* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd [not found] <CABBYNZKDjf2wZYCmumoifFJ_OnG2vjJBqjE+0yOf9c6iqWA8+w@mail.gmail.com> @ 2025-01-22 17:52 ` syzbot 0 siblings, 0 replies; 17+ messages in thread From: syzbot @ 2025-01-22 17:52 UTC (permalink / raw) To: linux-bluetooth, linux-kernel, luiz.dentz, syzkaller-bugs Hello, syzbot has tested the proposed patch and the reproducer did not trigger any issue: Reported-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com Tested-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com Tested on: commit: c4b9570c Merge tag 'audit-pr-20250121' of git://git.ke.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=126f1824580000 kernel config: https://syzkaller.appspot.com/x/.config?x=5d46425e33fe266e dashboard link: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734 compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 patch: https://syzkaller.appspot.com/x/patch.diff?x=147b1824580000 Note: testing is done by a robot and is best-effort only. ^ permalink raw reply [flat|nested] 17+ messages in thread
[parent not found: <CABBYNZKX0GKVwEEmf6XhnL-RJKqzLvt0izVC152Lzc8MjWWo7A@mail.gmail.com>]
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd [not found] <CABBYNZKX0GKVwEEmf6XhnL-RJKqzLvt0izVC152Lzc8MjWWo7A@mail.gmail.com> @ 2025-01-22 3:17 ` syzbot 0 siblings, 0 replies; 17+ messages in thread From: syzbot @ 2025-01-22 3:17 UTC (permalink / raw) To: linux-bluetooth, linux-kernel, luiz.dentz, syzkaller-bugs Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: KASAN: slab-use-after-free Read in hci_send_acl Bluetooth: Unknown BR/EDR signaling command 0x10 Bluetooth: Wrong link type (-22) ================================================================== BUG: KASAN: slab-use-after-free in hci_send_acl+0x4d/0xd00 net/bluetooth/hci_core.c:3232 Read of size 8 at addr ffff88802f536f18 by task kworker/u9:5/6557 CPU: 0 UID: 0 PID: 6557 Comm: kworker/u9:5 Not tainted 6.13.0-syzkaller-02469-gd0f93ac2c384-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 Workqueue: hci4 hci_rx_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 hci_send_acl+0x4d/0xd00 net/bluetooth/hci_core.c:3232 l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5500 [inline] l2cap_sig_channel net/bluetooth/l2cap_core.c:5536 [inline] l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6815 l2cap_recv_acldata+0x700/0x1a70 net/bluetooth/l2cap_core.c:7522 hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline] hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317 worker_thread+0x870/0xd30 kernel/workqueue.c:3398 kthread+0x7a9/0x920 kernel/kthread.c:464 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Allocated by task 54: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329 kmalloc_noprof include/linux/slab.h:901 [inline] kzalloc_noprof include/linux/slab.h:1037 [inline] hci_chan_create+0xc8/0x310 net/bluetooth/hci_conn.c:2838 l2cap_conn_add+0x69/0x8e0 net/bluetooth/l2cap_core.c:6854 l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7237 hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline] hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726 hci_event_func net/bluetooth/hci_event.c:7473 [inline] hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525 hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317 worker_thread+0x870/0xd30 kernel/workqueue.c:3398 kthread+0x7a9/0x920 kernel/kthread.c:464 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Freed by task 6554: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2353 [inline] slab_free mm/slub.c:4613 [inline] kfree+0x196/0x430 mm/slub.c:4761 hci_chan_list_flush net/bluetooth/hci_conn.c:2878 [inline] hci_conn_cleanup net/bluetooth/hci_conn.c:149 [inline] hci_conn_del+0x4b5/0xc40 net/bluetooth/hci_conn.c:1164 hci_conn_failed+0x319/0x400 net/bluetooth/hci_conn.c:1267 hci_abort_conn_sync+0x56c/0x11f0 net/bluetooth/hci_sync.c:5604 hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317 worker_thread+0x870/0xd30 kernel/workqueue.c:3398 kthread+0x7a9/0x920 kernel/kthread.c:464 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 The buggy address belongs to the object at ffff88802f536f00 which belongs to the cache kmalloc-128 of size 128 The buggy address is located 24 bytes inside of freed 128-byte region [ffff88802f536f00, ffff88802f536f80) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88802f536d00 pfn:0x2f536 flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000200 ffff88801ac41a00 ffffea000187a110 ffffea0001882ad0 raw: ffff88802f536d00 0000000000100005 00000001f5000000 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 6482, tgid 6482 (udevd), ts 109120173001, free_ts 109113912385 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1558 prep_new_page mm/page_alloc.c:1566 [inline] get_page_from_freelist+0x365c/0x37a0 mm/page_alloc.c:3476 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4753 alloc_pages_mpol_noprof+0x3e1/0x780 mm/mempolicy.c:2269 alloc_slab_page+0x6a/0x110 mm/slub.c:2423 allocate_slab+0x5a/0x2b0 mm/slub.c:2589 new_slab mm/slub.c:2642 [inline] ___slab_alloc+0xc27/0x14a0 mm/slub.c:3830 __slab_alloc+0x58/0xa0 mm/slub.c:3920 __slab_alloc_node mm/slub.c:3995 [inline] slab_alloc_node mm/slub.c:4156 [inline] __kmalloc_cache_noprof+0x27b/0x390 mm/slub.c:4324 kmalloc_noprof include/linux/slab.h:901 [inline] kzalloc_noprof include/linux/slab.h:1037 [inline] kernfs_get_open_node fs/kernfs/file.c:525 [inline] kernfs_fop_open+0x826/0xd10 fs/kernfs/file.c:700 do_dentry_open+0xbe1/0x1b70 fs/open.c:938 vfs_open+0x3e/0x330 fs/open.c:1068 do_open fs/namei.c:3828 [inline] path_openat+0x2c84/0x3590 fs/namei.c:3987 do_filp_open+0x27f/0x4e0 fs/namei.c:4014 do_sys_openat2+0x13e/0x1d0 fs/open.c:1395 do_sys_open fs/open.c:1410 [inline] __do_sys_openat fs/open.c:1426 [inline] __se_sys_openat fs/open.c:1421 [inline] __x64_sys_openat+0x247/0x2a0 fs/open.c:1421 page last free pid 6511 tgid 6511 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1127 [inline] free_unref_folios+0xe39/0x18b0 mm/page_alloc.c:2706 folios_put_refs+0x76c/0x860 mm/swap.c:962 free_pages_and_swap_cache+0x5c8/0x690 mm/swap_state.c:335 __tlb_batch_free_encoded_pages mm/mmu_gather.c:136 [inline] tlb_batch_pages_flush mm/mmu_gather.c:149 [inline] tlb_flush_mmu_free mm/mmu_gather.c:366 [inline] tlb_flush_mmu+0x3a3/0x680 mm/mmu_gather.c:373 tlb_finish_mmu+0xd4/0x200 mm/mmu_gather.c:465 exit_mmap+0x4d5/0xca0 mm/mmap.c:1685 __mmput+0x115/0x3c0 kernel/fork.c:1345 exit_mm+0x220/0x310 kernel/exit.c:570 do_exit+0x9ad/0x28e0 kernel/exit.c:925 do_group_exit+0x207/0x2c0 kernel/exit.c:1087 get_signal+0x16b2/0x1750 kernel/signal.c:3036 arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0xce/0x340 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff88802f536e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc ffff88802f536e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88802f536f00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88802f536f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88802f537000: 00 00 00 00 fc fc fc fc fa fb fb fb fc fc fc fc ================================================================== Tested on: commit: d0f93ac2 Merge tag 'docs-6.14' of git://git.lwn.net/li.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=112b8ab0580000 kernel config: https://syzkaller.appspot.com/x/.config?x=11ecbacf9de73733 dashboard link: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734 compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 patch: https://syzkaller.appspot.com/x/patch.diff?x=16e82238580000 ^ permalink raw reply [flat|nested] 17+ messages in thread
[parent not found: <CABBYNZKWo_+EuoOWTYUyAFQ2RuA1F4s3hgdeSHuy2v9A5d9XCg@mail.gmail.com>]
