth/hci_conn.c:914
hci_le_big_sync_established_evt+0x1cf/0xb90 net/bluetooth/hci_event.c:6980
hci_event_func net/bluetooth/hci_event.c:7514 [inline]
hci_event_packet+0xa53/0x1540 net/bluetooth/hci_event.c:7569
hci_rx_work+0x3e8/0xca0 net/bluetooth/hci_core.c:4171
process_one_work kernel/workqueue.c:3254 [inline]
process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335
worker_thread+0x86d/0xd70 kernel/workqueue.c:3416
kthread+0x2f0/0x390 kernel/kthread.c:388
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
Freed by task 5070:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
poison_slab_object+0xa6/0xe0 mm/kasan/common.c:240
__kasan_slab_free+0x37/0x60 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2106 [inline]
slab_free mm/slub.c:4280 [inline]
kfree+0x14a/0x380 mm/slub.c:4390
device_release+0x99/0x1c0
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x22f/0x480 lib/kobject.c:737
hci_conn_cleanup net/bluetooth/hci_conn.c:176 [inline]
hci_conn_del+0x900/0xc80 net/bluetooth/hci_conn.c:1126
hci_le_create_big_complete_evt+0x619/0xae0 net/bluetooth/hci_event.c:6941
hci_event_func net/bluetooth/hci_event.c:7514 [inline]
hci_event_packet+0xa53/0x1540 net/bluetooth/hci_event.c:7569
hci_rx_work+0x3e8/0xca0 net/bluetooth/hci_core.c:4171
process_one_work kernel/workqueue.c:3254 [inline]
process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335
worker_thread+0x86d/0xd70 kernel/workqueue.c:3416
kthread+0x2f0/0x390 kernel/kthread.c:388
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
The buggy address belongs to the object at ffff88807cb1c000
which belongs to the cache kmalloc-8k of size 8192
The buggy address is located 0 bytes inside of
freed 8192-byte region [ffff88807cb1c000, ffff88807cb1e000)
The buggy address belongs to the physical page:
page:ffffea0001f2c600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7cb18
head:ffffea0001f2c600 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
ksm flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000840 ffff888014c42280 ffffea0001f2cc00 dead000000000003
raw: 0000000000000000 0000000080020002 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4524, tgid 4524 (S10udev), ts 19996984719, free_ts 17455903844
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1533
prep_new_page mm/page_alloc.c:1540 [inline]
get_page_from_freelist+0x33ea/0x3580 mm/page_alloc.c:3311
__alloc_pages+0x256/0x680 mm/page_alloc.c:4569
__alloc_pages_node include/linux/gfp.h:238 [inline]
alloc_pages_node include/linux/gfp.h:261 [inline]
alloc_slab_page+0x5f/0x160 mm/slub.c:2175
allocate_slab mm/slub.c:2338 [inline]
new_slab+0x84/0x2f0 mm/slub.c:2391
___slab_alloc+0xc73/0x1260 mm/slub.c:3525
__slab_alloc mm/slub.c:3610 [inline]
__slab_alloc_node mm/slub.c:3663 [inline]
slab_alloc_node mm/slub.c:3835 [inline]
kmalloc_trace+0x269/0x360 mm/slub.c:3992
kmalloc include/linux/slab.h:628 [inline]
kzalloc include/linux/slab.h:749 [inline]
tomoyo_print_bprm security/tomoyo/audit.c:26 [inline]
tomoyo_init_log+0x11ce/0x2050 security/tomoyo/audit.c:264
tomoyo_supervisor+0x38a/0x11f0 security/tomoyo/common.c:2089
tomoyo_audit_env_log security/tomoyo/environ.c:36 [inline]
tomoyo_env_perm+0x178/0x210 security/tomoyo/environ.c:63
tomoyo_environ security/tomoyo/domain.c:672 [inline]
tomoyo_find_next_domain+0x1384/0x1cf0 security/tomoyo/domain.c:878
tomoyo_bprm_check_security+0x115/0x180 security/tomoyo/tomoyo.c:102
security_bprm_check+0x65/0x90 security/security.c:1185
search_binary_handler fs/exec.c:1765 [inline]
exec_binprm fs/exec.c:1819 [inline]
bprm_execve+0xa56/0x1790 fs/exec.c:1871
do_execveat_common+0x553/0x700 fs/exec.c:1978
do_execve fs/exec.c:2052 [inline]
__do_sys_execve fs/exec.c:2128 [inline]
__se_sys_execve fs/exec.c:2123 [inline]
__x64_sys_execve+0x92/0xb0 fs/exec.c:2123
page last free pid 1 tgid 1 stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1140 [inline]
free_unref_page_prepare+0x968/0xa90 mm/page_alloc.c:2346
free_unref_page+0x37/0x3f0 mm/page_alloc.c:2486
free_contig_range+0x9e/0x160 mm/page_alloc.c:6547
destroy_args+0x8a/0x890 mm/debug_vm_pgtable.c:1036
debug_vm_pgtable+0x4be/0x550 mm/debug_vm_pgtable.c:1416
do_one_initcall+0x238/0x830 init/main.c:1241
do_initcall_level+0x157/0x210 init/main.c:1303
do_initcalls+0x3f/0x80 init/main.c:1319
kernel_init_freeable+0x435/0x5d0 init/main.c:1550
kernel_init+0x1d/0x2a0 init/main.c:1439
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
Memory state around the buggy address:
ffff88807cb1bf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88807cb1bf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88807cb1c000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88807cb1c080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88807cb1c100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: [syzbot] [bluetooth?] BUG: sleeping function called from invalid context in hci_le_create_big_complete_evt 2024-04-07 11:33 [syzbot] [bluetooth?] BUG: sleeping function called from invalid context in hci_le_create_big_complete_evt syzbot @ 2024-04-07 12:16 ` Hillf Danton 2024-04-07 12:50 ` syzbot 2024-04-07 13:59 ` syzbot ` (3 subsequent siblings) 4 siblings, 1 reply; 10+ messages in thread From: Hillf Danton @ 2024-04-07 12:16 UTC (permalink / raw) To: syzbot; +Cc: linux-kernel, syzkaller-bugs On Sun, 07 Apr 2024 04:33:29 -0700 > syzbot found the following issue on: > > HEAD commit: 480e035fc4c7 Merge tag 'drm-next-2024-03-13' of https://gi.. > git tree: upstream > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11ee2e75180000 #syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 480e035fc4c7 --- x/net/bluetooth/hci_event.c +++ y/net/bluetooth/hci_event.c @@ -6936,8 +6936,8 @@ static void hci_le_create_big_complete_e continue; } - hci_connect_cfm(conn, ev->status); rcu_read_unlock(); + hci_connect_cfm(conn, ev->status); hci_conn_del(conn); rcu_read_lock(); } -- ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] [bluetooth?] BUG: sleeping function called from invalid context in hci_le_create_big_complete_evt 2024-04-07 12:16 ` Hillf Danton @ 2024-04-07 12:50 ` syzbot 0 siblings, 0 replies; 10+ messages in thread From: syzbot @ 2024-04-07 12:50 UTC (permalink / raw) To: hdanton, linux-kernel, syzkaller-bugs Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: KASAN: slab-use-after-free Read in hci_le_create_big_complete_evt ================================================================== BUG: KASAN: slab-use-after-free in hci_le_create_big_complete_evt+0x383/0xb00 Read of size 8 at addr ffff88801f0b4000 by task kworker/u9:1/4465 CPU: 1 PID: 4465 Comm: kworker/u9:1 Not tainted 6.8.0-syzkaller-08073-g480e035fc4c7-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Workqueue: hci0 hci_rx_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 hci_le_create_big_complete_evt+0x383/0xb00 hci_event_func net/bluetooth/hci_event.c:7514 [inline] hci_event_packet+0xa53/0x1540 net/bluetooth/hci_event.c:7569 hci_rx_work+0x3e8/0xca0 net/bluetooth/hci_core.c:4171 process_one_work kernel/workqueue.c:3254 [inline] process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335 worker_thread+0x86d/0xd70 kernel/workqueue.c:3416 kthread+0x2f0/0x390 kernel/kthread.c:388 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 </TASK> Allocated by task 4465: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:370 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387 kasan_kmalloc include/linux/kasan.h:211 [inline] kmalloc_trace+0x1db/0x360 mm/slub.c:3997 kmalloc include/linux/slab.h:628 [inline] kzalloc include/linux/slab.h:749 [inline] hci_conn_add+0xc7/0x13a0 net/bluetooth/hci_conn.c:914 hci_le_big_sync_established_evt+0x1cf/0xb90 net/bluetooth/hci_event.c:6980 hci_event_func net/bluetooth/hci_event.c:7514 [inline] hci_event_packet+0xa53/0x1540 net/bluetooth/hci_event.c:7569 hci_rx_work+0x3e8/0xca0 net/bluetooth/hci_core.c:4171 process_one_work kernel/workqueue.c:3254 [inline] process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335 worker_thread+0x86d/0xd70 kernel/workqueue.c:3416 kthread+0x2f0/0x390 kernel/kthread.c:388 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 Freed by task 4465: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object+0xa6/0xe0 mm/kasan/common.c:240 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2106 [inline] slab_free mm/slub.c:4280 [inline] kfree+0x14a/0x380 mm/slub.c:4390 device_release+0x99/0x1c0 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x22f/0x480 lib/kobject.c:737 hci_conn_cleanup net/bluetooth/hci_conn.c:176 [inline] hci_conn_del+0x900/0xc80 net/bluetooth/hci_conn.c:1126 hci_le_create_big_complete_evt+0x61b/0xb00 net/bluetooth/hci_event.c:6941 hci_event_func net/bluetooth/hci_event.c:7514 [inline] hci_event_packet+0xa53/0x1540 net/bluetooth/hci_event.c:7569 hci_rx_work+0x3e8/0xca0 net/bluetooth/hci_core.c:4171 process_one_work kernel/workqueue.c:3254 [inline] process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335 worker_thread+0x86d/0xd70 kernel/workqueue.c:3416 kthread+0x2f0/0x390 kernel/kthread.c:388 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 The buggy address belongs to the object at ffff88801f0b4000 which belongs to the cache kmalloc-8k of size 8192 The buggy address is located 0 bytes inside of freed 8192-byte region [ffff88801f0b4000, ffff88801f0b6000) The buggy address belongs to the physical page: page:ffffea00007c2c00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1f0b0 head:ffffea00007c2c00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000000840 ffff888014c42280 ffffea00007efc00 dead000000000002 raw: 0000000000000000 0000000080020002 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd28c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4736, tgid 4736 (dhcpcd), ts 33772916994, free_ts 33772629416 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1533 prep_new_page mm/page_alloc.c:1540 [inline] get_page_from_freelist+0x33ea/0x3580 mm/page_alloc.c:3311 __alloc_pages+0x256/0x680 mm/page_alloc.c:4569 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] alloc_slab_page+0x5f/0x160 mm/slub.c:2175 allocate_slab mm/slub.c:2338 [inline] new_slab+0x84/0x2f0 mm/slub.c:2391 ___slab_alloc+0xc73/0x1260 mm/slub.c:3525 __slab_alloc mm/slub.c:3610 [inline] __slab_alloc_node mm/slub.c:3663 [inline] slab_alloc_node mm/slub.c:3835 [inline] __do_kmalloc_node mm/slub.c:3965 [inline] __kmalloc_node_track_caller+0x2d6/0x4e0 mm/slub.c:3986 kmalloc_reserve+0x111/0x2a0 net/core/skbuff.c:599 __alloc_skb+0x1f3/0x440 net/core/skbuff.c:668 alloc_skb include/linux/skbuff.h:1318 [inline] netlink_dump+0x1e6/0xe50 net/netlink/af_netlink.c:2229 netlink_recvmsg+0x6bb/0x11d0 net/netlink/af_netlink.c:1987 sock_recvmsg_nosec net/socket.c:1046 [inline] sock_recvmsg+0x22f/0x280 net/socket.c:1068 ____sys_recvmsg+0x1db/0x470 net/socket.c:2803 ___sys_recvmsg net/socket.c:2845 [inline] __sys_recvmsg+0x2f0/0x3e0 net/socket.c:2875 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 page last free pid 4736 tgid 4736 stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1140 [inline] free_unref_page_prepare+0x968/0xa90 mm/page_alloc.c:2346 free_unref_page+0x37/0x3f0 mm/page_alloc.c:2486 discard_slab mm/slub.c:2437 [inline] __put_partials+0xeb/0x130 mm/slub.c:2906 put_cpu_partial+0x17c/0x250 mm/slub.c:2981 __slab_free+0x2ea/0x3d0 mm/slub.c:4151 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x5e/0xc0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x23/0x80 mm/kasan/common.c:322 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slub.c:3798 [inline] slab_alloc_node mm/slub.c:3845 [inline] kmem_cache_alloc_node+0x194/0x380 mm/slub.c:3888 