[syzbot] [bluetooth?] KASAN: slab-use-after-free Read in skb_queue_purge_reason (2)

[syzbot] [bluetooth?] KASAN: slab-use-after-free Read in skb_queue_purge_reason (2)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    621cde16e49b Merge git://git.kernel.org/pub/scm/linux/kern..
git tree:       net
console output: https://syzkaller.appspot.com/x/log.txt?x=14b6fa84980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=bddb81daac38d475
dashboard link: https://syzkaller.appspot.com/bug?extid=683f8cb11b94b1824c77
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/9591b45993bc/disk-621cde16.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2a31801cab2a/vmlinux-621cde16.xz
kernel image: https://storage.googleapis.com/syzbot-assets/37962f7be4eb/bzImage-621cde16.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+683f8cb11b94b1824c77@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: slab-use-after-free in skb_queue_empty_lockless include/linux/skbuff.h:1840 [inline]
BUG: KASAN: slab-use-after-free in skb_queue_purge_reason+0xb9/0x500 net/core/skbuff.c:3877
Read of size 8 at addr ffff8880118db058 by task syz-executor.1/9233

CPU: 1 PID: 9233 Comm: syz-executor.1 Not tainted 6.9.0-syzkaller-05156-g621cde16e49b #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0x169/0x550 mm/kasan/report.c:488
 kasan_report+0x143/0x180 mm/kasan/report.c:601
 skb_queue_empty_lockless include/linux/skbuff.h:1840 [inline]
 skb_queue_purge_reason+0xb9/0x500 net/core/skbuff.c:3877
 skb_queue_purge include/linux/skbuff.h:3273 [inline]
 vhci_flush+0x44/0x50 drivers/bluetooth/hci_vhci.c:69
 hci_dev_do_reset net/bluetooth/hci_core.c:625 [inline]
 hci_dev_reset+0x42a/0x5d0 net/bluetooth/hci_core.c:665
 sock_do_ioctl+0x158/0x460 net/socket.c:1222
 sock_ioctl+0x629/0x8e0 net/socket.c:1341
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:904 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:890
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fdbb787cee9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fdbb85530c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fdbb79abf80 RCX: 00007fdbb787cee9
RDX: 0000000000000000 RSI: 00000000400448cb RDI: 0000000000000006
RBP: 00007fdbb78c949e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007fdbb79abf80 R15: 00007ffea6376cb8
 </TASK>

Allocated by task 8951:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
 __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387
 kasan_kmalloc include/linux/kasan.h:211 [inline]
 kmalloc_trace+0x1db/0x370 mm/slub.c:4070
 kmalloc include/linux/slab.h:628 [inline]
 kzalloc include/linux/slab.h:749 [inline]
 vhci_open+0x57/0x370 drivers/bluetooth/hci_vhci.c:636
 misc_open+0x313/0x390 drivers/char/misc.c:165
 chrdev_open+0x5b0/0x630 fs/char_dev.c:414
 do_dentry_open+0x907/0x15a0 fs/open.c:955
 do_open fs/namei.c:3650 [inline]
 path_openat+0x2860/0x3240 fs/namei.c:3807
 do_filp_open+0x235/0x490 fs/namei.c:3834
 do_sys_openat2+0x13e/0x1d0 fs/open.c:1406
 do_sys_open fs/open.c:1421 [inline]
 __do_sys_openat fs/open.c:1437 [inline]
 __se_sys_openat fs/open.c:1432 [inline]
 __x64_sys_openat+0x247/0x2a0 fs/open.c:1432
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 8951:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
 poison_slab_object+0xa6/0xe0 mm/kasan/common.c:240
 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256
 kasan_slab_free include/linux/kasan.h:184 [inline]
 slab_free_hook mm/slub.c:2121 [inline]
 slab_free mm/slub.c:4353 [inline]
 kfree+0x153/0x3b0 mm/slub.c:4463
 vhci_release+0xbf/0xd0 drivers/bluetooth/hci_vhci.c:672
 __fput+0x429/0x8a0 fs/file_table.c:422
 task_work_run+0x24f/0x310 kernel/task_work.c:180
 exit_task_work include/linux/task_work.h:38 [inline]
 do_exit+0xa1b/0x27e0 kernel/exit.c:878
 do_group_exit+0x207/0x2c0 kernel/exit.c:1027
 __do_sys_exit_group kernel/exit.c:1038 [inline]
 __se_sys_exit_group kernel/exit.c:1036 [inline]
 __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1036
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff8880118db000
 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 88 bytes inside of
 freed 1024-byte region [ffff8880118db000, ffff8880118db400)