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd [not found] <CABBYNZKWo_+EuoOWTYUyAFQ2RuA1F4s3hgdeSHuy2v9A5d9XCg@mail.gmail.com> @ 2025-01-17 21:15 ` syzbot 0 siblings, 0 replies; 17+ messages in thread From: syzbot @ 2025-01-17 21:15 UTC (permalink / raw) To: linux-bluetooth, linux-kernel, luiz.dentz, syzkaller-bugs Hello, syzbot has tested the proposed patch and the reproducer did not trigger any issue: Reported-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com Tested-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com Tested on: commit: ad26fc09 Merge tag 'mm-hotfixes-stable-2025-01-16-21-1.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=17ec5fc4580000 kernel config: https://syzkaller.appspot.com/x/.config?x=aadf89e2f6db86cc dashboard link: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734 compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 patch: https://syzkaller.appspot.com/x/patch.diff?x=122bc2b0580000 Note: testing is done by a robot and is best-effort only. ^ permalink raw reply [flat|nested] 17+ messages in thread
[parent not found: <CABBYNZKyZKqM4pNxjqPEc1ot5fi50Oy_0VnujUXrJOe_ZeWNWA@mail.gmail.com>]
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd [not found] <CABBYNZKyZKqM4pNxjqPEc1ot5fi50Oy_0VnujUXrJOe_ZeWNWA@mail.gmail.com> @ 2025-01-17 17:56 ` syzbot 0 siblings, 0 replies; 17+ messages in thread From: syzbot @ 2025-01-17 17:56 UTC (permalink / raw) To: linux-bluetooth, linux-kernel, luiz.dentz, syzkaller-bugs Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: KASAN: slab-use-after-free Read in l2cap_send_cmd Bluetooth: Wrong link type (-22) ================================================================== BUG: KASAN: slab-use-after-free in l2cap_build_cmd net/bluetooth/l2cap_core.c:2951 [inline] BUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x67b/0x8d0 net/bluetooth/l2cap_core.c:954 Read of size 4 at addr ffff88805bd45810 by task kworker/u9:8/6565 CPU: 1 UID: 0 PID: 6565 Comm: kworker/u9:8 Not tainted 6.13.0-rc7-syzkaller-gad26fc09dabf #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 Workqueue: hci5 hci_rx_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 l2cap_build_cmd net/bluetooth/l2cap_core.c:2951 [inline] l2cap_send_cmd+0x67b/0x8d0 net/bluetooth/l2cap_core.c:954 l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline] l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline] l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817 hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline] hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317 worker_thread+0x870/0xd30 kernel/workqueue.c:3398 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Allocated by task 6556: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329 kmalloc_noprof include/linux/slab.h:901 [inline] kzalloc_noprof include/linux/slab.h:1037 [inline] l2cap_conn_add+0xa9/0x8e0 net/bluetooth/l2cap_core.c:6860 l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7239 hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline] hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726 hci_event_func net/bluetooth/hci_event.c:7473 [inline] hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525 hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317 worker_thread+0x870/0xd30 kernel/workqueue.c:3398 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Freed by task 6556: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2353 [inline] slab_free mm/slub.c:4613 [inline] kfree+0x196/0x430 mm/slub.c:4761 l2cap_connect_cfm+0xcc/0x1090 net/bluetooth/l2cap_core.c:7235 hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline] hci_conn_failed+0x287/0x400 net/bluetooth/hci_conn.c:1266 hci_abort_conn_sync+0x56c/0x11f0 net/bluetooth/hci_sync.c:5604 hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317 worker_thread+0x870/0xd30 kernel/workqueue.c:3398 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Last potentially related work creation: kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47 __kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:544 insert_work+0x3e/0x330 kernel/workqueue.c:2183 __queue_work+0xc8b/0xf50 kernel/workqueue.c:2339 call_timer_fn+0x187/0x650 kernel/time/timer.c:1793 expire_timers kernel/time/timer.c:1839 [inline] __run_timers kernel/time/timer.c:2418 [inline] __run_timer_base+0x695/0x8e0 kernel/time/timer.c:2430 run_timer_base kernel/time/timer.c:2439 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2449 handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561 __do_softirq kernel/softirq.c:595 [inline] invoke_softirq kernel/softirq.c:435 [inline] __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 Second to last potentially related work creation: kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47 __kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:544 insert_work+0x3e/0x330 kernel/workqueue.c:2183 __queue_work+0xb66/0xf50 kernel/workqueue.c:2343 queue_work_on+0x1c2/0x380 kernel/workqueue.c:2390 queue_work include/linux/workqueue.h:662 [inline] l2cap_conn_ready net/bluetooth/l2cap_core.c:1640 [inline] l2cap_connect_cfm+0xdd5/0x1090 net/bluetooth/l2cap_core.c:7280 hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline] hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726 hci_event_func net/bluetooth/hci_event.c:7473 [inline] hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525 hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317 worker_thread+0x870/0xd30 kernel/workqueue.c:3398 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 The buggy address belongs to the object at ffff88805bd45800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 16 bytes inside of freed 1024-byte region [ffff88805bd45800, ffff88805bd45c00) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5bd40 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801ac41dc0 dead000000000100 dead000000000122 raw: 0000000000000000 0000000000100010 00000001f5000000 0000000000000000 head: 00fff00000000040 ffff88801ac41dc0 dead000000000100 dead000000000122 head: 0000000000000000 0000000000100010 00000001f5000000 0000000000000000 head: 00fff00000000003 ffffea00016f5001 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 52, tgid 52 (kworker/u8:3), ts 110221332948, free_ts 104807511653 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1558 prep_new_page mm/page_alloc.c:1566 [inline] get_page_from_freelist+0x365c/0x37a0 mm/page_alloc.c:3476 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4753 alloc_pages_mpol_noprof+0x3e1/0x780 mm/mempolicy.c:2269 alloc_slab_page+0x6a/0x110 mm/slub.c:2423 allocate_slab+0x5a/0x2b0 mm/slub.c:2589 new_slab mm/slub.c:2642 [inline] ___slab_alloc+0xc27/0x14a0 mm/slub.c:3830 __slab_alloc+0x58/0xa0 mm/slub.c:3920 __slab_alloc_node mm/slub.c:3995 [inline] slab_alloc_node mm/slub.c:4156 [inline] __do_kmalloc_node mm/slub.c:4297 [inline] __kmalloc_node_track_caller_noprof+0x2e9/0x4c0 mm/slub.c:4317 kmalloc_reserve+0x111/0x2a0 net/core/skbuff.c:609 __alloc_skb+0x1f3/0x440 net/core/skbuff.c:678 alloc_skb include/linux/skbuff.h:1323 [inline] nlmsg_new include/net/netlink.h:1018 [inline] inet6_rt_notify+0xba/0x240 net/ipv6/route.c:6195 fib6_add_rt2node net/ipv6/ip6_fib.c:1259 [inline] fib6_add+0x1e33/0x4420 net/ipv6/ip6_fib.c:1488 __ip6_ins_rt net/ipv6/route.c:1317 [inline] ip6_ins_rt+0x106/0x170 net/ipv6/route.c:1327 __ipv6_ifa_notify+0x5d2/0x1230 net/ipv6/addrconf.c:6282 ipv6_ifa_notify net/ipv6/addrconf.c:6321 [inline] addrconf_dad_completed+0x181/0xcd0 net/ipv6/addrconf.c:4341 page last free pid 6489 tgid 6489 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1127 [inline] free_unref_page+0xd3f/0x1010 mm/page_alloc.c:2659 vfree+0x1c3/0x360 mm/vmalloc.c:3383 kcov_put kernel/kcov.c:439 [inline] kcov_close+0x28/0x50 kernel/kcov.c:535 __fput+0x23c/0xa50 fs/file_table.c:450 task_work_run+0x24f/0x310 kernel/task_work.c:239 exit_task_work include/linux/task_work.h:43 [inline] do_exit+0xa2a/0x28e0 kernel/exit.c:938 do_group_exit+0x207/0x2c0 kernel/exit.c:1087 get_signal+0x16b2/0x1750 kernel/signal.c:3017 arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0xce/0x340 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff88805bd45700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88805bd45780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88805bd45800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88805bd45880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88805bd45900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Tested on: commit: ad26fc09 Merge tag 'mm-hotfixes-stable-2025-01-16-21-1.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=162c3a18580000 kernel config: https://syzkaller.appspot.com/x/.config?x=aadf89e2f6db86cc dashboard link: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734 compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 Note: no patches were applied. ^ permalink raw reply [flat|nested] 17+ messages in thread