kmalloc_reserve+0xa8/0x2a0 net/core/skbuff.c:577 __alloc_skb+0x1f3/0x440 net/core/skbuff.c:668 netlink_sendmsg+0x637/0xcb0 net/netlink/af_netlink.c:1880 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:745 __sys_sendto+0x3a4/0x4f0 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2199 do_syscall_64+0xfb/0x240 Memory state around the buggy address: ffff88801f0b3f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88801f0b3f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88801f0b4000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88801f0b4080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88801f0b4100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Tested on: commit: 480e035f Merge tag 'drm-next-2024-03-13' of https://gi.. git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git console output: https://syzkaller.appspot.com/x/log.txt?x=16896499180000 kernel config: https://syzkaller.appspot.com/x/.config?x=1e5b814e91787669 dashboard link: https://syzkaller.appspot.com/bug?extid=2fb0835e0c9cefc34614 compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 patch: https://syzkaller.appspot.com/x/patch.diff?x=17b92e05180000 ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] [bluetooth?] BUG: sleeping function called from invalid context in hci_le_create_big_complete_evt 2024-04-07 11:33 [syzbot] [bluetooth?] BUG: sleeping function called from invalid context in hci_le_create_big_complete_evt syzbot 2024-04-07 12:16 ` Hillf Danton @ 2024-04-07 13:59 ` syzbot 2024-04-07 23:14 ` Hillf Danton ` (2 subsequent siblings) 4 siblings, 0 replies; 10+ messages in thread From: syzbot @ 2024-04-07 13:59 UTC (permalink / raw) To: davem, edumazet, hdanton, iulia.tanasescu, johan.hedberg, kuba, linux-bluetooth, linux-kernel, luiz.dentz, luiz.von.dentz, marcel, netdev, pabeni, syzkaller-bugs syzbot has bisected this issue to: commit a0bfde167b506423111ddb8cd71930497a40fc54 Author: Iulia Tanasescu <iulia.tanasescu@nxp.com> Date: Tue May 30 14:21:59 2023 +0000 Bluetooth: ISO: Add support for connecting multiple BISes bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=146c679d180000 start commit: 8568bb2ccc27 Add linux-next specific files for 20240405 git tree: linux-next final oops: https://syzkaller.appspot.com/x/report.txt?x=166c679d180000 console output: https://syzkaller.appspot.com/x/log.txt?x=126c679d180000 kernel config: https://syzkaller.appspot.com/x/.config?x=48ca5acf8d2eb3bc dashboard link: https://syzkaller.appspot.com/bug?extid=2fb0835e0c9cefc34614 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1338efc5180000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15428f4b180000 Reported-by: syzbot+2fb0835e0c9cefc34614@syzkaller.appspotmail.com Fixes: a0bfde167b50 ("Bluetooth: ISO: Add support for connecting multiple BISes") For information about bisection process see: https://goo.gl/tpsmEJ#bisection ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] [bluetooth?] BUG: sleeping function called from invalid context in hci_le_create_big_complete_evt 2024-04-07 11:33 [syzbot] [bluetooth?] BUG: sleeping function called from invalid context in hci_le_create_big_complete_evt syzbot 2024-04-07 12:16 ` Hillf Danton 2024-04-07 13:59 ` syzbot @ 2024-04-07 23:14 ` Hillf Danton 2024-04-08 1:50 ` syzbot 2024-12-03 22:30 ` [syzbot] Re: [PATCH v1] Bluetooth: hci_core: Fix sleeping function called from invalid context syzbot 2024-12-05 15:13 ` [syzbot] Re: [PATCH v2] " syzbot 4 siblings, 1 reply; 10+ messages in thread From: Hillf Danton @ 2024-04-07 23:14 UTC (permalink / raw) To: syzbot; +Cc: linux-kernel, syzkaller-bugs On Sun, 07 Apr 2024 04:33:29 -0700 > syzbot found the following issue on: > > HEAD commit: 480e035fc4c7 Merge tag 'drm-next-2024-03-13' of https://gi.. > git tree: upstream > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11ee2e75180000 #syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 480e035fc4c7 --- x/net/bluetooth/hci_event.c +++ y/net/bluetooth/hci_event.c @@ -6902,7 +6902,7 @@ static void hci_le_create_big_complete_e struct sk_buff *skb) { struct hci_evt_le_create_big_complete *ev = data; - struct hci_conn *conn; + struct hci_conn *conn, *next; __u8 i = 0; BT_DBG("%s status 0x%2.2x", hdev->name, ev->status); @@ -6912,38 +6912,29 @@ static void hci_le_create_big_complete_e return; hci_dev_lock(hdev); - rcu_read_lock(); - /* Connect all BISes that are bound to the BIG */ - list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) { + list_for_each_entry_safe(conn, next, &hdev->conn_hash.list, list) { if (bacmp(&conn->dst, BDADDR_ANY) || conn->type != ISO_LINK || conn->iso_qos.bcast.big != ev->handle) continue; - if (hci_conn_set_handle(conn, - __le16_to_cpu(ev->bis_handle[i++]))) + if (hci_conn_set_handle(conn, __le16_to_cpu(ev->bis_handle[i++]))) continue; if (!ev->status) { conn->state = BT_CONNECTED; set_bit(HCI_CONN_BIG_CREATED, &conn->flags); - rcu_read_unlock(); hci_debugfs_create_conn(conn); hci_conn_add_sysfs(conn); hci_iso_setup_path(conn); - rcu_read_lock(); continue; } hci_connect_cfm(conn, ev->status); - rcu_read_unlock(); hci_conn_del(conn); - rcu_read_lock(); } - rcu_read_unlock(); - if (!ev->status && !i) /* If no BISes have been connected for the BIG, * terminate. This is in case all bound connections @@ -6952,7 +6943,6 @@ static void hci_le_create_big_complete_e */ hci_cmd_sync_queue(hdev, hci_iso_term_big_sync, UINT_PTR(ev->handle), NULL); - hci_dev_unlock(hdev); } -- ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] [bluetooth?] BUG: sleeping function called from invalid context in hci_le_create_big_complete_evt 2024-04-07 23:14 ` Hillf Danton @ 2024-04-08 1:50 ` syzbot 0 siblings, 0 replies; 10+ messages in thread From: syzbot @ 2024-04-08 1:50 UTC (permalink / raw) To: hdanton, linux-kernel, syzkaller-bugs Hello, syzbot has tested the proposed patch and the reproducer did not trigger any issue: Reported-and-tested-by: syzbot+2fb0835e0c9cefc34614@syzkaller.appspotmail.com Tested on: commit: 480e035f Merge tag 'drm-next-2024-03-13' of https://gi.. git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git console output: https://syzkaller.appspot.com/x/log.txt?x=171f2b39180000 kernel config: https://syzkaller.appspot.com/x/.config?x=1e5b814e91787669 dashboard link: https://syzkaller.appspot.com/bug?extid=2fb0835e0c9cefc34614 compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 patch: https://syzkaller.appspot.com/x/patch.diff?x=14dfa699180000 Note: testing is done by a robot and is best-effort only. ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] Re: [PATCH v1] Bluetooth: hci_core: Fix sleeping function called from invalid context 2024-04-07 11:33 [syzbot] [bluetooth?] BUG: sleeping function called from invalid context in hci_le_create_big_complete_evt syzbot ` (2 preceding siblings ...) 2024-04-07 23:14 ` Hillf Danton @ 2024-12-03 22:30 ` syzbot 2024-12-05 15:13 ` [syzbot] Re: [PATCH v2] " syzbot 4 siblings, 0 replies; 10+ messages in thread From: syzbot @ 2024-12-03 22:30 UTC (permalink / raw) To: linux-kernel, syzkaller-bugs For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com. *** Subject: Re: [PATCH v1] Bluetooth: hci_core: Fix sleeping function called from invalid context Author: luiz.dentz@gmail.com #syz test On Tue, Dec 3, 2024 at 4:15 PM Luiz Augusto von Dentz <luiz.dentz@gmail.com> wrote: > > From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> > > This reworks hci_cb_list to not use mutex hci_cb_list_lock to avoid bugs > like the bellow: > > BUG: sleeping function called from invalid context at kernel/locking/mutex.c:585 > in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 5070, name: kworker/u9:2 > preempt_count: 0, expected: 0 > RCU nest depth: 1, expected: 0 > 4 locks held by kworker/u9:2/5070: > #0: ffff888015be3948 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3229 [inline] > #0: ffff888015be3948 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_scheduled_works+0x8e0/0x1770 kernel/workqueue.c:3335 > #1: ffffc90003b6fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3230 [inline] > #1: ffffc90003b6fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x91b/0x1770 kernel/workqueue.c:3335 > #2: ffff8880665d0078 (&hdev->lock){+.+.}-{3:3}, at: hci_le_create_big_complete_evt+0xcf/0xae0 net/bluetooth/hci_event.c:6914 > #3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline] > #3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline] > #3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: hci_le_create_big_complete_evt+0xdb/0xae0 net/bluetooth/hci_event.c:6915 > CPU: 0 PID: 5070 Comm: kworker/u9:2 Not tainted 6.8.0-syzkaller-08073-g480e035fc4c7 #0 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 > Workqueue: hci0 hci_rx_work > Call Trace: > <TASK> > __dump_stack lib/dump_stack.c:88 [inline] > dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 > __might_resched+0x5d4/0x780 kernel/sched/core.c:10187 > __mutex_lock_common kernel/locking/mutex.c:585 [inline] > __mutex_lock+0xc1/0xd70 kernel/locking/mutex.c:752 > hci_connect_cfm include/net/bluetooth/hci_core.h:2004 [inline] > hci_le_create_big_complete_evt+0x3d9/0xae0 net/bluetooth/hci_event.c:6939 > hci_event_func net/bluetooth/hci_event.c:7514 [inline] > hci_event_packet+0xa53/0x1540 net/bluetooth/hci_event.c:7569 > hci_rx_work+0x3e8/0xca0 net/bluetooth/hci_core.c:4171 > process_one_work kernel/workqueue.c:3254 [inline] > process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335 > worker_thread+0x86d/0xd70 kernel/workqueue.c:3416 > kthread+0x2f0/0x390 kernel/kthread.c:388 > ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 > </TASK> > > Reported-by: syzbot+2fb0835e0c9cefc34614@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=2fb0835e0c9cefc34614 > Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> > --- > include/net/bluetooth/hci_core.h | 89 ++++++++++++++++++++++---------- > net/bluetooth/hci_core.c | 9 ++-- > 2 files changed, 65 insertions(+), 33 deletions(-) > > diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h > index ea798f07c5a2..95f11f04e24a 100644 > --- a/include/net/bluetooth/hci_core.h > +++ b/include/net/bluetooth/hci_core.h > @@ -804,7 +804,6 @@ struct hci_conn_params { > extern struct list_head hci_dev_list; > extern struct list_head hci_cb_list; > extern rwlock_t hci_dev_list_lock; > -extern struct mutex hci_cb_list_lock; > > #define hci_dev_set_flag(hdev, nr) set_bit((nr), (hdev)->dev_flags) > #define hci_dev_clear_flag(hdev, nr) clear_bit((nr), (hdev)->dev_flags) > @@ -2029,12 +2028,18 @@ static inline void hci_connect_cfm(struct hci_conn *conn, __u8 status) > { > struct hci_cb *cb; > > - mutex_lock(&hci_cb_list_lock); > - list_for_each_entry(cb, &hci_cb_list, list) { > - if (cb->connect_cfm) > - cb->connect_cfm(conn, status); > + rcu_read_lock(); > + list_for_each_entry_rcu(cb, &hci_cb_list, list) { > + if (cb->connect_cfm) { > + struct hci_cb cpy = *cb; > + > + /* Callback may block so release RCU read lock */ > + rcu_read_unlock(); > + cpy.connect_cfm(conn, status); > + rcu_read_lock(); > + } > } > - mutex_unlock(&hci_cb_list_lock); > + rcu_read_unlock(); > > if (conn->connect_cfm_cb) > conn->connect_cfm_cb(conn, status); > @@ -2044,12 +2049,18 @@ static inline void hci_disconn_cfm(struct hci_conn *conn, __u8 reason) > { > struct hci_cb *cb; > > - mutex_lock(&hci_cb_list_lock); > + rcu_read_lock(); > list_for_each_entry(cb, &hci_cb_list, list) { > - if (cb->disconn_cfm) > - cb->disconn_cfm(conn, reason); > + if (cb->disconn_cfm) { > + struct hci_cb cpy = *cb; > + > + /* Callback may block so release RCU read lock */ > + rcu_read_unlock(); > + cpy.disconn_cfm(conn, reason); > + rcu_read_lock(); > + } > } > - mutex_unlock(&hci_cb_list_lock); > + rcu_read_unlock(); > > if (conn->disconn_cfm_cb) > conn->disconn_cfm_cb(conn, reason); > @@ -2065,12 +2076,18 @@ static inline void hci_auth_cfm(struct hci_conn *conn, __u8 status) > > encrypt = test_bit(HCI_CONN_ENCRYPT, &conn->flags) ? 