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x118d8
head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
anon flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000840 ffff888015041dc0 0000000000000000 dead000000000001
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
head: 00fff00000000840 ffff888015041dc0 0000000000000000 dead000000000001
head: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
head: 00fff00000000003 ffffea0000463601 dead000000000122 00000000ffffffff
head: 0000000800000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4793, tgid 4793 (dhcpcd), ts 31626179552, free_ts 31588472252
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1534
 prep_new_page mm/page_alloc.c:1541 [inline]
 get_page_from_freelist+0x3410/0x35b0 mm/page_alloc.c:3317
 __alloc_pages+0x256/0x6c0 mm/page_alloc.c:4575
 __alloc_pages_node include/linux/gfp.h:238 [inline]
 alloc_pages_node include/linux/gfp.h:261 [inline]
 alloc_slab_page+0x5f/0x160 mm/slub.c:2190
 allocate_slab mm/slub.c:2353 [inline]
 new_slab+0x84/0x2f0 mm/slub.c:2406
 ___slab_alloc+0xb07/0x12e0 mm/slub.c:3592
 __slab_alloc mm/slub.c:3682 [inline]
 __slab_alloc_node mm/slub.c:3735 [inline]
 slab_alloc_node mm/slub.c:3908 [inline]
 __do_kmalloc_node mm/slub.c:4038 [inline]
 __kmalloc+0x2e5/0x4a0 mm/slub.c:4052
 kmalloc include/linux/slab.h:632 [inline]
 load_elf_phdrs fs/binfmt_elf.c:526 [inline]
 load_elf_binary+0x2f4/0x2660 fs/binfmt_elf.c:855
 search_binary_handler fs/exec.c:1786 [inline]
 exec_binprm fs/exec.c:1828 [inline]
 bprm_execve+0xaf8/0x17c0 fs/exec.c:1880
 do_execveat_common+0x553/0x700 fs/exec.c:1987
 do_execve fs/exec.c:2061 [inline]
 __do_sys_execve fs/exec.c:2137 [inline]
 __se_sys_execve fs/exec.c:2132 [inline]
 __x64_sys_execve+0x92/0xb0 fs/exec.c:2132
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 4791 tgid 4791 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1141 [inline]
 free_unref_page_prepare+0x986/0xab0 mm/page_alloc.c:2347
 free_unref_page+0x37/0x3f0 mm/page_alloc.c:2487
 discard_slab mm/slub.c:2452 [inline]
 __put_partials+0xeb/0x130 mm/slub.c:2920
 put_cpu_partial+0x17c/0x250 mm/slub.c:2995
 __slab_free+0x2ea/0x3d0 mm/slub.c:4224
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x5e/0xc0 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x23/0x80 mm/kasan/common.c:322
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook mm/slub.c:3871 [inline]
 slab_alloc_node mm/slub.c:3918 [inline]
 kmem_cache_alloc+0x174/0x350 mm/slub.c:3925
 getname_flags+0xbd/0x4f0 fs/namei.c:139
 vfs_fstatat+0x11c/0x190 fs/stat.c:303
 __do_sys_newfstatat fs/stat.c:468 [inline]
 __se_sys_newfstatat fs/stat.c:462 [inline]
 __x64_sys_newfstatat+0x125/0x1b0 fs/stat.c:462
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff8880118daf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8880118daf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8880118db000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                    ^
 ffff8880118db080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8880118db100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in skb_queue_purge_reason (2)