[parent not found: <CABBYNZ++2=0bfK328cVaFY3_94DL0v8W7aSWW7YgrKP+L8Ax1g@mail.gmail.com>]
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd [not found] <CABBYNZ++2=0bfK328cVaFY3_94DL0v8W7aSWW7YgrKP+L8Ax1g@mail.gmail.com> @ 2025-01-17 16:54 ` syzbot 0 siblings, 0 replies; 17+ messages in thread From: syzbot @ 2025-01-17 16:54 UTC (permalink / raw) To: linux-bluetooth, linux-kernel, luiz.dentz, syzkaller-bugs Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: general protection fault in l2cap_send_cmd Bluetooth: Wrong link type (-22) Oops: general protection fault, probably for non-canonical address 0xdffffc0000000064: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000320-0x0000000000000327] CPU: 0 UID: 0 PID: 8403 Comm: kworker/u9:10 Not tainted 6.13.0-rc7-syzkaller-g9bffa1ad25b8 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 Workqueue: hci4 hci_rx_work RIP: 0010:l2cap_send_cmd+0x563/0x8d0 net/bluetooth/l2cap_core.c:964 Code: fc ff df 80 3c 08 00 74 08 48 89 df e8 f6 54 42 f7 bd 22 03 00 00 48 03 2b 48 89 e8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 11 01 00 00 0f b6 5d 00 89 de 83 e6 40 31 RSP: 0018:ffffc9000557f378 EFLAGS: 00010202 RAX: 0000000000000064 RBX: ffff88801eb23c78 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff888034724000 RBP: 0000000000000322 R08: ffffffff8ac395c4 R09: 0000000000000000 R10: dffffc0000000000 R11: ffffed100f588363 R12: ffff888034724000 R13: ffff888034724010 R14: ffff88801eb22c80 R15: ffff888063932140 FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055558b7da5c8 CR3: 000000002974a000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline] l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline] l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817 hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline] hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317 worker_thread+0x870/0xd30 kernel/workqueue.c:3398 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:l2cap_send_cmd+0x563/0x8d0 net/bluetooth/l2cap_core.c:964 Code: fc ff df 80 3c 08 00 74 08 48 89 df e8 f6 54 42 f7 bd 22 03 00 00 48 03 2b 48 89 e8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 11 01 00 00 0f b6 5d 00 89 de 83 e6 40 31 RSP: 0018:ffffc9000557f378 EFLAGS: 00010202 RAX: 0000000000000064 RBX: ffff88801eb23c78 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff888034724000 ---------------- Code disassembly (best guess), 2 bytes skipped: 0: df 80 3c 08 00 74 filds 0x7400083c(%rax) 6: 08 48 89 or %cl,-0x77(%rax) 9: df e8 fucomip %st(0),%st b: f6 54 42 f7 notb -0x9(%rdx,%rax,2) f: bd 22 03 00 00 mov $0x322,%ebp 14: 48 03 2b add (%rbx),%rbp 17: 48 89 e8 mov %rbp,%rax 1a: 48 c1 e8 03 shr $0x3,%rax 1e: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx 25: fc ff df * 28: 0f b6 04 08 movzbl (%rax,%rcx,1),%eax <-- trapping instruction 2c: 84 c0 test %al,%al 2e: 0f 85 11 01 00 00 jne 0x145 34: 0f b6 5d 00 movzbl 0x0(%rbp),%ebx 38: 89 de mov %ebx,%esi 3a: 83 e6 40 and $0x40,%esi 3d: 31 .byte 0x31 Tested on: commit: 9bffa1ad Merge tag 'drm-fixes-2025-01-17' of https://g.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=16139fc4580000 kernel config: https://syzkaller.appspot.com/x/.config?x=aadf89e2f6db86cc dashboard link: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734 compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 Note: no patches were applied. ^ permalink raw reply [flat|nested] 17+ messages in thread
[parent not found: <CABBYNZJYDW+k+RMZiLGxK094UB8bMcXeqqqMzDv7zkStRPTyTA@mail.gmail.com>]
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd [not found] <CABBYNZJYDW+k+RMZiLGxK094UB8bMcXeqqqMzDv7zkStRPTyTA@mail.gmail.com> @ 2025-01-17 1:24 ` syzbot 0 siblings, 0 replies; 17+ messages in thread From: syzbot @ 2025-01-17 1:24 UTC (permalink / raw) To: linux-bluetooth, linux-kernel, luiz.dentz, syzkaller-bugs Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: general protection fault in hci_send_acl Bluetooth: Unknown BR/EDR signaling command 0x0d Bluetooth: Wrong link type (-22) Bluetooth: Unknown BR/EDR signaling command 0x0f Bluetooth: Wrong link type (-22) Oops: general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] CPU: 0 UID: 0 PID: 6555 Comm: kworker/u9:3 Not tainted 6.13.0-rc7-syzkaller-00102-gce69b4019001-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 Workqueue: hci3 hci_rx_work RIP: 0010:hci_send_acl+0x3e/0xd00 net/bluetooth/hci_core.c:3232 Code: 00 89 54 24 04 49 89 f5 48 89 fb 49 bf 00 00 00 00 00 fc ff df e8 e2 91 e6 f6 48 89 5c 24 18 4c 8d 73 18 4c 89 f3 48 c1 eb 03 <42> 80 3c 3b 00 74 08 4c 89 f7 e8 03 fc 4c f7 bd f8 0f 00 00 49 03 RSP: 0018:ffffc90003627238 EFLAGS: 00010206 RAX: ffffffff8ab8f08e RBX: 0000000000000003 RCX: ffff88802f890000 RDX: 0000000000000000 RSI: ffff888029522b40 RDI: 0000000000000000 RBP: ffffc90003627a10 R08: ffffffff8ac38ee4 R09: 0000000000000000 R10: dffffc0000000000 R11: ffffed100e8028c3 R12: ffff888031548629 R13: ffff888029522b40 R14: 0000000000000018 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f2c547452d8 CR3: 000000000e736000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline] l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline] l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817 l2cap_recv_acldata+0x700/0x1a50 net/bluetooth/l2cap_core.c:7524 hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline] hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317 worker_thread+0x870/0xd30 kernel/workqueue.c:3398 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:hci_send_acl+0x3e/0xd00 net/bluetooth/hci_core.c:3232 Code: 00 89 54 24 04 49 89 f5 48 89 fb 49 bf 00 00 00 00 00 fc ff df e8 e2 91 e6 f6 48 89 5c 24 18 4c 8d 73 18 4c 89 f3 48 c1 eb 03 <42> 80 3c 3b 00 74 08 4c 89 f7 e8 03 fc 4c f7 bd f8 0f 00 00 49 03 RSP: 0018:ffffc90003627238 EFLAGS: 00010206 RAX: ffffffff8ab8f08e RBX: 0000000000000003 RCX: ffff88802f890000 RDX: 0000000000000000 RSI: ffff888029522b40 RDI: 0000000000000000 RBP: ffffc90003627a10 R08: ffffffff8ac38ee4 R09: 0000000000000000 R10: dffffc0000000000 R11: ffffed100e8028c3 R12: ffff888031548629 R13: ffff888029522b40 R14: 0000000000000018 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000564e8bb3fdc8 CR3: 000000000e736000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 00 89 54 24 04 49 add %cl,0x49042454(%rcx) 6: 89 f5 mov %esi,%ebp 8: 48 89 fb mov %rdi,%rbx b: 49 bf 00 00 00 00 00 movabs $0xdffffc0000000000,%r15 12: fc ff df 15: e8 e2 91 e6 f6 call 0xf6e691fc 1a: 48 89 5c 24 18 mov %rbx,0x18(%rsp) 1f: 4c 8d 73 18 lea 0x18(%rbx),%r14 23: 4c 89 f3 mov %r14,%rbx 26: 48 c1 eb 03 shr $0x3,%rbx * 2a: 42 80 3c 3b 00 cmpb $0x0,(%rbx,%r15,1) <-- trapping instruction 2f: 74 08 je 0x39 31: 4c 89 f7 mov %r14,%rdi 34: e8 03 fc 4c f7 call 0xf74cfc3c 39: bd f8 0f 00 00 mov $0xff8,%ebp 3e: 49 rex.WB 3f: 03 .byte 0x3 Tested on: commit: ce69b401 Merge tag 'net-6.13-rc8' of git://git.kernel... git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=10e782b0580000 kernel config: https://syzkaller.appspot.com/x/.config?x=aadf89e2f6db86cc dashboard link: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734 compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 patch: https://syzkaller.appspot.com/x/patch.diff?x=154721f8580000 ^ permalink raw reply [flat|nested] 17+ messages in thread
* [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd
@ 2024-02-26 9:32 syzbot
2025-01-06 9:04 ` syzbot
2025-01-14 14:09 ` syzbot
0 siblings, 2 replies; 17+ messages in thread
From: syzbot @ 2024-02-26 9:32 UTC (permalink / raw)
To: johan.hedberg, linux-bluetooth, linux-kernel, luiz.dentz, marcel,
syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: b401b621758e Linux 6.8-rc5
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12f63152180000
kernel config: https://syzkaller.appspot.com/x/.config?x=eff9f3183d0a20dd
dashboard link: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d31bbc7def2b/disk-b401b621.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/92891f219eae/vmlinux-b401b621.xz
kernel image: https://storage.googleapis.com/syzbot-assets/aedf35bce0a0/bzImage-b401b621.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: slab-use-after-free in l2cap_build_cmd net/bluetooth/l2cap_core.c:3100 [inline]
BUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x679/0x8d0 net/bluetooth/l2cap_core.c:958
Read of size 4 at addr ffff88802b3d7010 by task kworker/u5:7/5112
CPU: 0 PID: 5112 Comm: kworker/u5:7 Not tainted 6.8.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
Workqueue: hci3 hci_rx_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x167/0x540 mm/kasan/report.c:488
kasan_report+0x142/0x180 mm/kasan/report.c:601
l2cap_build_cmd net/bluetooth/l2cap_core.c:3100 [inline]
l2cap_send_cmd+0x679/0x8d0 net/bluetooth/l2cap_core.c:958
l2cap_recv_frame+0xfe9/0x8bd0
hci_acldata_packet net/bluetooth/hci_core.c:3875 [inline]
hci_rx_work+0x50f/0xca0 net/bluetooth/hci_core.c:4110
process_one_work kernel/workqueue.c:2633 [inline]
process_scheduled_works+0x915/0x1420 kernel/workqueue.c:2706
worker_thread+0xa5f/0x1000 kernel/workqueue.c:2787
kthread+0x2f1/0x390 kernel/kthread.c:388
ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242
</TASK>
Allocated by task 5104:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:372 [inline]
__kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:389
kasan_kmalloc include/linux/kasan.h:211 [inline]
kmalloc_trace+0x1d6/0x360 mm/slub.c:4012
kmalloc include/linux/slab.h:590 [inline]
kzalloc include/linux/slab.h:711 [inline]
l2cap_conn_add+0xb6/0xc10 net/bluetooth/l2cap_core.c:7855
l2cap_connect_cfm+0x138/0x1290 net/bluetooth/l2cap_core.c:8252
hci_connect_cfm+0xa4/0x150 include/net/bluetooth/hci_core.h:1986
le_conn_complete_evt+0xd10/0x1290 net/bluetooth/hci_event.c:6025
hci_le_conn_complete_evt+0x18c/0x420 net/bluetooth/hci_event.c:6051
hci_event_func net/bluetooth/hci_event.c:7679 [inline]
hci_event_packet+0xa59/0x1540 net/bluetooth/hci_event.c:7734
hci_rx_work+0x3e8/0xca0 net/bluetooth/hci_core.c:4105
process_one_work kernel/workqueue.c:2633 [inline]
process_scheduled_works+0x915/0x1420 kernel/workqueue.c:2706
worker_thread+0xa5f/0x1000 kernel/workqueue.c:2787
kthread+0x2f1/0x390 kernel/kthread.c:388
ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242
Freed by task 5316:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x4e/0x60 mm/kasan/generic.c:640
poison_slab_object+0xa6/0xe0 mm/kasan/common.c:241
__kasan_slab_free+0x34/0x70 mm/kasan/common.c:257
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2121 [inline]
slab_free mm/slub.c:4299 [inline]
kfree+0x14a/0x380 mm/slub.c:4409
l2cap_connect_cfm+0x121/0x1290 net/bluetooth/l2cap_core.c:8248
hci_connect_cfm include/net/bluetooth/hci_core.h:1986 [inline]
hci_conn_failed+0x1f8/0x340 net/bluetooth/hci_conn.c:1289
hci_abort_conn_sync+0x583/0xde0 net/bluetooth/hci_sync.c:5356
hci_cmd_sync_work+0x22d/0x400 net/bluetooth/hci_sync.c:306
process_one_work kernel/workqueue.c:2633 [inline]
process_scheduled_works+0x915/0x1420 kernel/workqueue.c:2706
worker_thread+0xa5f/0x1000 kernel/workqueue.c:2787
kthread+0x2f1/0x390 kernel/kthread.c:388
ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242
Last potentially related work creation:
kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47
__kasan_record_aux_stack+0xae/0x100 mm/kasan/generic.c:586
insert_work+0x3e/0x330 kernel/workqueue.c:1653
__queue_work+0xcdb/0x1000 kernel/workqueue.c:1806
queue_work_on+0x14f/0x250 kernel/workqueue.c:1837
queue_work include/linux/workqueue.h:548 [inline]
l2cap_conn_ready net/bluetooth/l2cap_core.c:1779 [inline]
l2cap_connect_cfm+0xf34/0x1290 net/bluetooth/l2cap_core.c:8293
hci_connect_cfm+0xa4/0x150 include/net/bluetooth/hci_core.h:1986
le_conn_complete_evt+0xd10/0x1290 net/bluetooth/hci_event.c:6025
hci_le_conn_complete_evt+0x18c/0x420 net/bluetooth/hci_event.c:6051
hci_event_func net/bluetooth/hci_event.c:7679 [inline]
hci_event_packet+0xa59/0x1540 net/bluetooth/hci_event.c:7734
hci_rx_work+0x3e8/0xca0 net/bluetooth/hci_core.c:4105
process_one_work kernel/workqueue.c:2633 [inline]
process_scheduled_works+0x915/0x1420 kernel/workqueue.c:2706
worker_thread+0xa5f/0x1000 kernel/workqueue.c:2787
kthread+0x2f1/0x390 kernel/kthread.c:388
ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242
The buggy address belongs to the object at ffff88802b3d7000
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 16 bytes inside of
freed 1024-byte region [ffff88802b3d7000, ffff88802b3d7400)
The buggy address belongs to the physical page:
page:ffffea0000acf400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2b3d0
head:ffffea0000acf400 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000840 ffff888014c41dc0 ffffea000080da00 dead000000000002
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 17603844133, free_ts 0
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1533
prep_new_page mm/page_alloc.c:1540 [inline]
get_page_from_freelist+0x33ea/0x3580 mm/page_alloc.c:3311
__alloc_pages+0x255/0x680 mm/page_alloc.c:4567
__alloc_pages_node include/linux/gfp.h:238 [inline]
alloc_pages_node include/linux/gfp.h:261 [inline]
alloc_slab_page+0x5f/0x160 mm/slub.c:2190
allocate_slab mm/slub.c:2354 [inline]
new_slab+0x84/0x2f0 mm/slub.c:2407
___slab_alloc+0xd17/0x13e0 mm/slub.c:3540
__slab_alloc mm/slub.c:3625 [inline]
__slab_alloc_node mm/slub.c:3678 [inline]
slab_alloc_node mm/slub.c:3850 [inline]
__do_kmalloc_node mm/slub.c:3980 [inline]
__kmalloc+0x2e0/0x490 mm/slub.c:3994
kmalloc include/linux/slab.h:594 [inline]
kzalloc include/linux/slab.h:711 [inline]
net_alloc_generic net/core/net_namespace.c:75 [inline]
net_assign_generic net/core/net_namespace.c:95 [inline]
ops_init+0x203/0x610 net/core/net_namespace.c:130
__register_pernet_operations net/core/net_namespace.c:1214 [inline]
register_pernet_operations+0x2cb/0x660 net/core/net_namespace.c:1283
register_pernet_device+0x33/0x80 net/core/net_namespace.c:1370
dp_init+0x95/0x160 net/openvswitch/datapath.c:2745
do_one_initcall+0x23a/0x830 init/main.c:1236
do_initcall_level+0x157/0x210 init/main.c:1298
do_initcalls+0x3f/0x80 init/main.c:1314
kernel_init_freeable+0x42f/0x5d0 init/main.c:1551
kernel_init+0x1d/0x2a0 init/main.c:1441
page_owner free stack trace missing
Memory state around the buggy address:
ffff88802b3d6f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88802b3d6f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88802b3d7000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88802b3d7080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88802b3d7100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 17+ messages in thread* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd 2024-02-26 9:32 syzbot @ 2025-01-06 9:04 ` syzbot 2025-01-14 10:54 ` Hillf Danton ` (3 more replies) 2025-01-14 14:09 ` syzbot 1 sibling, 4 replies; 17+ messages in thread From: syzbot @ 2025-01-06 9:04 UTC (permalink / raw) To: johan.hedberg, linux-bluetooth, linux-kernel, luiz.dentz, marcel, syzkaller-bugs syzbot has found a reproducer for the following issue on: HEAD commit: ab75170520d4 Merge tag 'linux-watchdog-6.13-rc6' of git://.. git tree: upstream console+strace: https://syzkaller.appspot.com/x/log.txt?x=17f4330f980000 kernel config: https://syzkaller.appspot.com/x/.config?x=1c541fa8af5c9cc7 dashboard link: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734 compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11261edf980000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17fa36f8580000 Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/1740fef78c43/disk-ab751705.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/a74d1ace549b/vmlinux-ab751705.xz kernel image: https://storage.googleapis.com/syzbot-assets/524d100d5187/bzImage-ab751705.