0x01 : 0x00; > > - mutex_lock(&hci_cb_list_lock); > + rcu_read_lock(); > list_for_each_entry(cb, &hci_cb_list, list) { > - if (cb->security_cfm) > - cb->security_cfm(conn, status, encrypt); > + if (cb->security_cfm) { > + struct hci_cb cpy = *cb; > + > + /* Callback may block so release RCU read lock */ > + rcu_read_unlock(); > + cpy.security_cfm(conn, status, encrypt); > + rcu_read_lock(); > + } > } > - mutex_unlock(&hci_cb_list_lock); > + rcu_read_unlock(); > > if (conn->security_cfm_cb) > conn->security_cfm_cb(conn, status); > @@ -2105,12 +2122,18 @@ static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status) > conn->sec_level = conn->pending_sec_level; > } > > - mutex_lock(&hci_cb_list_lock); > + rcu_read_lock(); > list_for_each_entry(cb, &hci_cb_list, list) { > - if (cb->security_cfm) > - cb->security_cfm(conn, status, encrypt); > + if (cb->security_cfm) { > + struct hci_cb cpy = *cb; > + > + /* Callback may block so release RCU read lock */ > + rcu_read_unlock(); > + cpy.security_cfm(conn, status, encrypt); > + rcu_read_lock(); > + } > } > - mutex_unlock(&hci_cb_list_lock); > + rcu_read_unlock(); > > if (conn->security_cfm_cb) > conn->security_cfm_cb(conn, status); > @@ -2120,12 +2143,18 @@ static inline void hci_key_change_cfm(struct hci_conn *conn, __u8 status) > { > struct hci_cb *cb; > > - mutex_lock(&hci_cb_list_lock); > + rcu_read_lock(); > list_for_each_entry(cb, &hci_cb_list, list) { > - if (cb->key_change_cfm) > - cb->key_change_cfm(conn, status); > + if (cb->key_change_cfm) { > + struct hci_cb cpy = *cb; > + > + /* Callback may block so release RCU read lock */ > + rcu_read_unlock(); > + cpy.key_change_cfm(conn, status); > + rcu_read_lock(); > + } > } > - mutex_unlock(&hci_cb_list_lock); > + rcu_read_unlock(); > } > > static inline void hci_role_switch_cfm(struct hci_conn *conn, __u8 status, > @@ -2133,12 +2162,18 @@ static inline void hci_role_switch_cfm(struct hci_conn *conn, __u8 status, > { > struct hci_cb *cb; > > - mutex_lock(&hci_cb_list_lock); > - list_for_each_entry(cb, &hci_cb_list, list) { > - if (cb->role_switch_cfm) > - cb->role_switch_cfm(conn, status, role); > + rcu_read_lock(); > + list_for_each_entry_rcu(cb, &hci_cb_list, list) { > + if (cb->role_switch_cfm) { > + struct hci_cb cpy = *cb; > + > + /* Callback may block so release RCU read lock */ > + rcu_read_unlock(); > + cpy.role_switch_cfm(conn, status, role); > + rcu_read_lock(); > + } > } > - mutex_unlock(&hci_cb_list_lock); > + rcu_read_unlock(); > } > > static inline bool hci_bdaddr_is_rpa(bdaddr_t *bdaddr, u8 addr_type) > diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c > index f9e19f9cb5a3..25d180d225c1 100644 > --- a/net/bluetooth/hci_core.c > +++ b/net/bluetooth/hci_core.c > @@ -2993,9 +2993,7 @@ int hci_register_cb(struct hci_cb *cb) > { > BT_DBG("%p name %s", cb, cb->name); > > - mutex_lock(&hci_cb_list_lock); > - list_add_tail(&cb->list, &hci_cb_list); > - mutex_unlock(&hci_cb_list_lock); > + list_add_tail_rcu(&cb->list, &hci_cb_list); > > return 0; > } > @@ -3005,9 +3003,8 @@ int hci_unregister_cb(struct hci_cb *cb) > { > BT_DBG("%p name %s", cb, cb->name); > > - mutex_lock(&hci_cb_list_lock); > - list_del(&cb->list); > - mutex_unlock(&hci_cb_list_lock); > + list_del_rcu(&cb->list); > + synchronize_rcu(); > > return 0; > } > -- > 2.47.1 > -- Luiz Augusto von Dentz ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] Re: [PATCH v2] Bluetooth: hci_core: Fix sleeping function called from invalid context 2024-04-07 11:33 [syzbot] [bluetooth?] BUG: sleeping function called from invalid context in hci_le_create_big_complete_evt syzbot ` (3 preceding siblings ...) 2024-12-03 22:30 ` [syzbot] Re: [PATCH v1] Bluetooth: hci_core: Fix sleeping function called from invalid context syzbot @ 2024-12-05 15:13 ` syzbot 4 siblings, 0 replies; 10+ messages in thread From: syzbot @ 2024-12-05 15:13 UTC (permalink / raw) To: linux-kernel, syzkaller-bugs For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com. *** Subject: Re: [PATCH v2] Bluetooth: hci_core: Fix sleeping function called from invalid context Author: luiz.dentz@gmail.com #syz test On Wed, Dec 4, 2024 at 1:59 PM Luiz Augusto von Dentz <luiz.dentz@gmail.com> wrote: > > Hi Pauli, > > On Wed, Dec 4, 2024 at 1:44 PM Pauli Virtanen <pav@iki.fi> wrote: > > > > Hi Luiz, > > > > ke, 2024-12-04 kello 11:58 -0500, Luiz Augusto von Dentz kirjoitti: > > > From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> > > > > > > This reworks hci_cb_list to not use mutex hci_cb_list_lock to avoid bugs > > > like the bellow: > > > > This also in principle allows callbacks to be still running on another > > CPU when hci_unregister_cb() exits. Not sure if that is unwanted. > > Well hci_unregister_cb is only called if you unload the whole module > e.g bt_exit, but you can't do that if the interface is not down afaik, > so I don't think it is possible to hit the case where the copied > entries would be invalid due to module being unloaded. > > > > > > > BUG: sleeping function called from invalid context at kernel/locking/mutex.c:585 > > > in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 5070, name: kworker/u9:2 > > > preempt_count: 0, expected: 0 > > > RCU nest depth: 1, expected: 0 > > > 4 locks held by kworker/u9:2/5070: > > > #0: ffff888015be3948 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3229 [inline] > > > #0: ffff888015be3948 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_scheduled_works+0x8e0/0x1770 kernel/workqueue.c:3335 > > > #1: ffffc90003b6fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3230 [inline] > > > #1: ffffc90003b6fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x91b/0x1770 kernel/workqueue.c:3335 > > > #2: ffff8880665d0078 (&hdev->lock){+.