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit:    40b8e93e17bf Add linux-next specific files for 20250204
git tree:       linux-next
console+strace: https://syzkaller.appspot.com/x/log.txt?x=113d5d18580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=ec880188a87c6aad
dashboard link: https://syzkaller.appspot.com/bug?extid=683f8cb11b94b1824c77
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=10b7eeb0580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=12f74f64580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ccdfef06f59f/disk-40b8e93e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/b339eaf8dcfd/vmlinux-40b8e93e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/ae1a0f1c3c80/bzImage-40b8e93e.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+683f8cb11b94b1824c77@syzkaller.appspotmail.com

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 UID: 0 PID: 5833 Comm: syz-executor346 Not tainted 6.14.0-rc1-next-20250204-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
RIP: 0010:skb_queue_empty_lockless include/linux/skbuff.h:1887 [inline]
RIP: 0010:skb_queue_purge_reason+0xaa/0x500 net/core/skbuff.c:3936
Code: 89 44 24 78 42 c6 44 30 13 f3 e8 81 76 05 f8 48 8d bc 24 b0 00 00 00 ba 48 00 00 00 31 f6 e8 0d f2 6b f8 4d 89 ef 49 c1 ef 03 <43> 80 3c 37 00 74 08 4c 89 ef e8 27 ef 6b f8 49 8b 45 00 4c 39 e8
RSP: 0018:ffffc90003d17880 EFLAGS: 00010202
RAX: ffffc90003d17930 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc90003d17978
RBP: ffffc90003d179f0 R08: ffffc90003d17977 R09: 0000000000000000
R10: ffffc90003d17930 R11: fffff520007a2f2f R12: dffffc0000000000
R13: 0000000000000008 R14: dffffc0000000000 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055867393d608 CR3: 000000000e738000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 skb_queue_purge include/linux/skbuff.h:3364 [inline]
 mrvl_close+0x8e/0x120 drivers/bluetooth/hci_mrvl.c:100
 hci_uart_tty_close+0x205/0x290 drivers/bluetooth/hci_ldisc.c:557
 tty_ldisc_kill+0xa3/0x1a0 drivers/tty/tty_ldisc.c:613
 tty_ldisc_release+0x1a1/0x200 drivers/tty/tty_ldisc.c:781
 tty_release_struct+0x2b/0xe0 drivers/tty/tty_io.c:1690
 tty_release+0xd06/0x12c0 drivers/tty/tty_io.c:1861
 __fput+0x3e9/0x9f0 fs/file_table.c:448
 task_work_run+0x24f/0x310 kernel/task_work.c:227
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0xa2a/0x28e0 kernel/exit.c:938
 do_group_exit+0x207/0x2c0 kernel/exit.c:1087
 __do_sys_exit_group kernel/exit.c:1098 [inline]
 __se_sys_exit_group kernel/exit.c:1096 [inline]
 __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1096
 x64_sys_call+0x26a8/0x26b0 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f794f6cfc79
Code: Unable to access opcode bytes at 0x7f794f6cfc4f.
RSP: 002b:00007fff04322488 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f794f6cfc79
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
RBP: 00007f794f74a270 R08: ffffffffffffffb8 R09: 00007fff043226a8
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f794f74a270
R13: 0000000000000000 R14: 00007f794f74acc0 R15: 00007f794f6a1a60
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:skb_queue_empty_lockless include/linux/skbuff.h:1887 [inline]
RIP: 0010:skb_queue_purge_reason+0xaa/0x500 net/core/skbuff.c:3936
Code: 89 44 24 78 42 c6 44 30 13 f3 e8 81 76 05 f8 48 8d bc 24 b0 00 00 00 ba 48 00 00 00 31 f6 e8 0d f2 6b f8 4d 89 ef 49 c1 ef 03 <43> 80 3c 37 00 74 08 4c 89 ef e8 27 ef 6b f8 49 8b 45 00 4c 39 e8
RSP: 0018:ffffc90003d17880 EFLAGS: 00010202
RAX: ffffc90003d17930 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc90003d17978
RBP: ffffc90003d179f0 R08: ffffc90003d17977 R09: 0000000000000000
R10: ffffc90003d17930 R11: fffff520007a2f2f R12: dffffc0000000000
R13: 0000000000000008 R14: dffffc0000000000 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055867393d608 CR3: 000000000e738000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	89 44 24 78          	mov    %eax,0x78(%rsp)
   4:	42 c6 44 30 13 f3    	movb   $0xf3,0x13(%rax,%r14,1)
   a:	e8 81 76 05 f8       	call   0xf8057690
   f:	48 8d bc 24 b0 00 00 	lea    0xb0(%rsp),%rdi
  16:	00
  17:	ba 48 00 00 00       	mov    $0x48,%edx
  1c:	31 f6                	xor    %esi,%esi
  1e:	e8 0d f2 6b f8       	call   0xf86bf230
  23:	4d 89 ef             	mov    %r13,%r15
  26:	49 c1 ef 03          	shr    $0x3,%r15
* 2a:	43 80 3c 37 00       	cmpb   $0x0,(%r15,%r14,1) <-- trapping instruction
  2f:	74 08                	je     0x39
  31:	4c 89 ef             	mov    %r13,%rdi
  34:	e8 27 ef 6b f8       	call   0xf86bef60
  39:	49 8b 45 00          	mov    0x0(%r13),%rax
  3d:	4c 39 e8             	cmp    %r13,%rax


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in skb_queue_purge_reason (2)

[syzbot]

syzbot has bisected this issue to:

commit c411c62cc13319533b1861e00cedc4883c3bc1bb
Author: Arseniy Krasnov <avkrasnov@salutedevices.com>
Date:   Thu Jan 30 18:43:26 2025 +0000

    Bluetooth: hci_uart: fix race during initialization

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=116cebdf980000
start commit:   40b8e93e17bf Add linux-next specific files for 20250204
git tree:       linux-next
final oops:     https://syzkaller.appspot.com/x/report.txt?x=136cebdf980000
console output: https://syzkaller.appspot.com/x/log.txt?x=156cebdf980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=ec880188a87c6aad
dashboard link: https://syzkaller.appspot.com/bug?extid=683f8cb11b94b1824c77
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=10b7eeb0580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=12f74f64580000

Reported-by: syzbot+683f8cb11b94b1824c77@syzkaller.appspotmail.com
Fixes: c411c62cc133 ("Bluetooth: hci_uart: fix race during initialization")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

Re: [DMARC error] Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in skb_queue_purge_reason (2)

[Arseniy Krasnov]

Hi, I guess problem here is that, if hci_uart_tty_close() will be called between
setting HCI_UART_PROTO_READY and skb_queue_head_init(), in that case mrvl_close()
will access uninitialized data.

hci_uart_set_proto() {
        ...
        set_bit(HCI_UART_PROTO_READY, &hu->flags);
                                                   
        err = hci_uart_register_dev(hu);
                mrvl_open()
                    skb_queue_head_init();

        if (err) {
                return err;
        }
        ...
}

Thanks

On 10.02.2025 14:26, syzbot wrote:
> syzbot has bisected this issue to:
> 
> commit c411c62cc13319533b1861e00cedc4883c3bc1bb
> Author: Arseniy Krasnov <avkrasnov@salutedevices.com>
> Date:   Thu Jan 30 18:43:26 2025 +0000
> 
>     Bluetooth: hci_uart: fix race during initialization
> 
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=116cebdf980000
> start commit:   40b8e93e17bf Add linux-next specific files for 20250204
> git tree:       linux-next
> final oops:     https://syzkaller.appspot.com/x/report.txt?x=136cebdf980000
> console output: https://syzkaller.appspot.com/x/log.txt?x=156cebdf980000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=ec880188a87c6aad
> dashboard link: https://syzkaller.appspot.com/bug?extid=683f8cb11b94b1824c77
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=10b7eeb0580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=12f74f64580000
> 
> Reported-by: syzbot+683f8cb11b94b1824c77@syzkaller.appspotmail.com
> Fixes: c411c62cc133 ("Bluetooth: hci_uart: fix race during initialization")
> 
> For information about bisection process see: https://goo.gl/tpsmEJ#bisection

Re: [DMARC error] Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in skb_queue_purge_reason (2)

[Arseniy Krasnov]

May be my previous version was free of this problem ?

https://lore.kernel.org/linux-bluetooth/a1db0c90-1803-e01c-3e23-d18e4343a4eb@salutedevices.com/

Thanks

On 11.02.2025 17:16, Arseniy Krasnov wrote:
> Hi, I guess problem here is that, if hci_uart_tty_close() will be called between
> setting HCI_UART_PROTO_READY and skb_queue_head_init(), in that case mrvl_close()
> will access uninitialized data.
> 
> hci_uart_set_proto() {
>         ...
>         set_bit(HCI_UART_PROTO_READY, &hu->flags);
>                                                    
>         err = hci_uart_register_dev(hu);
>                 mrvl_open()
>                     skb_queue_head_init();
> 
>         if (err) {
>                 return err;
>         }
>         ...
> }
> 
> Thanks
> 
> On 10.02.2025 14:26, syzbot wrote:
>> syzbot has bisected this issue to:
>>
>> commit c411c62cc13319533b1861e00cedc4883c3bc1bb
>> Author: Arseniy Krasnov <avkrasnov@salutedevices.com>
>> Date:   Thu Jan 30 18:43:26 2025 +0000
>>
>>     Bluetooth: hci_uart: fix race during initialization
>>
>> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=116cebdf980000
>> start commit:   40b8e93e17bf Add linux-next specific files for 20250204
>> git tree:       linux-next
>> final oops:     https://syzkaller.appspot.com/x/report.txt?x=136cebdf980000
>> console output: https://syzkaller.appspot.com/x/log.txt?x=156cebdf980000
>> kernel config:  https://syzkaller.appspot.com/x/.config?x=ec880188a87c6aad
>> dashboard link: https://syzkaller.appspot.com/bug?extid=683f8cb11b94b1824c77
>> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=10b7eeb0580000
>> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=12f74f64580000
>>
>> Reported-by: syzbot+683f8cb11b94b1824c77@syzkaller.appspotmail.com
>> Fixes: c411c62cc133 ("Bluetooth: hci_uart: fix race during initialization")
>>
>> For information about bisection process see: https://goo.gl/tpsmEJ#bisection

Re: [DMARC error] Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in skb_queue_purge_reason (2)

[Luiz Augusto von Dentz]

Hi Arseniy,

On Tue, Feb 11, 2025 at 11:22 AM Arseniy Krasnov
<avkrasnov@salutedevices.com> wrote:
>
> May be my previous version was free of this problem ?
>
> https://lore.kernel.org/linux-bluetooth/a1db0c90-1803-e01c-3e23-d18e4343a4eb@salutedevices.com/

You can try sending it to
syzbot+683f8cb11b94b1824c77@syzkaller.appspotmail.com to check if that
works.

> Thanks
>
> On 11.02.2025 17:16, Arseniy Krasnov wrote:
> > Hi, I guess problem here is that, if hci_uart_tty_close() will be called between
> > setting HCI_UART_PROTO_READY and skb_queue_head_init(), in that case mrvl_close()
> > will access uninitialized data.
> >
> > hci_uart_set_proto() {
> >         ...
> >         set_bit(HCI_UART_PROTO_READY, &hu->flags);
> >
> >         err = hci_uart_register_dev(hu);
> >                 mrvl_open()
> >                     skb_queue_head_init();

Or we follow what the likes of hci_uart_register_device_priv, in fact
we may want to take the time to clean this up, afaik the ldisc is
deprecated and serdev shall be used instead, in any case if we can't
just remove ldisc version then at very least they shall be using the
same flow when it comes to hci_register_dev since the share the same
struct hci_uart.

> >         if (err) {
> >                 return err;
> >         }
> >         ...
> > }
> >
> > Thanks
> >
> > On 10.02.2025 14:26, syzbot wrote:
> >> syzbot has bisected this issue to:
> >>
> >> commit c411c62cc13319533b1861e00cedc4883c3bc1bb
> >> Author: Arseniy Krasnov <avkrasnov@salutedevices.com>
> >> Date:   Thu Jan 30 18:43:26 2025 +0000
> >>
> >>     Bluetooth: hci_uart: fix race during initialization
> >>
> >> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=116cebdf980000
> >> start commit:   40b8e93e17bf Add linux-next specific files for 20250204
> >> git tree:       linux-next
> >> final oops:     https://syzkaller.appspot.com/x/report.txt?x=136cebdf980000
> >> console output: https://syzkaller.appspot.com/x/log.txt?x=156cebdf980000
> >> kernel config:  https://syzkaller.appspot.com/x/.config?x=ec880188a87c6aad
> >> dashboard link: https://syzkaller.appspot.com/bug?extid=683f8cb11b94b1824c77
> >> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=10b7eeb0580000
> >> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=12f74f64580000
> >>
> >> Reported-by: syzbot+683f8cb11b94b1824c77@syzkaller.appspotmail.com
> >> Fixes: c411c62cc133 ("Bluetooth: hci_uart: fix race during initialization")
> >>
> >> For information about bisection process see: https://goo.gl/tpsmEJ#bisection



-- 
Luiz Augusto von Dentz

Re: [DMARC error] Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in skb_queue_purge_reason (2)

[Arseniy Krasnov]

On 11.02.2025 19:51, Luiz Augusto von Dentz wrote:
> Hi Arseniy,
> 
> On Tue, Feb 11, 2025 at 11:22 AM Arseniy Krasnov
> <avkrasnov@salutedevices.com> wrote:
>>
>> May be my previous version was free of this problem ?
>>
>> https://lore.kernel.org/linux-bluetooth/a1db0c90-1803-e01c-3e23-d18e4343a4eb@salutedevices.com/
> 
> You can try sending it to
> syzbot+683f8cb11b94b1824c77@syzkaller.appspotmail.com to check if that
> works.

Ok, I'll send it. I think that even this logic is deprecated, it is better to
keep it without bugs (even if fix is not elegant).

Thanks

> 
>> Thanks
>>
>> On 11.02.2025 17:16, Arseniy Krasnov wrote:
>>> Hi, I guess problem here is that, if hci_uart_tty_close() will be called between
>>> setting HCI_UART_PROTO_READY and skb_queue_head_init(), in that case mrvl_close()
>>> will access uninitialized data.
>>>
>>> hci_uart_set_proto() {
>>>         ...
>>>         set_bit(HCI_UART_PROTO_READY, &hu->flags);
>>>
>>>         err = hci_uart_register_dev(hu);
>>>                 mrvl_open()
>>>                     skb_queue_head_init();
> 
> Or we follow what the likes of hci_uart_register_device_priv, in fact
> we may want to take the time to clean this up, afaik the ldisc is
> deprecated and serdev shall be used instead, in any case if we can't
> just remove ldisc version then at very least they shall be using the
> same flow when it comes to hci_register_dev since the share the same
> struct hci_uart.
> 
>>>         if (err) {
>>>                 return err;
>>>         }
>>>         ...
>>> }
>>>
>>> Thanks
>>>
>>> On 10.02.2025 14:26, syzbot wrote:
>>>> syzbot has bisected this issue to:
>>>>
>>>> commit c411c62cc13319533b1861e00cedc4883c3bc1bb
>>>> Author: Arseniy Krasnov <avkrasnov@salutedevices.com>
>>>> Date:   Thu Jan 30 18:43:26 2025 +0000
>>>>
>>>>     Bluetooth: hci_uart: fix race during initialization
>>>>
>>>> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=116cebdf980000
>>>> start commit:   40b8e93e17bf Add linux-next specific files for 20250204
>>>> git tree:       linux-next
>>>> final oops:     https://syzkaller.appspot.com/x/report.txt?x=136cebdf980000
>>>> console output: https://syzkaller.appspot.com/x/log.txt?x=156cebdf980000
>>>> kernel config:  https://syzkaller.appspot.com/x/.config?x=ec880188a87c6aad
>>>> dashboard link: https://syzkaller.appspot.com/bug?extid=683f8cb11b94b1824c77
>>>> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=10b7eeb0580000
>>>> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=12f74f64580000
>>>>
>>>> Reported-by: syzbot+683f8cb11b94b1824c77@syzkaller.appspotmail.com
>>>> Fixes: c411c62cc133 ("Bluetooth: hci_uart: fix race during initialization")
>>>>
>>>> For information about bisection process see: https://goo.gl/tpsmEJ#bisection
> 
> 
>