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com BUG: KASAN: slab-use-after-free in l2cap_build_cmd net/bluetooth/l2cap_core.c:2964 [inline] BUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954 Read of size 8 at addr ffff8880271a4000 by task kworker/u9:2/5837 CPU: 0 UID: 0 PID: 5837 Comm: kworker/u9:2 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: hci1 hci_rx_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 l2cap_build_cmd net/bluetooth/l2cap_core.c:2964 [inline] l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954 l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline] l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline] l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817 hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline] hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Allocated by task 5837: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329 kmalloc_noprof include/linux/slab.h:901 [inline] kzalloc_noprof include/linux/slab.h:1037 [inline] l2cap_conn_add+0xa9/0x8e0 net/bluetooth/l2cap_core.c:6860 l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7239 hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline] hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726 hci_event_func net/bluetooth/hci_event.c:7473 [inline] hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525 hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Freed by task 54: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2353 [inline] slab_free mm/slub.c:4613 [inline] kfree+0x196/0x430 mm/slub.c:4761 l2cap_connect_cfm+0xcc/0x1090 net/bluetooth/l2cap_core.c:7235 hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline] hci_conn_failed+0x287/0x400 net/bluetooth/hci_conn.c:1266 hci_abort_conn_sync+0x56c/0x11f0 net/bluetooth/hci_sync.c:5603 hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Last potentially related work creation: kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47 __kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:544 insert_work+0x3e/0x330 kernel/workqueue.c:2183 __queue_work+0xc8b/0xf50 kernel/workqueue.c:2339 call_timer_fn+0x187/0x650 kernel/time/timer.c:1793 expire_timers kernel/time/timer.c:1839 [inline] __run_timers kernel/time/timer.c:2418 [inline] __run_timer_base+0x695/0x8e0 kernel/time/timer.c:2430 run_timer_base kernel/time/timer.c:2439 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2449 handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561 __do_softirq kernel/softirq.c:595 [inline] invoke_softirq kernel/softirq.c:435 [inline] __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 Second to last potentially related work creation: kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47 __kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:544 insert_work+0x3e/0x330 kernel/workqueue.c:2183 __queue_work+0xb66/0xf50 kernel/workqueue.c:2343 queue_work_on+0x1c2/0x380 kernel/workqueue.c:2390 queue_work include/linux/workqueue.h:662 [inline] l2cap_conn_ready net/bluetooth/l2cap_core.c:1640 [inline] l2cap_connect_cfm+0xdd5/0x1090 net/bluetooth/l2cap_core.c:7280 hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline] hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726 hci_event_func net/bluetooth/hci_event.c:7473 [inline] hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525 hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 The buggy address belongs to the object at ffff8880271a4000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 0 bytes inside of freed 1024-byte region [ffff8880271a4000, ffff8880271a4400) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x271a0 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801ac41dc0 ffffea0001c09800 dead000000000002 raw: 0000000000000000 0000000000100010 00000001f5000000 0000000000000000 head: 00fff00000000040 ffff88801ac41dc0 ffffea0001c09800 dead000000000002 head: 0000000000000000 0000000000100010 00000001f5000000 0000000000000000 head: 00fff00000000003 ffffea00009c6801 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0x252800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_THISNODE), pid 12, tgid 12 (kworker/u8:1), ts 7179124429, free_ts 0 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1558 prep_new_page mm/page_alloc.c:1566 [inline] get_page_from_freelist+0x365c/0x37a0 mm/page_alloc.c:3476 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4753 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline] alloc_slab_page+0x59/0x110 mm/slub.c:2425 allocate_slab+0x5a/0x2b0 mm/slub.c:2589 new_slab mm/slub.c:2642 [inline] ___slab_alloc+0xc27/0x14a0 mm/slub.c:3830 __slab_alloc+0x58/0xa0 mm/slub.c:3920 __slab_alloc_node mm/slub.c:3995 [inline] slab_alloc_node mm/slub.c:4156 [inline] __kmalloc_cache_node_noprof+0x294/0x3a0 mm/slub.c:4337 kmalloc_node_noprof include/linux/slab.h:924 [inline] blk_mq_alloc_hctx block/blk-mq.c:3935 [inline] blk_mq_alloc_and_init_hctx+0x17f/0xd50 block/blk-mq.c:4443 blk_mq_realloc_hw_ctxs+0x19c/0xb00 block/blk-mq.c:4476 blk_mq_init_allocated_queue+0x3f6/0x14c0 block/blk-mq.c:4530 blk_mq_alloc_queue+0x1d3/0x2f0 block/blk-mq.c:4343 scsi_alloc_sdev+0x76c/0xb80 drivers/scsi/scsi_scan.c:337 scsi_probe_and_add_lun+0x1d4/0x4bd0 drivers/scsi/scsi_scan.c:1210 __scsi_scan_target+0x205/0x1080 drivers/scsi/scsi_scan.c:1757 scsi_scan_channel drivers/scsi/scsi_scan.c:1845 [inline] scsi_scan_host_selected+0x37e/0x690 drivers/scsi/scsi_scan.c:1874 page_owner free stack trace missing Memory state around the buggy address: ffff8880271a3f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8880271a3f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8880271a4000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880271a4080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880271a4100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== --- If you want syzbot to run the reproducer, reply with: #syz test: git://repo/address.git branch-or-commit-hash If you attach or paste a git patch, syzbot will apply it before testing. ^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd 2025-01-06 9:04 ` syzbot @ 2025-01-14 10:54 ` Hillf Danton 2025-01-14 15:16 ` syzbot 2025-01-15 5:28 ` Hillf Danton ` (2 subsequent siblings) 3 siblings, 1 reply; 17+ messages in thread From: Hillf Danton @ 2025-01-14 10:54 UTC (permalink / raw) To: syzbot; +Cc: linux-kernel, syzkaller-bugs On Mon, 06 Jan 2025 01:04:23 -0800 > syzbot has found a reproducer for the following issue on: > > HEAD commit: ab75170520d4 Merge tag 'linux-watchdog-6.13-rc6' of git://.. > git tree: upstream > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17fa36f8580000 #syz test --- xnet/bluetooth/l2cap_core.c +++ ynet/bluetooth/l2cap_core.c @@ -1747,6 +1747,8 @@ static void l2cap_unregister_all_users(s } } +static DEFINE_SPINLOCK(l2cap_conn_del_lock); + static void l2cap_conn_del(struct hci_conn *hcon, int err) { struct l2cap_conn *conn = hcon->l2cap_data; @@ -1797,7 +1799,9 @@ static void l2cap_conn_del(struct hci_co if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) cancel_delayed_work_sync(&conn->info_timer); + spin_lock(&l2cap_conn_del_lock); hcon->l2cap_data = NULL; + spin_unlock(&l2cap_conn_del_lock); conn->hchan = NULL; l2cap_conn_put(conn); } @@ -1819,6 +1823,8 @@ EXPORT_SYMBOL(l2cap_conn_get); void l2cap_conn_put(struct l2cap_conn *conn) { + if (!conn) + return; kref_put(&conn->ref, l2cap_conn_free); } EXPORT_SYMBOL(l2cap_conn_put); @@ -7477,6 +7483,13 @@ void l2cap_recv_acldata(struct hci_conn if (!conn) goto drop; + spin_lock(&l2cap_conn_del_lock); + conn = hcon->l2cap_data; + if (conn) + l2cap_conn_get(conn); + spin_unlock(&l2cap_conn_del_lock); + if (!conn) + goto drop; BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags); switch (flags) { @@ -7503,6 +7516,7 @@ void l2cap_recv_acldata(struct hci_conn if (len == skb->len) { /* Complete frame received */ l2cap_recv_frame(conn, skb); + l2cap_conn_put(conn); return; } @@ -7566,6 +7580,7 @@ void l2cap_recv_acldata(struct hci_conn } drop: + l2cap_conn_put(conn); kfree_skb(skb); } -- ^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd 2025-01-14 10:54 ` Hillf Danton @ 2025-01-14 15:16 ` syzbot 0 siblings, 0 replies; 17+ messages in thread From: syzbot @ 2025-01-14 15:16 UTC (permalink / raw) To: hdanton, linux-kernel, syzkaller-bugs Hello, syzbot tried to test the proposed patch but the build/boot failed: failed to apply patch: can't find file to patch at input line 3 Perhaps you used the wrong -p or --strip option? The text leading up to this was: -------------------------- |--- xnet/bluetooth/l2cap_core.c |+++ ynet/bluetooth/l2cap_core.c -------------------------- No file to patch. Skipping patch. 6 out of 6 hunks ignored Tested on: commit: c45323b7 Merge tag 'mm-hotfixes-stable-2025-01-13-00-0.. git tree: upstream kernel config: https://syzkaller.appspot.com/x/.config?x=1c541fa8af5c9cc7 dashboard link: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734 compiler: patch: https://syzkaller.appspot.com/x/patch.diff?x=14e85bc4580000 ^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd 2025-01-06 9:04 ` syzbot 2025-01-14 10:54 ` Hillf Danton @ 2025-01-15 5:28 ` Hillf Danton 2025-01-15 5:53 ` syzbot 2025-01-15 8:12 ` Edward Adam Davis 2025-01-15 10:25 ` Hillf Danton 3 siblings, 1 reply; 17+ messages in thread From: Hillf Danton @ 2025-01-15 5:28 UTC (permalink / raw) To: syzbot; +Cc: linux-kernel, syzkaller-bugs On Mon, 06 Jan 2025 01:04:23 -0800 > syzbot has found a reproducer for the following issue on: > > HEAD commit: ab75170520d4 Merge tag 'linux-watchdog-6.13-rc6' of git://.. > git tree: upstream > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17fa36f8580000 #syz test --- x/net/bluetooth/l2cap_core.c +++ y/net/bluetooth/l2cap_core.c @@ -1747,6 +1747,8 @@ static void l2cap_unregister_all_users(s } } +static DEFINE_SPINLOCK(l2cap_conn_del_lock); + static void l2cap_conn_del(struct hci_conn *hcon, int err) { struct l2cap_conn *conn = hcon->l2cap_data; @@ -1797,7 +1799,9 @@ static void l2cap_conn_del(struct hci_co if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) cancel_delayed_work_sync(&conn->info_timer); + spin_lock(&l2cap_conn_del_lock); hcon->l2cap_data = NULL; + spin_unlock(&l2cap_conn_del_lock); conn->hchan = NULL; l2cap_conn_put(conn); } @@ -1819,6 +1823,8 @@ EXPORT_SYMBOL(l2cap_conn_get); void l2cap_conn_put(struct l2cap_conn *conn) { + if (!conn) + return; kref_put(&conn->ref, l2cap_conn_free); } EXPORT_SYMBOL(l2cap_conn_put); @@ -7477,6 +7483,13 @@ void l2cap_recv_acldata(struct hci_conn if (!conn) goto drop; + spin_lock(&l2cap_conn_del_lock); + conn = hcon->l2cap_data; + if (conn) + l2cap_conn_get(conn); + spin_unlock(&l2cap_conn_del_lock); + if (!conn) + goto drop; BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags); switch (flags) { @@ -7503,6 +7516,7 @@ void l2cap_recv_acldata(struct hci_conn if (len == skb->len) { /* Complete frame received */ l2cap_recv_frame(conn, skb); + l2cap_conn_put(conn); return; } @@ -7566,6 +7580,7 @@ void l2cap_recv_acldata(struct hci_conn } drop: + l2cap_conn_put(conn); kfree_skb(skb); } -- ^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd 2025-01-15 5:28 ` Hillf Danton @ 2025-01-15 5:53 ` syzbot 0 siblings, 0 replies; 17+ messages in thread From: syzbot @ 2025-01-15 5:53 UTC (permalink / raw) To: hdanton, linux-kernel, syzkaller-bugs Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: general protection fault in hci_send_acl Bluetooth: Wrong link type (-22) Oops: general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] CPU: 1 UID: 0 PID: 8192 Comm: kworker/u9:7 Not tainted 6.13.0-rc7-syzkaller-g619f0b6fad52-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 Workqueue: hci5 hci_rx_work RIP: 0010:hci_send_acl+0x3e/0xd00 net/bluetooth/hci_core.c:3232 Code: 00 89 54 24 04 49 89 f5 48 89 fb 49 bf 00 00 00 00 00 fc ff df e8 a2 93 e6 f6 48 89 5c 24 18 4c 8d 73 18 4c 89 f3 48 c1 eb 03 <42> 80 3c 3b 00 74 08 4c 89 f7 e8 c3 fd 4c f7 bd f8 0f 00 00 49 03 RSP: 0018:ffffc900057e72b8 EFLAGS: 00010206 RAX: ffffffff8ab8eece RBX: 0000000000000003 RCX: ffff8880304dbc00 RDX: 0000000000000000 RSI: ffff8880578f5c80 RDI: 0000000000000000 RBP: ffffc900057e7a98 R08: ffffffff8ac38d24 R09: 0000000000000000 R10: dffffc0000000000 R11: ffffed100dbd7003 R12: ffff88802d5c0f4b R13: ffff8880578f5c80 R14: 0000000000000018 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000c005688000 CR3: 0000000032a00000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5508 [inline] l2cap_sig_channel net/bluetooth/l2cap_core.c:5544 [inline] l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6823 l2cap_recv_acldata+0x51f/0x1530 net/bluetooth/l2cap_core.c:7518 hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline] hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317 worker_thread+0x870/0xd30 kernel/workqueue.c:3398 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:hci_send_acl+0x3e/0xd00 net/bluetooth/hci_core.c:3232 Code: 00 89 54 24 04 49 89 f5 48 89 fb 49 bf 00 00 00 00 00 fc ff df e8 a2 93 e6 f6 48 89 5c 24 18 4c 8d 73 18 4c 89 f3 48 c1 eb 03 <42> 80 3c 3b 00 74 08 4c 89 f7 e8 c3 fd 4c f7 bd f8 0f 00 00 49 03 RSP: 0018:ffffc900057e72b8 EFLAGS: 00010206 RAX: ffffffff8ab8eece RBX: 0000000000000003 RCX: ffff8880304dbc00 RDX: 0000000000000000 RSI: ffff8880578f5c80 RDI: 0000000000000000 RBP: ffffc900057e7a98 R08: ffffffff8ac38d24 R09: 0000000000000000 R10: dffffc0000000000 R11: ffffed100dbd7003 R12: ffff88802d5c0f4b R13: ffff8880578f5c80 R14: 0000000000000018 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000c005688000 CR3: 000000000e736000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 00 89 54 24 04 49 add %cl,0x49042454(%rcx) 6: 89 f5 mov %esi,%ebp 8: 48 89 fb mov %rdi,%rbx b: 49 bf 00 00 00 00 00 movabs $0xdffffc0000000000,%r15 12: fc ff df 15: e8 a2 93 e6 f6 call 0xf6e693bc 1a: 48 89 5c 24 18 mov %rbx,0x18(%rsp) 1f: 4c 8d 73 18 lea 0x18(%rbx),%r14 23: 4c 89 f3 mov %r14,%rbx 26: 48 c1 eb 03 shr $0x3,%rbx * 2a: 42 80 3c 3b 00 cmpb $0x0,(%rbx,%r15,1) <-- trapping instruction 2f: 74 08 je 0x39 31: 4c 89 f7 mov %r14,%rdi 34: e8 c3 fd 4c f7 call 0xf74cfdfc 39: bd f8 0f 00 00 mov $0xff8,%ebp 3e: 49 rex.WB 3f: 03 .byte 0x3 Tested on: commit: 619f0b6f Merge tag 'seccomp-v6.13-rc8' of git://git.ke.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=145ebcb0580000 kernel config: https://syzkaller.appspot.com/x/.config?x=aadf89e2f6db86cc dashboard link: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734 compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 patch: https://syzkaller.appspot.com/x/patch.diff?x=1276bcb0580000 ^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd 2025-01-06 9:04 ` syzbot 2025-01-14 10:54 ` Hillf Danton 2025-01-15 5:28 ` Hillf Danton @ 2025-01-15 8:12 ` Edward Adam Davis 2025-01-15 9:11 ` syzbot 2025-01-15 10:25 ` Hillf Danton 3 siblings, 1 reply; 17+ messages in thread From: Edward Adam Davis @ 2025-01-15 8:12 UTC (permalink / raw) To: syzbot+31c2f641b850a348a734; +Cc: linux-kernel, syzkaller-bugs #syz test: https://github.com/ea1davis/linux bthci/syz ^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd 2025-01-15 8:12 ` Edward Adam Davis @ 2025-01-15 9:11 ` syzbot 0 siblings, 0 replies; 17+ messages in thread From: syzbot @ 2025-01-15 9:11 UTC (permalink / raw) To: eadavis, linux-kernel, syzkaller-bugs Hello, syzbot has tested the proposed patch and the reproducer did not trigger any issue: Reported-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com Tested-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com Tested on: commit: a9b74d57 Bluetooth: hci_core: sync hci_rx_work and hci.. git tree: https://github.com/ea1davis/linux bthci/syz console output: https://syzkaller.appspot.com/x/log.txt?x=133057c4580000 kernel config: https://syzkaller.appspot.com/x/.config?x=82d76f5a1a8b5c36 dashboard link: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734 compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 Note: no patches were applied. Note: testing is done by a robot and is best-effort only. ^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd 2025-01-06 9:04 ` syzbot ` (2 preceding siblings ...) 2025-01-15 8:12 ` Edward Adam Davis @ 2025-01-15 10:25 ` Hillf Danton 2025-01-15 11:29 ` syzbot 3 siblings, 1 reply; 17+ messages in thread From: Hillf Danton @ 2025-01-15 10:25 UTC (permalink / raw) To: syzbot; +Cc: linux-kernel, syzkaller-bugs On Mon, 06 Jan 2025 01:04:23 -0800 > syzbot has found a reproducer for the following issue on: > > HEAD commit: ab75170520d4 Merge tag 'linux-watchdog-6.13-rc6' of git://.. > git tree: upstream > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17fa36f8580000 #syz test --- x/net/bluetooth/l2cap_core.c +++ y/net/bluetooth/l2cap_core.c @@ -1747,6 +1747,8 @@ static void l2cap_unregister_all_users(s } } +static DEFINE_MUTEX(l2cap_conn_del_lock); + static void l2cap_conn_del(struct hci_conn *hcon, int err) { struct l2cap_conn *conn = hcon->l2cap_data; @@ -1797,8 +1799,10 @@ static void l2cap_conn_del(struct hci_co if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) cancel_delayed_work_sync(&conn->info_timer); + mutex_lock(&l2cap_conn_del_lock); hcon->l2cap_data = NULL; conn->hchan = NULL; + mutex_unlock(&l2cap_conn_del_lock); l2cap_conn_put(conn); } @@ -7470,6 +7474,7 @@ void l2cap_recv_acldata(struct hci_conn { struct l2cap_conn *conn = hcon->l2cap_data; int len; + int locked = 0; if (!conn) conn = l2cap_conn_add(hcon); @@ -7477,6 +7482,11 @@ void l2cap_recv_acldata(struct hci_conn if (!conn) goto drop; + mutex_lock(&l2cap_conn_del_lock); + locked = 1; + conn = hcon->l2cap_data; + if (!conn) + goto drop; BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags); switch (flags) { @@ -7503,6 +7513,7 @@ void l2cap_recv_acldata(struct hci_conn if (len == skb->len) { /* Complete frame received */ l2cap_recv_frame(conn, skb); + mutex_unlock(&l2cap_conn_del_lock); return; } @@ -7566,6 +7577,8 @@ void l2cap_recv_acldata(struct hci_conn } drop: + if (locked) + mutex_unlock(&l2cap_conn_del_lock); kfree_skb(skb); } -- ^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd 2025-01-15 10:25 ` Hillf Danton @ 2025-01-15 11:29 ` syzbot 0 siblings, 0 replies; 17+ messages in thread From: syzbot @ 2025-01-15 11:29 UTC (permalink / raw) To: hdanton, linux-kernel, syzkaller-bugs Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: INFO: task hung in disable_work_sync INFO: task syz-executor:13931 blocked for more than 143 seconds. Not tainted 6.13.0-rc7-syzkaller-g619f0b6fad52-dirty #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:20544 pid:13931 tgid:13931 ppid:1 flags:0x00004006 Call Trace: <TASK> context_switch kernel/sched/core.c:5369 [inline] __schedule+0x1850/0x4c30 kernel/sched/core.c:6756 __schedule_loop kernel/sched/core.c:6833 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6848 schedule_timeout+0xb0/0x290 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:95 [inline] __wait_for_common kernel/sched/completion.c:116 [inline] wait_for_common kernel/sched/completion.c:127 [inline] wait_for_completion+0x355/0x620 kernel/sched/completion.c:148 __flush_work+0xa47/0xc60 kernel/workqueue.c:4242 __cancel_work_sync kernel/workqueue.c:4362 [inline] disable_work_sync+0xba/0xe0 kernel/workqueue.c:4473 hci_unregister_dev+0x149/0x510 net/bluetooth/hci_core.c:2687 vhci_release+0x80/0xd0 drivers/bluetooth/hci_vhci.c:664 __fput+0x23c/0xa50 fs/file_table.c:450 task_work_run+0x24f/0x310 kernel/task_work.c:239 exit_task_work include/linux/task_work.h:43 [inline] do_exit+0xa2a/0x28e0 kernel/exit.c:938 do_group_exit+0x207/0x2c0 kernel/exit.c:1087 get_signal+0x16b2/0x1750 kernel/signal.c:3017 arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0xce/0x340 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f1b7bf8453a RSP: 002b:00007f1b7c29ecc8 EFLAGS: 00000286 ORIG_RAX: 0000000000000106 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f1b7bf8453a RDX: 00007f1b7c29ecf0 RSI: 00007f1b7c29ed80 RDI: 00000000ffffff9c RBP: 00007f1b7c29ed80 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000100 R11: 0000000000000286 R12: 00007f1b7c29fe00 R13: 00007f1b7c0018f4 R14: 00007f1b7c29fe40 R15: 0000000000000258 </TASK> INFO: task syz-executor:14434 blocked for more than 144 seconds. Not tainted 6.13.0-rc7-syzkaller-g619f0b6fad52-dirty #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:19936 pid:14434 tgid:14434 ppid:1 flags:0x00004006 Call Trace: <TASK> context_switch kernel/sched/core.c:5369 [inline] __schedule+0x1850/0x4c30 kernel/sched/core.c:6756 __schedule_loop kernel/sched/core.c:6833 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6848 schedule_timeout+0xb0/0x290 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:95 [inline] __wait_for_common kernel/sched/completion.c:116 [inline] wait_for_common kernel/sched/completion.c:127 [inline] wait_for_completion+0x355/0x620 kernel/sched/completion.c:148 __flush_work+0xa47/0xc60 kernel/workqueue.c:4242 __cancel_work_sync kernel/workqueue.c:4362 [inline] disable_work_sync+0xba/0xe0 kernel/workqueue.c:4473 hci_unregister_dev+0x149/0x510 net/bluetooth/hci_core.c:2687 vhci_release+0x80/0xd0 drivers/bluetooth/hci_vhci.c:664 __fput+0x23c/0xa50 fs/file_table.c:450 task_work_run+0x24f/0x310 kernel/task_work.c:239 exit_task_work include/linux/task_work.h:43 [inline] do_exit+0xa2a/0x28e0 kernel/exit.c:938 do_group_exit+0x207/0x2c0 kernel/exit.c:1087 get_signal+0x16b2/0x1750 kernel/signal.c:3017 arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0xce/0x340 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f9b86587a6a RSP: 002b:00007f9b8689f6c8 EFLAGS: 00000212 ORIG_RAX: 0000000000000037 RAX: 0000000000000000 RBX: 00007f9b8689f750 RCX: 00007f9b86587a6a RDX: 0000000000000041 RSI: 0000000000000029 RDI: 0000000000000003 RBP: 0000000000000003 R08: 00007f9b8689f6ec R09: 0079746972756365 R10: 00007f9b8689f750 R11: 0000000000000212 R12: 00007f9b86746c80 R13: 00007f9b8689f6ec R14: 0000000000000000 R15: 00007f9b86748e40 </TASK> Showing all locks held in the system: 1 lock held by khungtaskd/30: #0: ffffffff8e937ae0 (rcu_read_lock ){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] ){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] ){....}-{1:3}, at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6744 3 locks held by kworker/u9:0/54: #0: ffff88805dbaa148 ((wq_completion)hci3#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline] ((wq_completion)hci3#2){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1840 kernel/workqueue.c:3317 #1: ffffc90000be7d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline] ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1840 kernel/workqueue.c:3317 #2: ffffffff8fe23c88 (l2cap_conn_del_lock){+.+.}-{4:4}, at: l2cap_recv_acldata+0x79/0x1300 net/bluetooth/l2cap_core.c:7485 3 locks held by kworker/u9:1/5146: #0: ffff8880298ad148 ( (wq_completion)hci10#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline] (wq_completion)hci10#2){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1840 kernel/workqueue.c:3317 #1: ffffc9000ecc7d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0} , at: process_one_work kernel/workqueue.c:3212 [inline] , at: process_scheduled_works+0x976/0x1840 kernel/workqueue.c:3317 #2: ffffffff8fe23c88 (l2cap_conn_del_lock){+.+.}-{4:4}, at: l2cap_recv_acldata+0x79/0x1300 net/bluetooth/l2cap_core.c:7485 2 locks held by getty/5588: #0: ffff88803160e0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc90002fde2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x6a6/0x1e00 drivers/tty/n_tty.c:2211 3 locks held by kworker/u9:4/6605: #0: ffff88807a88d948 ( (wq_completion)hci5 #2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline] #2){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1840 kernel/workqueue.c:3317 #1: ffffc90003a17d00 ((work_completion)(&hdev->rx_work) ){+.+.}-{0:0} , at: process_one_work kernel/workqueue.c:3212 [inline] , at: process_scheduled_works+0x976/0x1840 kernel/workqueue.c:3317 #2: ffffffff8fe23c88 (l2cap_conn_del_lock){+.+.}-{4:4}, at: l2cap_recv_acldata+0x79/0x1300 net/bluetooth/l2cap_core.c:7485 3 locks held by kworker/u9:5/6607: #0: ffff8880794e8148 ( (wq_completion)hci7#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline] (wq_completion)hci7#2){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1840 kernel/workqueue.c:3317 #1: ffffc90003967d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline] ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1840 kernel/workqueue.c:3317 #2: ffffffff8fe23c88 (l2cap_conn_del_lock){+.+.}-{4:4} , at: l2cap_recv_acldata+0x79/0x1300 net/bluetooth/l2cap_core.c:7485 3 locks held by kworker/u9:6/6609: #0: ffff88805b8a2148 ( (wq_completion)hci9 #2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline] #2){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1840 kernel/workqueue.c:3317 #1: ffffc90003c87d00 ( (work_completion)(&hdev->rx_work) ){+.+.}-{0:0} , at: process_one_work kernel/workqueue.c:3212 [inline] , at: process_scheduled_works+0x976/0x1840 kernel/workqueue.c:3317 #2: ffffffff8fe23c88 (l2cap_conn_del_lock){+.+.}-{4:4}, at: l2cap_recv_acldata+0x79/0x1300 net/bluetooth/l2cap_core.c:7485 3 locks held by kworker/u9:7/6610: #0: ffff8880250d8148 ((wq_completion)hci1 #2 ){+.+.}-{0:0} , at: process_one_work kernel/workqueue.c:3211 [inline] , at: process_scheduled_works+0x93b/0x1840 kernel/workqueue.c:3317 #1: ffffc90003a87d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0} , at: process_one_work kernel/workqueue.c:3212 [inline] , at: process_scheduled_works+0x976/0x1840 kernel/workqueue.c:3317 #2: ffffffff8fe23c88 (l2cap_conn_del_lock){+.+.}-{4:4} , at: l2cap_recv_acldata+0x79/0x1300 net/bluetooth/l2cap_core.c:7485 5 locks held by kworker/u9:8/14419: 3 locks held by kworker/u9:9/14841: #0: ffff8880794ed948 ((wq_completion)hci6#2){+.+.}-{0:0} , at: process_one_work kernel/workqueue.c:3211 [inline] , at: process_scheduled_works+0x93b/0x1840 kernel/workqueue.c:3317 #1: ffffc9000c9f7d00 ((work_completion)(&hdev->rx_work) ){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline] ){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1840 kernel/workqueue.c:3317 #2: ffffffff8fe23c88 (l2cap_conn_del_lock ){+.+.}-{4:4}, at: l2cap_recv_acldata+0x79/0x1300 net/bluetooth/l2cap_core.c:7485 3 locks held by kworker/u9:11/15620: #0: ffff88805dbae148 ( (wq_completion)hci4#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline] (wq_completion)hci4#2){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1840 kernel/workqueue.c:3317 #1: ffffc9000cd17d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0} , at: process_one_work kernel/workqueue.c:3212 [inline] , at: process_scheduled_works+0x976/0x1840 kernel/workqueue.c:3317 #2: ffffffff8fe23c88 ( l2cap_conn_del_lock ){+.+.}-{4:4}, at: l2cap_recv_acldata+0x79/0x1300 net/bluetooth/l2cap_core.c:7485 3 locks held by kworker/u9:12/22957: 4 locks held by syz-executor920/22964: ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.13.0-rc7-syzkaller-g619f0b6fad52-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 nmi_cpu_backtrace+0x49c/0x4d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:234 [inline] watchdog+0xff6/0x1040 kernel/hung_task.c:397 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 14419 Comm: kworker/u9:8 Not tainted 6.13.0-rc7-syzkaller-g619f0b6fad52-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 Workqueue: hci8 hci_rx_work RIP: 0010:io_serial_in+0x76/0xb0 drivers/tty/serial/8250/8250_port.c:409 Code: 10 2c 4f fc 89 e9 41 d3 e6 48 83 c3 40 48 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 31 96 b5 fc 44 03 33 44 89 f2 ec <0f> b6 c0 5b 41 5e 41 5f 5d c3 cc cc cc cc 89 e9 80 e1 07 38 c1 7c RSP: 0018:ffffc9000dba6b98 EFLAGS: 00000002 RAX: 1ffffffff34de400 RBX: ffffffff9a6f27c0 RCX: 0000000000000000 RDX: 00000000000003fd RSI: 0000000000000000 RDI: 0000000000000020 RBP: 0000000000000000 R08: ffffffff85505656 R09: 1ffff11004a5c046 R10: dffffc0000000000 R11: ffffffff85505610 R12: dffffc0000000000 R13: ffffffff9a3ecf70 R14: 00000000000003fd R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555578960788 CR3: 000000005b10e000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <NMI> </NMI> <TASK> serial_in drivers/tty/serial/8250/8250.h:137 [inline] serial_lsr_in drivers/tty/serial/8250/8250.h:159 [inline] wait_for_lsr drivers/tty/serial/8250/8250_port.c:2088 [inline] serial8250_console_fifo_write drivers/tty/serial/8250/8250_port.c:3335 [inline] serial8250_console_write+0x1373/0x1ed0 drivers/tty/serial/8250/8250_port.c:3413 console_emit_next_record kernel/printk/printk.c:3122 [inline] console_flush_all+0x869/0xeb0 kernel/printk/printk.c:3210 __console_flush_and_unlock kernel/printk/printk.c:3269 [inline] console_unlock+0x14f/0x3b0 kernel/printk/printk.c:3309 vprintk_emit+0x730/0xa10 kernel/printk/printk.c:2432 _printk+0xd5/0x120 kernel/printk/printk.c:2457 bt_err+0x127/0x180 net/bluetooth/lib.c:296 l2cap_sig_channel net/bluetooth/l2cap_core.c:5541 [inline] l2cap_recv_frame+0x21ba/0x10db0 net/bluetooth/l2cap_core.c:6821 l2cap_recv_acldata+0x486/0x1300 net/bluetooth/l2cap_core.c:7515 hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline] hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317 worker_thread+0x870/0xd30 kernel/workqueue.c:3398 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Tested on: commit: 619f0b6f Merge tag 'seccomp-v6.13-rc8' of git://git.ke.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=12a5ce64580000 kernel config: https://syzkaller.appspot.com/x/.config?x=aadf89e2f6db86cc dashboard link: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734 compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 patch: https://syzkaller.appspot.com/x/patch.diff?x=11b789df980000 ^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd 2024-02-26 9:32 syzbot 2025-01-06 9:04 ` syzbot @ 2025-01-14 14:09 ` syzbot 1 sibling, 0 replies; 17+ messages in thread From: syzbot @ 2025-01-14 14:09 UTC (permalink / raw) To: davem, edumazet, hdanton, johan.hedberg, kuba, linux-bluetooth, linux-kernel, luiz.dentz, luiz.von.dentz, marcel, netdev, pabeni, syzkaller-bugs syzbot has bisected this issue to: commit e7b02296fb400ee64822fbdd81a0718449066333 Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Date: Thu Feb 1 16:18:58 2024 +0000 Bluetooth: Remove BT_HS bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=10665bc4580000 start commit: ab75170520d4 Merge tag 'linux-watchdog-6.13-rc6' of git://.. git tree: upstream final oops: https://syzkaller.appspot.com/x/report.txt?x=12665bc4580000 console output: https://syzkaller.appspot.com/x/log.txt?x=14665bc4580000 kernel config: https://syzkaller.appspot.com/x/.config?x=1c541fa8af5c9cc7 dashboard link: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11261edf980000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17fa36f8580000 Reported-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com Fixes: e7b02296fb40 ("Bluetooth: Remove BT_HS") For information about bisection process see: https://goo.gl/tpsmEJ#bisection ^ permalink raw reply [flat|nested] 17+ messages in thread
end of thread, other threads:[~2025-01-22 17:52 UTC | newest]
Thread overview: 17+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <CABBYNZKDjf2wZYCmumoifFJ_OnG2vjJBqjE+0yOf9c6iqWA8+w@mail.gmail.com>
2025-01-22 17:52 ` [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd syzbot
[not found] <CABBYNZKX0GKVwEEmf6XhnL-RJKqzLvt0izVC152Lzc8MjWWo7A@mail.gmail.com>
2025-01-22 3:17 ` syzbot
[not found] <CABBYNZKWo_+EuoOWTYUyAFQ2RuA1F4s3hgdeSHuy2v9A5d9XCg@mail.gmail.com>
2025-01-17 21:15 ` syzbot
[not found] <CABBYNZKyZKqM4pNxjqPEc1ot5fi50Oy_0VnujUXrJOe_ZeWNWA@mail.gmail.com>
2025-01-17 17:56 ` syzbot
[not found] <CABBYNZ++2=0bfK328cVaFY3_94DL0v8W7aSWW7YgrKP+L8Ax1g@mail.gmail.com>
2025-01-17 16:54 ` syzbot
[not found] <CABBYNZJYDW+k+RMZiLGxK094UB8bMcXeqqqMzDv7zkStRPTyTA@mail.gmail.com>
2025-01-17 1:24 ` syzbot
2024-02-26 9:32 syzbot
2025-01-06 9:04 ` syzbot
2025-01-14 10:54 ` Hillf Danton
2025-01-14 15:16 ` syzbot
2025-01-15 5:28 ` Hillf Danton
2025-01-15 5:53 ` syzbot
2025-01-15 8:12 ` Edward Adam Davis
2025-01-15 9:11 ` syzbot
2025-01-15 10:25 ` Hillf Danton
2025-01-15 11:29 ` syzbot
2025-01-14 14:09 ` syzbot
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox