* [syzbot] [bluetooth?] KMSAN: uninit-value in hci_rx_work @ 2024-07-23 21:07 syzbot 2024-10-07 10:05 ` syzbot 0 siblings, 1 reply; 14+ messages in thread From: syzbot @ 2024-07-23 21:07 UTC (permalink / raw) To: johan.hedberg, linux-bluetooth, linux-kernel, luiz.dentz, marcel, syzkaller-bugs Hello, syzbot found the following issue on: HEAD commit: 2c9b3512402e Merge tag 'for-linus' of git://git.kernel.org.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=12628cad980000 kernel config: https://syzkaller.appspot.com/x/.config?x=6bfb33a8ad10458f dashboard link: https://syzkaller.appspot.com/bug?extid=6ea290ba76d8c1eb1ac2 compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 userspace arch: i386 Unfortunately, I don't have any reproducer for this issue yet. Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/9593db3ad921/disk-2c9b3512.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/77c4ed0c2bb7/vmlinux-2c9b3512.xz kernel image: https://storage.googleapis.com/syzbot-assets/b1e492f9354b/bzImage-2c9b3512.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+6ea290ba76d8c1eb1ac2@syzkaller.appspotmail.com ===================================================== BUG: KMSAN: uninit-value in hci_scodata_packet net/bluetooth/hci_core.c:3835 [inline] BUG: KMSAN: uninit-value in hci_rx_work+0x10a8/0x1130 net/bluetooth/hci_core.c:4039 hci_scodata_packet net/bluetooth/hci_core.c:3835 [inline] hci_rx_work+0x10a8/0x1130 net/bluetooth/hci_core.c:4039 process_one_work kernel/workqueue.c:3231 [inline] process_scheduled_works+0xae0/0x1c40 kernel/workqueue.c:3312 worker_thread+0xea5/0x1520 kernel/workqueue.c:3390 kthread+0x3e2/0x540 kernel/kthread.c:389 ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Uninit was created at: slab_post_alloc_hook mm/slub.c:3985 [inline] slab_alloc_node mm/slub.c:4028 [inline] kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4071 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:583 __alloc_skb+0x363/0x7b0 net/core/skbuff.c:674 alloc_skb include/linux/skbuff.h:1320 [inline] bt_skb_alloc include/net/bluetooth/bluetooth.h:493 [inline] vhci_get_user drivers/bluetooth/hci_vhci.c:489 [inline] vhci_write+0x128/0x910 drivers/bluetooth/hci_vhci.c:609 new_sync_write fs/read_write.c:497 [inline] vfs_write+0xb2f/0x1550 fs/read_write.c:590 ksys_write+0x20f/0x4c0 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __ia32_sys_write+0x91/0xe0 fs/read_write.c:652 ia32_sys_call+0x2e34/0x40d0 arch/x86/include/generated/asm/syscalls_32.h:5 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0xb0/0x110 arch/x86/entry/common.c:386 do_fast_syscall_32+0x38/0x80 arch/x86/entry/common.c:411 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:449 entry_SYSENTER_compat_after_hwframe+0x84/0x8e CPU: 1 PID: 5058 Comm: kworker/u9:6 Not tainted 6.10.0-syzkaller-11185-g2c9b3512402e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 Workqueue: hci3 hci_rx_work ===================================================== --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the report is already addressed, let syzbot know by replying with: #syz fix: exact-commit-title If you want to overwrite report's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the report is a duplicate of another one, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [syzbot] [bluetooth?] KMSAN: uninit-value in hci_rx_work 2024-07-23 21:07 [syzbot] [bluetooth?] KMSAN: uninit-value in hci_rx_work syzbot @ 2024-10-07 10:05 ` syzbot 2024-10-07 10:53 ` Edward Adam Davis ` (3 more replies) 0 siblings, 4 replies; 14+ messages in thread From: syzbot @ 2024-10-07 10:05 UTC (permalink / raw) To: johan.hedberg, linux-bluetooth, linux-kernel, luiz.dentz, marcel, syzkaller-bugs syzbot has found a reproducer for the following issue on: HEAD commit: 8cf0b93919e1 Linux 6.12-rc2 git tree: upstream console+strace: https://syzkaller.appspot.com/x/log.txt?x=164bc707980000 kernel config: https://syzkaller.appspot.com/x/.config?x=981fe2ff8a1e457a dashboard link: https://syzkaller.appspot.com/bug?extid=6ea290ba76d8c1eb1ac2 compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=114bc707980000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17b74327980000 Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/e6ae962426a8/disk-8cf0b939.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/6965b62be377/vmlinux-8cf0b939.xz kernel image: https://storage.googleapis.com/syzbot-assets/1a0056895389/bzImage-8cf0b939.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+6ea290ba76d8c1eb1ac2@syzkaller.appspotmail.com ===================================================== BUG: KMSAN: uninit-value in hci_acldata_packet net/bluetooth/hci_core.c:3796 [inline] BUG: KMSAN: uninit-value in hci_rx_work+0x1092/0x11f0 net/bluetooth/hci_core.c:4030 hci_acldata_packet net/bluetooth/hci_core.c:3796 [inline] hci_rx_work+0x1092/0x11f0 net/bluetooth/hci_core.c:4030 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xae0/0x1c40 kernel/workqueue.c:3310 worker_thread+0xea7/0x14f0 kernel/workqueue.c:3391 kthread+0x3e2/0x540 kernel/kthread.c:389 ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Uninit was created at: slab_post_alloc_hook mm/slub.c:4091 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4186 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:587 __alloc_skb+0x363/0x7b0 net/core/skbuff.c:678 alloc_skb include/linux/skbuff.h:1322 [inline] bt_skb_alloc include/net/bluetooth/bluetooth.h:493 [inline] vhci_get_user drivers/bluetooth/hci_vhci.c:487 [inline] vhci_write+0x127/0x900 drivers/bluetooth/hci_vhci.c:607 new_sync_write fs/read_write.c:590 [inline] vfs_write+0xb28/0x1540 fs/read_write.c:683 ksys_write+0x24f/0x4c0 fs/read_write.c:736 __do_sys_write fs/read_write.c:748 [inline] __se_sys_write fs/read_write.c:745 [inline] __x64_sys_write+0x93/0xe0 fs/read_write.c:745 x64_sys_call+0x306a/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:2 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 1 UID: 0 PID: 4565 Comm: kworker/u9:1 Not tainted 6.12.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: hci0 hci_rx_work ===================================================== --- If you want syzbot to run the reproducer, reply with: #syz test: git://repo/address.git branch-or-commit-hash If you attach or paste a git patch, syzbot will apply it before testing. ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [syzbot] [bluetooth?] KMSAN: uninit-value in hci_rx_work 2024-10-07 10:05 ` syzbot @ 2024-10-07 10:53 ` Edward Adam Davis 2024-10-07 13:01 ` syzbot 2024-10-08 3:40 ` Edward Adam Davis ` (2 subsequent siblings) 3 siblings, 1 reply; 14+ messages in thread From: Edward Adam Davis @ 2024-10-07 10:53 UTC (permalink / raw) To: syzbot+6ea290ba76d8c1eb1ac2; +Cc: linux-kernel, syzkaller-bugs set skb reserve memory to 0. #syz test diff --git a/drivers/bluetooth/hci_vhci.c b/drivers/bluetooth/hci_vhci.c index aa6af351d02d..b2e99a83d6c7 100644 --- a/drivers/bluetooth/hci_vhci.c +++ b/drivers/bluetooth/hci_vhci.c @@ -492,6 +492,7 @@ static inline ssize_t vhci_get_user(struct vhci_data *data, kfree_skb(skb); return -EFAULT; } + memset(skb + len, 0, BT_SKB_RESERVE); pkt_type = *((__u8 *) skb->data); skb_pull(skb, 1); ^ permalink raw reply related [flat|nested] 14+ messages in thread
* Re: [syzbot] [bluetooth?] KMSAN: uninit-value in hci_rx_work 2024-10-07 10:53 ` Edward Adam Davis @ 2024-10-07 13:01 ` syzbot 0 siblings, 0 replies; 14+ messages in thread From: syzbot @ 2024-10-07 13:01 UTC (permalink / raw) To: eadavis, linux-kernel, syzkaller-bugs Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: KMSAN: uninit-value in hci_rx_work ===================================================== BUG: KMSAN: uninit-value in hci_acldata_packet net/bluetooth/hci_core.c:3796 [inline] BUG: KMSAN: uninit-value in hci_rx_work+0x1092/0x11f0 net/bluetooth/hci_core.c:4030 hci_acldata_packet net/bluetooth/hci_core.c:3796 [inline] hci_rx_work+0x1092/0x11f0 net/bluetooth/hci_core.c:4030 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xae0/0x1c40 kernel/workqueue.c:3310 worker_thread+0xea7/0x14f0 kernel/workqueue.c:3391 kthread+0x3e2/0x540 kernel/kthread.c:389 ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Uninit was created at: slab_post_alloc_hook mm/slub.c:4091 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4186 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:587 __alloc_skb+0x363/0x7b0 net/core/skbuff.c:678 alloc_skb include/linux/skbuff.h:1322 [inline] bt_skb_alloc include/net/bluetooth/bluetooth.h:493 [inline] vhci_get_user drivers/bluetooth/hci_vhci.c:487 [inline] vhci_write+0x122/0x960 drivers/bluetooth/hci_vhci.c:608 new_sync_write fs/read_write.c:590 [inline] vfs_write+0xb28/0x1540 fs/read_write.c:683 ksys_write+0x24f/0x4c0 fs/read_write.c:736 __do_sys_write fs/read_write.c:748 [inline] __se_sys_write fs/read_write.c:745 [inline] __x64_sys_write+0x93/0xe0 fs/read_write.c:745 x64_sys_call+0x306a/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:2 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 0 UID: 0 PID: 4561 Comm: kworker/u9:1 Tainted: G W 6.12.0-rc2-syzkaller-g8cf0b93919e1-dirty #0 Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: hci0 hci_rx_work ===================================================== Tested on: commit: 8cf0b939 Linux 6.12-rc2 git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=121adb80580000 kernel config: https://syzkaller.appspot.com/x/.config?x=981fe2ff8a1e457a dashboard link: https://syzkaller.appspot.com/bug?extid=6ea290ba76d8c1eb1ac2 compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 patch: https://syzkaller.appspot.com/x/patch.diff?x=150fc707980000 ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [syzbot] [bluetooth?] KMSAN: uninit-value in hci_rx_work 2024-10-07 10:05 ` syzbot 2024-10-07 10:53 ` Edward Adam Davis @ 2024-10-08 3:40 ` Edward Adam Davis 2024-10-08 4:29 ` syzbot 2024-10-08 9:30 ` Edward Adam Davis 2024-10-08 10:47 ` [PATCH] Bluetooth: hci_core: remove acl hdr handle error message Edward Adam Davis 3 siblings, 1 reply; 14+ messages in thread From: Edward Adam Davis @ 2024-10-08 3:40 UTC (permalink / raw) To: syzbot+6ea290ba76d8c1eb1ac2; +Cc: linux-kernel, syzkaller-bugs bt device is closed ? #syz test diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index d6976db02c06..c55f0ca33b90 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -3791,7 +3791,7 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb) l2cap_recv_acldata(conn, skb, flags); return; } else { - bt_dev_err(hdev, "ACL packet for unknown connection handle %d", + BT_ERR("ACL packet for unknown connection handle %d", handle); } ^ permalink raw reply related [flat|nested] 14+ messages in thread
* Re: [syzbot] [bluetooth?] KMSAN: uninit-value in hci_rx_work 2024-10-08 3:40 ` Edward Adam Davis @ 2024-10-08 4:29 ` syzbot 0 siblings, 0 replies; 14+ messages in thread From: syzbot @ 2024-10-08 4:29 UTC (permalink / raw) To: eadavis, linux-kernel, syzkaller-bugs Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: KMSAN: uninit-value in hci_rx_work ===================================================== BUG: KMSAN: uninit-value in hci_acldata_packet net/bluetooth/hci_core.c:3796 [inline] BUG: KMSAN: uninit-value in hci_rx_work+0xff7/0x1150 net/bluetooth/hci_core.c:4030 hci_acldata_packet net/bluetooth/hci_core.c:3796 [inline] hci_rx_work+0xff7/0x1150 net/bluetooth/hci_core.c:4030 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xae0/0x1c40 kernel/workqueue.c:3310 worker_thread+0xea7/0x14f0 kernel/workqueue.c:3391 kthread+0x3e2/0x540 kernel/kthread.c:389 ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Uninit was created at: slab_post_alloc_hook mm/slub.c:4091 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4186 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:587 __alloc_skb+0x363/0x7b0 net/core/skbuff.c:678 alloc_skb include/linux/skbuff.h:1322 [inline] bt_skb_alloc include/net/bluetooth/bluetooth.h:493 [inline] vhci_get_user drivers/bluetooth/hci_vhci.c:487 [inline] vhci_write+0x127/0x900 drivers/bluetooth/hci_vhci.c:607 new_sync_write fs/read_write.c:590 [inline] vfs_write+0xb28/0x1540 fs/read_write.c:683 ksys_write+0x24f/0x4c0 fs/read_write.c:736 __do_sys_write fs/read_write.c:748 [inline] __se_sys_write fs/read_write.c:745 [inline] __x64_sys_write+0x93/0xe0 fs/read_write.c:745 x64_sys_call+0x306a/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:2 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 0 UID: 0 PID: 4556 Comm: kworker/u9:1 Not tainted 6.12.0-rc2-syzkaller-g87d6aab2389e-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: hci0 hci_rx_work ===================================================== Tested on: commit: 87d6aab2 Merge tag 'for_linus' of git://git.kernel.org.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=1602bb80580000 kernel config: https://syzkaller.appspot.com/x/.config?x=981fe2ff8a1e457a dashboard link: https://syzkaller.appspot.com/bug?extid=6ea290ba76d8c1eb1ac2 compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 patch: https://syzkaller.appspot.com/x/patch.diff?x=12890f9f980000 ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [syzbot] [bluetooth?] KMSAN: uninit-value in hci_rx_work 2024-10-07 10:05 ` syzbot 2024-10-07 10:53 ` Edward Adam Davis 2024-10-08 3:40 ` Edward Adam Davis @ 2024-10-08 9:30 ` Edward Adam Davis 2024-10-08 10:03 ` syzbot 2024-10-08 10:47 ` [PATCH] Bluetooth: hci_core: remove acl hdr handle error message Edward Adam Davis 3 siblings, 1 reply; 14+ messages in thread From: Edward Adam Davis @ 2024-10-08 9:30 UTC (permalink / raw) To: syzbot+6ea290ba76d8c1eb1ac2; +Cc: linux-kernel, syzkaller-bugs If hci_queue_acl is not executed, where does hci_acl_hdr->handle come from ? #syz test diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index d6976db02c06..6e22eb33fdc7 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -3185,6 +3185,7 @@ static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue, hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT; + printk("conn: %p, cnn H: %u, %s\n", conn, conn->handle, __func__); hci_add_acl_hdr(skb, conn->handle, flags); list = skb_shinfo(skb)->frag_list; @@ -3791,8 +3792,7 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb) l2cap_recv_acldata(conn, skb, flags); return; } else { - bt_dev_err(hdev, "ACL packet for unknown connection handle %d", - handle); + bt_dev_err(hdev, "ACL packet for unknown connection handle"); } kfree_skb(skb); ^ permalink raw reply related [flat|nested] 14+ messages in thread
* Re: [syzbot] [bluetooth?] KMSAN: uninit-value in hci_rx_work 2024-10-08 9:30 ` Edward Adam Davis @ 2024-10-08 10:03 ` syzbot 0 siblings, 0 replies; 14+ messages in thread From: syzbot @ 2024-10-08 10:03 UTC (permalink / raw) To: eadavis, linux-kernel, syzkaller-bugs Hello, syzbot has tested the proposed patch and the reproducer did not trigger any issue: Reported-by: syzbot+6ea290ba76d8c1eb1ac2@syzkaller.appspotmail.com Tested-by: syzbot+6ea290ba76d8c1eb1ac2@syzkaller.appspotmail.com Tested on: commit: 87d6aab2 Merge tag 'for_linus' of git://git.kernel.org.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=14eba327980000 kernel config: https://syzkaller.appspot.com/x/.config?x=981fe2ff8a1e457a dashboard link: https://syzkaller.appspot.com/bug?extid=6ea290ba76d8c1eb1ac2 compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 patch: https://syzkaller.appspot.com/x/patch.diff?x=11cbbb80580000 Note: testing is done by a robot and is best-effort only. ^ permalink raw reply [flat|nested] 14+ messages in thread
* [PATCH] Bluetooth: hci_core: remove acl hdr handle error message 2024-10-07 10:05 ` syzbot ` (2 preceding siblings ...) 2024-10-08 9:30 ` Edward Adam Davis @ 2024-10-08 10:47 ` Edward Adam Davis 2024-10-08 14:12 ` Luiz Augusto von Dentz 3 siblings, 1 reply; 14+ messages in thread From: Edward Adam Davis @ 2024-10-08 10:47 UTC (permalink / raw) To: syzbot+6ea290ba76d8c1eb1ac2 Cc: johan.hedberg, linux-bluetooth, linux-kernel, luiz.dentz, marcel, syzkaller-bugs Syzbot reported a uninit-value in hci_rx_work.This is because l2cap didn't execute the corresponding connection request to call l2cap_send_cmd() or l2cap_do_send(), and ultimately called hci_add_acl_hdr() to set hdr->handle. Therefore, when calling the thread callback function hci_rx_work() to call hci_acldata_packet, hdr->handle should not be used directly. Reported-and-tested-by: syzbot+6ea290ba76d8c1eb1ac2@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6ea290ba76d8c1eb1ac2 Signed-off-by: Edward Adam Davis <eadavis@qq.com> --- net/bluetooth/hci_core.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index d6976db02c06..20605a7f3f4e 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -3791,8 +3791,7 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb) l2cap_recv_acldata(conn, skb, flags); return; } else { - bt_dev_err(hdev, "ACL packet for unknown connection handle %d", - handle); + bt_dev_err(hdev, "ACL packet for unknown connection handle"); } kfree_skb(skb); -- 2.43.0 ^ permalink raw reply related [flat|nested] 14+ messages in thread
* Re: [PATCH] Bluetooth: hci_core: remove acl hdr handle error message 2024-10-08 10:47 ` [PATCH] Bluetooth: hci_core: remove acl hdr handle error message Edward Adam Davis @ 2024-10-08 14:12 ` Luiz Augusto von Dentz 2024-10-08 14:30 ` Luiz Augusto von Dentz 2024-10-09 1:07 ` [PATCH] Bluetooth: hci_core: remove acl hdr handle error message Edward Adam Davis 0 siblings, 2 replies; 14+ messages in thread From: Luiz Augusto von Dentz @ 2024-10-08 14:12 UTC (permalink / raw) To: Edward Adam Davis Cc: syzbot+6ea290ba76d8c1eb1ac2, johan.hedberg, linux-bluetooth, linux-kernel, marcel, syzkaller-bugs Hi Edward, On Tue, Oct 8, 2024 at 6:47 AM Edward Adam Davis <eadavis@qq.com> wrote: > > Syzbot reported a uninit-value in hci_rx_work.This is because l2cap didn't > execute the corresponding connection request to call l2cap_send_cmd() or > l2cap_do_send(), and ultimately called hci_add_acl_hdr() to set hdr->handle. What are you talking about here, what these functions have to do with a local handle variable? > Therefore, when calling the thread callback function hci_rx_work() to call > hci_acldata_packet, hdr->handle should not be used directly. It is not being used directly, the handle is a local variable which get assigned: handle = __le16_to_cpu(hdr->handle); If what you are saying is that there is no guarantee that skb->len >= HCI_ACL_HDR_SIZE then we probably want to replace skb_pull with skb_pull_data. > Reported-and-tested-by: syzbot+6ea290ba76d8c1eb1ac2@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=6ea290ba76d8c1eb1ac2 > Signed-off-by: Edward Adam Davis <eadavis@qq.com> > --- > net/bluetooth/hci_core.c | 3 +-- > 1 file changed, 1 insertion(+), 2 deletions(-) > > diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c > index d6976db02c06..20605a7f3f4e 100644 > --- a/net/bluetooth/hci_core.c > +++ b/net/bluetooth/hci_core.c > @@ -3791,8 +3791,7 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb) > l2cap_recv_acldata(conn, skb, flags); > return; > } else { > - bt_dev_err(hdev, "ACL packet for unknown connection handle %d", > - handle); > + bt_dev_err(hdev, "ACL packet for unknown connection handle"); > } > > kfree_skb(skb); > -- > 2.43.0 > -- Luiz Augusto von Dentz ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH] Bluetooth: hci_core: remove acl hdr handle error message 2024-10-08 14:12 ` Luiz Augusto von Dentz @ 2024-10-08 14:30 ` Luiz Augusto von Dentz 2024-10-08 14:58 ` [syzbot] [bluetooth?] KMSAN: uninit-value in hci_rx_work syzbot 2024-10-09 1:07 ` [PATCH] Bluetooth: hci_core: remove acl hdr handle error message Edward Adam Davis 1 sibling, 1 reply; 14+ messages in thread From: Luiz Augusto von Dentz @ 2024-10-08 14:30 UTC (permalink / raw) To: Edward Adam Davis Cc: syzbot+6ea290ba76d8c1eb1ac2, johan.hedberg, linux-bluetooth, linux-kernel, marcel, syzkaller-bugs [-- Attachment #1: Type: text/plain, Size: 2068 bytes --] On Tue, Oct 8, 2024 at 10:12 AM Luiz Augusto von Dentz <luiz.dentz@gmail.com> wrote: > > Hi Edward, > > On Tue, Oct 8, 2024 at 6:47 AM Edward Adam Davis <eadavis@qq.com> wrote: > > > > Syzbot reported a uninit-value in hci_rx_work.This is because l2cap didn't > > execute the corresponding connection request to call l2cap_send_cmd() or > > l2cap_do_send(), and ultimately called hci_add_acl_hdr() to set hdr->handle. > > What are you talking about here, what these functions have to do with > a local handle variable? > > > Therefore, when calling the thread callback function hci_rx_work() to call > > hci_acldata_packet, hdr->handle should not be used directly. > > It is not being used directly, the handle is a local variable which > get assigned: > > handle = __le16_to_cpu(hdr->handle); > > If what you are saying is that there is no guarantee that skb->len >= > HCI_ACL_HDR_SIZE then we probably want to replace skb_pull with > skb_pull_data. > > > Reported-and-tested-by: syzbot+6ea290ba76d8c1eb1ac2@syzkaller.appspotmail.com > > Closes: https://syzkaller.appspot.com/bug?extid=6ea290ba76d8c1eb1ac2 > > Signed-off-by: Edward Adam Davis <eadavis@qq.com> > > --- > > net/bluetooth/hci_core.c | 3 +-- > > 1 file changed, 1 insertion(+), 2 deletions(-) > > > > diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c > > index d6976db02c06..20605a7f3f4e 100644 > > --- a/net/bluetooth/hci_core.c > > +++ b/net/bluetooth/hci_core.c > > @@ -3791,8 +3791,7 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb) > > l2cap_recv_acldata(conn, skb, flags); > > return; > > } else { > > - bt_dev_err(hdev, "ACL packet for unknown connection handle %d", > > - handle); > > + bt_dev_err(hdev, "ACL packet for unknown connection handle"); > > } > > > > kfree_skb(skb); > > -- > > 2.43.0 > > > > > -- > Luiz Augusto von Dentz #syz test -- Luiz Augusto von Dentz [-- Attachment #2: v1-0001-Bluetooth-hci_core-Fix-not-checking-skb-length-on.patch --] [-- Type: text/x-patch, Size: 1684 bytes --] From cda0135697d86de8a2d732df17e0fa497c2f02ff Mon Sep 17 00:00:00 2001 From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Date: Tue, 8 Oct 2024 10:16:48 -0400 Subject: [PATCH v1] Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet This fixes not checking if skb really contains an ACL header otherwise the code may attempt to access some uninitilized/invalid memory past the actual skb->data. Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> --- net/bluetooth/hci_core.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index b2f8f9c5b610..d5f917076e0e 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -3765,18 +3765,22 @@ static void hci_tx_work(struct work_struct *work) /* ACL data packet */ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb) { - struct hci_acl_hdr *hdr = (void *) skb->data; + struct hci_acl_hdr *hdr; struct hci_conn *conn; __u16 handle, flags; - skb_pull(skb, HCI_ACL_HDR_SIZE); + hdr = skb_pull_data(skb, sizeof(*hdr)); + if (!hdr) { + bt_dev_err(hdev, "ACL packet too small"); + goto drop; + } handle = __le16_to_cpu(hdr->handle); flags = hci_flags(handle); handle = hci_handle(handle); - BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len, - handle, flags); + bt_dev_dbg(hdev, "len %d handle 0x%4.4x flags 0x%4.4x", skb->len, + handle, flags); hdev->stat.acl_rx++; @@ -3797,6 +3801,7 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb) handle); } +drop: kfree_skb(skb); } -- 2.46.1 ^ permalink raw reply related [flat|nested] 14+ messages in thread
* Re: [syzbot] [bluetooth?] KMSAN: uninit-value in hci_rx_work 2024-10-08 14:30 ` Luiz Augusto von Dentz @ 2024-10-08 14:58 ` syzbot 0 siblings, 0 replies; 14+ messages in thread From: syzbot @ 2024-10-08 14:58 UTC (permalink / raw) To: eadavis, johan.hedberg, linux-bluetooth, linux-kernel, luiz.dentz, marcel, syzkaller-bugs Hello, syzbot has tested the proposed patch and the reproducer did not trigger any issue: Reported-by: syzbot+6ea290ba76d8c1eb1ac2@syzkaller.appspotmail.com Tested-by: syzbot+6ea290ba76d8c1eb1ac2@syzkaller.appspotmail.com Tested on: commit: 87d6aab2 Merge tag 'for_linus' of git://git.kernel.org.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=14bf8f9f980000 kernel config: https://syzkaller.appspot.com/x/.config?x=981fe2ff8a1e457a dashboard link: https://syzkaller.appspot.com/bug?extid=6ea290ba76d8c1eb1ac2 compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 patch: https://syzkaller.appspot.com/x/patch.diff?x=14f41780580000 Note: testing is done by a robot and is best-effort only. ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH] Bluetooth: hci_core: remove acl hdr handle error message 2024-10-08 14:12 ` Luiz Augusto von Dentz 2024-10-08 14:30 ` Luiz Augusto von Dentz @ 2024-10-09 1:07 ` Edward Adam Davis 2024-10-09 1:36 ` [syzbot] [bluetooth?] KMSAN: uninit-value in hci_rx_work syzbot 1 sibling, 1 reply; 14+ messages in thread From: Edward Adam Davis @ 2024-10-09 1:07 UTC (permalink / raw) To: luiz.dentz Cc: eadavis, johan.hedberg, linux-bluetooth, linux-kernel, marcel, syzbot+6ea290ba76d8c1eb1ac2, syzkaller-bugs On Tue, 8 Oct 2024 10:12:34 -0400, Luiz Augusto von Dentz wrote: > On Tue, Oct 8, 2024 at 6:47 AM Edward Adam Davis <eadavis@qq.com> wrote: > > > > Syzbot reported a uninit-value in hci_rx_work.This is because l2cap didn't > > execute the corresponding connection request to call l2cap_send_cmd() or > > l2cap_do_send(), and ultimately called hci_add_acl_hdr() to set hdr->handle. > > What are you talking about here, what these functions have to do with > a local handle variable? > > > Therefore, when calling the thread callback function hci_rx_work() to call > > hci_acldata_packet, hdr->handle should not be used directly. > > It is not being used directly, the handle is a local variable which > get assigned: > > handle = __le16_to_cpu(hdr->handle); > > If what you are saying is that there is no guarantee that skb->len >= > HCI_ACL_HDR_SIZE then we probably want to replace skb_pull with > skb_pull_data. You are right, skb->len is too small. But, skb_pull is ok, maybe just need to add a check. #syz test diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index d6976db02c06..cfb828452a13 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -3769,7 +3769,11 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb) struct hci_conn *conn; __u16 handle, flags; - skb_pull(skb, HCI_ACL_HDR_SIZE); + if (!skb_pull(skb, HCI_ACL_HDR_SIZE)) { + BT_ERR("ACL data packet %d, smaller than ACL HEADER Size %d\n", + skb->len, HCI_ACL_HDR_SIZE); + goto out; + } handle = __le16_to_cpu(hdr->handle); flags = hci_flags(handle); @@ -3795,6 +3799,7 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb) handle); } +out: kfree_skb(skb); } ^ permalink raw reply related [flat|nested] 14+ messages in thread
* Re: [syzbot] [bluetooth?] KMSAN: uninit-value in hci_rx_work 2024-10-09 1:07 ` [PATCH] Bluetooth: hci_core: remove acl hdr handle error message Edward Adam Davis @ 2024-10-09 1:36 ` syzbot 0 siblings, 0 replies; 14+ messages in thread From: syzbot @ 2024-10-09 1:36 UTC (permalink / raw) To: eadavis, johan.hedberg, linux-bluetooth, linux-kernel, luiz.dentz, marcel, syzkaller-bugs Hello, syzbot has tested the proposed patch and the reproducer did not trigger any issue: Reported-by: syzbot+6ea290ba76d8c1eb1ac2@syzkaller.appspotmail.com Tested-by: syzbot+6ea290ba76d8c1eb1ac2@syzkaller.appspotmail.com Tested on: commit: 75b607fa Merge tag 'sched_ext-for-6.12-rc2-fixes' of g.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=1415f380580000 kernel config: https://syzkaller.appspot.com/x/.config?x=981fe2ff8a1e457a dashboard link: https://syzkaller.appspot.com/bug?extid=6ea290ba76d8c1eb1ac2 compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 patch: https://syzkaller.appspot.com/x/patch.diff?x=12e37707980000 Note: testing is done by a robot and is best-effort only. ^ permalink raw reply [flat|nested] 14+ messages in thread
end of thread, other threads:[~2024-10-09 1:36 UTC | newest] Thread overview: 14+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2024-07-23 21:07 [syzbot] [bluetooth?] KMSAN: uninit-value in hci_rx_work syzbot 2024-10-07 10:05 ` syzbot 2024-10-07 10:53 ` Edward Adam Davis 2024-10-07 13:01 ` syzbot 2024-10-08 3:40 ` Edward Adam Davis 2024-10-08 4:29 ` syzbot 2024-10-08 9:30 ` Edward Adam Davis 2024-10-08 10:03 ` syzbot 2024-10-08 10:47 ` [PATCH] Bluetooth: hci_core: remove acl hdr handle error message Edward Adam Davis 2024-10-08 14:12 ` Luiz Augusto von Dentz 2024-10-08 14:30 ` Luiz Augusto von Dentz 2024-10-08 14:58 ` [syzbot] [bluetooth?] KMSAN: uninit-value in hci_rx_work syzbot 2024-10-09 1:07 ` [PATCH] Bluetooth: hci_core: remove acl hdr handle error message Edward Adam Davis 2024-10-09 1:36 ` [syzbot] [bluetooth?] KMSAN: uninit-value in hci_rx_work syzbot
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox