* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd
2024-02-26 9:32 [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd syzbot
@ 2025-01-06 9:04 ` syzbot
2025-01-14 10:54 ` Hillf Danton
` (4 more replies)
2025-01-14 14:09 ` syzbot
` (6 subsequent siblings)
7 siblings, 5 replies; 28+ messages in thread
From: syzbot @ 2025-01-06 9:04 UTC (permalink / raw)
To: johan.hedberg, linux-bluetooth, linux-kernel, luiz.dentz, marcel,
syzkaller-bugs
syzbot has found a reproducer for the following issue on:
HEAD commit: ab75170520d4 Merge tag 'linux-watchdog-6.13-rc6' of git://..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=17f4330f980000
kernel config: https://syzkaller.appspot.com/x/.config?x=1c541fa8af5c9cc7
dashboard link: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11261edf980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17fa36f8580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/1740fef78c43/disk-ab751705.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a74d1ace549b/vmlinux-ab751705.xz
kernel image: https://storage.googleapis.com/syzbot-assets/524d100d5187/bzImage-ab751705.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com
BUG: KASAN: slab-use-after-free in l2cap_build_cmd net/bluetooth/l2cap_core.c:2964 [inline]
BUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954
Read of size 8 at addr ffff8880271a4000 by task kworker/u9:2/5837
CPU: 0 UID: 0 PID: 5837 Comm: kworker/u9:2 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: hci1 hci_rx_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x169/0x550 mm/kasan/report.c:489
kasan_report+0x143/0x180 mm/kasan/report.c:602
l2cap_build_cmd net/bluetooth/l2cap_core.c:2964 [inline]
l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954
l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline]
l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline]
l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817
hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline]
hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Allocated by task 5837:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329
kmalloc_noprof include/linux/slab.h:901 [inline]
kzalloc_noprof include/linux/slab.h:1037 [inline]
l2cap_conn_add+0xa9/0x8e0 net/bluetooth/l2cap_core.c:6860
l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7239
hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726
hci_event_func net/bluetooth/hci_event.c:7473 [inline]
hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525
hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Freed by task 54:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2353 [inline]
slab_free mm/slub.c:4613 [inline]
kfree+0x196/0x430 mm/slub.c:4761
l2cap_connect_cfm+0xcc/0x1090 net/bluetooth/l2cap_core.c:7235
hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
hci_conn_failed+0x287/0x400 net/bluetooth/hci_conn.c:1266
hci_abort_conn_sync+0x56c/0x11f0 net/bluetooth/hci_sync.c:5603
hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Last potentially related work creation:
kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47
__kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:544
insert_work+0x3e/0x330 kernel/workqueue.c:2183
__queue_work+0xc8b/0xf50 kernel/workqueue.c:2339
call_timer_fn+0x187/0x650 kernel/time/timer.c:1793
expire_timers kernel/time/timer.c:1839 [inline]
__run_timers kernel/time/timer.c:2418 [inline]
__run_timer_base+0x695/0x8e0 kernel/time/timer.c:2430
run_timer_base kernel/time/timer.c:2439 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2449
handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561
__do_softirq kernel/softirq.c:595 [inline]
invoke_softirq kernel/softirq.c:435 [inline]
__irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662
irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
Second to last potentially related work creation:
kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47
__kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:544
insert_work+0x3e/0x330 kernel/workqueue.c:2183
__queue_work+0xb66/0xf50 kernel/workqueue.c:2343
queue_work_on+0x1c2/0x380 kernel/workqueue.c:2390
queue_work include/linux/workqueue.h:662 [inline]
l2cap_conn_ready net/bluetooth/l2cap_core.c:1640 [inline]
l2cap_connect_cfm+0xdd5/0x1090 net/bluetooth/l2cap_core.c:7280
hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726
hci_event_func net/bluetooth/hci_event.c:7473 [inline]
hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525
hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
The buggy address belongs to the object at ffff8880271a4000
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 0 bytes inside of
freed 1024-byte region [ffff8880271a4000, ffff8880271a4400)
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x271a0
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801ac41dc0 ffffea0001c09800 dead000000000002
raw: 0000000000000000 0000000000100010 00000001f5000000 0000000000000000
head: 00fff00000000040 ffff88801ac41dc0 ffffea0001c09800 dead000000000002
head: 0000000000000000 0000000000100010 00000001f5000000 0000000000000000
head: 00fff00000000003 ffffea00009c6801 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x252800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_THISNODE), pid 12, tgid 12 (kworker/u8:1), ts 7179124429, free_ts 0
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1558
prep_new_page mm/page_alloc.c:1566 [inline]
get_page_from_freelist+0x365c/0x37a0 mm/page_alloc.c:3476
__alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4753
__alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
alloc_slab_page+0x59/0x110 mm/slub.c:2425
allocate_slab+0x5a/0x2b0 mm/slub.c:2589
new_slab mm/slub.c:2642 [inline]
___slab_alloc+0xc27/0x14a0 mm/slub.c:3830
__slab_alloc+0x58/0xa0 mm/slub.c:3920
__slab_alloc_node mm/slub.c:3995 [inline]
slab_alloc_node mm/slub.c:4156 [inline]
__kmalloc_cache_node_noprof+0x294/0x3a0 mm/slub.c:4337
kmalloc_node_noprof include/linux/slab.h:924 [inline]
blk_mq_alloc_hctx block/blk-mq.c:3935 [inline]
blk_mq_alloc_and_init_hctx+0x17f/0xd50 block/blk-mq.c:4443
blk_mq_realloc_hw_ctxs+0x19c/0xb00 block/blk-mq.c:4476
blk_mq_init_allocated_queue+0x3f6/0x14c0 block/blk-mq.c:4530
blk_mq_alloc_queue+0x1d3/0x2f0 block/blk-mq.c:4343
scsi_alloc_sdev+0x76c/0xb80 drivers/scsi/scsi_scan.c:337
scsi_probe_and_add_lun+0x1d4/0x4bd0 drivers/scsi/scsi_scan.c:1210
__scsi_scan_target+0x205/0x1080 drivers/scsi/scsi_scan.c:1757
scsi_scan_channel drivers/scsi/scsi_scan.c:1845 [inline]
scsi_scan_host_selected+0x37e/0x690 drivers/scsi/scsi_scan.c:1874
page_owner free stack trace missing
Memory state around the buggy address:
ffff8880271a3f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8880271a3f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8880271a4000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880271a4080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880271a4100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 28+ messages in thread* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd
2025-01-06 9:04 ` syzbot
@ 2025-01-14 10:54 ` Hillf Danton
2025-01-14 15:16 ` syzbot
2025-01-15 5:28 ` Hillf Danton
` (3 subsequent siblings)
4 siblings, 1 reply; 28+ messages in thread
From: Hillf Danton @ 2025-01-14 10:54 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
On Mon, 06 Jan 2025 01:04:23 -0800
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: ab75170520d4 Merge tag 'linux-watchdog-6.13-rc6' of git://..
> git tree: upstream
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17fa36f8580000
#syz test
--- xnet/bluetooth/l2cap_core.c
+++ ynet/bluetooth/l2cap_core.c
@@ -1747,6 +1747,8 @@ static void l2cap_unregister_all_users(s
}
}
+static DEFINE_SPINLOCK(l2cap_conn_del_lock);
+
static void l2cap_conn_del(struct hci_conn *hcon, int err)
{
struct l2cap_conn *conn = hcon->l2cap_data;
@@ -1797,7 +1799,9 @@ static void l2cap_conn_del(struct hci_co
if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
cancel_delayed_work_sync(&conn->info_timer);
+ spin_lock(&l2cap_conn_del_lock);
hcon->l2cap_data = NULL;
+ spin_unlock(&l2cap_conn_del_lock);
conn->hchan = NULL;
l2cap_conn_put(conn);
}
@@ -1819,6 +1823,8 @@ EXPORT_SYMBOL(l2cap_conn_get);
void l2cap_conn_put(struct l2cap_conn *conn)
{
+ if (!conn)
+ return;
kref_put(&conn->ref, l2cap_conn_free);
}
EXPORT_SYMBOL(l2cap_conn_put);
@@ -7477,6 +7483,13 @@ void l2cap_recv_acldata(struct hci_conn
if (!conn)
goto drop;
+ spin_lock(&l2cap_conn_del_lock);
+ conn = hcon->l2cap_data;
+ if (conn)
+ l2cap_conn_get(conn);
+ spin_unlock(&l2cap_conn_del_lock);
+ if (!conn)
+ goto drop;
BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags);
switch (flags) {
@@ -7503,6 +7516,7 @@ void l2cap_recv_acldata(struct hci_conn
if (len == skb->len) {
/* Complete frame received */
l2cap_recv_frame(conn, skb);
+ l2cap_conn_put(conn);
return;
}
@@ -7566,6 +7580,7 @@ void l2cap_recv_acldata(struct hci_conn
}
drop:
+ l2cap_conn_put(conn);
kfree_skb(skb);
}
--
^ permalink raw reply [flat|nested] 28+ messages in thread* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd
2025-01-06 9:04 ` syzbot
2025-01-14 10:54 ` Hillf Danton
@ 2025-01-15 5:28 ` Hillf Danton
2025-01-15 5:53 ` syzbot
2025-01-15 8:12 ` Edward Adam Davis
` (2 subsequent siblings)
4 siblings, 1 reply; 28+ messages in thread
From: Hillf Danton @ 2025-01-15 5:28 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
On Mon, 06 Jan 2025 01:04:23 -0800
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: ab75170520d4 Merge tag 'linux-watchdog-6.13-rc6' of git://..
> git tree: upstream
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17fa36f8580000
#syz test
--- x/net/bluetooth/l2cap_core.c
+++ y/net/bluetooth/l2cap_core.c
@@ -1747,6 +1747,8 @@ static void l2cap_unregister_all_users(s
}
}
+static DEFINE_SPINLOCK(l2cap_conn_del_lock);
+
static void l2cap_conn_del(struct hci_conn *hcon, int err)
{
struct l2cap_conn *conn = hcon->l2cap_data;
@@ -1797,7 +1799,9 @@ static void l2cap_conn_del(struct hci_co
if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
cancel_delayed_work_sync(&conn->info_timer);
+ spin_lock(&l2cap_conn_del_lock);
hcon->l2cap_data = NULL;
+ spin_unlock(&l2cap_conn_del_lock);
conn->hchan = NULL;
l2cap_conn_put(conn);
}
@@ -1819,6 +1823,8 @@ EXPORT_SYMBOL(l2cap_conn_get);
void l2cap_conn_put(struct l2cap_conn *conn)
{
+ if (!conn)
+ return;
kref_put(&conn->ref, l2cap_conn_free);
}
EXPORT_SYMBOL(l2cap_conn_put);
@@ -7477,6 +7483,13 @@ void l2cap_recv_acldata(struct hci_conn
if (!conn)
goto drop;
+ spin_lock(&l2cap_conn_del_lock);
+ conn = hcon->l2cap_data;
+ if (conn)
+ l2cap_conn_get(conn);
+ spin_unlock(&l2cap_conn_del_lock);
+ if (!conn)
+ goto drop;
BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags);
switch (flags) {
@@ -7503,6 +7516,7 @@ void l2cap_recv_acldata(struct hci_conn
if (len == skb->len) {
/* Complete frame received */
l2cap_recv_frame(conn, skb);
+ l2cap_conn_put(conn);
return;
}
@@ -7566,6 +7580,7 @@ void l2cap_recv_acldata(struct hci_conn
}
drop:
+ l2cap_conn_put(conn);
kfree_skb(skb);
}
--
^ permalink raw reply [flat|nested] 28+ messages in thread* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd
2025-01-15 5:28 ` Hillf Danton
@ 2025-01-15 5:53 ` syzbot
0 siblings, 0 replies; 28+ messages in thread
From: syzbot @ 2025-01-15 5:53 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in hci_send_acl
Bluetooth: Wrong link type (-22)
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
CPU: 1 UID: 0 PID: 8192 Comm: kworker/u9:7 Not tainted 6.13.0-rc7-syzkaller-g619f0b6fad52-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Workqueue: hci5 hci_rx_work
RIP: 0010:hci_send_acl+0x3e/0xd00 net/bluetooth/hci_core.c:3232
Code: 00 89 54 24 04 49 89 f5 48 89 fb 49 bf 00 00 00 00 00 fc ff df e8 a2 93 e6 f6 48 89 5c 24 18 4c 8d 73 18 4c 89 f3 48 c1 eb 03 <42> 80 3c 3b 00 74 08 4c 89 f7 e8 c3 fd 4c f7 bd f8 0f 00 00 49 03
RSP: 0018:ffffc900057e72b8 EFLAGS: 00010206
RAX: ffffffff8ab8eece RBX: 0000000000000003 RCX: ffff8880304dbc00
RDX: 0000000000000000 RSI: ffff8880578f5c80 RDI: 0000000000000000
RBP: ffffc900057e7a98 R08: ffffffff8ac38d24 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed100dbd7003 R12: ffff88802d5c0f4b
R13: ffff8880578f5c80 R14: 0000000000000018 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c005688000 CR3: 0000000032a00000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5508 [inline]
l2cap_sig_channel net/bluetooth/l2cap_core.c:5544 [inline]
l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6823
l2cap_recv_acldata+0x51f/0x1530 net/bluetooth/l2cap_core.c:7518
hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline]
hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040
process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317
worker_thread+0x870/0xd30 kernel/workqueue.c:3398
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:hci_send_acl+0x3e/0xd00 net/bluetooth/hci_core.c:3232
Code: 00 89 54 24 04 49 89 f5 48 89 fb 49 bf 00 00 00 00 00 fc ff df e8 a2 93 e6 f6 48 89 5c 24 18 4c 8d 73 18 4c 89 f3 48 c1 eb 03 <42> 80 3c 3b 00 74 08 4c 89 f7 e8 c3 fd 4c f7 bd f8 0f 00 00 49 03
RSP: 0018:ffffc900057e72b8 EFLAGS: 00010206
RAX: ffffffff8ab8eece RBX: 0000000000000003 RCX: ffff8880304dbc00
RDX: 0000000000000000 RSI: ffff8880578f5c80 RDI: 0000000000000000
RBP: ffffc900057e7a98 R08: ffffffff8ac38d24 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed100dbd7003 R12: ffff88802d5c0f4b
R13: ffff8880578f5c80 R14: 0000000000000018 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c005688000 CR3: 000000000e736000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 00 89 54 24 04 49 add %cl,0x49042454(%rcx)
6: 89 f5 mov %esi,%ebp
8: 48 89 fb mov %rdi,%rbx
b: 49 bf 00 00 00 00 00 movabs $0xdffffc0000000000,%r15
12: fc ff df
15: e8 a2 93 e6 f6 call 0xf6e693bc
1a: 48 89 5c 24 18 mov %rbx,0x18(%rsp)
1f: 4c 8d 73 18 lea 0x18(%rbx),%r14
23: 4c 89 f3 mov %r14,%rbx
26: 48 c1 eb 03 shr $0x3,%rbx
* 2a: 42 80 3c 3b 00 cmpb $0x0,(%rbx,%r15,1) <-- trapping instruction
2f: 74 08 je 0x39
31: 4c 89 f7 mov %r14,%rdi
34: e8 c3 fd 4c f7 call 0xf74cfdfc
39: bd f8 0f 00 00 mov $0xff8,%ebp
3e: 49 rex.WB
3f: 03 .byte 0x3
Tested on:
commit: 619f0b6f Merge tag 'seccomp-v6.13-rc8' of git://git.ke..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=145ebcb0580000
kernel config: https://syzkaller.appspot.com/x/.config?x=aadf89e2f6db86cc
dashboard link: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=1276bcb0580000
^ permalink raw reply [flat|nested] 28+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd
2025-01-06 9:04 ` syzbot
2025-01-14 10:54 ` Hillf Danton
2025-01-15 5:28 ` Hillf Danton
@ 2025-01-15 8:12 ` Edward Adam Davis
2025-01-15 9:11 ` syzbot
2025-01-15 9:46 ` [PATCH] Bluetooth: hci_core: sync hci rx and cmd sync work Edward Adam Davis
2025-01-15 10:25 ` [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd Hillf Danton
4 siblings, 1 reply; 28+ messages in thread
From: Edward Adam Davis @ 2025-01-15 8:12 UTC (permalink / raw)
To: syzbot+31c2f641b850a348a734; +Cc: linux-kernel, syzkaller-bugs
#syz test: https://github.com/ea1davis/linux bthci/syz
^ permalink raw reply [flat|nested] 28+ messages in thread
* [PATCH] Bluetooth: hci_core: sync hci rx and cmd sync work
2025-01-06 9:04 ` syzbot
` (2 preceding siblings ...)
2025-01-15 8:12 ` Edward Adam Davis
@ 2025-01-15 9:46 ` Edward Adam Davis
2025-01-15 16:13 ` Luiz Augusto von Dentz
2025-01-15 10:25 ` [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd Hillf Danton
4 siblings, 1 reply; 28+ messages in thread
From: Edward Adam Davis @ 2025-01-15 9:46 UTC (permalink / raw)
To: syzbot+31c2f641b850a348a734
Cc: johan.hedberg, linux-bluetooth, linux-kernel, luiz.dentz, marcel,
syzkaller-bugs
syzbot reported a slab-use-after-free Read in l2cap_send_cmd. [1]
After the hci sync command releases l2cap_conn, the hci receive data work
queue references the released l2cap_conn when sending to the upper layer.
Add hci dev lock to the hci receive data work queue to synchronize the two.
[1]
BUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954
Read of size 8 at addr ffff8880271a4000 by task kworker/u9:2/5837
CPU: 0 UID: 0 PID: 5837 Comm: kworker/u9:2 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: hci1 hci_rx_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x169/0x550 mm/kasan/report.c:489
kasan_report+0x143/0x180 mm/kasan/report.c:602
l2cap_build_cmd net/bluetooth/l2cap_core.c:2964 [inline]
l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954
l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline]
l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline]
l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817
hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline]
hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Allocated by task 5837:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329
kmalloc_noprof include/linux/slab.h:901 [inline]
kzalloc_noprof include/linux/slab.h:1037 [inline]
l2cap_conn_add+0xa9/0x8e0 net/bluetooth/l2cap_core.c:6860
l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7239
hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726
hci_event_func net/bluetooth/hci_event.c:7473 [inline]
hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525
hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Freed by task 54:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2353 [inline]
slab_free mm/slub.c:4613 [inline]
kfree+0x196/0x430 mm/slub.c:4761
l2cap_connect_cfm+0xcc/0x1090 net/bluetooth/l2cap_core.c:7235
hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
hci_conn_failed+0x287/0x400 net/bluetooth/hci_conn.c:1266
hci_abort_conn_sync+0x56c/0x11f0 net/bluetooth/hci_sync.c:5603
hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Reported-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734
Tested-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
net/bluetooth/hci_core.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index f9e19f9cb5a3..88c8aa37eb64 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -3798,7 +3798,9 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
/* Send to upper protocol */
+ hci_dev_lock(hdev);
l2cap_recv_acldata(conn, skb, flags);
+ hci_dev_unlock(hdev);
return;
} else {
bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
--
2.47.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* Re: [PATCH] Bluetooth: hci_core: sync hci rx and cmd sync work
2025-01-15 9:46 ` [PATCH] Bluetooth: hci_core: sync hci rx and cmd sync work Edward Adam Davis
@ 2025-01-15 16:13 ` Luiz Augusto von Dentz
2025-01-16 10:42 ` Hillf Danton
0 siblings, 1 reply; 28+ messages in thread
From: Luiz Augusto von Dentz @ 2025-01-15 16:13 UTC (permalink / raw)
To: Edward Adam Davis
Cc: syzbot+31c2f641b850a348a734, johan.hedberg, linux-bluetooth,
linux-kernel, marcel, syzkaller-bugs
Hi Edward,
On Wed, Jan 15, 2025 at 4:46 AM Edward Adam Davis <eadavis@qq.com> wrote:
>
> syzbot reported a slab-use-after-free Read in l2cap_send_cmd. [1]
>
> After the hci sync command releases l2cap_conn, the hci receive data work
> queue references the released l2cap_conn when sending to the upper layer.
> Add hci dev lock to the hci receive data work queue to synchronize the two.
>
> [1]
> BUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954
> Read of size 8 at addr ffff8880271a4000 by task kworker/u9:2/5837
>
> CPU: 0 UID: 0 PID: 5837 Comm: kworker/u9:2 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
> Workqueue: hci1 hci_rx_work
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:94 [inline]
> dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
> print_address_description mm/kasan/report.c:378 [inline]
> print_report+0x169/0x550 mm/kasan/report.c:489
> kasan_report+0x143/0x180 mm/kasan/report.c:602
> l2cap_build_cmd net/bluetooth/l2cap_core.c:2964 [inline]
> l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954
> l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline]
> l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline]
> l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817
> hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline]
> hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040
> process_one_work kernel/workqueue.c:3229 [inline]
> process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> worker_thread+0x870/0xd30 kernel/workqueue.c:3391
> kthread+0x2f0/0x390 kernel/kthread.c:389
> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> </TASK>
>
> Allocated by task 5837:
> kasan_save_stack mm/kasan/common.c:47 [inline]
> kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
> poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
> __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
> kasan_kmalloc include/linux/kasan.h:260 [inline]
> __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329
> kmalloc_noprof include/linux/slab.h:901 [inline]
> kzalloc_noprof include/linux/slab.h:1037 [inline]
> l2cap_conn_add+0xa9/0x8e0 net/bluetooth/l2cap_core.c:6860
> l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7239
> hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
> hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726
> hci_event_func net/bluetooth/hci_event.c:7473 [inline]
> hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525
> hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035
> process_one_work kernel/workqueue.c:3229 [inline]
> process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> worker_thread+0x870/0xd30 kernel/workqueue.c:3391
> kthread+0x2f0/0x390 kernel/kthread.c:389
> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
>
> Freed by task 54:
> kasan_save_stack mm/kasan/common.c:47 [inline]
> kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
> kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582
> poison_slab_object mm/kasan/common.c:247 [inline]
> __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
> kasan_slab_free include/linux/kasan.h:233 [inline]
> slab_free_hook mm/slub.c:2353 [inline]
> slab_free mm/slub.c:4613 [inline]
> kfree+0x196/0x430 mm/slub.c:4761
> l2cap_connect_cfm+0xcc/0x1090 net/bluetooth/l2cap_core.c:7235
> hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
> hci_conn_failed+0x287/0x400 net/bluetooth/hci_conn.c:1266
> hci_abort_conn_sync+0x56c/0x11f0 net/bluetooth/hci_sync.c:5603
> hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332
> process_one_work kernel/workqueue.c:3229 [inline]
> process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> worker_thread+0x870/0xd30 kernel/workqueue.c:3391
> kthread+0x2f0/0x390 kernel/kthread.c:389
> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
>
> Reported-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734
> Tested-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com
> Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> ---
> net/bluetooth/hci_core.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
> index f9e19f9cb5a3..88c8aa37eb64 100644
> --- a/net/bluetooth/hci_core.c
> +++ b/net/bluetooth/hci_core.c
> @@ -3798,7 +3798,9 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
> hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
>
> /* Send to upper protocol */
> + hci_dev_lock(hdev);
> l2cap_recv_acldata(conn, skb, flags);
> + hci_dev_unlock(hdev);
This will not gonna fly, there have been instances where l2cap code
needs to lock hdev so this most likely causes a deadlock, besides we
used to have such design of locking hdev for everything but that
doesn't scale very well.
Instead, perhaps we can do something like the following:
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 27b4c4a2ba1f..023e3ebe0e39 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -7466,6 +7466,16 @@ static void l2cap_recv_reset(struct l2cap_conn *conn)
conn->rx_len = 0;
}
+static struct l2cap_conn *l2cap_conn_hold_unless_zero(struct l2cap_conn *c)
+{
+ BT_DBG("conn %p orig refcnt %u", c, kref_read(&c->ref));
+
+ if (!kref_get_unless_zero(&c->ref))
+ return NULL;
+
+ return c;
+}
+
void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
{
struct l2cap_conn *conn = hcon->l2cap_data;
@@ -7474,6 +7484,7 @@ void l2cap_recv_acldata(struct hci_conn *hcon,
struct sk_buff *skb, u16 flags)
if (!conn)
conn = l2cap_conn_add(hcon);
+ conn = l2cap_conn_hold_unless_zero(conn);
if (!conn)
goto drop;
@@ -7565,6 +7576,8 @@ void l2cap_recv_acldata(struct hci_conn *hcon,
struct sk_buff *skb, u16 flags)
break;
}
+ l2cap_conn_put(conn);
+
drop:
kfree_skb(skb);
}
> return;
> } else {
> bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
> --
> 2.47.0
>
--
Luiz Augusto von Dentz
^ permalink raw reply related [flat|nested] 28+ messages in thread* Re: [PATCH] Bluetooth: hci_core: sync hci rx and cmd sync work
2025-01-15 16:13 ` Luiz Augusto von Dentz
@ 2025-01-16 10:42 ` Hillf Danton
2025-01-16 15:31 ` Luiz Augusto von Dentz
0 siblings, 1 reply; 28+ messages in thread
From: Hillf Danton @ 2025-01-16 10:42 UTC (permalink / raw)
To: Luiz Augusto von Dentz
Cc: Edward Adam Davis, syzbot+31c2f641b850a348a734, johan.hedberg,
linux-bluetooth, linux-kernel, marcel, syzkaller-bugs
On Wed, 15 Jan 2025 11:13:00 -0500 Luiz Augusto von Dentz <luiz.dentz@gmail.com>
> On Wed, Jan 15, 2025 at 4:46 AM Edward Adam Davis <eadavis@qq.com> wrote:
> >
> > syzbot reported a slab-use-after-free Read in l2cap_send_cmd. [1]
> >
> > After the hci sync command releases l2cap_conn, the hci receive data work
> > queue references the released l2cap_conn when sending to the upper layer.
> > Add hci dev lock to the hci receive data work queue to synchronize the two.
> >
> > [1]
> > BUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954
> > Read of size 8 at addr ffff8880271a4000 by task kworker/u9:2/5837
> >
> > CPU: 0 UID: 0 PID: 5837 Comm: kworker/u9:2 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0
> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
> > Workqueue: hci1 hci_rx_work
> > Call Trace:
> > <TASK>
> > __dump_stack lib/dump_stack.c:94 [inline]
> > dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
> > print_address_description mm/kasan/report.c:378 [inline]
> > print_report+0x169/0x550 mm/kasan/report.c:489
> > kasan_report+0x143/0x180 mm/kasan/report.c:602
> > l2cap_build_cmd net/bluetooth/l2cap_core.c:2964 [inline]
> > l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954
> > l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline]
> > l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline]
> > l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817
> > hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline]
> > hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040
> > process_one_work kernel/workqueue.c:3229 [inline]
> > process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> > worker_thread+0x870/0xd30 kernel/workqueue.c:3391
> > kthread+0x2f0/0x390 kernel/kthread.c:389
> > ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> > </TASK>
> >
> > Allocated by task 5837:
> > kasan_save_stack mm/kasan/common.c:47 [inline]
> > kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
> > poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
> > __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
> > kasan_kmalloc include/linux/kasan.h:260 [inline]
> > __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329
> > kmalloc_noprof include/linux/slab.h:901 [inline]
> > kzalloc_noprof include/linux/slab.h:1037 [inline]
> > l2cap_conn_add+0xa9/0x8e0 net/bluetooth/l2cap_core.c:6860
> > l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7239
> > hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
> > hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726
> > hci_event_func net/bluetooth/hci_event.c:7473 [inline]
> > hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525
> > hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035
> > process_one_work kernel/workqueue.c:3229 [inline]
> > process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> > worker_thread+0x870/0xd30 kernel/workqueue.c:3391
> > kthread+0x2f0/0x390 kernel/kthread.c:389
> > ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> >
> > Freed by task 54:
> > kasan_save_stack mm/kasan/common.c:47 [inline]
> > kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
> > kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582
> > poison_slab_object mm/kasan/common.c:247 [inline]
> > __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
> > kasan_slab_free include/linux/kasan.h:233 [inline]
> > slab_free_hook mm/slub.c:2353 [inline]
> > slab_free mm/slub.c:4613 [inline]
> > kfree+0x196/0x430 mm/slub.c:4761
> > l2cap_connect_cfm+0xcc/0x1090 net/bluetooth/l2cap_core.c:7235
> > hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
> > hci_conn_failed+0x287/0x400 net/bluetooth/hci_conn.c:1266
> > hci_abort_conn_sync+0x56c/0x11f0 net/bluetooth/hci_sync.c:5603
> > hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332
> > process_one_work kernel/workqueue.c:3229 [inline]
> > process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> > worker_thread+0x870/0xd30 kernel/workqueue.c:3391
> > kthread+0x2f0/0x390 kernel/kthread.c:389
> > ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> >
> > Reported-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734
> > Tested-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com
> > Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> > ---
> > net/bluetooth/hci_core.c | 2 ++
> > 1 file changed, 2 insertions(+)
> >
> > diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
> > index f9e19f9cb5a3..88c8aa37eb64 100644
> > --- a/net/bluetooth/hci_core.c
> > +++ b/net/bluetooth/hci_core.c
> > @@ -3798,7 +3798,9 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
> > hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
> >
> > /* Send to upper protocol */
> > + hci_dev_lock(hdev);
> > l2cap_recv_acldata(conn, skb, flags);
> > + hci_dev_unlock(hdev);
>
> This will not gonna fly, there have been instances where l2cap code
> needs to lock hdev so this most likely causes a deadlock, besides we
> used to have such design of locking hdev for everything but that
> doesn't scale very well.
>
> Instead, perhaps we can do something like the following:
>
> diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> index 27b4c4a2ba1f..023e3ebe0e39 100644
> --- a/net/bluetooth/l2cap_core.c
> +++ b/net/bluetooth/l2cap_core.c
> @@ -7466,6 +7466,16 @@ static void l2cap_recv_reset(struct l2cap_conn *conn)
> conn->rx_len = 0;
> }
>
> +static struct l2cap_conn *l2cap_conn_hold_unless_zero(struct l2cap_conn *c)
> +{
> + BT_DBG("conn %p orig refcnt %u", c, kref_read(&c->ref));
> +
> + if (!kref_get_unless_zero(&c->ref))
> + return NULL;
> +
> + return c;
> +}
> +
> void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
> {
> struct l2cap_conn *conn = hcon->l2cap_data;
> @@ -7474,6 +7484,7 @@ void l2cap_recv_acldata(struct hci_conn *hcon,
> struct sk_buff *skb, u16 flags)
> if (!conn)
> conn = l2cap_conn_add(hcon);
>
> + conn = l2cap_conn_hold_unless_zero(conn);
This does not work because conn can be freed before bumping refcnt up,
and bumpup alone does not help l2cap_send_cmd() in case conn->hchan has been
cleared in l2cap_conn_del().
> if (!conn)
> goto drop;
>
> @@ -7565,6 +7576,8 @@ void l2cap_recv_acldata(struct hci_conn *hcon,
> struct sk_buff *skb, u16 flags)
> break;
> }
>
> + l2cap_conn_put(conn);
> +
> drop:
> kfree_skb(skb);
> }
>
> > return;
> > } else {
> > bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
> > --
> > 2.47.0
^ permalink raw reply [flat|nested] 28+ messages in thread* Re: [PATCH] Bluetooth: hci_core: sync hci rx and cmd sync work
2025-01-16 10:42 ` Hillf Danton
@ 2025-01-16 15:31 ` Luiz Augusto von Dentz
2025-01-16 22:44 ` Hillf Danton
0 siblings, 1 reply; 28+ messages in thread
From: Luiz Augusto von Dentz @ 2025-01-16 15:31 UTC (permalink / raw)
To: Hillf Danton
Cc: Edward Adam Davis, syzbot+31c2f641b850a348a734, johan.hedberg,
linux-bluetooth, linux-kernel, marcel, syzkaller-bugs
Hi Hillf,
On Thu, Jan 16, 2025 at 5:42 AM Hillf Danton <hdanton@sina.com> wrote:
>
> On Wed, 15 Jan 2025 11:13:00 -0500 Luiz Augusto von Dentz <luiz.dentz@gmail.com>
> > On Wed, Jan 15, 2025 at 4:46 AM Edward Adam Davis <eadavis@qq.com> wrote:
> > >
> > > syzbot reported a slab-use-after-free Read in l2cap_send_cmd. [1]
> > >
> > > After the hci sync command releases l2cap_conn, the hci receive data work
> > > queue references the released l2cap_conn when sending to the upper layer.
> > > Add hci dev lock to the hci receive data work queue to synchronize the two.
> > >
> > > [1]
> > > BUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954
> > > Read of size 8 at addr ffff8880271a4000 by task kworker/u9:2/5837
> > >
> > > CPU: 0 UID: 0 PID: 5837 Comm: kworker/u9:2 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0
> > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
> > > Workqueue: hci1 hci_rx_work
> > > Call Trace:
> > > <TASK>
> > > __dump_stack lib/dump_stack.c:94 [inline]
> > > dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
> > > print_address_description mm/kasan/report.c:378 [inline]
> > > print_report+0x169/0x550 mm/kasan/report.c:489
> > > kasan_report+0x143/0x180 mm/kasan/report.c:602
> > > l2cap_build_cmd net/bluetooth/l2cap_core.c:2964 [inline]
> > > l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954
> > > l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline]
> > > l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline]
> > > l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817
> > > hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline]
> > > hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040
> > > process_one_work kernel/workqueue.c:3229 [inline]
> > > process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> > > worker_thread+0x870/0xd30 kernel/workqueue.c:3391
> > > kthread+0x2f0/0x390 kernel/kthread.c:389
> > > ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> > > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> > > </TASK>
> > >
> > > Allocated by task 5837:
> > > kasan_save_stack mm/kasan/common.c:47 [inline]
> > > kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
> > > poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
> > > __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
> > > kasan_kmalloc include/linux/kasan.h:260 [inline]
> > > __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329
> > > kmalloc_noprof include/linux/slab.h:901 [inline]
> > > kzalloc_noprof include/linux/slab.h:1037 [inline]
> > > l2cap_conn_add+0xa9/0x8e0 net/bluetooth/l2cap_core.c:6860
> > > l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7239
> > > hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
> > > hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726
> > > hci_event_func net/bluetooth/hci_event.c:7473 [inline]
> > > hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525
> > > hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035
> > > process_one_work kernel/workqueue.c:3229 [inline]
> > > process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> > > worker_thread+0x870/0xd30 kernel/workqueue.c:3391
> > > kthread+0x2f0/0x390 kernel/kthread.c:389
> > > ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> > > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> > >
> > > Freed by task 54:
> > > kasan_save_stack mm/kasan/common.c:47 [inline]
> > > kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
> > > kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582
> > > poison_slab_object mm/kasan/common.c:247 [inline]
> > > __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
> > > kasan_slab_free include/linux/kasan.h:233 [inline]
> > > slab_free_hook mm/slub.c:2353 [inline]
> > > slab_free mm/slub.c:4613 [inline]
> > > kfree+0x196/0x430 mm/slub.c:4761
> > > l2cap_connect_cfm+0xcc/0x1090 net/bluetooth/l2cap_core.c:7235
> > > hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
> > > hci_conn_failed+0x287/0x400 net/bluetooth/hci_conn.c:1266
> > > hci_abort_conn_sync+0x56c/0x11f0 net/bluetooth/hci_sync.c:5603
> > > hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332
> > > process_one_work kernel/workqueue.c:3229 [inline]
> > > process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> > > worker_thread+0x870/0xd30 kernel/workqueue.c:3391
> > > kthread+0x2f0/0x390 kernel/kthread.c:389
> > > ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> > > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> > >
> > > Reported-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com
> > > Closes: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734
> > > Tested-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com
> > > Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> > > ---
> > > net/bluetooth/hci_core.c | 2 ++
> > > 1 file changed, 2 insertions(+)
> > >
> > > diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
> > > index f9e19f9cb5a3..88c8aa37eb64 100644
> > > --- a/net/bluetooth/hci_core.c
> > > +++ b/net/bluetooth/hci_core.c
> > > @@ -3798,7 +3798,9 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
> > > hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
> > >
> > > /* Send to upper protocol */
> > > + hci_dev_lock(hdev);
> > > l2cap_recv_acldata(conn, skb, flags);
> > > + hci_dev_unlock(hdev);
> >
> > This will not gonna fly, there have been instances where l2cap code
> > needs to lock hdev so this most likely causes a deadlock, besides we
> > used to have such design of locking hdev for everything but that
> > doesn't scale very well.
> >
> > Instead, perhaps we can do something like the following:
> >
> > diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> > index 27b4c4a2ba1f..023e3ebe0e39 100644
> > --- a/net/bluetooth/l2cap_core.c
> > +++ b/net/bluetooth/l2cap_core.c
> > @@ -7466,6 +7466,16 @@ static void l2cap_recv_reset(struct l2cap_conn *conn)
> > conn->rx_len = 0;
> > }
> >
> > +static struct l2cap_conn *l2cap_conn_hold_unless_zero(struct l2cap_conn *c)
> > +{
> > + BT_DBG("conn %p orig refcnt %u", c, kref_read(&c->ref));
> > +
> > + if (!kref_get_unless_zero(&c->ref))
> > + return NULL;
> > +
> > + return c;
> > +}
> > +
> > void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
> > {
> > struct l2cap_conn *conn = hcon->l2cap_data;
> > @@ -7474,6 +7484,7 @@ void l2cap_recv_acldata(struct hci_conn *hcon,
> > struct sk_buff *skb, u16 flags)
> > if (!conn)
> > conn = l2cap_conn_add(hcon);
> >
> > + conn = l2cap_conn_hold_unless_zero(conn);
>
> This does not work because conn can be freed before bumping refcnt up,
> and bumpup alone does not help l2cap_send_cmd() in case conn->hchan has been
> cleared in l2cap_conn_del().
Well then perhaps we can use hdev lock just to protect l2cap_data:
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 27b4c4a2ba1f..00ef61609d49 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -7466,14 +7466,33 @@ static void l2cap_recv_reset(struct l2cap_conn *conn)
conn->rx_len = 0;
}
+static struct l2cap_conn *l2cap_conn_hold_unless_zero(struct l2cap_conn *c)
+{
+ BT_DBG("conn %p orig refcnt %u", c, kref_read(&c->ref));
+
+ if (!kref_get_unless_zero(&c->ref))
+ return NULL;
+
+ return c;
+}
+
void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
{
- struct l2cap_conn *conn = hcon->l2cap_data;
+ struct l2cap_conn *conn;
int len;
+ /* Lock hdev to access l2cap_data to avoid race with l2cap_conn_del */
+ hci_dev_lock(hcon->hdev);
+
+ conn = hcon->l2cap_data;
+
if (!conn)
conn = l2cap_conn_add(hcon);
+ conn = l2cap_conn_hold_unless_zero(conn);
+
+ hci_dev_unlock(hcon->hdev);
+
if (!conn)
goto drop;
@@ -7565,6 +7584,8 @@ void l2cap_recv_acldata(struct hci_conn *hcon,
struct sk_buff *skb, u16 flags)
break;
}
+ l2cap_conn_put(conn);
+
drop:
kfree_skb(skb);
}
>
> > if (!conn)
> > goto drop;
> >
> > @@ -7565,6 +7576,8 @@ void l2cap_recv_acldata(struct hci_conn *hcon,
> > struct sk_buff *skb, u16 flags)
> > break;
> > }
> >
> > + l2cap_conn_put(conn);
> > +
> > drop:
> > kfree_skb(skb);
> > }
> >
> > > return;
> > > } else {
> > > bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
> > > --
> > > 2.47.0
--
Luiz Augusto von Dentz
^ permalink raw reply related [flat|nested] 28+ messages in thread* Re: [PATCH] Bluetooth: hci_core: sync hci rx and cmd sync work
2025-01-16 15:31 ` Luiz Augusto von Dentz
@ 2025-01-16 22:44 ` Hillf Danton
0 siblings, 0 replies; 28+ messages in thread
From: Hillf Danton @ 2025-01-16 22:44 UTC (permalink / raw)
To: Luiz Augusto von Dentz
Cc: Edward Adam Davis, syzbot+31c2f641b850a348a734, johan.hedberg,
linux-bluetooth, linux-kernel, marcel, syzkaller-bugs
On Thu, 16 Jan 2025 10:31:03 -0500 Luiz Augusto von Dentz
> On Thu, Jan 16, 2025 at 5:42 AM Hillf Danton <hdanton@sina.com> wrote:
> >
> > This does not work because conn can be freed before bumping refcnt up,
> > and bumpup alone does not help l2cap_send_cmd() in case conn->hchan has been
> > cleared in l2cap_conn_del().
>
> Well then perhaps we can use hdev lock just to protect l2cap_data:
>
> diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> index 27b4c4a2ba1f..00ef61609d49 100644
> --- a/net/bluetooth/l2cap_core.c
> +++ b/net/bluetooth/l2cap_core.c
> @@ -7466,14 +7466,33 @@ static void l2cap_recv_reset(struct l2cap_conn *conn)
> conn->rx_len = 0;
> }
>
> +static struct l2cap_conn *l2cap_conn_hold_unless_zero(struct l2cap_conn *c)
> +{
> + BT_DBG("conn %p orig refcnt %u", c, kref_read(&c->ref));
> +
> + if (!kref_get_unless_zero(&c->ref))
> + return NULL;
> +
> + return c;
> +}
> +
> void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
> {
> - struct l2cap_conn *conn = hcon->l2cap_data;
> + struct l2cap_conn *conn;
> int len;
>
> + /* Lock hdev to access l2cap_data to avoid race with l2cap_conn_del */
> + hci_dev_lock(hcon->hdev);
> +
> + conn = hcon->l2cap_data;
> +
> if (!conn)
> conn = l2cap_conn_add(hcon);
>
> + conn = l2cap_conn_hold_unless_zero(conn);
> +
> + hci_dev_unlock(hcon->hdev);
> +
This does not work either because after releasing lock bumpup alone can
not prevent conn->hchan from being cleared.
^ permalink raw reply [flat|nested] 28+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd
2025-01-06 9:04 ` syzbot
` (3 preceding siblings ...)
2025-01-15 9:46 ` [PATCH] Bluetooth: hci_core: sync hci rx and cmd sync work Edward Adam Davis
@ 2025-01-15 10:25 ` Hillf Danton
2025-01-15 11:29 ` syzbot
4 siblings, 1 reply; 28+ messages in thread
From: Hillf Danton @ 2025-01-15 10:25 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
On Mon, 06 Jan 2025 01:04:23 -0800
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: ab75170520d4 Merge tag 'linux-watchdog-6.13-rc6' of git://..
> git tree: upstream
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17fa36f8580000
#syz test
--- x/net/bluetooth/l2cap_core.c
+++ y/net/bluetooth/l2cap_core.c
@@ -1747,6 +1747,8 @@ static void l2cap_unregister_all_users(s
}
}
+static DEFINE_MUTEX(l2cap_conn_del_lock);
+
static void l2cap_conn_del(struct hci_conn *hcon, int err)
{
struct l2cap_conn *conn = hcon->l2cap_data;
@@ -1797,8 +1799,10 @@ static void l2cap_conn_del(struct hci_co
if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
cancel_delayed_work_sync(&conn->info_timer);
+ mutex_lock(&l2cap_conn_del_lock);
hcon->l2cap_data = NULL;
conn->hchan = NULL;
+ mutex_unlock(&l2cap_conn_del_lock);
l2cap_conn_put(conn);
}
@@ -7470,6 +7474,7 @@ void l2cap_recv_acldata(struct hci_conn
{
struct l2cap_conn *conn = hcon->l2cap_data;
int len;
+ int locked = 0;
if (!conn)
conn = l2cap_conn_add(hcon);
@@ -7477,6 +7482,11 @@ void l2cap_recv_acldata(struct hci_conn
if (!conn)
goto drop;
+ mutex_lock(&l2cap_conn_del_lock);
+ locked = 1;
+ conn = hcon->l2cap_data;
+ if (!conn)
+ goto drop;
BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags);
switch (flags) {
@@ -7503,6 +7513,7 @@ void l2cap_recv_acldata(struct hci_conn
if (len == skb->len) {
/* Complete frame received */
l2cap_recv_frame(conn, skb);
+ mutex_unlock(&l2cap_conn_del_lock);
return;
}
@@ -7566,6 +7577,8 @@ void l2cap_recv_acldata(struct hci_conn
}
drop:
+ if (locked)
+ mutex_unlock(&l2cap_conn_del_lock);
kfree_skb(skb);
}
--
^ permalink raw reply [flat|nested] 28+ messages in thread* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd
2025-01-15 10:25 ` [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd Hillf Danton
@ 2025-01-15 11:29 ` syzbot
0 siblings, 0 replies; 28+ messages in thread
From: syzbot @ 2025-01-15 11:29 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
INFO: task hung in disable_work_sync
INFO: task syz-executor:13931 blocked for more than 143 seconds.
Not tainted 6.13.0-rc7-syzkaller-g619f0b6fad52-dirty #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor state:D stack:20544 pid:13931 tgid:13931 ppid:1 flags:0x00004006
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5369 [inline]
__schedule+0x1850/0x4c30 kernel/sched/core.c:6756
__schedule_loop kernel/sched/core.c:6833 [inline]
schedule+0x14b/0x320 kernel/sched/core.c:6848
schedule_timeout+0xb0/0x290 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:95 [inline]
__wait_for_common kernel/sched/completion.c:116 [inline]
wait_for_common kernel/sched/completion.c:127 [inline]
wait_for_completion+0x355/0x620 kernel/sched/completion.c:148
__flush_work+0xa47/0xc60 kernel/workqueue.c:4242
__cancel_work_sync kernel/workqueue.c:4362 [inline]
disable_work_sync+0xba/0xe0 kernel/workqueue.c:4473
hci_unregister_dev+0x149/0x510 net/bluetooth/hci_core.c:2687
vhci_release+0x80/0xd0 drivers/bluetooth/hci_vhci.c:664
__fput+0x23c/0xa50 fs/file_table.c:450
task_work_run+0x24f/0x310 kernel/task_work.c:239
exit_task_work include/linux/task_work.h:43 [inline]
do_exit+0xa2a/0x28e0 kernel/exit.c:938
do_group_exit+0x207/0x2c0 kernel/exit.c:1087
get_signal+0x16b2/0x1750 kernel/signal.c:3017
arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0xce/0x340 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1b7bf8453a
RSP: 002b:00007f1b7c29ecc8 EFLAGS: 00000286
ORIG_RAX: 0000000000000106
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f1b7bf8453a
RDX: 00007f1b7c29ecf0 RSI: 00007f1b7c29ed80 RDI: 00000000ffffff9c
RBP: 00007f1b7c29ed80 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000100 R11: 0000000000000286 R12: 00007f1b7c29fe00
R13: 00007f1b7c0018f4 R14: 00007f1b7c29fe40 R15: 0000000000000258
</TASK>
INFO: task syz-executor:14434 blocked for more than 144 seconds.
Not tainted 6.13.0-rc7-syzkaller-g619f0b6fad52-dirty #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor state:D
stack:19936 pid:14434 tgid:14434 ppid:1 flags:0x00004006
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5369 [inline]
__schedule+0x1850/0x4c30 kernel/sched/core.c:6756
__schedule_loop kernel/sched/core.c:6833 [inline]
schedule+0x14b/0x320 kernel/sched/core.c:6848
schedule_timeout+0xb0/0x290 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:95 [inline]
__wait_for_common kernel/sched/completion.c:116 [inline]
wait_for_common kernel/sched/completion.c:127 [inline]
wait_for_completion+0x355/0x620 kernel/sched/completion.c:148
__flush_work+0xa47/0xc60 kernel/workqueue.c:4242
__cancel_work_sync kernel/workqueue.c:4362 [inline]
disable_work_sync+0xba/0xe0 kernel/workqueue.c:4473
hci_unregister_dev+0x149/0x510 net/bluetooth/hci_core.c:2687
vhci_release+0x80/0xd0 drivers/bluetooth/hci_vhci.c:664
__fput+0x23c/0xa50 fs/file_table.c:450
task_work_run+0x24f/0x310 kernel/task_work.c:239
exit_task_work include/linux/task_work.h:43 [inline]
do_exit+0xa2a/0x28e0 kernel/exit.c:938
do_group_exit+0x207/0x2c0 kernel/exit.c:1087
get_signal+0x16b2/0x1750 kernel/signal.c:3017
arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0xce/0x340 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f9b86587a6a
RSP: 002b:00007f9b8689f6c8 EFLAGS: 00000212
ORIG_RAX: 0000000000000037
RAX: 0000000000000000 RBX: 00007f9b8689f750 RCX: 00007f9b86587a6a
RDX: 0000000000000041 RSI: 0000000000000029 RDI: 0000000000000003
RBP: 0000000000000003 R08: 00007f9b8689f6ec R09: 0079746972756365
R10: 00007f9b8689f750 R11: 0000000000000212 R12: 00007f9b86746c80
R13: 00007f9b8689f6ec R14: 0000000000000000 R15: 00007f9b86748e40
</TASK>
Showing all locks held in the system:
1 lock held by khungtaskd/30:
#0:
ffffffff8e937ae0 (rcu_read_lock
){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
){....}-{1:3}, at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6744
3 locks held by kworker/u9:0/54:
#0: ffff88805dbaa148
((wq_completion)hci3#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline]
((wq_completion)hci3#2){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1840 kernel/workqueue.c:3317
#1: ffffc90000be7d00
((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline]
((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1840 kernel/workqueue.c:3317
#2:
ffffffff8fe23c88
(l2cap_conn_del_lock){+.+.}-{4:4}, at: l2cap_recv_acldata+0x79/0x1300 net/bluetooth/l2cap_core.c:7485
3 locks held by kworker/u9:1/5146:
#0:
ffff8880298ad148
(
(wq_completion)hci10#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline]
(wq_completion)hci10#2){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1840 kernel/workqueue.c:3317
#1: ffffc9000ecc7d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}
, at: process_one_work kernel/workqueue.c:3212 [inline]
, at: process_scheduled_works+0x976/0x1840 kernel/workqueue.c:3317
#2: ffffffff8fe23c88 (l2cap_conn_del_lock){+.+.}-{4:4}, at: l2cap_recv_acldata+0x79/0x1300 net/bluetooth/l2cap_core.c:7485
2 locks held by getty/5588:
#0: ffff88803160e0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc90002fde2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x6a6/0x1e00 drivers/tty/n_tty.c:2211
3 locks held by kworker/u9:4/6605:
#0:
ffff88807a88d948
(
(wq_completion)hci5
#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline]
#2){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1840 kernel/workqueue.c:3317
#1: ffffc90003a17d00 ((work_completion)(&hdev->rx_work)
){+.+.}-{0:0}
, at: process_one_work kernel/workqueue.c:3212 [inline]
, at: process_scheduled_works+0x976/0x1840 kernel/workqueue.c:3317
#2: ffffffff8fe23c88 (l2cap_conn_del_lock){+.+.}-{4:4}, at: l2cap_recv_acldata+0x79/0x1300 net/bluetooth/l2cap_core.c:7485
3 locks held by kworker/u9:5/6607:
#0: ffff8880794e8148 (
(wq_completion)hci7#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline]
(wq_completion)hci7#2){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1840 kernel/workqueue.c:3317
#1:
ffffc90003967d00
((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline]
((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1840 kernel/workqueue.c:3317
#2:
ffffffff8fe23c88
(l2cap_conn_del_lock){+.+.}-{4:4}
, at: l2cap_recv_acldata+0x79/0x1300 net/bluetooth/l2cap_core.c:7485
3 locks held by kworker/u9:6/6609:
#0:
ffff88805b8a2148
(
(wq_completion)hci9
#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline]
#2){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1840 kernel/workqueue.c:3317
#1:
ffffc90003c87d00
(
(work_completion)(&hdev->rx_work)
){+.+.}-{0:0}
, at: process_one_work kernel/workqueue.c:3212 [inline]
, at: process_scheduled_works+0x976/0x1840 kernel/workqueue.c:3317
#2: ffffffff8fe23c88 (l2cap_conn_del_lock){+.+.}-{4:4}, at: l2cap_recv_acldata+0x79/0x1300 net/bluetooth/l2cap_core.c:7485
3 locks held by kworker/u9:7/6610:
#0:
ffff8880250d8148 ((wq_completion)hci1
#2
){+.+.}-{0:0}
, at: process_one_work kernel/workqueue.c:3211 [inline]
, at: process_scheduled_works+0x93b/0x1840 kernel/workqueue.c:3317
#1:
ffffc90003a87d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}
, at: process_one_work kernel/workqueue.c:3212 [inline]
, at: process_scheduled_works+0x976/0x1840 kernel/workqueue.c:3317
#2:
ffffffff8fe23c88
(l2cap_conn_del_lock){+.+.}-{4:4}
, at: l2cap_recv_acldata+0x79/0x1300 net/bluetooth/l2cap_core.c:7485
5 locks held by kworker/u9:8/14419:
3 locks held by kworker/u9:9/14841:
#0: ffff8880794ed948
((wq_completion)hci6#2){+.+.}-{0:0}
, at: process_one_work kernel/workqueue.c:3211 [inline]
, at: process_scheduled_works+0x93b/0x1840 kernel/workqueue.c:3317
#1:
ffffc9000c9f7d00
((work_completion)(&hdev->rx_work)
){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline]
){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1840 kernel/workqueue.c:3317
#2:
ffffffff8fe23c88
(l2cap_conn_del_lock
){+.+.}-{4:4}, at: l2cap_recv_acldata+0x79/0x1300 net/bluetooth/l2cap_core.c:7485
3 locks held by kworker/u9:11/15620:
#0: ffff88805dbae148
(
(wq_completion)hci4#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline]
(wq_completion)hci4#2){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1840 kernel/workqueue.c:3317
#1: ffffc9000cd17d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}
, at: process_one_work kernel/workqueue.c:3212 [inline]
, at: process_scheduled_works+0x976/0x1840 kernel/workqueue.c:3317
#2:
ffffffff8fe23c88
(
l2cap_conn_del_lock
){+.+.}-{4:4}, at: l2cap_recv_acldata+0x79/0x1300 net/bluetooth/l2cap_core.c:7485
3 locks held by kworker/u9:12/22957:
4 locks held by syz-executor920/22964:
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.13.0-rc7-syzkaller-g619f0b6fad52-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
nmi_cpu_backtrace+0x49c/0x4d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:234 [inline]
watchdog+0xff6/0x1040 kernel/hung_task.c:397
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 14419 Comm: kworker/u9:8 Not tainted 6.13.0-rc7-syzkaller-g619f0b6fad52-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Workqueue: hci8 hci_rx_work
RIP: 0010:io_serial_in+0x76/0xb0 drivers/tty/serial/8250/8250_port.c:409
Code: 10 2c 4f fc 89 e9 41 d3 e6 48 83 c3 40 48 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 31 96 b5 fc 44 03 33 44 89 f2 ec <0f> b6 c0 5b 41 5e 41 5f 5d c3 cc cc cc cc 89 e9 80 e1 07 38 c1 7c
RSP: 0018:ffffc9000dba6b98 EFLAGS: 00000002
RAX: 1ffffffff34de400 RBX: ffffffff9a6f27c0 RCX: 0000000000000000
RDX: 00000000000003fd RSI: 0000000000000000 RDI: 0000000000000020
RBP: 0000000000000000 R08: ffffffff85505656 R09: 1ffff11004a5c046
R10: dffffc0000000000 R11: ffffffff85505610 R12: dffffc0000000000
R13: ffffffff9a3ecf70 R14: 00000000000003fd R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555578960788 CR3: 000000005b10e000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<NMI>
</NMI>
<TASK>
serial_in drivers/tty/serial/8250/8250.h:137 [inline]
serial_lsr_in drivers/tty/serial/8250/8250.h:159 [inline]
wait_for_lsr drivers/tty/serial/8250/8250_port.c:2088 [inline]
serial8250_console_fifo_write drivers/tty/serial/8250/8250_port.c:3335 [inline]
serial8250_console_write+0x1373/0x1ed0 drivers/tty/serial/8250/8250_port.c:3413
console_emit_next_record kernel/printk/printk.c:3122 [inline]
console_flush_all+0x869/0xeb0 kernel/printk/printk.c:3210
__console_flush_and_unlock kernel/printk/printk.c:3269 [inline]
console_unlock+0x14f/0x3b0 kernel/printk/printk.c:3309
vprintk_emit+0x730/0xa10 kernel/printk/printk.c:2432
_printk+0xd5/0x120 kernel/printk/printk.c:2457
bt_err+0x127/0x180 net/bluetooth/lib.c:296
l2cap_sig_channel net/bluetooth/l2cap_core.c:5541 [inline]
l2cap_recv_frame+0x21ba/0x10db0 net/bluetooth/l2cap_core.c:6821
l2cap_recv_acldata+0x486/0x1300 net/bluetooth/l2cap_core.c:7515
hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline]
hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040
process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317
worker_thread+0x870/0xd30 kernel/workqueue.c:3398
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Tested on:
commit: 619f0b6f Merge tag 'seccomp-v6.13-rc8' of git://git.ke..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12a5ce64580000
kernel config: https://syzkaller.appspot.com/x/.config?x=aadf89e2f6db86cc
dashboard link: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=11b789df980000
^ permalink raw reply [flat|nested] 28+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd
2024-02-26 9:32 [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd syzbot
2025-01-06 9:04 ` syzbot
@ 2025-01-14 14:09 ` syzbot
2025-01-16 16:55 ` [syzbot] Re: [PATCH v1] Bluetooth: L2CAP: Fix " syzbot
` (5 subsequent siblings)
7 siblings, 0 replies; 28+ messages in thread
From: syzbot @ 2025-01-14 14:09 UTC (permalink / raw)
To: davem, edumazet, hdanton, johan.hedberg, kuba, linux-bluetooth,
linux-kernel, luiz.dentz, luiz.von.dentz, marcel, netdev, pabeni,
syzkaller-bugs
syzbot has bisected this issue to:
commit e7b02296fb400ee64822fbdd81a0718449066333
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: Thu Feb 1 16:18:58 2024 +0000
Bluetooth: Remove BT_HS
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=10665bc4580000
start commit: ab75170520d4 Merge tag 'linux-watchdog-6.13-rc6' of git://..
git tree: upstream
final oops: https://syzkaller.appspot.com/x/report.txt?x=12665bc4580000
console output: https://syzkaller.appspot.com/x/log.txt?x=14665bc4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=1c541fa8af5c9cc7
dashboard link: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11261edf980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17fa36f8580000
Reported-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com
Fixes: e7b02296fb40 ("Bluetooth: Remove BT_HS")
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
^ permalink raw reply [flat|nested] 28+ messages in thread* Re: [syzbot] Re: [PATCH v1] Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd
2024-02-26 9:32 [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd syzbot
2025-01-06 9:04 ` syzbot
2025-01-14 14:09 ` syzbot
@ 2025-01-16 16:55 ` syzbot
2025-01-17 15:59 ` [syzbot] Re: [PATCH v2] " syzbot
` (4 subsequent siblings)
7 siblings, 0 replies; 28+ messages in thread
From: syzbot @ 2025-01-16 16:55 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [PATCH v1] Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd
Author: luiz.dentz@gmail.com
#syz test
On Thu, Jan 16, 2025 at 10:36 AM Luiz Augusto von Dentz
<luiz.dentz@gmail.com> wrote:
>
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
>
> After the hci sync command releases l2cap_conn, the hci receive data work
> queue references the released l2cap_conn when sending to the upper layer.
> Add hci dev lock to the hci receive data work queue to synchronize the two.
>
> [1]
> BUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954
> Read of size 8 at addr ffff8880271a4000 by task kworker/u9:2/5837
>
> CPU: 0 UID: 0 PID: 5837 Comm: kworker/u9:2 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
> Workqueue: hci1 hci_rx_work
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:94 [inline]
> dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
> print_address_description mm/kasan/report.c:378 [inline]
> print_report+0x169/0x550 mm/kasan/report.c:489
> kasan_report+0x143/0x180 mm/kasan/report.c:602
> l2cap_build_cmd net/bluetooth/l2cap_core.c:2964 [inline]
> l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954
> l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline]
> l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline]
> l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817
> hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline]
> hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040
> process_one_work kernel/workqueue.c:3229 [inline]
> process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> worker_thread+0x870/0xd30 kernel/workqueue.c:3391
> kthread+0x2f0/0x390 kernel/kthread.c:389
> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> </TASK>
>
> Allocated by task 5837:
> kasan_save_stack mm/kasan/common.c:47 [inline]
> kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
> poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
> __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
> kasan_kmalloc include/linux/kasan.h:260 [inline]
> __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329
> kmalloc_noprof include/linux/slab.h:901 [inline]
> kzalloc_noprof include/linux/slab.h:1037 [inline]
> l2cap_conn_add+0xa9/0x8e0 net/bluetooth/l2cap_core.c:6860
> l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7239
> hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
> hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726
> hci_event_func net/bluetooth/hci_event.c:7473 [inline]
> hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525
> hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035
> process_one_work kernel/workqueue.c:3229 [inline]
> process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> worker_thread+0x870/0xd30 kernel/workqueue.c:3391
> kthread+0x2f0/0x390 kernel/kthread.c:389
> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
>
> Freed by task 54:
> kasan_save_stack mm/kasan/common.c:47 [inline]
> kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
> kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582
> poison_slab_object mm/kasan/common.c:247 [inline]
> __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
> kasan_slab_free include/linux/kasan.h:233 [inline]
> slab_free_hook mm/slub.c:2353 [inline]
> slab_free mm/slub.c:4613 [inline]
> kfree+0x196/0x430 mm/slub.c:4761
> l2cap_connect_cfm+0xcc/0x1090 net/bluetooth/l2cap_core.c:7235
> hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
> hci_conn_failed+0x287/0x400 net/bluetooth/hci_conn.c:1266
> hci_abort_conn_sync+0x56c/0x11f0 net/bluetooth/hci_sync.c:5603
> hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332
> process_one_work kernel/workqueue.c:3229 [inline]
> process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> worker_thread+0x870/0xd30 kernel/workqueue.c:3391
> kthread+0x2f0/0x390 kernel/kthread.c:389
> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
>
> Reported-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734
> Tested-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com
> Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> ---
> net/bluetooth/l2cap_core.c | 23 ++++++++++++++++++++++-
> 1 file changed, 22 insertions(+), 1 deletion(-)
>
> diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> index 27b4c4a2ba1f..00ef61609d49 100644
> --- a/net/bluetooth/l2cap_core.c
> +++ b/net/bluetooth/l2cap_core.c
> @@ -7466,14 +7466,33 @@ static void l2cap_recv_reset(struct l2cap_conn *conn)
> conn->rx_len = 0;
> }
>
> +static struct l2cap_conn *l2cap_conn_hold_unless_zero(struct l2cap_conn *c)
> +{
> + BT_DBG("conn %p orig refcnt %u", c, kref_read(&c->ref));
> +
> + if (!kref_get_unless_zero(&c->ref))
> + return NULL;
> +
> + return c;
> +}
> +
> void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
> {
> - struct l2cap_conn *conn = hcon->l2cap_data;
> + struct l2cap_conn *conn;
> int len;
>
> + /* Lock hdev to access l2cap_data to avoid race with l2cap_conn_del */
> + hci_dev_lock(hcon->hdev);
> +
> + conn = hcon->l2cap_data;
> +
> if (!conn)
> conn = l2cap_conn_add(hcon);
>
> + conn = l2cap_conn_hold_unless_zero(conn);
> +
> + hci_dev_unlock(hcon->hdev);
> +
> if (!conn)
> goto drop;
>
> @@ -7565,6 +7584,8 @@ void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
> break;
> }
>
> + l2cap_conn_put(conn);
> +
> drop:
> kfree_skb(skb);
> }
> --
> 2.47.1
>
--
Luiz Augusto von Dentz
^ permalink raw reply [flat|nested] 28+ messages in thread* Re: [syzbot] Re: [PATCH v2] Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd
2024-02-26 9:32 [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd syzbot
` (2 preceding siblings ...)
2025-01-16 16:55 ` [syzbot] Re: [PATCH v1] Bluetooth: L2CAP: Fix " syzbot
@ 2025-01-17 15:59 ` syzbot
2025-01-17 17:16 ` [syzbot] Re: [PATCH v3] " syzbot
` (3 subsequent siblings)
7 siblings, 0 replies; 28+ messages in thread
From: syzbot @ 2025-01-17 15:59 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [PATCH v2] Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd
Author: luiz.dentz@gmail.com
#syz test
On Fri, Jan 17, 2025 at 10:56 AM Luiz Augusto von Dentz
<luiz.dentz@gmail.com> wrote:
>
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
>
> After the hci sync command releases l2cap_conn, the hci receive data work
> queue references the released l2cap_conn when sending to the upper layer.
> Add hci dev lock to the hci receive data work queue to synchronize the two.
>
> [1]
> BUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954
> Read of size 8 at addr ffff8880271a4000 by task kworker/u9:2/5837
>
> CPU: 0 UID: 0 PID: 5837 Comm: kworker/u9:2 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
> Workqueue: hci1 hci_rx_work
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:94 [inline]
> dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
> print_address_description mm/kasan/report.c:378 [inline]
> print_report+0x169/0x550 mm/kasan/report.c:489
> kasan_report+0x143/0x180 mm/kasan/report.c:602
> l2cap_build_cmd net/bluetooth/l2cap_core.c:2964 [inline]
> l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954
> l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline]
> l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline]
> l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817
> hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline]
> hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040
> process_one_work kernel/workqueue.c:3229 [inline]
> process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> worker_thread+0x870/0xd30 kernel/workqueue.c:3391
> kthread+0x2f0/0x390 kernel/kthread.c:389
> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> </TASK>
>
> Allocated by task 5837:
> kasan_save_stack mm/kasan/common.c:47 [inline]
> kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
> poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
> __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
> kasan_kmalloc include/linux/kasan.h:260 [inline]
> __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329
> kmalloc_noprof include/linux/slab.h:901 [inline]
> kzalloc_noprof include/linux/slab.h:1037 [inline]
> l2cap_conn_add+0xa9/0x8e0 net/bluetooth/l2cap_core.c:6860
> l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7239
> hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
> hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726
> hci_event_func net/bluetooth/hci_event.c:7473 [inline]
> hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525
> hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035
> process_one_work kernel/workqueue.c:3229 [inline]
> process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> worker_thread+0x870/0xd30 kernel/workqueue.c:3391
> kthread+0x2f0/0x390 kernel/kthread.c:389
> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
>
> Freed by task 54:
> kasan_save_stack mm/kasan/common.c:47 [inline]
> kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
> kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582
> poison_slab_object mm/kasan/common.c:247 [inline]
> __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
> kasan_slab_free include/linux/kasan.h:233 [inline]
> slab_free_hook mm/slub.c:2353 [inline]
> slab_free mm/slub.c:4613 [inline]
> kfree+0x196/0x430 mm/slub.c:4761
> l2cap_connect_cfm+0xcc/0x1090 net/bluetooth/l2cap_core.c:7235
> hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
> hci_conn_failed+0x287/0x400 net/bluetooth/hci_conn.c:1266
> hci_abort_conn_sync+0x56c/0x11f0 net/bluetooth/hci_sync.c:5603
> hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332
> process_one_work kernel/workqueue.c:3229 [inline]
> process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> worker_thread+0x870/0xd30 kernel/workqueue.c:3391
> kthread+0x2f0/0x390 kernel/kthread.c:389
> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
>
> Reported-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734
> Tested-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com
> Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> ---
> net/bluetooth/l2cap_core.c | 38 ++++++++++++++++++++++++++++++++++++--
> 1 file changed, 36 insertions(+), 2 deletions(-)
>
> diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> index 27b4c4a2ba1f..025bb038e304 100644
> --- a/net/bluetooth/l2cap_core.c
> +++ b/net/bluetooth/l2cap_core.c
> @@ -951,11 +951,18 @@ static u8 l2cap_get_ident(struct l2cap_conn *conn)
> static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
> void *data)
> {
> - struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
> + struct sk_buff *skb;
> u8 flags;
>
> + /* Check if HCI_CONN_DROP has been set since it means hci_chan_del has
> + * been called.
> + */
> + if (test_bit(HCI_CONN_DROP, &conn->hcon->flags))
> + return;
> +
> BT_DBG("code 0x%2.2x", code);
>
> + skb = l2cap_build_cmd(conn, code, ident, len, data);
> if (!skb)
> return;
>
> @@ -6785,6 +6792,12 @@ static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
> u16 cid, len;
> __le16 psm;
>
> + /* Check if hcon has been dropped then drop its packets as well */
> + if (test_bit(HCI_CONN_DROP, &hcon->flags)) {
> + kfree_skb(skb);
> + return;
> + }
> +
> if (hcon->state != BT_CONNECTED) {
> BT_DBG("queueing pending rx skb");
> skb_queue_tail(&conn->pending_rx, skb);
> @@ -7466,14 +7479,33 @@ static void l2cap_recv_reset(struct l2cap_conn *conn)
> conn->rx_len = 0;
> }
>
> +static struct l2cap_conn *l2cap_conn_hold_unless_zero(struct l2cap_conn *c)
> +{
> + BT_DBG("conn %p orig refcnt %u", c, kref_read(&c->ref));
> +
> + if (!kref_get_unless_zero(&c->ref))
> + return NULL;
> +
> + return c;
> +}
> +
> void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
> {
> - struct l2cap_conn *conn = hcon->l2cap_data;
> + struct l2cap_conn *conn;
> int len;
>
> + /* Lock hdev to access l2cap_data to avoid race with l2cap_conn_del */
> + hci_dev_lock(hcon->hdev);
> +
> + conn = hcon->l2cap_data;
> +
> if (!conn)
> conn = l2cap_conn_add(hcon);
>
> + conn = l2cap_conn_hold_unless_zero(conn);
> +
> + hci_dev_unlock(hcon->hdev);
> +
> if (!conn)
> goto drop;
>
> @@ -7565,6 +7597,8 @@ void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
> break;
> }
>
> + l2cap_conn_put(conn);
> +
> drop:
> kfree_skb(skb);
> }
> --
> 2.47.1
>
--
Luiz Augusto von Dentz
^ permalink raw reply [flat|nested] 28+ messages in thread* Re: [syzbot] Re: [PATCH v3] Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd
2024-02-26 9:32 [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd syzbot
` (3 preceding siblings ...)
2025-01-17 15:59 ` [syzbot] Re: [PATCH v2] " syzbot
@ 2025-01-17 17:16 ` syzbot
2025-01-17 20:48 ` [syzbot] Re: [PATCH v4] " syzbot
` (2 subsequent siblings)
7 siblings, 0 replies; 28+ messages in thread
From: syzbot @ 2025-01-17 17:16 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [PATCH v3] Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd
Author: luiz.dentz@gmail.com
#syz test
On Fri, Jan 17, 2025 at 12:14 PM Luiz Augusto von Dentz
<luiz.dentz@gmail.com> wrote:
>
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
>
> After the hci sync command releases l2cap_conn, the hci receive data work
> queue references the released l2cap_conn when sending to the upper layer.
> Add hci dev lock to the hci receive data work queue to synchronize the two.
>
> [1]
> BUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954
> Read of size 8 at addr ffff8880271a4000 by task kworker/u9:2/5837
>
> CPU: 0 UID: 0 PID: 5837 Comm: kworker/u9:2 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
> Workqueue: hci1 hci_rx_work
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:94 [inline]
> dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
> print_address_description mm/kasan/report.c:378 [inline]
> print_report+0x169/0x550 mm/kasan/report.c:489
> kasan_report+0x143/0x180 mm/kasan/report.c:602
> l2cap_build_cmd net/bluetooth/l2cap_core.c:2964 [inline]
> l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954
> l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline]
> l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline]
> l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817
> hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline]
> hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040
> process_one_work kernel/workqueue.c:3229 [inline]
> process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> worker_thread+0x870/0xd30 kernel/workqueue.c:3391
> kthread+0x2f0/0x390 kernel/kthread.c:389
> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> </TASK>
>
> Allocated by task 5837:
> kasan_save_stack mm/kasan/common.c:47 [inline]
> kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
> poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
> __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
> kasan_kmalloc include/linux/kasan.h:260 [inline]
> __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329
> kmalloc_noprof include/linux/slab.h:901 [inline]
> kzalloc_noprof include/linux/slab.h:1037 [inline]
> l2cap_conn_add+0xa9/0x8e0 net/bluetooth/l2cap_core.c:6860
> l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7239
> hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
> hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726
> hci_event_func net/bluetooth/hci_event.c:7473 [inline]
> hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525
> hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035
> process_one_work kernel/workqueue.c:3229 [inline]
> process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> worker_thread+0x870/0xd30 kernel/workqueue.c:3391
> kthread+0x2f0/0x390 kernel/kthread.c:389
> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
>
> Freed by task 54:
> kasan_save_stack mm/kasan/common.c:47 [inline]
> kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
> kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582
> poison_slab_object mm/kasan/common.c:247 [inline]
> __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
> kasan_slab_free include/linux/kasan.h:233 [inline]
> slab_free_hook mm/slub.c:2353 [inline]
> slab_free mm/slub.c:4613 [inline]
> kfree+0x196/0x430 mm/slub.c:4761
> l2cap_connect_cfm+0xcc/0x1090 net/bluetooth/l2cap_core.c:7235
> hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
> hci_conn_failed+0x287/0x400 net/bluetooth/hci_conn.c:1266
> hci_abort_conn_sync+0x56c/0x11f0 net/bluetooth/hci_sync.c:5603
> hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332
> process_one_work kernel/workqueue.c:3229 [inline]
> process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> worker_thread+0x870/0xd30 kernel/workqueue.c:3391
> kthread+0x2f0/0x390 kernel/kthread.c:389
> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
>
> Reported-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734
> Tested-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com
> Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> ---
> net/bluetooth/l2cap_core.c | 38 ++++++++++++++++++++++++++++++++++++--
> 1 file changed, 36 insertions(+), 2 deletions(-)
>
> diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> index 27b4c4a2ba1f..cf3597682011 100644
> --- a/net/bluetooth/l2cap_core.c
> +++ b/net/bluetooth/l2cap_core.c
> @@ -951,11 +951,18 @@ static u8 l2cap_get_ident(struct l2cap_conn *conn)
> static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
> void *data)
> {
> - struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
> + struct sk_buff *skb;
> u8 flags;
>
> + /* Check if hchan has been dropped since it means hci_chan_del has
> + * been called.
> + */
> + if (!conn->hchan)
> + return;
> +
> BT_DBG("code 0x%2.2x", code);
>
> + skb = l2cap_build_cmd(conn, code, ident, len, data);
> if (!skb)
> return;
>
> @@ -6785,6 +6792,12 @@ static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
> u16 cid, len;
> __le16 psm;
>
> + /* Check if hchan has been dropped then drop any packets as well */
> + if (!conn->hchan) {
> + kfree_skb(skb);
> + return;
> + }
> +
> if (hcon->state != BT_CONNECTED) {
> BT_DBG("queueing pending rx skb");
> skb_queue_tail(&conn->pending_rx, skb);
> @@ -7466,14 +7479,33 @@ static void l2cap_recv_reset(struct l2cap_conn *conn)
> conn->rx_len = 0;
> }
>
> +static struct l2cap_conn *l2cap_conn_hold_unless_zero(struct l2cap_conn *c)
> +{
> + BT_DBG("conn %p orig refcnt %u", c, kref_read(&c->ref));
> +
> + if (!kref_get_unless_zero(&c->ref))
> + return NULL;
> +
> + return c;
> +}
> +
> void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
> {
> - struct l2cap_conn *conn = hcon->l2cap_data;
> + struct l2cap_conn *conn;
> int len;
>
> + /* Lock hdev to access l2cap_data to avoid race with l2cap_conn_del */
> + hci_dev_lock(hcon->hdev);
> +
> + conn = hcon->l2cap_data;
> +
> if (!conn)
> conn = l2cap_conn_add(hcon);
>
> + conn = l2cap_conn_hold_unless_zero(conn);
> +
> + hci_dev_unlock(hcon->hdev);
> +
> if (!conn)
> goto drop;
>
> @@ -7565,6 +7597,8 @@ void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
> break;
> }
>
> + l2cap_conn_put(conn);
> +
> drop:
> kfree_skb(skb);
> }
> --
> 2.47.1
>
--
Luiz Augusto von Dentz
^ permalink raw reply [flat|nested] 28+ messages in thread* Re: [syzbot] Re: [PATCH v4] Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd
2024-02-26 9:32 [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd syzbot
` (4 preceding siblings ...)
2025-01-17 17:16 ` [syzbot] Re: [PATCH v3] " syzbot
@ 2025-01-17 20:48 ` syzbot
2025-01-21 18:08 ` syzbot
2025-01-22 17:04 ` syzbot
7 siblings, 0 replies; 28+ messages in thread
From: syzbot @ 2025-01-17 20:48 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [PATCH v4] Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd
Author: luiz.dentz@gmail.com
#syz test
On Fri, Jan 17, 2025 at 1:42 PM Luiz Augusto von Dentz
<luiz.dentz@gmail.com> wrote:
>
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
>
> After the hci sync command releases l2cap_conn, the hci receive data work
> queue references the released l2cap_conn when sending to the upper layer.
> Add hci dev lock to the hci receive data work queue to synchronize the two.
>
> [1]
> BUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954
> Read of size 8 at addr ffff8880271a4000 by task kworker/u9:2/5837
>
> CPU: 0 UID: 0 PID: 5837 Comm: kworker/u9:2 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
> Workqueue: hci1 hci_rx_work
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:94 [inline]
> dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
> print_address_description mm/kasan/report.c:378 [inline]
> print_report+0x169/0x550 mm/kasan/report.c:489
> kasan_report+0x143/0x180 mm/kasan/report.c:602
> l2cap_build_cmd net/bluetooth/l2cap_core.c:2964 [inline]
> l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954
> l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline]
> l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline]
> l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817
> hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline]
> hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040
> process_one_work kernel/workqueue.c:3229 [inline]
> process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> worker_thread+0x870/0xd30 kernel/workqueue.c:3391
> kthread+0x2f0/0x390 kernel/kthread.c:389
> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> </TASK>
>
> Allocated by task 5837:
> kasan_save_stack mm/kasan/common.c:47 [inline]
> kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
> poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
> __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
> kasan_kmalloc include/linux/kasan.h:260 [inline]
> __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329
> kmalloc_noprof include/linux/slab.h:901 [inline]
> kzalloc_noprof include/linux/slab.h:1037 [inline]
> l2cap_conn_add+0xa9/0x8e0 net/bluetooth/l2cap_core.c:6860
> l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7239
> hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
> hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726
> hci_event_func net/bluetooth/hci_event.c:7473 [inline]
> hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525
> hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035
> process_one_work kernel/workqueue.c:3229 [inline]
> process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> worker_thread+0x870/0xd30 kernel/workqueue.c:3391
> kthread+0x2f0/0x390 kernel/kthread.c:389
> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
>
> Freed by task 54:
> kasan_save_stack mm/kasan/common.c:47 [inline]
> kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
> kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582
> poison_slab_object mm/kasan/common.c:247 [inline]
> __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
> kasan_slab_free include/linux/kasan.h:233 [inline]
> slab_free_hook mm/slub.c:2353 [inline]
> slab_free mm/slub.c:4613 [inline]
> kfree+0x196/0x430 mm/slub.c:4761
> l2cap_connect_cfm+0xcc/0x1090 net/bluetooth/l2cap_core.c:7235
> hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
> hci_conn_failed+0x287/0x400 net/bluetooth/hci_conn.c:1266
> hci_abort_conn_sync+0x56c/0x11f0 net/bluetooth/hci_sync.c:5603
> hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332
> process_one_work kernel/workqueue.c:3229 [inline]
> process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> worker_thread+0x870/0xd30 kernel/workqueue.c:3391
> kthread+0x2f0/0x390 kernel/kthread.c:389
> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
>
> Reported-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734
> Tested-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com
> Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> ---
> net/bluetooth/l2cap_core.c | 45 ++++++++++++++++++++++++++++++++++----
> 1 file changed, 41 insertions(+), 4 deletions(-)
>
> diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> index 27b4c4a2ba1f..cc730135e5d9 100644
> --- a/net/bluetooth/l2cap_core.c
> +++ b/net/bluetooth/l2cap_core.c
> @@ -951,11 +951,18 @@ static u8 l2cap_get_ident(struct l2cap_conn *conn)
> static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
> void *data)
> {
> - struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
> + struct sk_buff *skb;
> u8 flags;
>
> + /* Check if hchan has been dropped since it means hci_chan_del has
> + * been called.
> + */
> + if (!conn->hchan)
> + return;
> +
> BT_DBG("code 0x%2.2x", code);
>
> + skb = l2cap_build_cmd(conn, code, ident, len, data);
> if (!skb)
> return;
>
> @@ -1751,12 +1758,16 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
> {
> struct l2cap_conn *conn = hcon->l2cap_data;
> struct l2cap_chan *chan, *l;
> + struct hci_chan *hchan;
>
> if (!conn)
> return;
>
> BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
>
> + hchan = conn->hchan;
> + conn->hchan = NULL;
> +
> kfree_skb(conn->rx_skb);
>
> skb_queue_purge(&conn->pending_rx);
> @@ -1792,13 +1803,12 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
>
> mutex_unlock(&conn->chan_lock);
>
> - hci_chan_del(conn->hchan);
> + hci_chan_del(hchan);
>
> if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
> cancel_delayed_work_sync(&conn->info_timer);
>
> hcon->l2cap_data = NULL;
> - conn->hchan = NULL;
> l2cap_conn_put(conn);
> }
>
> @@ -6785,6 +6795,12 @@ static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
> u16 cid, len;
> __le16 psm;
>
> + /* Check if hchan has been dropped then drop any packets as well */
> + if (!conn->hchan) {
> + kfree_skb(skb);
> + return;
> + }
> +
> if (hcon->state != BT_CONNECTED) {
> BT_DBG("queueing pending rx skb");
> skb_queue_tail(&conn->pending_rx, skb);
> @@ -7466,14 +7482,33 @@ static void l2cap_recv_reset(struct l2cap_conn *conn)
> conn->rx_len = 0;
> }
>
> +static struct l2cap_conn *l2cap_conn_hold_unless_zero(struct l2cap_conn *c)
> +{
> + BT_DBG("conn %p orig refcnt %u", c, kref_read(&c->ref));
> +
> + if (!kref_get_unless_zero(&c->ref))
> + return NULL;
> +
> + return c;
> +}
> +
> void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
> {
> - struct l2cap_conn *conn = hcon->l2cap_data;
> + struct l2cap_conn *conn;
> int len;
>
> + /* Lock hdev to access l2cap_data to avoid race with l2cap_conn_del */
> + hci_dev_lock(hcon->hdev);
> +
> + conn = hcon->l2cap_data;
> +
> if (!conn)
> conn = l2cap_conn_add(hcon);
>
> + conn = l2cap_conn_hold_unless_zero(conn);
> +
> + hci_dev_unlock(hcon->hdev);
> +
> if (!conn)
> goto drop;
>
> @@ -7565,6 +7600,8 @@ void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
> break;
> }
>
> + l2cap_conn_put(conn);
> +
> drop:
> kfree_skb(skb);
> }
> --
> 2.47.1
>
--
Luiz Augusto von Dentz
^ permalink raw reply [flat|nested] 28+ messages in thread* Re: [syzbot] Re: [PATCH v4] Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd
2024-02-26 9:32 [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd syzbot
` (5 preceding siblings ...)
2025-01-17 20:48 ` [syzbot] Re: [PATCH v4] " syzbot
@ 2025-01-21 18:08 ` syzbot
2025-01-22 17:04 ` syzbot
7 siblings, 0 replies; 28+ messages in thread
From: syzbot @ 2025-01-21 18:08 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [PATCH v4] Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd
Author: luiz.dentz@gmail.com
#syz test
On Fri, Jan 17, 2025 at 3:48 PM Luiz Augusto von Dentz
<luiz.dentz@gmail.com> wrote:
>
> #syz test
>
> On Fri, Jan 17, 2025 at 1:42 PM Luiz Augusto von Dentz
> <luiz.dentz@gmail.com> wrote:
> >
> > From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> >
> > After the hci sync command releases l2cap_conn, the hci receive data work
> > queue references the released l2cap_conn when sending to the upper layer.
> > Add hci dev lock to the hci receive data work queue to synchronize the two.
> >
> > [1]
> > BUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954
> > Read of size 8 at addr ffff8880271a4000 by task kworker/u9:2/5837
> >
> > CPU: 0 UID: 0 PID: 5837 Comm: kworker/u9:2 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0
> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
> > Workqueue: hci1 hci_rx_work
> > Call Trace:
> > <TASK>
> > __dump_stack lib/dump_stack.c:94 [inline]
> > dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
> > print_address_description mm/kasan/report.c:378 [inline]
> > print_report+0x169/0x550 mm/kasan/report.c:489
> > kasan_report+0x143/0x180 mm/kasan/report.c:602
> > l2cap_build_cmd net/bluetooth/l2cap_core.c:2964 [inline]
> > l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954
> > l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline]
> > l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline]
> > l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817
> > hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline]
> > hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040
> > process_one_work kernel/workqueue.c:3229 [inline]
> > process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> > worker_thread+0x870/0xd30 kernel/workqueue.c:3391
> > kthread+0x2f0/0x390 kernel/kthread.c:389
> > ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> > </TASK>
> >
> > Allocated by task 5837:
> > kasan_save_stack mm/kasan/common.c:47 [inline]
> > kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
> > poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
> > __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
> > kasan_kmalloc include/linux/kasan.h:260 [inline]
> > __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329
> > kmalloc_noprof include/linux/slab.h:901 [inline]
> > kzalloc_noprof include/linux/slab.h:1037 [inline]
> > l2cap_conn_add+0xa9/0x8e0 net/bluetooth/l2cap_core.c:6860
> > l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7239
> > hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
> > hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726
> > hci_event_func net/bluetooth/hci_event.c:7473 [inline]
> > hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525
> > hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035
> > process_one_work kernel/workqueue.c:3229 [inline]
> > process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> > worker_thread+0x870/0xd30 kernel/workqueue.c:3391
> > kthread+0x2f0/0x390 kernel/kthread.c:389
> > ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> >
> > Freed by task 54:
> > kasan_save_stack mm/kasan/common.c:47 [inline]
> > kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
> > kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582
> > poison_slab_object mm/kasan/common.c:247 [inline]
> > __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
> > kasan_slab_free include/linux/kasan.h:233 [inline]
> > slab_free_hook mm/slub.c:2353 [inline]
> > slab_free mm/slub.c:4613 [inline]
> > kfree+0x196/0x430 mm/slub.c:4761
> > l2cap_connect_cfm+0xcc/0x1090 net/bluetooth/l2cap_core.c:7235
> > hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
> > hci_conn_failed+0x287/0x400 net/bluetooth/hci_conn.c:1266
> > hci_abort_conn_sync+0x56c/0x11f0 net/bluetooth/hci_sync.c:5603
> > hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332
> > process_one_work kernel/workqueue.c:3229 [inline]
> > process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> > worker_thread+0x870/0xd30 kernel/workqueue.c:3391
> > kthread+0x2f0/0x390 kernel/kthread.c:389
> > ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> >
> > Reported-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734
> > Tested-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com
> > Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> > Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> > ---
> > net/bluetooth/l2cap_core.c | 45 ++++++++++++++++++++++++++++++++++----
> > 1 file changed, 41 insertions(+), 4 deletions(-)
> >
> > diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> > index 27b4c4a2ba1f..cc730135e5d9 100644
> > --- a/net/bluetooth/l2cap_core.c
> > +++ b/net/bluetooth/l2cap_core.c
> > @@ -951,11 +951,18 @@ static u8 l2cap_get_ident(struct l2cap_conn *conn)
> > static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
> > void *data)
> > {
> > - struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
> > + struct sk_buff *skb;
> > u8 flags;
> >
> > + /* Check if hchan has been dropped since it means hci_chan_del has
> > + * been called.
> > + */
> > + if (!conn->hchan)
> > + return;
> > +
> > BT_DBG("code 0x%2.2x", code);
> >
> > + skb = l2cap_build_cmd(conn, code, ident, len, data);
> > if (!skb)
> > return;
> >
> > @@ -1751,12 +1758,16 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
> > {
> > struct l2cap_conn *conn = hcon->l2cap_data;
> > struct l2cap_chan *chan, *l;
> > + struct hci_chan *hchan;
> >
> > if (!conn)
> > return;
> >
> > BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
> >
> > + hchan = conn->hchan;
> > + conn->hchan = NULL;
> > +
> > kfree_skb(conn->rx_skb);
> >
> > skb_queue_purge(&conn->pending_rx);
> > @@ -1792,13 +1803,12 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
> >
> > mutex_unlock(&conn->chan_lock);
> >
> > - hci_chan_del(conn->hchan);
> > + hci_chan_del(hchan);
> >
> > if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
> > cancel_delayed_work_sync(&conn->info_timer);
> >
> > hcon->l2cap_data = NULL;
> > - conn->hchan = NULL;
> > l2cap_conn_put(conn);
> > }
> >
> > @@ -6785,6 +6795,12 @@ static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
> > u16 cid, len;
> > __le16 psm;
> >
> > + /* Check if hchan has been dropped then drop any packets as well */
> > + if (!conn->hchan) {
> > + kfree_skb(skb);
> > + return;
> > + }
> > +
> > if (hcon->state != BT_CONNECTED) {
> > BT_DBG("queueing pending rx skb");
> > skb_queue_tail(&conn->pending_rx, skb);
> > @@ -7466,14 +7482,33 @@ static void l2cap_recv_reset(struct l2cap_conn *conn)
> > conn->rx_len = 0;
> > }
> >
> > +static struct l2cap_conn *l2cap_conn_hold_unless_zero(struct l2cap_conn *c)
> > +{
> > + BT_DBG("conn %p orig refcnt %u", c, kref_read(&c->ref));
> > +
> > + if (!kref_get_unless_zero(&c->ref))
> > + return NULL;
> > +
> > + return c;
> > +}
> > +
> > void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
> > {
> > - struct l2cap_conn *conn = hcon->l2cap_data;
> > + struct l2cap_conn *conn;
> > int len;
> >
> > + /* Lock hdev to access l2cap_data to avoid race with l2cap_conn_del */
> > + hci_dev_lock(hcon->hdev);
> > +
> > + conn = hcon->l2cap_data;
> > +
> > if (!conn)
> > conn = l2cap_conn_add(hcon);
> >
> > + conn = l2cap_conn_hold_unless_zero(conn);
> > +
> > + hci_dev_unlock(hcon->hdev);
> > +
> > if (!conn)
> > goto drop;
> >
> > @@ -7565,6 +7600,8 @@ void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
> > break;
> > }
> >
> > + l2cap_conn_put(conn);
> > +
> > drop:
> > kfree_skb(skb);
> > }
> > --
> > 2.47.1
> >
>
>
> --
> Luiz Augusto von Dentz
--
Luiz Augusto von Dentz
^ permalink raw reply [flat|nested] 28+ messages in thread* Re: [syzbot] Re: [PATCH v4] Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd
2024-02-26 9:32 [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd syzbot
` (6 preceding siblings ...)
2025-01-21 18:08 ` syzbot
@ 2025-01-22 17:04 ` syzbot
7 siblings, 0 replies; 28+ messages in thread
From: syzbot @ 2025-01-22 17:04 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [PATCH v4] Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd
Author: luiz.dentz@gmail.com
#syz test
On Tue, Jan 21, 2025 at 1:08 PM Luiz Augusto von Dentz
<luiz.dentz@gmail.com> wrote:
>
> #syz test
>
> On Fri, Jan 17, 2025 at 3:48 PM Luiz Augusto von Dentz
> <luiz.dentz@gmail.com> wrote:
> >
> > #syz test
> >
> > On Fri, Jan 17, 2025 at 1:42 PM Luiz Augusto von Dentz
> > <luiz.dentz@gmail.com> wrote:
> > >
> > > From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> > >
> > > After the hci sync command releases l2cap_conn, the hci receive data work
> > > queue references the released l2cap_conn when sending to the upper layer.
> > > Add hci dev lock to the hci receive data work queue to synchronize the two.
> > >
> > > [1]
> > > BUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954
> > > Read of size 8 at addr ffff8880271a4000 by task kworker/u9:2/5837
> > >
> > > CPU: 0 UID: 0 PID: 5837 Comm: kworker/u9:2 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0
> > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
> > > Workqueue: hci1 hci_rx_work
> > > Call Trace:
> > > <TASK>
> > > __dump_stack lib/dump_stack.c:94 [inline]
> > > dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
> > > print_address_description mm/kasan/report.c:378 [inline]
> > > print_report+0x169/0x550 mm/kasan/report.c:489
> > > kasan_report+0x143/0x180 mm/kasan/report.c:602
> > > l2cap_build_cmd net/bluetooth/l2cap_core.c:2964 [inline]
> > > l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954
> > > l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline]
> > > l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline]
> > > l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817
> > > hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline]
> > > hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040
> > > process_one_work kernel/workqueue.c:3229 [inline]
> > > process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> > > worker_thread+0x870/0xd30 kernel/workqueue.c:3391
> > > kthread+0x2f0/0x390 kernel/kthread.c:389
> > > ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> > > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> > > </TASK>
> > >
> > > Allocated by task 5837:
> > > kasan_save_stack mm/kasan/common.c:47 [inline]
> > > kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
> > > poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
> > > __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
> > > kasan_kmalloc include/linux/kasan.h:260 [inline]
> > > __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329
> > > kmalloc_noprof include/linux/slab.h:901 [inline]
> > > kzalloc_noprof include/linux/slab.h:1037 [inline]
> > > l2cap_conn_add+0xa9/0x8e0 net/bluetooth/l2cap_core.c:6860
> > > l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7239
> > > hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
> > > hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726
> > > hci_event_func net/bluetooth/hci_event.c:7473 [inline]
> > > hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525
> > > hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035
> > > process_one_work kernel/workqueue.c:3229 [inline]
> > > process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> > > worker_thread+0x870/0xd30 kernel/workqueue.c:3391
> > > kthread+0x2f0/0x390 kernel/kthread.c:389
> > > ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> > > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> > >
> > > Freed by task 54:
> > > kasan_save_stack mm/kasan/common.c:47 [inline]
> > > kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
> > > kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582
> > > poison_slab_object mm/kasan/common.c:247 [inline]
> > > __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
> > > kasan_slab_free include/linux/kasan.h:233 [inline]
> > > slab_free_hook mm/slub.c:2353 [inline]
> > > slab_free mm/slub.c:4613 [inline]
> > > kfree+0x196/0x430 mm/slub.c:4761
> > > l2cap_connect_cfm+0xcc/0x1090 net/bluetooth/l2cap_core.c:7235
> > > hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
> > > hci_conn_failed+0x287/0x400 net/bluetooth/hci_conn.c:1266
> > > hci_abort_conn_sync+0x56c/0x11f0 net/bluetooth/hci_sync.c:5603
> > > hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332
> > > process_one_work kernel/workqueue.c:3229 [inline]
> > > process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> > > worker_thread+0x870/0xd30 kernel/workqueue.c:3391
> > > kthread+0x2f0/0x390 kernel/kthread.c:389
> > > ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> > > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> > >
> > > Reported-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com
> > > Closes: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734
> > > Tested-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com
> > > Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> > > Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> > > ---
> > > net/bluetooth/l2cap_core.c | 45 ++++++++++++++++++++++++++++++++++----
> > > 1 file changed, 41 insertions(+), 4 deletions(-)
> > >
> > > diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> > > index 27b4c4a2ba1f..cc730135e5d9 100644
> > > --- a/net/bluetooth/l2cap_core.c
> > > +++ b/net/bluetooth/l2cap_core.c
> > > @@ -951,11 +951,18 @@ static u8 l2cap_get_ident(struct l2cap_conn *conn)
> > > static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
> > > void *data)
> > > {
> > > - struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
> > > + struct sk_buff *skb;
> > > u8 flags;
> > >
> > > + /* Check if hchan has been dropped since it means hci_chan_del has
> > > + * been called.
> > > + */
> > > + if (!conn->hchan)
> > > + return;
> > > +
> > > BT_DBG("code 0x%2.2x", code);
> > >
> > > + skb = l2cap_build_cmd(conn, code, ident, len, data);
> > > if (!skb)
> > > return;
> > >
> > > @@ -1751,12 +1758,16 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
> > > {
> > > struct l2cap_conn *conn = hcon->l2cap_data;
> > > struct l2cap_chan *chan, *l;
> > > + struct hci_chan *hchan;
> > >
> > > if (!conn)
> > > return;
> > >
> > > BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
> > >
> > > + hchan = conn->hchan;
> > > + conn->hchan = NULL;
> > > +
> > > kfree_skb(conn->rx_skb);
> > >
> > > skb_queue_purge(&conn->pending_rx);
> > > @@ -1792,13 +1803,12 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
> > >
> > > mutex_unlock(&conn->chan_lock);
> > >
> > > - hci_chan_del(conn->hchan);
> > > + hci_chan_del(hchan);
> > >
> > > if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
> > > cancel_delayed_work_sync(&conn->info_timer);
> > >
> > > hcon->l2cap_data = NULL;
> > > - conn->hchan = NULL;
> > > l2cap_conn_put(conn);
> > > }
> > >
> > > @@ -6785,6 +6795,12 @@ static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
> > > u16 cid, len;
> > > __le16 psm;
> > >
> > > + /* Check if hchan has been dropped then drop any packets as well */
> > > + if (!conn->hchan) {
> > > + kfree_skb(skb);
> > > + return;
> > > + }
> > > +
> > > if (hcon->state != BT_CONNECTED) {
> > > BT_DBG("queueing pending rx skb");
> > > skb_queue_tail(&conn->pending_rx, skb);
> > > @@ -7466,14 +7482,33 @@ static void l2cap_recv_reset(struct l2cap_conn *conn)
> > > conn->rx_len = 0;
> > > }
> > >
> > > +static struct l2cap_conn *l2cap_conn_hold_unless_zero(struct l2cap_conn *c)
> > > +{
> > > + BT_DBG("conn %p orig refcnt %u", c, kref_read(&c->ref));
> > > +
> > > + if (!kref_get_unless_zero(&c->ref))
> > > + return NULL;
> > > +
> > > + return c;
> > > +}
> > > +
> > > void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
> > > {
> > > - struct l2cap_conn *conn = hcon->l2cap_data;
> > > + struct l2cap_conn *conn;
> > > int len;
> > >
> > > + /* Lock hdev to access l2cap_data to avoid race with l2cap_conn_del */
> > > + hci_dev_lock(hcon->hdev);
> > > +
> > > + conn = hcon->l2cap_data;
> > > +
> > > if (!conn)
> > > conn = l2cap_conn_add(hcon);
> > >
> > > + conn = l2cap_conn_hold_unless_zero(conn);
> > > +
> > > + hci_dev_unlock(hcon->hdev);
> > > +
> > > if (!conn)
> > > goto drop;
> > >
> > > @@ -7565,6 +7600,8 @@ void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
> > > break;
> > > }
> > >
> > > + l2cap_conn_put(conn);
> > > +
> > > drop:
> > > kfree_skb(skb);
> > > }
> > > --
> > > 2.47.1
> > >
> >
> >
> > --
> > Luiz Augusto von Dentz
>
>
>
> --
> Luiz Augusto von Dentz
--
Luiz Augusto von Dentz
^ permalink raw reply [flat|nested] 28+ messages in thread