+.}-{3:3}, at: hci_le_create_big_complete_evt+0xcf/0xae0 net/bluetooth/hci_event.c:6914 > > > #3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline] > > > #3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline] > > > #3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: hci_le_create_big_complete_evt+0xdb/0xae0 net/bluetooth/hci_event.c:6915 > > > CPU: 0 PID: 5070 Comm: kworker/u9:2 Not tainted 6.8.0-syzkaller-08073-g480e035fc4c7 #0 > > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 > > > Workqueue: hci0 hci_rx_work > > > Call Trace: > > > <TASK> > > > __dump_stack lib/dump_stack.c:88 [inline] > > > dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 > > > __might_resched+0x5d4/0x780 kernel/sched/core.c:10187 > > > __mutex_lock_common kernel/locking/mutex.c:585 [inline] > > > __mutex_lock+0xc1/0xd70 kernel/locking/mutex.c:752 > > > hci_connect_cfm include/net/bluetooth/hci_core.h:2004 [inline] > > > hci_le_create_big_complete_evt+0x3d9/0xae0 net/bluetooth/hci_event.c:6939 > > > hci_event_func net/bluetooth/hci_event.c:7514 [inline] > > > hci_event_packet+0xa53/0x1540 net/bluetooth/hci_event.c:7569 > > > hci_rx_work+0x3e8/0xca0 net/bluetooth/hci_core.c:4171 > > > process_one_work kernel/workqueue.c:3254 [inline] > > > process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335 > > > worker_thread+0x86d/0xd70 kernel/workqueue.c:3416 > > > kthread+0x2f0/0x390 kernel/kthread.c:388 > > > ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 > > > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 > > > </TASK> > > > > > > Reported-by: syzbot+2fb0835e0c9cefc34614@syzkaller.appspotmail.com > > > Closes: https://syzkaller.appspot.com/bug?extid=2fb0835e0c9cefc34614 > > > Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> > > > --- > > > include/net/bluetooth/hci_core.h | 108 ++++++++++++++++++++----------- > > > net/bluetooth/hci_core.c | 9 +-- > > > net/bluetooth/iso.c | 6 ++ > > > net/bluetooth/l2cap_core.c | 12 ++-- > > > net/bluetooth/rfcomm/core.c | 6 ++ > > > net/bluetooth/sco.c | 12 ++-- > > > 6 files changed, 97 insertions(+), 56 deletions(-) > > > > > > diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h > > > index ea798f07c5a2..ca22ead85dbe 100644 > > > --- a/include/net/bluetooth/hci_core.h > > > +++ b/include/net/bluetooth/hci_core.h > > > @@ -804,7 +804,6 @@ struct hci_conn_params { > > > extern struct list_head hci_dev_list; > > > extern struct list_head hci_cb_list; > > > extern rwlock_t hci_dev_list_lock; > > > -extern struct mutex hci_cb_list_lock; > > > > > > #define hci_dev_set_flag(hdev, nr) set_bit((nr), (hdev)->dev_flags) > > > #define hci_dev_clear_flag(hdev, nr) clear_bit((nr), (hdev)->dev_flags) > > > @@ -2017,24 +2016,47 @@ struct hci_cb { > > > > > > char *name; > > > > > > + bool (*match) (struct hci_conn *conn); > > > void (*connect_cfm) (struct hci_conn *conn, __u8 status); > > > void (*disconn_cfm) (struct hci_conn *conn, __u8 status); > > > void (*security_cfm) (struct hci_conn *conn, __u8 status, > > > - __u8 encrypt); > > > + __u8 encrypt); > > > void (*key_change_cfm) (struct hci_conn *conn, __u8 status); > > > void (*role_switch_cfm) (struct hci_conn *conn, __u8 status, __u8 role); > > > }; > > > > > > +static inline void hci_cb_lookup(struct hci_conn *conn, struct list_head *list) > > > +{ > > > + struct hci_cb *cb, *cpy; > > > + > > > + rcu_read_lock(); > > > + list_for_each_entry_rcu(cb, &hci_cb_list, list) { > > > + if (cb->match && cb->match(conn)) { > > > + cpy = kmalloc(sizeof(*cpy), GFP_ATOMIC); > > > + if (!cpy) > > > + break; > > > + > > > + *cpy = *cb; > > > + INIT_LIST_HEAD(&cpy->list); > > > + list_add_rcu(&cpy->list, list); > > > + } > > > + } > > > + rcu_read_unlock(); > > > +} > > > + > > > static inline void hci_connect_cfm(struct hci_conn *conn, __u8 status) > > > { > > > - struct hci_cb *cb; > > > + struct list_head list; > > > + struct hci_cb *cb, *tmp; > > > > > > - mutex_lock(&hci_cb_list_lock); > > > - list_for_each_entry(cb, &hci_cb_list, list) { > > > + INIT_LIST_HEAD(&list); > > > + hci_cb_lookup(conn, &list); > > > + > > > + list_for_each_entry_safe(cb, tmp, &list, list) { > > > if (cb->connect_cfm) > > > cb->connect_cfm(conn, status); > > > + kfree(cb); > > > } > > > - mutex_unlock(&hci_cb_list_lock); > > > > > > if (conn->connect_cfm_cb) > > > conn->connect_cfm_cb(conn, status); > > > @@ -2042,22 +2064,43 @@ static inline void hci_connect_cfm(struct hci_conn *conn, __u8 status) > > > > > > static inline void hci_disconn_cfm(struct hci_conn *conn, __u8 reason) > > > { > > > - struct hci_cb *cb; > > > + struct list_head list; > > > + struct hci_cb *cb, *tmp; > > > > > > - mutex_lock(&hci_cb_list_lock); > > > - list_for_each_entry(cb, &hci_cb_list, list) { > > > + INIT_LIST_HEAD(&list); > > > + hci_cb_lookup(conn, &list); > > > + > > > + list_for_each_entry_safe(cb, tmp, &list, list) { > > > if (cb->disconn_cfm) > > > cb->disconn_cfm(conn, reason); > > > + kfree(cb); > > > } > > > - mutex_unlock(&hci_cb_list_lock); > > > > > > if (conn->disconn_cfm_cb) > > > conn->disconn_cfm_cb(conn, reason); > > > } > > > > > > +static inline void hci_security_cfm(struct hci_conn *conn, __u8 status, > > > + __u8 encrypt) > > > +{ > > > + struct list_head list; > > > + struct hci_cb *cb, *tmp; > > > + > > > + INIT_LIST_HEAD(&list); > > > + hci_cb_lookup(conn, &list); > > > + > > > + list_for_each_entry_safe(cb, tmp, &list, list) { > > > + if (cb->security_cfm) > > > + cb->security_cfm(conn, status, encrypt); > > > + kfree(cb); > > > + } > > > + > > > + if (conn->security_cfm_cb) > > > + conn->security_cfm_cb(conn, status); > > > +} > > > + > > > static inline void hci_auth_cfm(struct hci_conn *conn, __u8 status) > > > { > > > - struct hci_cb *cb; > > > __u8 encrypt; > > > > > > if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) > > > @@ -2065,20 +2108,11 @@ static inline void hci_auth_cfm(struct hci_conn *conn, __u8 status) > > > > > > encrypt = test_bit(HCI_CONN_ENCRYPT, &conn->flags) ? 0x01 : 0x00; > > > > > > - mutex_lock(&hci_cb_list_lock); > > > - list_for_each_entry(cb, &hci_cb_list, list) { > > > - if (cb->security_cfm) > > > - cb->security_cfm(conn, status, encrypt); > > > - } > > > - mutex_unlock(&hci_cb_list_lock); > > > - > > > - if (conn->security_cfm_cb) > > > - conn->security_cfm_cb(conn, status); > > > + hci_security_cfm(conn, status, encrypt); > > > } > > > > > > static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status) > > > { > > > - struct hci_cb *cb; > > > __u8 encrypt; > > > > > > if (conn->state == BT_CONFIG) { > > > @@ -2105,40 +2139,38 @@ static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status) > > > conn->sec_level = conn->pending_sec_level; > > > } > > > > > > - mutex_lock(&hci_cb_list_lock); > > > - list_for_each_entry(cb, &hci_cb_list, list) { > > > - if (cb->security_cfm) > > > - cb->security_cfm(conn, status, encrypt); > > > - } > > > - mutex_unlock(&hci_cb_list_lock); > > > - > > > - if (conn->security_cfm_cb) > > > - conn->security_cfm_cb(conn, status); > > > + hci_security_cfm(conn, status, encrypt); > > > } > > > > > > static inline void hci_key_change_cfm(struct hci_conn *conn, __u8 status) > > > { > > > - struct hci_cb *cb; > > > + struct list_head list; > > > + struct hci_cb *cb, *tmp; > > > > > > - mutex_lock(&hci_cb_list_lock); > > > - list_for_each_entry(cb, &hci_cb_list, list) { > > > + INIT_LIST_HEAD(&list); > > > + hci_cb_lookup(conn, &list); > > > + > > > + list_for_each_entry_safe(cb, tmp, &list, list) { > > > if (cb->key_change_cfm) > > > cb->key_change_cfm(conn, status); > > > + kfree(cb); > > > } > > > - mutex_unlock(&hci_cb_list_lock); > > > } > > > > > > static inline void hci_role_switch_cfm(struct hci_conn *conn, __u8 status, > > > __u8 role) > > > { > > > - struct hci_cb *cb; > > > + struct list_head list; > > > + struct hci_cb *cb, *tmp; > > > > > > - mutex_lock(&hci_cb_list_lock); > > > - list_for_each_entry(cb, &hci_cb_list, list) { > > > + INIT_LIST_HEAD(&list); > > > + hci_cb_lookup(conn, &list); > > > + > > > + list_for_each_entry_safe(cb, tmp, &list, list) { > > > if (cb->role_switch_cfm) > > > cb->role_switch_cfm(conn, status, role); > > > + kfree(cb); > > > } > > > - mutex_unlock(&hci_cb_list_lock); > > > } > > > > > > static inline bool hci_bdaddr_is_rpa(bdaddr_t *bdaddr, u8 addr_type) > > > diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c > > > index f9e19f9cb5a3..25d180d225c1 100644 > > > --- a/net/bluetooth/hci_core.c > > > +++ b/net/bluetooth/hci_core.c > > > @@ -2993,9 +2993,7 @@ int hci_register_cb(struct hci_cb *cb) > > > { > > > BT_DBG("%p name %s", cb, cb->name); > > > > > > - mutex_lock(&hci_cb_list_lock); > > > - list_add_tail(&cb->list, &hci_cb_list); > > > - mutex_unlock(&hci_cb_list_lock); > > > + list_add_tail_rcu(&cb->list, &hci_cb_list); > > > > > > return 0; > > > } > > > @@ -3005,9 +3003,8 @@ int hci_unregister_cb(struct hci_cb *cb) > > > { > > > BT_DBG("%p name %s", cb, cb->name); > > > > > > - mutex_lock(&hci_cb_list_lock); > > > - list_del(&cb->list); > > > - mutex_unlock(&hci_cb_list_lock); > > > + list_del_rcu(&cb->list); > > > + synchronize_rcu(); > > > > > > return 0; > > > } > > > diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c > > > index 8ed818254dc8..eccdaa16cba0 100644 > > > --- a/net/bluetooth/iso.c > > > +++ b/net/bluetooth/iso.c > > > @@ -2154,6 +2154,11 @@ int iso_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags) > > > return HCI_LM_ACCEPT; > > > } > > > > > > +static bool iso_match(struct hci_conn *hcon) > > > +{ > > > + return hcon->type == ISO_LINK || hcon->type == LE_LINK; > > > +} > > > + > > > static void iso_connect_cfm(struct hci_conn *hcon, __u8 status) > > > { > > > if (hcon->type != ISO_LINK) { > > > @@ -2335,6 +2340,7 @@ void iso_recv(struct hci_conn *hcon, struct sk_buff *skb, u16 flags) > > > > > > static struct hci_cb iso_cb = { > > > .name = "ISO", > > > + .match = iso_match, > > > .connect_cfm = iso_connect_cfm, > > > .disconn_cfm = iso_disconn_cfm, > > > }; > > > diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c > > > index 6544c1ed7143..27b4c4a2ba1f 100644 > > > --- a/net/bluetooth/l2cap_core.c > > > +++ b/net/bluetooth/l2cap_core.c > > > @@ -7217,6 +7217,11 @@ static struct l2cap_chan *l2cap_global_fixed_chan(struct l2cap_chan *c, > > > return NULL; > > > } > > > > > > +static bool l2cap_match(struct hci_conn *hcon) > > > +{ > > > + return hcon->type == ACL_LINK || hcon->type == LE_LINK; > > > +} > > > + > > > static void l2cap_connect_cfm(struct hci_conn *hcon, u8 status) > > > { > > > struct hci_dev *hdev = hcon->hdev; > > > @@ -7224,9 +7229,6 @@ static void l2cap_connect_cfm(struct hci_conn *hcon, u8 status) > > > struct l2cap_chan *pchan; > > > u8 dst_type; > > > > > > - if (hcon->type != ACL_LINK && hcon->type != LE_LINK) > > > - return; > > > - > > > BT_DBG("hcon %p bdaddr %pMR status %d", hcon, &hcon->dst, status); > > > > > > if (status) { > > > @@ -7291,9 +7293,6 @@ int l2cap_disconn_ind(struct hci_conn *hcon) > > > > > > static void l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason) > > > { > > > - if (hcon->type != ACL_LINK && hcon->type != LE_LINK) > > > - return; > > > - > > > BT_DBG("hcon %p reason %d", hcon, reason); > > > > > > l2cap_conn_del(hcon, bt_to_errno(reason)); > > > @@ -7572,6 +7571,7 @@ void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags) > > > > > > static struct hci_cb l2cap_cb = { > > > .name = "L2CAP", > > > + .match = l2cap_match, > > > .connect_cfm = l2cap_connect_cfm, > > > .disconn_cfm = l2cap_disconn_cfm, > > > .security_cfm = l2cap_security_cfm, > > > diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c > > > index ad5177e3a69b..4c56ca5a216c 100644 > > > --- a/net/bluetooth/rfcomm/core.c > > > +++ b/net/bluetooth/rfcomm/core.c > > > @@ -2134,6 +2134,11 @@ static int rfcomm_run(void *unused) > > > return 0; > > > } > > > > > > +static bool rfcomm_match(struct hci_conn *hcon) > > > +{ > > > + return hcon->type == ACL_LINK; > > > +} > > > + > > > static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt) > > > { > > > struct rfcomm_session *s; > > > @@ -2180,6 +2185,7 @@ static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt) > > > > > > static struct hci_cb rfcomm_cb = { > > > .name = "RFCOMM", > > > + .match = rfcomm_match, > > > .security_cfm = rfcomm_security_cfm > > > }; > > > > > > diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c > > > index 7eb8d3e04ec4..40c4957cfc0b 100644 > > > --- a/net/bluetooth/sco.c > > > +++ b/net/bluetooth/sco.c > > > @@ -1397,11 +1397,13 @@ int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags) > > > return lm; > > > } > > > > > > +static bool sco_match(struct hci_conn *hcon) > > > +{ > > > + return hcon->type == SCO_LINK || hcon->type == ESCO_LINK; > > > +} > > > + > > > static void sco_connect_cfm(struct hci_conn *hcon, __u8 status) > > > { > > > - if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK) > > > - return; > > > - > > > BT_DBG("hcon %p bdaddr %pMR status %u", hcon, &hcon->dst, status); > > > > > > if (!status) { > > > @@ -1416,9 +1418,6 @@ static void sco_connect_cfm(struct hci_conn *hcon, __u8 status) > > > > > > static void sco_disconn_cfm(struct hci_conn *hcon, __u8 reason) > > > { > > > - if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK) > > > - return; > > > - > > > BT_DBG("hcon %p reason %d", hcon, reason); > > > > > > sco_conn_del(hcon, bt_to_errno(reason)); > > > @@ -1444,6 +1443,7 @@ void sco_recv_scodata(struct hci_conn *hcon, struct sk_buff *skb) > > > > > > static struct hci_cb sco_cb = { > > > .name = "SCO", > > > + .match = sco_match, > > > .connect_cfm = sco_connect_cfm, > > > .disconn_cfm = sco_disconn_cfm, > > > }; > > > > > -- > Luiz Augusto von Dentz -- Luiz Augusto von Dentz ^ permalink raw reply [flat|nested] 10+ messages in thread
[parent not found: <CABBYNZJeXf0Lbe-vwC1XX6-hRmw4iqgSRbTV=zCZHbT1hWZLoQ@mail.gmail.com>]
* Re: [syzbot] [bluetooth?] BUG: sleeping function called from invalid context in hci_le_create_big_complete_evt [not found] <CABBYNZJeXf0Lbe-vwC1XX6-hRmw4iqgSRbTV=zCZHbT1hWZLoQ@mail.gmail.com> @ 2024-12-04 2:04 ` syzbot 0 siblings, 0 replies; 10+ messages in thread From: syzbot @ 2024-12-04 2:04 UTC (permalink / raw) To: linux-bluetooth, linux-kernel, luiz.dentz, luiz.von.dentz, syzkaller-bugs Hello, syzbot has tested the proposed patch and the reproducer did not trigger any issue: Reported-by: syzbot+2fb0835e0c9cefc34614@syzkaller.appspotmail.com Tested-by: syzbot+2fb0835e0c9cefc34614@syzkaller.appspotmail.com Tested on: commit: feffde68 Merge tag 'for-6.13-rc1-tag' of git://git.ker.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=10e708df980000 kernel config: https://syzkaller.appspot.com/x/.config?x=773e6b07384b3087 dashboard link: https://syzkaller.appspot.com/bug?extid=2fb0835e0c9cefc34614 compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 patch: https://syzkaller.appspot.com/x/patch.diff?x=100c0de8580000 Note: testing is done by a robot and is best-effort only. ^ permalink raw reply [flat|nested] 10+ messages in thread
[parent not found: <CABBYNZKEK9QXBbtopROD=94h7suNA_UbXUJp=H+7q_2n3OhO4g@mail.gmail.com>]
* Re: [syzbot] [bluetooth?] BUG: sleeping function called from invalid context in hci_le_create_big_complete_evt [not found] <CABBYNZKEK9QXBbtopROD=94h7suNA_UbXUJp=H+7q_2n3OhO4g@mail.gmail.com> @ 2024-12-05 15:35 ` syzbot 0 siblings, 0 replies; 10+ messages in thread From: syzbot @ 2024-12-05 15:35 UTC (permalink / raw) To: linux-bluetooth, linux-kernel, luiz.dentz, syzkaller-bugs Hello, syzbot has tested the proposed patch and the reproducer did not trigger any issue: Reported-by: syzbot+2fb0835e0c9cefc34614@syzkaller.appspotmail.com Tested-by: syzbot+2fb0835e0c9cefc34614@syzkaller.appspotmail.com Tested on: commit: feffde68 Merge tag 'for-6.13-rc1-tag' of git://git.ker.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=144e1330580000 kernel config: https://syzkaller.appspot.com/x/.config?x=773e6b07384b3087 dashboard link: https://syzkaller.appspot.com/bug?extid=2fb0835e0c9cefc34614 compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 patch: https://syzkaller.appspot.com/x/patch.diff?x=178490f8580000 Note: testing is done by a robot and is best-effort only. ^ permalink raw reply [flat|nested] 10+ messages in thread
end of thread, other threads:[~2024-12-05 15:35 UTC | newest]
Thread overview: 10+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-04-07 11:33 [syzbot] [bluetooth?] BUG: sleeping function called from invalid context in hci_le_create_big_complete_evt syzbot
2024-04-07 12:16 ` Hillf Danton
2024-04-07 12:50 ` syzbot
2024-04-07 13:59 ` syzbot
2024-04-07 23:14 ` Hillf Danton
2024-04-08 1:50 ` syzbot
2024-12-03 22:30 ` [syzbot] Re: [PATCH v1] Bluetooth: hci_core: Fix sleeping function called from invalid context syzbot
2024-12-05 15:13 ` [syzbot] Re: [PATCH v2] " syzbot
[not found] <CABBYNZJeXf0Lbe-vwC1XX6-hRmw4iqgSRbTV=zCZHbT1hWZLoQ@mail.gmail.com>
2024-12-04 2:04 ` [syzbot] [bluetooth?] BUG: sleeping function called from invalid context in hci_le_create_big_complete_evt syzbot
[not found] <CABBYNZKEK9QXBbtopROD=94h7suNA_UbXUJp=H+7q_2n3OhO4g@mail.gmail.com>
2024-12-05 15:35 ` syzbot
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox