LKML Archive mirror
 help / color / mirror / Atom feed
* [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
@ 2024-06-24 20:23 syzbot
  2024-09-07 14:42 ` syzbot
                   ` (2 more replies)
  0 siblings, 3 replies; 44+ messages in thread
From: syzbot @ 2024-06-24 20:23 UTC (permalink / raw)
  To: johan.hedberg, linux-bluetooth, linux-kernel, luiz.dentz, marcel,
	syzkaller-bugs

Hello,

syzbot found the following issue on:

HEAD commit:    5f583a3162ff Merge tag 'rust-fixes-6.10' of https://github..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11170741980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=f413acf5b1eb4093
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f530c7950839/disk-5f583a31.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/b4f810bbc13e/vmlinux-5f583a31.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a49ec6dadbad/bzImage-5f583a31.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c12e2f941af1feb5632c@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: slab-use-after-free in l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949
Read of size 8 at addr ffff88802af53000 by task kworker/u9:4/5114

CPU: 1 PID: 5114 Comm: kworker/u9:4 Not tainted 6.10.0-rc4-syzkaller-00301-g5f583a3162ff #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Workqueue: hci1 hci_rx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0xc3/0x620 mm/kasan/report.c:488
 kasan_report+0xd9/0x110 mm/kasan/report.c:601
 l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949
 l2cap_connect_req net/bluetooth/l2cap_core.c:4080 [inline]
 l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4772 [inline]
 l2cap_sig_channel net/bluetooth/l2cap_core.c:5543 [inline]
 l2cap_recv_frame+0xf07/0x8e50 net/bluetooth/l2cap_core.c:6821
 l2cap_recv_acldata+0x9ac/0xb60 net/bluetooth/l2cap_core.c:7510
 hci_acldata_packet net/bluetooth/hci_core.c:3842 [inline]
 hci_rx_work+0xaa7/0x1610 net/bluetooth/hci_core.c:4079
 process_one_work+0x9fb/0x1b60 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>

Allocated by task 4480:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:387
 kmalloc_noprof include/linux/slab.h:660 [inline]
 kzalloc_noprof include/linux/slab.h:778 [inline]
 l2cap_conn_add.part.0+0x60/0xa60 net/bluetooth/l2cap_core.c:6864
 l2cap_conn_add net/bluetooth/l2cap_core.c:69 [inline]
 l2cap_connect_cfm+0x428/0xf80 net/bluetooth/l2cap_core.c:7241
 hci_connect_cfm include/net/bluetooth/hci_core.h:1970 [inline]
 hci_remote_features_evt+0x548/0x9e0 net/bluetooth/hci_event.c:3721
 hci_event_func net/bluetooth/hci_event.c:7417 [inline]
 hci_event_packet+0x9e3/0x1170 net/bluetooth/hci_event.c:7469
 hci_rx_work+0x2c4/0x1610 net/bluetooth/hci_core.c:4074
 process_one_work+0x9fb/0x1b60 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Freed by task 5112:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
 poison_slab_object+0xf7/0x160 mm/kasan/common.c:240
 __kasan_slab_free+0x32/0x50 mm/kasan/common.c:256
 kasan_slab_free include/linux/kasan.h:184 [inline]
 slab_free_hook mm/slub.c:2196 [inline]
 slab_free mm/slub.c:4437 [inline]
 kfree+0x12a/0x3b0 mm/slub.c:4558
 l2cap_conn_free net/bluetooth/l2cap_core.c:1810 [inline]
 kref_put include/linux/kref.h:65 [inline]
 l2cap_conn_put net/bluetooth/l2cap_core.c:1822 [inline]
 l2cap_conn_del+0x59d/0x740 net/bluetooth/l2cap_core.c:1802
 l2cap_connect_cfm+0x9e6/0xf80 net/bluetooth/l2cap_core.c:7237
 hci_connect_cfm include/net/bluetooth/hci_core.h:1970 [inline]
 hci_conn_failed+0x1c3/0x370 net/bluetooth/hci_conn.c:1257
 hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5450
 abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2909
 hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:310
 process_one_work+0x9fb/0x1b60 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Last potentially related work creation:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 __kasan_record_aux_stack+0xba/0xd0 mm/kasan/generic.c:541
 insert_work+0x36/0x230 kernel/workqueue.c:2207
 __queue_work+0x944/0x1020 kernel/workqueue.c:2359
 call_timer_fn+0x1a0/0x610 kernel/time/timer.c:1792
 expire_timers kernel/time/timer.c:1838 [inline]
 __run_timers+0x567/0xaf0 kernel/time/timer.c:2417
 __run_timer_base kernel/time/timer.c:2428 [inline]
 __run_timer_base kernel/time/timer.c:2421 [inline]
 run_timer_base+0x111/0x190 kernel/time/timer.c:2437
 run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2447
 handle_softirqs+0x216/0x8f0 kernel/softirq.c:554
 __do_softirq kernel/softirq.c:588 [inline]
 invoke_softirq kernel/softirq.c:428 [inline]
 __irq_exit_rcu kernel/softirq.c:637 [inline]
 irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
 sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1043
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702

Second to last potentially related work creation:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 __kasan_record_aux_stack+0xba/0xd0 mm/kasan/generic.c:541
 insert_work+0x36/0x230 kernel/workqueue.c:2207
 __queue_work+0x525/0x1020 kernel/workqueue.c:2363
 queue_work_on+0x11a/0x140 kernel/workqueue.c:2410
 queue_work include/linux/workqueue.h:621 [inline]
 l2cap_conn_ready net/bluetooth/l2cap_core.c:1640 [inline]
 l2cap_connect_cfm+0x9c9/0xf80 net/bluetooth/l2cap_core.c:7282
 hci_connect_cfm include/net/bluetooth/hci_core.h:1970 [inline]
 hci_remote_features_evt+0x548/0x9e0 net/bluetooth/hci_event.c:3721
 hci_event_func net/bluetooth/hci_event.c:7417 [inline]
 hci_event_packet+0x9e3/0x1170 net/bluetooth/hci_event.c:7469
 hci_rx_work+0x2c4/0x1610 net/bluetooth/hci_core.c:4074
 process_one_work+0x9fb/0x1b60 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

The buggy address belongs to the object at ffff88802af53000
 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 0 bytes inside of
 freed 1024-byte region [ffff88802af53000, ffff88802af53400)

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2af50
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffefff(slab)
raw: 00fff00000000040 ffff888015441dc0 0000000000000000 dead000000000001
raw: 0000000000000000 0000000000100010 00000001ffffefff 0000000000000000
head: 00fff00000000040 ffff888015441dc0 0000000000000000 dead000000000001
head: 0000000000000000 0000000000100010 00000001ffffefff 0000000000000000
head: 00fff00000000003 ffffea0000abd401 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4752, tgid 4752 (dhcpcd), ts 66098690934, free_ts 66038999175
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1468
 prep_new_page mm/page_alloc.c:1476 [inline]
 get_page_from_freelist+0x136a/0x2e50 mm/page_alloc.c:3420
 __alloc_pages_noprof+0x22b/0x2460 mm/page_alloc.c:4678
 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
 alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
 alloc_slab_page+0x56/0x110 mm/slub.c:2265
 allocate_slab mm/slub.c:2428 [inline]
 new_slab+0x84/0x260 mm/slub.c:2481
 ___slab_alloc+0xdac/0x1870 mm/slub.c:3667
 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3757
 __slab_alloc_node mm/slub.c:3810 [inline]
 slab_alloc_node mm/slub.c:3989 [inline]
 __do_kmalloc_node mm/slub.c:4121 [inline]
 kmalloc_node_track_caller_noprof+0x355/0x430 mm/slub.c:4142
 kmemdup_noprof+0x29/0x60 mm/util.c:131
 kmemdup_noprof include/linux/fortify-string.h:757 [inline]
 bpf_migrate_filter+0xc6/0x390 net/core/filter.c:1268
 bpf_prepare_filter+0x183/0x380 net/core/filter.c:1354
 bpf_prog_create_from_user+0x1e4/0x2d0 net/core/filter.c:1448
 seccomp_prepare_filter kernel/seccomp.c:680 [inline]
 seccomp_prepare_user_filter kernel/seccomp.c:717 [inline]
 seccomp_set_mode_filter kernel/seccomp.c:1935 [inline]
 do_seccomp+0x7b6/0x2580 kernel/seccomp.c:2055
 prctl_set_seccomp+0x4b/0x70 kernel/seccomp.c:2108
 __do_sys_prctl+0xc83/0x1e40 kernel/sys.c:2539
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
page last free pid 4747 tgid 4747 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1088 [inline]
 free_unref_page+0x64a/0xe40 mm/page_alloc.c:2583
 __put_partials+0x14c/0x170 mm/slub.c:2995
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x4e/0x140 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:322
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook mm/slub.c:3941 [inline]
 slab_alloc_node mm/slub.c:4001 [inline]
 kmem_cache_alloc_lru_noprof+0x121/0x2f0 mm/slub.c:4020
 shmem_alloc_inode+0x25/0x50 mm/shmem.c:4468
 alloc_inode+0x5d/0x230 fs/inode.c:261
 new_inode_pseudo fs/inode.c:1007 [inline]
 new_inode+0x22/0x270 fs/inode.c:1033
 __shmem_get_inode mm/shmem.c:2503 [inline]
 shmem_get_inode+0x194/0xe80 mm/shmem.c:2574
 shmem_mknod+0x66/0x240 mm/shmem.c:3268
 shmem_mkdir+0x31/0x60 mm/shmem.c:3329
 vfs_mkdir+0x57d/0x860 fs/namei.c:4131
 do_mkdirat+0x301/0x3a0 fs/namei.c:4154
 __do_sys_mkdir fs/namei.c:4174 [inline]
 __se_sys_mkdir fs/namei.c:4172 [inline]
 __x64_sys_mkdir+0xf1/0x140 fs/namei.c:4172
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83

Memory state around the buggy address:
 ffff88802af52f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88802af52f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88802af53000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff88802af53080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88802af53100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

^ permalink raw reply	[flat|nested] 44+ messages in thread

* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
  2024-06-24 20:23 [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2) syzbot
@ 2024-09-07 14:42 ` syzbot
  2024-09-08  0:01   ` Hillf Danton
                     ` (14 more replies)
  2024-09-10 18:43 ` syzbot
  2024-09-23 16:13 ` [syzbot] Re: [PATCH] Bluetooth/l2cap: Fix uaf in l2cap_connect syzbot
  2 siblings, 15 replies; 44+ messages in thread
From: syzbot @ 2024-09-07 14:42 UTC (permalink / raw)
  To: johan.hedberg, linux-bluetooth, linux-kernel, luiz.dentz, marcel,
	syzkaller-bugs

syzbot has found a reproducer for the following issue on:

HEAD commit:    788220eee30d Merge tag 'pm-6.11-rc7' of git://git.kernel.o..
git tree:       upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=10502bc7980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11da6f29980000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1304189f980000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e618b7c8e5a2/disk-788220ee.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/333bb524a2ba/vmlinux-788220ee.xz
kernel image: https://storage.googleapis.com/syzbot-assets/ad1779f24bb2/bzImage-788220ee.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c12e2f941af1feb5632c@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: slab-use-after-free in l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949
Read of size 8 at addr ffff8880241e9800 by task kworker/u9:0/54

CPU: 0 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.11.0-rc6-syzkaller-00268-g788220eee30d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: hci2 hci_rx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:93 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0xc3/0x620 mm/kasan/report.c:488
 kasan_report+0xd9/0x110 mm/kasan/report.c:601
 l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949
 l2cap_connect_req net/bluetooth/l2cap_core.c:4080 [inline]
 l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4772 [inline]
 l2cap_sig_channel net/bluetooth/l2cap_core.c:5543 [inline]
 l2cap_recv_frame+0xf0b/0x8eb0 net/bluetooth/l2cap_core.c:6825
 l2cap_recv_acldata+0x9b4/0xb70 net/bluetooth/l2cap_core.c:7514
 hci_acldata_packet net/bluetooth/hci_core.c:3791 [inline]
 hci_rx_work+0xaab/0x1610 net/bluetooth/hci_core.c:4028
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>

Allocated by task 5253:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:387
 kmalloc_noprof include/linux/slab.h:681 [inline]
 kzalloc_noprof include/linux/slab.h:807 [inline]
 l2cap_conn_add.part.0+0x60/0xa60 net/bluetooth/l2cap_core.c:6868
 l2cap_conn_add net/bluetooth/l2cap_core.c:69 [inline]
 l2cap_connect_cfm+0x428/0xf80 net/bluetooth/l2cap_core.c:7245
 hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
 hci_remote_features_evt+0x548/0x9e0 net/bluetooth/hci_event.c:3721
 hci_event_func net/bluetooth/hci_event.c:7446 [inline]
 hci_event_packet+0x9eb/0x1180 net/bluetooth/hci_event.c:7498
 hci_rx_work+0x2c6/0x1610 net/bluetooth/hci_core.c:4023
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Freed by task 5245:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
 poison_slab_object+0xf7/0x160 mm/kasan/common.c:240
 __kasan_slab_free+0x32/0x50 mm/kasan/common.c:256
 kasan_slab_free include/linux/kasan.h:184 [inline]
 slab_free_hook mm/slub.c:2256 [inline]
 slab_free mm/slub.c:4477 [inline]
 kfree+0x12a/0x3b0 mm/slub.c:4598
 l2cap_conn_free net/bluetooth/l2cap_core.c:1810 [inline]
 kref_put include/linux/kref.h:65 [inline]
 l2cap_conn_put net/bluetooth/l2cap_core.c:1822 [inline]
 l2cap_conn_del+0x59d/0x730 net/bluetooth/l2cap_core.c:1802
 l2cap_connect_cfm+0x9e6/0xf80 net/bluetooth/l2cap_core.c:7241
 hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
 hci_conn_failed+0x1c3/0x370 net/bluetooth/hci_conn.c:1265
 hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583
 abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2917
 hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Last potentially related work creation:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 __kasan_record_aux_stack+0xba/0xd0 mm/kasan/generic.c:541
 insert_work+0x36/0x230 kernel/workqueue.c:2185
 __queue_work+0x97e/0x1070 kernel/workqueue.c:2341
 call_timer_fn+0x1a0/0x610 kernel/time/timer.c:1792
 expire_timers kernel/time/timer.c:1838 [inline]
 __run_timers+0x567/0xaf0 kernel/time/timer.c:2417
 __run_timer_base kernel/time/timer.c:2428 [inline]
 __run_timer_base kernel/time/timer.c:2421 [inline]
 run_timer_base+0x111/0x190 kernel/time/timer.c:2437
 run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2447
 handle_softirqs+0x216/0x8f0 kernel/softirq.c:554
 __do_softirq kernel/softirq.c:588 [inline]
 invoke_softirq kernel/softirq.c:428 [inline]
 __irq_exit_rcu kernel/softirq.c:637 [inline]
 irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
 sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1043
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702

Second to last potentially related work creation:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 __kasan_record_aux_stack+0xba/0xd0 mm/kasan/generic.c:541
 insert_work+0x36/0x230 kernel/workqueue.c:2185
 __queue_work+0x3f8/0x1070 kernel/workqueue.c:2345
 queue_work_on+0x11a/0x140 kernel/workqueue.c:2392
 queue_work include/linux/workqueue.h:621 [inline]
 l2cap_conn_ready net/bluetooth/l2cap_core.c:1640 [inline]
 l2cap_connect_cfm+0x9c9/0xf80 net/bluetooth/l2cap_core.c:7286
 hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
 hci_remote_features_evt+0x548/0x9e0 net/bluetooth/hci_event.c:3721
 hci_event_func net/bluetooth/hci_event.c:7446 [inline]
 hci_event_packet+0x9eb/0x1180 net/bluetooth/hci_event.c:7498
 hci_rx_work+0x2c6/0x1610 net/bluetooth/hci_core.c:4023
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

The buggy address belongs to the object at ffff8880241e9800
 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 0 bytes inside of
 freed 1024-byte region [ffff8880241e9800, ffff8880241e9c00)

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x241e8
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xfdffffff(slab)
raw: 00fff00000000040 ffff88801ac41dc0 ffffea00007cac00 dead000000000002
raw: 0000000000000000 0000000000100010 00000001fdffffff 0000000000000000
head: 00fff00000000040 ffff88801ac41dc0 ffffea00007cac00 dead000000000002
head: 0000000000000000 0000000000100010 00000001fdffffff 0000000000000000
head: 00fff00000000003 ffffea0000907a01 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4642, tgid 4642 (init), ts 27796307015, free_ts 0
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1500
 prep_new_page mm/page_alloc.c:1508 [inline]
 get_page_from_freelist+0x1351/0x2e50 mm/page_alloc.c:3446
 __alloc_pages_noprof+0x22b/0x2460 mm/page_alloc.c:4702
 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
 alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
 alloc_slab_page+0x4e/0xf0 mm/slub.c:2325
 allocate_slab mm/slub.c:2488 [inline]
 new_slab+0x84/0x260 mm/slub.c:2541
 ___slab_alloc+0xdac/0x1870 mm/slub.c:3727
 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3817
 __slab_alloc_node mm/slub.c:3870 [inline]
 slab_alloc_node mm/slub.c:4029 [inline]
 __do_kmalloc_node mm/slub.c:4161 [inline]
 __kmalloc_noprof+0x367/0x400 mm/slub.c:4174
 kmalloc_noprof include/linux/slab.h:685 [inline]
 kzalloc_noprof include/linux/slab.h:807 [inline]
 tomoyo_init_log+0x13ca/0x2180 security/tomoyo/audit.c:275
 tomoyo_supervisor+0x30c/0xea0 security/tomoyo/common.c:2089
 tomoyo_audit_env_log security/tomoyo/environ.c:36 [inline]
 tomoyo_env_perm+0x193/0x210 security/tomoyo/environ.c:63
 tomoyo_environ security/tomoyo/domain.c:672 [inline]
 tomoyo_find_next_domain+0xef9/0x2020 security/tomoyo/domain.c:878
 tomoyo_bprm_check_security security/tomoyo/tomoyo.c:102 [inline]
 tomoyo_bprm_check_security+0x12e/0x1d0 security/tomoyo/tomoyo.c:92
 security_bprm_check+0x65/0xb0 security/security.c:1191
 search_binary_handler fs/exec.c:1815 [inline]
 exec_binprm fs/exec.c:1869 [inline]
 bprm_execve fs/exec.c:1920 [inline]
 bprm_execve+0x642/0x1960 fs/exec.c:1896
 do_execveat_common.isra.0+0x4f1/0x630 fs/exec.c:2027
page_owner free stack trace missing

Memory state around the buggy address:
 ffff8880241e9700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8880241e9780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8880241e9800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff8880241e9880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8880241e9900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

^ permalink raw reply	[flat|nested] 44+ messages in thread

* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
  2024-09-07 14:42 ` syzbot
@ 2024-09-08  0:01   ` Hillf Danton
  2024-09-08  0:24     ` syzbot
  2024-09-08  1:28   ` Edward Adam Davis
                     ` (13 subsequent siblings)
  14 siblings, 1 reply; 44+ messages in thread
From: Hillf Danton @ 2024-09-08  0:01 UTC (permalink / raw)
  To: syzbot; +Cc: linux-kernel, syzkaller-bugs

On Sat, 07 Sep 2024 07:42:26 -0700
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    788220eee30d Merge tag 'pm-6.11-rc7' of git://git.kernel.o..
> git tree:       upstream
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1304189f980000

#syz test

--- l/net/bluetooth/l2cap_core.c
+++ c/net/bluetooth/l2cap_core.c
@@ -1797,6 +1797,7 @@ static void l2cap_conn_del(struct hci_co
 	if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
 		cancel_delayed_work_sync(&conn->info_timer);
 
+	cancel_work_sync(&hcon->hdev->rx_work);
 	hcon->l2cap_data = NULL;
 	conn->hchan = NULL;
 	l2cap_conn_put(conn);
--

^ permalink raw reply	[flat|nested] 44+ messages in thread

* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
  2024-09-08  0:01   ` Hillf Danton
@ 2024-09-08  0:24     ` syzbot
  0 siblings, 0 replies; 44+ messages in thread
From: syzbot @ 2024-09-08  0:24 UTC (permalink / raw)
  To: hdanton, linux-kernel, syzkaller-bugs

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
possible deadlock in hci_conn_failed

======================================================
WARNING: possible circular locking dependency detected
6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0 Not tainted
------------------------------------------------------
kworker/u9:5/5970 is trying to acquire lock:
ffff888032308aa0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: touch_work_lockdep_map kernel/workqueue.c:3890 [inline]
ffff888032308aa0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: start_flush_work kernel/workqueue.c:4144 [inline]
ffff888032308aa0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: __flush_work+0x46d/0xc30 kernel/workqueue.c:4176

but task is already holding lock:
ffffffff8fc9caa8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1957 [inline]
ffffffff8fc9caa8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_failed+0x158/0x370 net/bluetooth/hci_conn.c:1265

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #2 (hci_cb_list_lock){+.+.}-{3:3}
:
       __mutex_lock_common kernel/locking/mutex.c:608 [inline]
       __mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
       hci_connect_cfm include/net/bluetooth/hci_core.h:1957 [inline]
       hci_remote_features_evt+0x4dc/0x9e0 net/bluetooth/hci_event.c:3721
       hci_event_func net/bluetooth/hci_event.c:7446 [inline]
       hci_event_packet+0x9eb/0x1180 net/bluetooth/hci_event.c:7498
       hci_rx_work+0x2c6/0x1610 net/bluetooth/hci_core.c:4023
       process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
       process_scheduled_works kernel/workqueue.c:3312 [inline]
       worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
       kthread+0x2c1/0x3a0 kernel/kthread.c:389
       ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

-> #1 (&hdev->lock){+.+.}-{3:3}:
       __mutex_lock_common kernel/locking/mutex.c:608 [inline]
       __mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
       hci_store_wake_reason net/bluetooth/hci_event.c:7191 [inline]
       hci_event_packet+0x323/0x1180 net/bluetooth/hci_event.c:7494
       hci_rx_work+0x2c6/0x1610 net/bluetooth/hci_core.c:4023
       process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
       process_scheduled_works kernel/workqueue.c:3312 [inline]
       worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
       kthread+0x2c1/0x3a0 kernel/kthread.c:389
       ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

-> #0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}:
       check_prev_add kernel/locking/lockdep.c:3133 [inline]
       check_prevs_add kernel/locking/lockdep.c:3252 [inline]
       validate_chain kernel/locking/lockdep.c:3868 [inline]
       __lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142
       lock_acquire kernel/locking/lockdep.c:5759 [inline]
       lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
       touch_work_lockdep_map kernel/workqueue.c:3890 [inline]
       start_flush_work kernel/workqueue.c:4144 [inline]
       __flush_work+0x477/0xc30 kernel/workqueue.c:4176
       __cancel_work_sync+0x10c/0x130 kernel/workqueue.c:4332
       l2cap_conn_del+0x4a6/0x760 net/bluetooth/l2cap_core.c:1800
       l2cap_connect_cfm+0x9e6/0xf80 net/bluetooth/l2cap_core.c:7242
       hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
       hci_conn_failed+0x1c3/0x370 net/bluetooth/hci_conn.c:1265
       hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583
       abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2917
       hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328
       process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
       process_scheduled_works kernel/workqueue.c:3312 [inline]
       worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
       kthread+0x2c1/0x3a0 kernel/kthread.c:389
       ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

other info that might help us debug this:

Chain exists of:
  (work_completion)(&hdev->rx_work) --> &hdev->lock --> hci_cb_list_lock

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(hci_cb_list_lock);
                               lock(&hdev->lock);
                               lock(hci_cb_list_lock);
  lock((work_completion)(&hdev->rx_work));

 *** DEADLOCK ***

6 locks held by kworker/u9:5/5970:
 #0: ffff8880280f7948 ((wq_completion)hci4){+.+.}-{0:0}, at: process_one_work+0x1277/0x1b40 kernel/workqueue.c:3206
 #1: ffffc9000305fd80 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x921/0x1b40 kernel/workqueue.c:3207
 #2: ffff888032308d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x170/0x410 net/bluetooth/hci_sync.c:327
 #3: ffff888032308078 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x150/0xb50 net/bluetooth/hci_sync.c:5564
 #4: ffffffff8fc9caa8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1957 [inline]
 #4: ffffffff8fc9caa8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_failed+0x158/0x370 net/bluetooth/hci_conn.c:1265
 #5: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:326 [inline]
 #5: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
 #5: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: start_flush_work kernel/workqueue.c:4118 [inline]
 #5: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: __flush_work+0x103/0xc30 kernel/workqueue.c:4176

stack backtrace:
CPU: 1 UID: 0 PID: 5970 Comm: kworker/u9:5 Not tainted 6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: hci4 hci_cmd_sync_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:93 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
 check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2186
 check_prev_add kernel/locking/lockdep.c:3133 [inline]
 check_prevs_add kernel/locking/lockdep.c:3252 [inline]
 validate_chain kernel/locking/lockdep.c:3868 [inline]
 __lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142
 lock_acquire kernel/locking/lockdep.c:5759 [inline]
 lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
 touch_work_lockdep_map kernel/workqueue.c:3890 [inline]
 start_flush_work kernel/workqueue.c:4144 [inline]
 __flush_work+0x477/0xc30 kernel/workqueue.c:4176
 __cancel_work_sync+0x10c/0x130 kernel/workqueue.c:4332
 l2cap_conn_del+0x4a6/0x760 net/bluetooth/l2cap_core.c:1800
 l2cap_connect_cfm+0x9e6/0xf80 net/bluetooth/l2cap_core.c:7242
 hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
 hci_conn_failed+0x1c3/0x370 net/bluetooth/hci_conn.c:1265
 hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583
 abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2917
 hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>


Tested on:

commit:         d1f2d51b Merge tag 'clk-fixes-for-linus' of git://git...
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13100e00580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=163c989f980000


^ permalink raw reply	[flat|nested] 44+ messages in thread

* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
  2024-09-07 14:42 ` syzbot
  2024-09-08  0:01   ` Hillf Danton
@ 2024-09-08  1:28   ` Edward Adam Davis
  2024-09-08  1:51     ` syzbot
  2024-09-08  2:06   ` Edward Adam Davis
                     ` (12 subsequent siblings)
  14 siblings, 1 reply; 44+ messages in thread
From: Edward Adam Davis @ 2024-09-08  1:28 UTC (permalink / raw)
  To: syzbot+c12e2f941af1feb5632c; +Cc: linux-kernel, syzkaller-bugs

after release conn, we need to cancle rx_work

#syz test

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 9988ba382b68..afa02e0d7917 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1800,6 +1800,7 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
 	hcon->l2cap_data = NULL;
 	conn->hchan = NULL;
 	l2cap_conn_put(conn);
+	cancel_work_sync(&hcon->hdev->rx_work);
 }
 
 static void l2cap_conn_free(struct kref *ref)


^ permalink raw reply related	[flat|nested] 44+ messages in thread

* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
  2024-09-08  1:28   ` Edward Adam Davis
@ 2024-09-08  1:51     ` syzbot
  0 siblings, 0 replies; 44+ messages in thread
From: syzbot @ 2024-09-08  1:51 UTC (permalink / raw)
  To: eadavis, linux-kernel, syzkaller-bugs

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
possible deadlock in hci_conn_failed

======================================================
WARNING: possible circular locking dependency detected
6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0 Not tainted
------------------------------------------------------
kworker/u9:6/7098 is trying to acquire lock:
ffff888025470aa0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: touch_work_lockdep_map kernel/workqueue.c:3890 [inline]
ffff888025470aa0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: start_flush_work kernel/workqueue.c:4144 [inline]
ffff888025470aa0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: __flush_work+0x46d/0xc30 kernel/workqueue.c:4176

but task is already holding lock:
ffffffff8fc9caa8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1957 [inline]
ffffffff8fc9caa8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_failed+0x158/0x370 net/bluetooth/hci_conn.c:1265

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #2 (
hci_cb_list_lock){+.+.}-{3:3}:
       __mutex_lock_common kernel/locking/mutex.c:608 [inline]
       __mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
       hci_connect_cfm include/net/bluetooth/hci_core.h:1957 [inline]
       hci_remote_features_evt+0x4dc/0x9e0 net/bluetooth/hci_event.c:3721
       hci_event_func net/bluetooth/hci_event.c:7446 [inline]
       hci_event_packet+0x9eb/0x1180 net/bluetooth/hci_event.c:7498
       hci_rx_work+0x2c6/0x1610 net/bluetooth/hci_core.c:4023
       process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
       process_scheduled_works kernel/workqueue.c:3312 [inline]
       worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
       kthread+0x2c1/0x3a0 kernel/kthread.c:389
       ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

-> #1 (&hdev->lock){+.+.}-{3:3}:
       __mutex_lock_common kernel/locking/mutex.c:608 [inline]
       __mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
       hci_store_wake_reason net/bluetooth/hci_event.c:7191 [inline]
       hci_event_packet+0x323/0x1180 net/bluetooth/hci_event.c:7494
       hci_rx_work+0x2c6/0x1610 net/bluetooth/hci_core.c:4023
       process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
       process_scheduled_works kernel/workqueue.c:3312 [inline]
       worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
       kthread+0x2c1/0x3a0 kernel/kthread.c:389
       ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

-> #0
 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}:
       check_prev_add kernel/locking/lockdep.c:3133 [inline]
       check_prevs_add kernel/locking/lockdep.c:3252 [inline]
       validate_chain kernel/locking/lockdep.c:3868 [inline]
       __lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142
       lock_acquire kernel/locking/lockdep.c:5759 [inline]
       lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
       touch_work_lockdep_map kernel/workqueue.c:3890 [inline]
       start_flush_work kernel/workqueue.c:4144 [inline]
       __flush_work+0x477/0xc30 kernel/workqueue.c:4176
       __cancel_work_sync+0x10c/0x130 kernel/workqueue.c:4332
       l2cap_conn_del+0x55c/0x780 net/bluetooth/l2cap_core.c:1803
       l2cap_connect_cfm+0x9e6/0xf80 net/bluetooth/l2cap_core.c:7242
       hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
       hci_conn_failed+0x1c3/0x370 net/bluetooth/hci_conn.c:1265
       hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583
       abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2917
       hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328
       process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
       process_scheduled_works kernel/workqueue.c:3312 [inline]
       worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
       kthread+0x2c1/0x3a0 kernel/kthread.c:389
       ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

other info that might help us debug this:

Chain exists of:
  (work_completion)(&hdev->rx_work) --> &hdev->lock --> hci_cb_list_lock

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(hci_cb_list_lock);
                               lock(&hdev->lock);
                               lock(hci_cb_list_lock);
  lock((work_completion)(&hdev->rx_work));

 *** DEADLOCK ***

6 locks held by kworker/u9:6/7098:
 #0: 
ffff88803384c148 (
(wq_completion)hci2
){+.+.}-{0:0}, at: process_one_work+0x1277/0x1b40 kernel/workqueue.c:3206
 #1: ffffc9000adcfd80 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x921/0x1b40 kernel/workqueue.c:3207
 #2: ffff888025470d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x170/0x410 net/bluetooth/hci_sync.c:327
 #3: ffff888025470078
 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x150/0xb50 net/bluetooth/hci_sync.c:5564
 #4: ffffffff8fc9caa8 (hci_cb_list_lock){+.+.}-{3:3}
, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1957 [inline]
, at: hci_conn_failed+0x158/0x370 net/bluetooth/hci_conn.c:1265
 #5: ffffffff8ddb9fe0
 (rcu_read_lock
){....}-{1:2}
, at: rcu_lock_acquire include/linux/rcupdate.h:326 [inline]
, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
, at: start_flush_work kernel/workqueue.c:4118 [inline]
, at: __flush_work+0x103/0xc30 kernel/workqueue.c:4176

stack backtrace:
CPU: 1 UID: 0 PID: 7098 Comm: kworker/u9:6 Not tainted 6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: hci2 hci_cmd_sync_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:93 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
 check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2186
 check_prev_add kernel/locking/lockdep.c:3133 [inline]
 check_prevs_add kernel/locking/lockdep.c:3252 [inline]
 validate_chain kernel/locking/lockdep.c:3868 [inline]
 __lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142
 lock_acquire kernel/locking/lockdep.c:5759 [inline]
 lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
 touch_work_lockdep_map kernel/workqueue.c:3890 [inline]
 start_flush_work kernel/workqueue.c:4144 [inline]
 __flush_work+0x477/0xc30 kernel/workqueue.c:4176
 __cancel_work_sync+0x10c/0x130 kernel/workqueue.c:4332
 l2cap_conn_del+0x55c/0x780 net/bluetooth/l2cap_core.c:1803
 l2cap_connect_cfm+0x9e6/0xf80 net/bluetooth/l2cap_core.c:7242
 hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
 hci_conn_failed+0x1c3/0x370 net/bluetooth/hci_conn.c:1265
 hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583
 abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2917
 hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>


Tested on:

commit:         d1f2d51b Merge tag 'clk-fixes-for-linus' of git://git...
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12acabc7980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=10640e00580000


^ permalink raw reply	[flat|nested] 44+ messages in thread

* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
  2024-09-07 14:42 ` syzbot
  2024-09-08  0:01   ` Hillf Danton
  2024-09-08  1:28   ` Edward Adam Davis
@ 2024-09-08  2:06   ` Edward Adam Davis
  2024-09-08  2:29     ` syzbot
  2024-09-08  2:41   ` Edward Adam Davis
                     ` (11 subsequent siblings)
  14 siblings, 1 reply; 44+ messages in thread
From: Edward Adam Davis @ 2024-09-08  2:06 UTC (permalink / raw)
  To: syzbot+c12e2f941af1feb5632c; +Cc: linux-kernel, syzkaller-bugs

after release conn, we need to cancle rx_work

#syz test

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 8e48ccd2af30..5050d20e9cd1 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -1264,6 +1264,7 @@ void hci_conn_failed(struct hci_conn *conn, u8 status)
 	conn->state = BT_CLOSED;
 	hci_connect_cfm(conn, status);
 	hci_conn_del(conn);
+	cancel_work_sync(&hdev->rx_work);
 }
 
 /* This function requires the caller holds hdev->lock */


^ permalink raw reply related	[flat|nested] 44+ messages in thread

* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
  2024-09-08  2:06   ` Edward Adam Davis
@ 2024-09-08  2:29     ` syzbot
  0 siblings, 0 replies; 44+ messages in thread
From: syzbot @ 2024-09-08  2:29 UTC (permalink / raw)
  To: eadavis, linux-kernel, syzkaller-bugs

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
possible deadlock in hci_abort_conn_sync

======================================================
WARNING: possible circular locking dependency detected
6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0 Not tainted
------------------------------------------------------
kworker/u9:2/5285 is trying to acquire lock:
ffff888043094aa0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: touch_work_lockdep_map kernel/workqueue.c:3890 [inline]
ffff888043094aa0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: start_flush_work kernel/workqueue.c:4144 [inline]
ffff888043094aa0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: __flush_work+0x46d/0xc30 kernel/workqueue.c:4176

but task is already holding lock:
ffff888043094078 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x150/0xb50 net/bluetooth/hci_sync.c:5564

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (&hdev->lock){+.+.}-{3:3}:
       __mutex_lock_common kernel/locking/mutex.c:608 [inline]
       __mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
       hci_store_wake_reason net/bluetooth/hci_event.c:7191 [inline]
       hci_event_packet+0x323/0x1180 net/bluetooth/hci_event.c:7494
       hci_rx_work+0x2c6/0x1610 net/bluetooth/hci_core.c:4023
       process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
       process_scheduled_works kernel/workqueue.c:3312 [inline]
       worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
       kthread+0x2c1/0x3a0 kernel/kthread.c:389
       ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

-> #0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}:
       check_prev_add kernel/locking/lockdep.c:3133 [inline]
       check_prevs_add kernel/locking/lockdep.c:3252 [inline]
       validate_chain kernel/locking/lockdep.c:3868 [inline]
       __lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142
       lock_acquire kernel/locking/lockdep.c:5759 [inline]
       lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
       touch_work_lockdep_map kernel/workqueue.c:3890 [inline]
       start_flush_work kernel/workqueue.c:4144 [inline]
       __flush_work+0x477/0xc30 kernel/workqueue.c:4176
       __cancel_work_sync+0x10c/0x130 kernel/workqueue.c:4332
       hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583
       abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2918
       hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328
       process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
       process_scheduled_works kernel/workqueue.c:3312 [inline]
       worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
       kthread+0x2c1/0x3a0 kernel/kthread.c:389
       ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&hdev->lock);
                               lock((work_completion)(&hdev->rx_work));
                               lock(&hdev->lock);
  lock((work_completion)(&hdev->rx_work));

 *** DEADLOCK ***

5 locks held by kworker/u9:2/5285:
 #0: ffff8880439ca148 ((wq_completion)hci0){+.+.}-{0:0}, at: process_one_work+0x1277/0x1b40 kernel/workqueue.c:3206
 #1: ffffc9000392fd80 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x921/0x1b40 kernel/workqueue.c:3207
 #2: ffff888043094d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x170/0x410 net/bluetooth/hci_sync.c:327
 #3: ffff888043094078 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x150/0xb50 net/bluetooth/hci_sync.c:5564
 #4: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:326 [inline]
 #4: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
 #4: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: start_flush_work kernel/workqueue.c:4118 [inline]
 #4: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: __flush_work+0x103/0xc30 kernel/workqueue.c:4176

stack backtrace:
CPU: 0 UID: 0 PID: 5285 Comm: kworker/u9:2 Not tainted 6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: hci0 hci_cmd_sync_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:93 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
 check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2186
 check_prev_add kernel/locking/lockdep.c:3133 [inline]
 check_prevs_add kernel/locking/lockdep.c:3252 [inline]
 validate_chain kernel/locking/lockdep.c:3868 [inline]
 __lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142
 lock_acquire kernel/locking/lockdep.c:5759 [inline]
 lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
 touch_work_lockdep_map kernel/workqueue.c:3890 [inline]
 start_flush_work kernel/workqueue.c:4144 [inline]
 __flush_work+0x477/0xc30 kernel/workqueue.c:4176
 __cancel_work_sync+0x10c/0x130 kernel/workqueue.c:4332
 hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583
 abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2918
 hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>


Tested on:

commit:         d1f2d51b Merge tag 'clk-fixes-for-linus' of git://git...
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=146feffb980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=175c0e00580000


^ permalink raw reply	[flat|nested] 44+ messages in thread

* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
  2024-09-07 14:42 ` syzbot
                     ` (2 preceding siblings ...)
  2024-09-08  2:06   ` Edward Adam Davis
@ 2024-09-08  2:41   ` Edward Adam Davis
  2024-09-08  3:06     ` syzbot
  2024-09-08  3:15   ` Edward Adam Davis
                     ` (10 subsequent siblings)
  14 siblings, 1 reply; 44+ messages in thread
From: Edward Adam Davis @ 2024-09-08  2:41 UTC (permalink / raw)
  To: syzbot+c12e2f941af1feb5632c; +Cc: linux-kernel, syzkaller-bugs

after release conn, we need to cancle rx_work

#syz test

diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index e79cd40bd079..6d95e07d9ddd 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -5499,7 +5499,7 @@ static int hci_reject_conn_sync(struct hci_dev *hdev, struct hci_conn *conn,
 
 int hci_abort_conn_sync(struct hci_dev *hdev, struct hci_conn *conn, u8 reason)
 {
-	int err = 0;
+	int err = 0, failed = 0;
 	u16 handle = conn->handle;
 	bool disconnect = false;
 	struct hci_conn *c;
@@ -5543,10 +5543,13 @@ int hci_abort_conn_sync(struct hci_dev *hdev, struct hci_conn *conn, u8 reason)
 		hci_conn_del(conn);
 	} else {
 		hci_conn_failed(conn, reason);
+		failed = 1;
 	}
 
 unlock:
 	hci_dev_unlock(hdev);
+	if (failed)
+		cancel_work_sync(&hdev->rx_work);
 	return err;
 }
 


^ permalink raw reply related	[flat|nested] 44+ messages in thread

* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
  2024-09-08  2:41   ` Edward Adam Davis
@ 2024-09-08  3:06     ` syzbot
  0 siblings, 0 replies; 44+ messages in thread
From: syzbot @ 2024-09-08  3:06 UTC (permalink / raw)
  To: eadavis, linux-kernel, syzkaller-bugs

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in l2cap_connect

Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
==================================================================
BUG: KASAN: slab-use-after-free in l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949
Read of size 8 at addr ffff88807a217000 by task kworker/u9:0/54

CPU: 0 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: hci2 hci_rx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:93 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0xc3/0x620 mm/kasan/report.c:488
 kasan_report+0xd9/0x110 mm/kasan/report.c:601
 l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949
 l2cap_connect_req net/bluetooth/l2cap_core.c:4080 [inline]
 l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4772 [inline]
 l2cap_sig_channel net/bluetooth/l2cap_core.c:5543 [inline]
 l2cap_recv_frame+0xf0b/0x8eb0 net/bluetooth/l2cap_core.c:6825
 l2cap_recv_acldata+0x9b4/0xb70 net/bluetooth/l2cap_core.c:7514
 hci_acldata_packet net/bluetooth/hci_core.c:3791 [inline]
 hci_rx_work+0xaab/0x1610 net/bluetooth/hci_core.c:4028
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>

Allocated by task 6033:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:387
 kmalloc_noprof include/linux/slab.h:681 [inline]
 kzalloc_noprof include/linux/slab.h:807 [inline]
 l2cap_conn_add.part.0+0x60/0xa60 net/bluetooth/l2cap_core.c:6868
 l2cap_conn_add net/bluetooth/l2cap_core.c:69 [inline]
 l2cap_connect_cfm+0x428/0xf80 net/bluetooth/l2cap_core.c:7245
 hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
 hci_remote_features_evt+0x548/0x9e0 net/bluetooth/hci_event.c:3721
 hci_event_func net/bluetooth/hci_event.c:7446 [inline]
 hci_event_packet+0x9eb/0x1180 net/bluetooth/hci_event.c:7498
 hci_rx_work+0x2c6/0x1610 net/bluetooth/hci_core.c:4023
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Freed by task 7242:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
 poison_slab_object+0xf7/0x160 mm/kasan/common.c:240
 __kasan_slab_free+0x32/0x50 mm/kasan/common.c:256
 kasan_slab_free include/linux/kasan.h:184 [inline]
 slab_free_hook mm/slub.c:2256 [inline]
 slab_free mm/slub.c:4477 [inline]
 kfree+0x12a/0x3b0 mm/slub.c:4598
 l2cap_conn_free net/bluetooth/l2cap_core.c:1810 [inline]
 kref_put include/linux/kref.h:65 [inline]
 l2cap_conn_put net/bluetooth/l2cap_core.c:1822 [inline]
 l2cap_conn_del+0x59d/0x730 net/bluetooth/l2cap_core.c:1802
 l2cap_connect_cfm+0x9e6/0xf80 net/bluetooth/l2cap_core.c:7241
 hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
 hci_conn_failed+0x1c3/0x370 net/bluetooth/hci_conn.c:1265
 hci_abort_conn_sync+0x5df/0xb90 net/bluetooth/hci_sync.c:5583
 abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2917
 hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Last potentially related work creation:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 __kasan_record_aux_stack+0xba/0xd0 mm/kasan/generic.c:541
 insert_work+0x36/0x230 kernel/workqueue.c:2185
 __queue_work+0x97e/0x1070 kernel/workqueue.c:2341
 call_timer_fn+0x1a0/0x610 kernel/time/timer.c:1792
 expire_timers kernel/time/timer.c:1838 [inline]
 __run_timers+0x567/0xaf0 kernel/time/timer.c:2417
 __run_timer_base kernel/time/timer.c:2428 [inline]
 __run_timer_base kernel/time/timer.c:2421 [inline]
 run_timer_base+0x111/0x190 kernel/time/timer.c:2437
 run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2447
 handle_softirqs+0x216/0x8f0 kernel/softirq.c:554
 __do_softirq kernel/softirq.c:588 [inline]
 invoke_softirq kernel/softirq.c:428 [inline]
 __irq_exit_rcu kernel/softirq.c:637 [inline]
 irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
 sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1043
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702

Second to last potentially related work creation:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 __kasan_record_aux_stack+0xba/0xd0 mm/kasan/generic.c:541
 insert_work+0x36/0x230 kernel/workqueue.c:2185
 __queue_work+0x3f8/0x1070 kernel/workqueue.c:2345
 queue_work_on+0x11a/0x140 kernel/workqueue.c:2392
 queue_work include/linux/workqueue.h:621 [inline]
 l2cap_conn_ready net/bluetooth/l2cap_core.c:1640 [inline]
 l2cap_connect_cfm+0x9c9/0xf80 net/bluetooth/l2cap_core.c:7286
 hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
 hci_remote_features_evt+0x548/0x9e0 net/bluetooth/hci_event.c:3721
 hci_event_func net/bluetooth/hci_event.c:7446 [inline]
 hci_event_packet+0x9eb/0x1180 net/bluetooth/hci_event.c:7498
 hci_rx_work+0x2c6/0x1610 net/bluetooth/hci_core.c:4023
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

The buggy address belongs to the object at ffff88807a217000
 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 0 bytes inside of
 freed 1024-byte region [ffff88807a217000, ffff88807a217400)

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7a210
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xfdffffff(slab)
raw: 00fff00000000040 ffff88801ac41dc0 ffffea0001813a00 dead000000000002
raw: 0000000000000000 0000000000100010 00000001fdffffff 0000000000000000
head: 00fff00000000040 ffff88801ac41dc0 ffffea0001813a00 dead000000000002
head: 0000000000000000 0000000000100010 00000001fdffffff 0000000000000000
head: 00fff00000000003 ffffea0001e88401 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 6025, tgid 6025 (syz-executor), ts 135418734548, free_ts 135276394069
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1500
 prep_new_page mm/page_alloc.c:1508 [inline]
 get_page_from_freelist+0x1351/0x2e50 mm/page_alloc.c:3446
 __alloc_pages_noprof+0x22b/0x2460 mm/page_alloc.c:4702
 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
 alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
 alloc_slab_page+0x4e/0xf0 mm/slub.c:2325
 allocate_slab mm/slub.c:2488 [inline]
 new_slab+0x84/0x260 mm/slub.c:2541
 ___slab_alloc+0xdac/0x1870 mm/slub.c:3727
 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3817
 __slab_alloc_node mm/slub.c:3870 [inline]
 slab_alloc_node mm/slub.c:4029 [inline]
 __do_kmalloc_node mm/slub.c:4161 [inline]
 __kmalloc_node_track_caller_noprof+0x355/0x430 mm/slub.c:4181
 kmemdup_noprof+0x29/0x60 mm/util.c:133
 kmemdup_noprof include/linux/fortify-string.h:753 [inline]
 setup_ipc_sysctls+0x5e/0x300 ipc/ipc_sysctl.c:251
 create_ipc_ns ipc/namespace.c:81 [inline]
 copy_ipcs+0x498/0x600 ipc/namespace.c:112
 create_new_namespaces+0x20a/0xad0 kernel/nsproxy.c:90
 unshare_nsproxy_namespaces+0xc0/0x1f0 kernel/nsproxy.c:228
 ksys_unshare+0x419/0x970 kernel/fork.c:3309
 __do_sys_unshare kernel/fork.c:3380 [inline]
 __se_sys_unshare kernel/fork.c:3378 [inline]
 __x64_sys_unshare+0x31/0x40 kernel/fork.c:3378
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
page last free pid 5878 tgid 5878 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1101 [inline]
 free_unref_page+0x64a/0xe40 mm/page_alloc.c:2619
 __put_partials+0x14c/0x170 mm/slub.c:3055
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x4e/0x140 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:322
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook mm/slub.c:3992 [inline]
 slab_alloc_node mm/slub.c:4041 [inline]
 __do_kmalloc_node mm/slub.c:4161 [inline]
 __kmalloc_node_noprof+0x1c3/0x430 mm/slub.c:4168
 kmalloc_node_noprof include/linux/slab.h:708 [inline]
 __vmalloc_area_node mm/vmalloc.c:3642 [inline]
 __vmalloc_node_range_noprof+0x3de/0x14e0 mm/vmalloc.c:3837
 alloc_thread_stack_node kernel/fork.c:313 [inline]
 dup_task_struct kernel/fork.c:1113 [inline]
 copy_process+0x2f3b/0x8de0 kernel/fork.c:2204
 kernel_clone+0xfd/0x960 kernel/fork.c:2781
 __do_sys_clone3+0x1f5/0x270 kernel/fork.c:3085
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff88807a216f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88807a216f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88807a217000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff88807a217080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88807a217100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


Tested on:

commit:         d1f2d51b Merge tag 'clk-fixes-for-linus' of git://git...
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=116def29980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=133feffb980000


^ permalink raw reply	[flat|nested] 44+ messages in thread

* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
  2024-09-07 14:42 ` syzbot
                     ` (3 preceding siblings ...)
  2024-09-08  2:41   ` Edward Adam Davis
@ 2024-09-08  3:15   ` Edward Adam Davis
  2024-09-08  3:58     ` syzbot
  2024-09-08  3:25   ` Hillf Danton
                     ` (9 subsequent siblings)
  14 siblings, 1 reply; 44+ messages in thread
From: Edward Adam Davis @ 2024-09-08  3:15 UTC (permalink / raw)
  To: syzbot+c12e2f941af1feb5632c; +Cc: linux-kernel, syzkaller-bugs

after release conn, we need to cancle rx_work

#syz test

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index f25a21f532aa..4f7b45bb863f 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -3776,18 +3776,19 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
 
 	hci_dev_lock(hdev);
 	conn = hci_conn_hash_lookup_handle(hdev, handle);
-	hci_dev_unlock(hdev);
 
 	if (conn) {
 		hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
 
 		/* Send to upper protocol */
 		l2cap_recv_acldata(conn, skb, flags);
+		hci_dev_unlock(hdev);
 		return;
 	} else {
 		bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
 			   handle);
 	}
+	hci_dev_unlock(hdev);
 
 	kfree_skb(skb);
 }


^ permalink raw reply related	[flat|nested] 44+ messages in thread

* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
  2024-09-07 14:42 ` syzbot
                     ` (4 preceding siblings ...)
  2024-09-08  3:15   ` Edward Adam Davis
@ 2024-09-08  3:25   ` Hillf Danton
  2024-09-08  4:07     ` syzbot
  2024-09-08  4:07   ` Edward Adam Davis
                     ` (8 subsequent siblings)
  14 siblings, 1 reply; 44+ messages in thread
From: Hillf Danton @ 2024-09-08  3:25 UTC (permalink / raw)
  To: syzbot; +Cc: linux-kernel, syzkaller-bugs

On Sat, 07 Sep 2024 07:42:26 -0700
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    788220eee30d Merge tag 'pm-6.11-rc7' of git://git.kernel.o..
> git tree:       upstream
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1304189f980000

#syz test

--- l/net/bluetooth/l2cap_core.c
+++ c/net/bluetooth/l2cap_core.c
@@ -1747,6 +1747,8 @@ static void l2cap_unregister_all_users(s
 	}
 }
 
+static DEFINE_MUTEX(l2cap_conn_del_mutex);
+
 static void l2cap_conn_del(struct hci_conn *hcon, int err)
 {
 	struct l2cap_conn *conn = hcon->l2cap_data;
@@ -1797,8 +1799,10 @@ static void l2cap_conn_del(struct hci_co
 	if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
 		cancel_delayed_work_sync(&conn->info_timer);
 
+	mutex_lock(&l2cap_conn_del_mutex);
 	hcon->l2cap_data = NULL;
 	conn->hchan = NULL;
+	mutex_unlock(&l2cap_conn_del_mutex);
 	l2cap_conn_put(conn);
 }
 
@@ -7480,11 +7484,21 @@ void l2cap_recv_acldata(struct hci_conn
 	struct l2cap_conn *conn = hcon->l2cap_data;
 	int len;
 
-	if (!conn)
+	if (!conn) {
 		conn = l2cap_conn_add(hcon);
-
-	if (!conn)
-		goto drop;
+		if (!conn)
+			goto drop;
+		l2cap_conn_get(conn);
+	} else {
+		mutex_lock(&l2cap_conn_del_mutex);
+		conn = hcon->l2cap_data;
+		if (conn)
+			if (!kref_get_unless_zero(&conn->ref))
+				conn = NULL;
+		mutex_unlock(&l2cap_conn_del_mutex);
+		if (!conn)
+			goto drop;
+	}
 
 	BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags);
 
@@ -7512,6 +7526,7 @@ void l2cap_recv_acldata(struct hci_conn
 		if (len == skb->len) {
 			/* Complete frame received */
 			l2cap_recv_frame(conn, skb);
+			l2cap_conn_put(conn);
 			return;
 		}
 
@@ -7576,6 +7591,8 @@ void l2cap_recv_acldata(struct hci_conn
 
 drop:
 	kfree_skb(skb);
+	if (conn)
+		2cap_conn_put(conn);
 }
 
 static struct hci_cb l2cap_cb = {
--

^ permalink raw reply	[flat|nested] 44+ messages in thread

* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
  2024-09-08  3:15   ` Edward Adam Davis
@ 2024-09-08  3:58     ` syzbot
  0 siblings, 0 replies; 44+ messages in thread
From: syzbot @ 2024-09-08  3:58 UTC (permalink / raw)
  To: eadavis, linux-kernel, syzkaller-bugs

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
possible deadlock in l2cap_recv_frame

Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
============================================
WARNING: possible recursive locking detected
6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0 Not tainted
--------------------------------------------
kworker/u9:1/4615 is trying to acquire lock:
ffff888062afc078 (&hdev->lock){+.+.}-{3:3}, at: l2cap_connect_req net/bluetooth/l2cap_core.c:4075 [inline]
ffff888062afc078 (&hdev->lock){+.+.}-{3:3}, at: l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4772 [inline]
ffff888062afc078 (&hdev->lock){+.+.}-{3:3}, at: l2cap_sig_channel net/bluetooth/l2cap_core.c:5543 [inline]
ffff888062afc078 (&hdev->lock){+.+.}-{3:3}, at: l2cap_recv_frame+0xe9d/0x8eb0 net/bluetooth/l2cap_core.c:6825

but task is already holding lock:
ffff888062afc078 (&hdev->lock){+.+.}-{3:3}, at: hci_acldata_packet net/bluetooth/hci_core.c:3783 [inline]
ffff888062afc078 (&hdev->lock){+.+.}-{3:3}, at: hci_rx_work+0x96b/0x1610 net/bluetooth/hci_core.c:4029

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&hdev->lock);
  lock(&hdev->lock);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

3 locks held by kworker/u9:1/4615:
 #0: ffff8880301df948 ((wq_completion)hci2#2){+.+.}-{0:0}, at: process_one_work+0x1277/0x1b40 kernel/workqueue.c:3206
 #1: ffffc9000d83fd80 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x921/0x1b40 kernel/workqueue.c:3207
 #2: ffff888062afc078 (&hdev->lock){+.+.}-{3:3}, at: hci_acldata_packet net/bluetooth/hci_core.c:3783 [inline]
 #2: ffff888062afc078 (&hdev->lock){+.+.}-{3:3}, at: hci_rx_work+0x96b/0x1610 net/bluetooth/hci_core.c:4029

stack backtrace:
CPU: 0 UID: 0 PID: 4615 Comm: kworker/u9:1 Not tainted 6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: hci2 hci_rx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:93 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
 check_deadlock kernel/locking/lockdep.c:3061 [inline]
 validate_chain kernel/locking/lockdep.c:3855 [inline]
 __lock_acquire+0x2167/0x3cb0 kernel/locking/lockdep.c:5142
 lock_acquire kernel/locking/lockdep.c:5759 [inline]
 lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
 __mutex_lock_common kernel/locking/mutex.c:608 [inline]
 __mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
 l2cap_connect_req net/bluetooth/l2cap_core.c:4075 [inline]
 l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4772 [inline]
 l2cap_sig_channel net/bluetooth/l2cap_core.c:5543 [inline]
 l2cap_recv_frame+0xe9d/0x8eb0 net/bluetooth/l2cap_core.c:6825
 l2cap_recv_acldata+0x9b4/0xb70 net/bluetooth/l2cap_core.c:7514
 hci_acldata_packet net/bluetooth/hci_core.c:3790 [inline]
 hci_rx_work+0xaa1/0x1610 net/bluetooth/hci_core.c:4029
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>


Tested on:

commit:         d1f2d51b Merge tag 'clk-fixes-for-linus' of git://git...
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1656abc7980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=165a0e00580000


^ permalink raw reply	[flat|nested] 44+ messages in thread

* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
  2024-09-08  3:25   ` Hillf Danton
@ 2024-09-08  4:07     ` syzbot
  0 siblings, 0 replies; 44+ messages in thread
From: syzbot @ 2024-09-08  4:07 UTC (permalink / raw)
  To: hdanton, linux-kernel, syzkaller-bugs

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

net/bluetooth/l2cap_core.c:7595:17: error: invalid suffix "cap_conn_put" on integer constant


Tested on:

commit:         d1f2d51b Merge tag 'clk-fixes-for-linus' of git://git...
git tree:       upstream
kernel config:  https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=137def29980000


^ permalink raw reply	[flat|nested] 44+ messages in thread

* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
  2024-09-07 14:42 ` syzbot
                     ` (5 preceding siblings ...)
  2024-09-08  3:25   ` Hillf Danton
@ 2024-09-08  4:07   ` Edward Adam Davis
  2024-09-08  4:37     ` syzbot
  2024-09-08  7:22   ` [PATCH] Bluetooth/l2cap: Fix uaf in l2cap_connect Edward Adam Davis
                     ` (7 subsequent siblings)
  14 siblings, 1 reply; 44+ messages in thread
From: Edward Adam Davis @ 2024-09-08  4:07 UTC (permalink / raw)
  To: syzbot+c12e2f941af1feb5632c; +Cc: linux-kernel, syzkaller-bugs

after release conn, we need to cancle rx_work

#syz test

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index f25a21f532aa..4f7b45bb863f 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -3776,18 +3776,19 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
 
 	hci_dev_lock(hdev);
 	conn = hci_conn_hash_lookup_handle(hdev, handle);
-	hci_dev_unlock(hdev);
 
 	if (conn) {
 		hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
 
 		/* Send to upper protocol */
 		l2cap_recv_acldata(conn, skb, flags);
+		hci_dev_unlock(hdev);
 		return;
 	} else {
 		bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
 			   handle);
 	}
+	hci_dev_unlock(hdev);
 
 	kfree_skb(skb);
 }
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 9988ba382b68..b948b0a3b2f2 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -4072,10 +4072,8 @@ static int l2cap_connect_req(struct l2cap_conn *conn,
 	if (cmd_len < sizeof(struct l2cap_conn_req))
 		return -EPROTO;
 
-	hci_dev_lock(hdev);
 	if (hci_dev_test_flag(hdev, HCI_MGMT))
 		mgmt_device_connected(hdev, hcon, NULL, 0);
-	hci_dev_unlock(hdev);
 
 	l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP);
 	return 0;


^ permalink raw reply related	[flat|nested] 44+ messages in thread

* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
  2024-09-08  4:07   ` Edward Adam Davis
@ 2024-09-08  4:37     ` syzbot
  0 siblings, 0 replies; 44+ messages in thread
From: syzbot @ 2024-09-08  4:37 UTC (permalink / raw)
  To: eadavis, linux-kernel, syzkaller-bugs

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+c12e2f941af1feb5632c@syzkaller.appspotmail.com
Tested-by: syzbot+c12e2f941af1feb5632c@syzkaller.appspotmail.com

Tested on:

commit:         d1f2d51b Merge tag 'clk-fixes-for-linus' of git://git...
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1187ef29980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=11ad989f980000

Note: testing is done by a robot and is best-effort only.

^ permalink raw reply	[flat|nested] 44+ messages in thread

* [PATCH] Bluetooth/l2cap: Fix uaf in l2cap_connect
  2024-09-07 14:42 ` syzbot
                     ` (6 preceding siblings ...)
  2024-09-08  4:07   ` Edward Adam Davis
@ 2024-09-08  7:22   ` Edward Adam Davis
  2024-09-10 20:56     ` Luiz Augusto von Dentz
  2024-09-08  8:32   ` Hillf Danton
                     ` (6 subsequent siblings)
  14 siblings, 1 reply; 44+ messages in thread
From: Edward Adam Davis @ 2024-09-08  7:22 UTC (permalink / raw)
  To: syzbot+c12e2f941af1feb5632c
  Cc: johan.hedberg, linux-bluetooth, linux-kernel, luiz.dentz, marcel,
	syzkaller-bugs

[Syzbot reported]
BUG: KASAN: slab-use-after-free in l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949
Read of size 8 at addr ffff8880241e9800 by task kworker/u9:0/54

CPU: 0 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.11.0-rc6-syzkaller-00268-g788220eee30d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: hci2 hci_rx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:93 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0xc3/0x620 mm/kasan/report.c:488
 kasan_report+0xd9/0x110 mm/kasan/report.c:601
 l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949
 l2cap_connect_req net/bluetooth/l2cap_core.c:4080 [inline]
 l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4772 [inline]
 l2cap_sig_channel net/bluetooth/l2cap_core.c:5543 [inline]
 l2cap_recv_frame+0xf0b/0x8eb0 net/bluetooth/l2cap_core.c:6825
 l2cap_recv_acldata+0x9b4/0xb70 net/bluetooth/l2cap_core.c:7514
 hci_acldata_packet net/bluetooth/hci_core.c:3791 [inline]
 hci_rx_work+0xaab/0x1610 net/bluetooth/hci_core.c:4028
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
...

Freed by task 5245:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
 poison_slab_object+0xf7/0x160 mm/kasan/common.c:240
 __kasan_slab_free+0x32/0x50 mm/kasan/common.c:256
 kasan_slab_free include/linux/kasan.h:184 [inline]
 slab_free_hook mm/slub.c:2256 [inline]
 slab_free mm/slub.c:4477 [inline]
 kfree+0x12a/0x3b0 mm/slub.c:4598
 l2cap_conn_free net/bluetooth/l2cap_core.c:1810 [inline]
 kref_put include/linux/kref.h:65 [inline]
 l2cap_conn_put net/bluetooth/l2cap_core.c:1822 [inline]
 l2cap_conn_del+0x59d/0x730 net/bluetooth/l2cap_core.c:1802
 l2cap_connect_cfm+0x9e6/0xf80 net/bluetooth/l2cap_core.c:7241
 hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
 hci_conn_failed+0x1c3/0x370 net/bluetooth/hci_conn.c:1265
 hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583
 abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2917
 hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

[Analysis] 
There was a data race when accessing conn in hci_rx_work and hci_cmd_sync_work.
This is because the hci dev lock was prematurely exited when executing
hci_acldata_macket() in hci_rx_work, which resulted in it being released
by hci_cmd_sync_work when accessing conn outside the lock.

Reported-and-tested-by: syzbot+c12e2f941af1feb5632c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
 net/bluetooth/hci_core.c   | 3 ++-
 net/bluetooth/l2cap_core.c | 2 --
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index f25a21f532aa..4f7b45bb863f 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -3776,18 +3776,19 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
 
 	hci_dev_lock(hdev);
 	conn = hci_conn_hash_lookup_handle(hdev, handle);
-	hci_dev_unlock(hdev);
 
 	if (conn) {
 		hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
 
 		/* Send to upper protocol */
 		l2cap_recv_acldata(conn, skb, flags);
+		hci_dev_unlock(hdev);
 		return;
 	} else {
 		bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
 			   handle);
 	}
+	hci_dev_unlock(hdev);
 
 	kfree_skb(skb);
 }
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 9988ba382b68..b948b0a3b2f2 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -4072,10 +4072,8 @@ static int l2cap_connect_req(struct l2cap_conn *conn,
 	if (cmd_len < sizeof(struct l2cap_conn_req))
 		return -EPROTO;
 
-	hci_dev_lock(hdev);
 	if (hci_dev_test_flag(hdev, HCI_MGMT))
 		mgmt_device_connected(hdev, hcon, NULL, 0);
-	hci_dev_unlock(hdev);
 
 	l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP);
 	return 0;
-- 
2.43.0


^ permalink raw reply related	[flat|nested] 44+ messages in thread

* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
  2024-09-07 14:42 ` syzbot
                     ` (7 preceding siblings ...)
  2024-09-08  7:22   ` [PATCH] Bluetooth/l2cap: Fix uaf in l2cap_connect Edward Adam Davis
@ 2024-09-08  8:32   ` Hillf Danton
  2024-09-08  8:52     ` syzbot
  2024-09-08 11:15   ` Hillf Danton
                     ` (5 subsequent siblings)
  14 siblings, 1 reply; 44+ messages in thread
From: Hillf Danton @ 2024-09-08  8:32 UTC (permalink / raw)
  To: syzbot; +Cc: linux-kernel, syzkaller-bugs

On Sat, 07 Sep 2024 07:42:26 -0700
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    788220eee30d Merge tag 'pm-6.11-rc7' of git://git.kernel.o..
> git tree:       upstream
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1304189f980000

#syz test

--- l/net/bluetooth/l2cap_core.c
+++ c/net/bluetooth/l2cap_core.c
@@ -1747,6 +1747,8 @@ static void l2cap_unregister_all_users(s
 	}
 }
 
+static DEFINE_MUTEX(l2cap_conn_del_mutex);
+
 static void l2cap_conn_del(struct hci_conn *hcon, int err)
 {
 	struct l2cap_conn *conn = hcon->l2cap_data;
@@ -1797,8 +1799,10 @@ static void l2cap_conn_del(struct hci_co
 	if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
 		cancel_delayed_work_sync(&conn->info_timer);
 
+	mutex_lock(&l2cap_conn_del_mutex);
 	hcon->l2cap_data = NULL;
 	conn->hchan = NULL;
+	mutex_unlock(&l2cap_conn_del_mutex);
 	l2cap_conn_put(conn);
 }
 
@@ -7480,11 +7484,21 @@ void l2cap_recv_acldata(struct hci_conn
 	struct l2cap_conn *conn = hcon->l2cap_data;
 	int len;
 
-	if (!conn)
+	if (!conn) {
 		conn = l2cap_conn_add(hcon);
-
-	if (!conn)
-		goto drop;
+		if (!conn)
+			goto drop;
+		l2cap_conn_get(conn);
+	} else {
+		mutex_lock(&l2cap_conn_del_mutex);
+		conn = hcon->l2cap_data;
+		if (conn)
+			if (!kref_get_unless_zero(&conn->ref))
+				conn = NULL;
+		mutex_unlock(&l2cap_conn_del_mutex);
+		if (!conn)
+			goto drop;
+	}
 
 	BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags);
 
@@ -7512,6 +7526,7 @@ void l2cap_recv_acldata(struct hci_conn
 		if (len == skb->len) {
 			/* Complete frame received */
 			l2cap_recv_frame(conn, skb);
+			l2cap_conn_put(conn);
 			return;
 		}
 
@@ -7576,6 +7591,8 @@ void l2cap_recv_acldata(struct hci_conn
 
 drop:
 	kfree_skb(skb);
+	if (conn)
+		l2cap_conn_put(conn);
 }
 
 static struct hci_cb l2cap_cb = {
--

^ permalink raw reply	[flat|nested] 44+ messages in thread

* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
  2024-09-08  8:32   ` Hillf Danton
@ 2024-09-08  8:52     ` syzbot
  0 siblings, 0 replies; 44+ messages in thread
From: syzbot @ 2024-09-08  8:52 UTC (permalink / raw)
  To: hdanton, linux-kernel, syzkaller-bugs

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in hci_send_acl

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
CPU: 1 UID: 0 PID: 7269 Comm: kworker/u9:8 Not tainted 6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: hci2 hci_rx_work
RIP: 0010:hci_send_acl+0x35/0xd30 net/bluetooth/hci_core.c:3230
Code: 41 55 41 54 55 49 8d 6f 18 53 48 89 f3 48 83 ec 70 89 14 24 e8 1c 18 83 f7 48 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 bc 0b 00 00 49 8b 47 18 48 8d b8 e0 0f 00 00 48
RSP: 0018:ffffc9000ae676e0 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: ffff888030adc500 RCX: ffffffff8a1303d4
RDX: 0000000000000003 RSI: ffffffff8a08b834 RDI: 0000000000000000
RBP: 0000000000000018 R08: 0000000000000001 R09: 0000000000000080
R10: 0000000000000001 R11: 0000000000000000 R12: ffff888011da0000
R13: 0000000000000002 R14: ffffc9000ae67880 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b8900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000080 CR3: 00000000781ba000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 l2cap_send_cmd+0x6e5/0x920 net/bluetooth/l2cap_core.c:973
 l2cap_connect.constprop.0+0x6f7/0x1270 net/bluetooth/l2cap_core.c:4038
 l2cap_connect_req net/bluetooth/l2cap_core.c:4084 [inline]
 l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4776 [inline]
 l2cap_sig_channel net/bluetooth/l2cap_core.c:5547 [inline]
 l2cap_recv_frame+0xf0b/0x8eb0 net/bluetooth/l2cap_core.c:6829
 l2cap_recv_acldata+0xd58/0xfd0 net/bluetooth/l2cap_core.c:7528
 hci_acldata_packet net/bluetooth/hci_core.c:3791 [inline]
 hci_rx_work+0xaab/0x1610 net/bluetooth/hci_core.c:4028
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:hci_send_acl+0x35/0xd30 net/bluetooth/hci_core.c:3230
Code: 41 55 41 54 55 49 8d 6f 18 53 48 89 f3 48 83 ec 70 89 14 24 e8 1c 18 83 f7 48 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 bc 0b 00 00 49 8b 47 18 48 8d b8 e0 0f 00 00 48
RSP: 0018:ffffc9000ae676e0 EFLAGS: 00010206

RAX: dffffc0000000000 RBX: ffff888030adc500 RCX: ffffffff8a1303d4
RDX: 0000000000000003 RSI: ffffffff8a08b834 RDI: 0000000000000000
RBP: 0000000000000018 R08: 0000000000000001 R09: 0000000000000080
R10: 0000000000000001 R11: 0000000000000000 R12: ffff888011da0000
R13: 0000000000000002 R14: ffffc9000ae67880 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b8800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000080 CR3: 00000000781ba000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	41 55                	push   %r13
   2:	41 54                	push   %r12
   4:	55                   	push   %rbp
   5:	49 8d 6f 18          	lea    0x18(%r15),%rbp
   9:	53                   	push   %rbx
   a:	48 89 f3             	mov    %rsi,%rbx
   d:	48 83 ec 70          	sub    $0x70,%rsp
  11:	89 14 24             	mov    %edx,(%rsp)
  14:	e8 1c 18 83 f7       	call   0xf7831835
  19:	48 89 ea             	mov    %rbp,%rdx
  1c:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  23:	fc ff df
  26:	48 c1 ea 03          	shr    $0x3,%rdx
* 2a:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1) <-- trapping instruction
  2e:	0f 85 bc 0b 00 00    	jne    0xbf0
  34:	49 8b 47 18          	mov    0x18(%r15),%rax
  38:	48 8d b8 e0 0f 00 00 	lea    0xfe0(%rax),%rdi
  3f:	48                   	rex.W


Tested on:

commit:         d1f2d51b Merge tag 'clk-fixes-for-linus' of git://git...
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13f51ffb980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=11651ffb980000


^ permalink raw reply	[flat|nested] 44+ messages in thread

* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
  2024-09-07 14:42 ` syzbot
                     ` (8 preceding siblings ...)
  2024-09-08  8:32   ` Hillf Danton
@ 2024-09-08 11:15   ` Hillf Danton
  2024-09-08 11:33     ` syzbot
  2024-09-08 12:50   ` Hillf Danton
                     ` (4 subsequent siblings)
  14 siblings, 1 reply; 44+ messages in thread
From: Hillf Danton @ 2024-09-08 11:15 UTC (permalink / raw)
  To: syzbot; +Cc: linux-kernel, syzkaller-bugs

On Sat, 07 Sep 2024 07:42:26 -0700
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    788220eee30d Merge tag 'pm-6.11-rc7' of git://git.kernel.o..
> git tree:       upstream
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1304189f980000

#syz test

--- l/net/bluetooth/l2cap_core.c
+++ c/net/bluetooth/l2cap_core.c
@@ -1747,6 +1747,8 @@ static void l2cap_unregister_all_users(s
 	}
 }
 
+static DEFINE_MUTEX(l2cap_conn_del_mutex);
+
 static void l2cap_conn_del(struct hci_conn *hcon, int err)
 {
 	struct l2cap_conn *conn = hcon->l2cap_data;
@@ -1792,14 +1794,15 @@ static void l2cap_conn_del(struct hci_co
 
 	mutex_unlock(&conn->chan_lock);
 
-	hci_chan_del(conn->hchan);
-
 	if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
 		cancel_delayed_work_sync(&conn->info_timer);
 
+	mutex_lock(&l2cap_conn_del_mutex);
 	hcon->l2cap_data = NULL;
+	hci_chan_del(conn->hchan);
 	conn->hchan = NULL;
 	l2cap_conn_put(conn);
+	mutex_unlock(&l2cap_conn_del_mutex);
 }
 
 static void l2cap_conn_free(struct kref *ref)
@@ -7480,6 +7483,7 @@ void l2cap_recv_acldata(struct hci_conn
 	struct l2cap_conn *conn = hcon->l2cap_data;
 	int len;
 
+	mutex_lock(&l2cap_conn_del_mutex);
 	if (!conn)
 		conn = l2cap_conn_add(hcon);
 
@@ -7512,6 +7516,7 @@ void l2cap_recv_acldata(struct hci_conn
 		if (len == skb->len) {
 			/* Complete frame received */
 			l2cap_recv_frame(conn, skb);
+			mutex_unlock(&l2cap_conn_del_mutex);
 			return;
 		}
 
@@ -7576,6 +7581,7 @@ void l2cap_recv_acldata(struct hci_conn
 
 drop:
 	kfree_skb(skb);
+	mutex_unlock(&l2cap_conn_del_mutex);
 }
 
 static struct hci_cb l2cap_cb = {
--

^ permalink raw reply	[flat|nested] 44+ messages in thread

* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
  2024-09-08 11:15   ` Hillf Danton
@ 2024-09-08 11:33     ` syzbot
  0 siblings, 0 replies; 44+ messages in thread
From: syzbot @ 2024-09-08 11:33 UTC (permalink / raw)
  To: hdanton, linux-kernel, syzkaller-bugs

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
possible deadlock in l2cap_recv_frame

Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
======================================================
WARNING: possible circular locking dependency detected
6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0 Not tainted
------------------------------------------------------
kworker/u9:2/5273 is trying to acquire lock:
ffff888031c20078 (&hdev->lock){+.+.}-{3:3}, at: l2cap_connect_req net/bluetooth/l2cap_core.c:4078 [inline]
ffff888031c20078 (&hdev->lock){+.+.}-{3:3}, at: l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4775 [inline]
ffff888031c20078 (&hdev->lock){+.+.}-{3:3}, at: l2cap_sig_channel net/bluetooth/l2cap_core.c:5546 [inline]
ffff888031c20078 (&hdev->lock){+.+.}-{3:3}, at: l2cap_recv_frame+0xe9d/0x8eb0 net/bluetooth/l2cap_core.c:6828

but task is already holding lock:
ffffffff8fcb1c28 (l2cap_conn_del_mutex){+.+.}-{3:3}, at: l2cap_recv_acldata+0x57/0xbd0 net/bluetooth/l2cap_core.c:7486

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #2 (l2cap_conn_del_mutex){+.+.}-{3:3}:
       __mutex_lock_common kernel/locking/mutex.c:608 [inline]
       __mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
       l2cap_conn_del+0x462/0x750 net/bluetooth/l2cap_core.c:1800
       l2cap_disconn_cfm net/bluetooth/l2cap_core.c:7310 [inline]
       l2cap_disconn_cfm+0x96/0xd0 net/bluetooth/l2cap_core.c:7303
       hci_disconn_cfm include/net/bluetooth/hci_core.h:1975 [inline]
       hci_conn_hash_flush+0x114/0x260 net/bluetooth/hci_conn.c:2592
       hci_dev_close_sync+0x59e/0x1110 net/bluetooth/hci_sync.c:5195
       hci_dev_do_close+0x2e/0x90 net/bluetooth/hci_core.c:483
       hci_unregister_dev+0x213/0x620 net/bluetooth/hci_core.c:2698
       vhci_release+0x7f/0x100 drivers/bluetooth/hci_vhci.c:664
       __fput+0x408/0xbb0 fs/file_table.c:422
       task_work_run+0x14e/0x250 kernel/task_work.c:228
       exit_task_work include/linux/task_work.h:40 [inline]
       do_exit+0xaa3/0x2bb0 kernel/exit.c:882
       do_group_exit+0xd3/0x2a0 kernel/exit.c:1031
       get_signal+0x25fb/0x2770 kernel/signal.c:2917
       arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:310
       exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
       exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
       __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
       syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
       do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #1 (hci_cb_list_lock){+.+.}-{3:3}:
       __mutex_lock_common kernel/locking/mutex.c:608 [inline]
       __mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
       hci_connect_cfm include/net/bluetooth/hci_core.h:1957 [inline]
       hci_remote_features_evt+0x4dc/0x9e0 net/bluetooth/hci_event.c:3721
       hci_event_func net/bluetooth/hci_event.c:7446 [inline]
       hci_event_packet+0x9eb/0x1180 net/bluetooth/hci_event.c:7498
       hci_rx_work+0x2c6/0x1610 net/bluetooth/hci_core.c:4023
       process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
       process_scheduled_works kernel/workqueue.c:3312 [inline]
       worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
       kthread+0x2c1/0x3a0 kernel/kthread.c:389
       ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

-> #0 (&hdev->lock){+.+.}-{3:3}:
       check_prev_add kernel/locking/lockdep.c:3133 [inline]
       check_prevs_add kernel/locking/lockdep.c:3252 [inline]
       validate_chain kernel/locking/lockdep.c:3868 [inline]
       __lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142
       lock_acquire kernel/locking/lockdep.c:5759 [inline]
       lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
       __mutex_lock_common kernel/locking/mutex.c:608 [inline]
       __mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
       l2cap_connect_req net/bluetooth/l2cap_core.c:4078 [inline]
       l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4775 [inline]
       l2cap_sig_channel net/bluetooth/l2cap_core.c:5546 [inline]
       l2cap_recv_frame+0xe9d/0x8eb0 net/bluetooth/l2cap_core.c:6828
       l2cap_recv_acldata+0x9fe/0xbd0 net/bluetooth/l2cap_core.c:7518
       hci_acldata_packet net/bluetooth/hci_core.c:3791 [inline]
       hci_rx_work+0xaab/0x1610 net/bluetooth/hci_core.c:4028
       process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
       process_scheduled_works kernel/workqueue.c:3312 [inline]
       worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
       kthread+0x2c1/0x3a0 kernel/kthread.c:389
       ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

other info that might help us debug this:

Chain exists of:
  &hdev->lock --> hci_cb_list_lock --> l2cap_conn_del_mutex

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(l2cap_conn_del_mutex);
                               lock(hci_cb_list_lock);
                               lock(l2cap_conn_del_mutex);
  lock(&hdev->lock);

 *** DEADLOCK ***

3 locks held by kworker/u9:2/5273:
 #0: ffff888062dda148 ((wq_completion)hci1#2){+.+.}-{0:0}, at: process_one_work+0x1277/0x1b40 kernel/workqueue.c:3206
 #1: ffffc9000379fd80 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x921/0x1b40 kernel/workqueue.c:3207
 #2: ffffffff8fcb1c28 (l2cap_conn_del_mutex){+.+.}-{3:3}, at: l2cap_recv_acldata+0x57/0xbd0 net/bluetooth/l2cap_core.c:7486

stack backtrace:
CPU: 1 UID: 0 PID: 5273 Comm: kworker/u9:2 Not tainted 6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: hci1 hci_rx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:93 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
 check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2186
 check_prev_add kernel/locking/lockdep.c:3133 [inline]
 check_prevs_add kernel/locking/lockdep.c:3252 [inline]
 validate_chain kernel/locking/lockdep.c:3868 [inline]
 __lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142
 lock_acquire kernel/locking/lockdep.c:5759 [inline]
 lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
 __mutex_lock_common kernel/locking/mutex.c:608 [inline]
 __mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
 l2cap_connect_req net/bluetooth/l2cap_core.c:4078 [inline]
 l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4775 [inline]
 l2cap_sig_channel net/bluetooth/l2cap_core.c:5546 [inline]
 l2cap_recv_frame+0xe9d/0x8eb0 net/bluetooth/l2cap_core.c:6828
 l2cap_recv_acldata+0x9fe/0xbd0 net/bluetooth/l2cap_core.c:7518
 hci_acldata_packet net/bluetooth/hci_core.c:3791 [inline]
 hci_rx_work+0xaab/0x1610 net/bluetooth/hci_core.c:4028
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)


Tested on:

commit:         d1f2d51b Merge tag 'clk-fixes-for-linus' of git://git...
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=103f1ffb980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=15508e00580000


^ permalink raw reply	[flat|nested] 44+ messages in thread

* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
  2024-09-07 14:42 ` syzbot
                     ` (9 preceding siblings ...)
  2024-09-08 11:15   ` Hillf Danton
@ 2024-09-08 12:50   ` Hillf Danton
  2024-09-08 13:10     ` syzbot
  2024-09-08 13:37   ` Hillf Danton
                     ` (3 subsequent siblings)
  14 siblings, 1 reply; 44+ messages in thread
From: Hillf Danton @ 2024-09-08 12:50 UTC (permalink / raw)
  To: syzbot; +Cc: linux-kernel, syzkaller-bugs

On Sat, 07 Sep 2024 07:42:26 -0700
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    788220eee30d Merge tag 'pm-6.11-rc7' of git://git.kernel.o..
> git tree:       upstream
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1304189f980000

#syz test

--- x/net/bluetooth/hci_core.c
+++ y/net/bluetooth/hci_core.c
@@ -3787,8 +3787,10 @@ static void hci_acldata_packet(struct hc
 	if (conn) {
 		hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
 
+		hci_req_sync_lock(hdev);
 		/* Send to upper protocol */
 		l2cap_recv_acldata(conn, skb, flags);
+		hci_req_sync_unlock(hdev);
 		return;
 	} else {
 		bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
--

^ permalink raw reply	[flat|nested] 44+ messages in thread

* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
  2024-09-08 12:50   ` Hillf Danton
@ 2024-09-08 13:10     ` syzbot
  0 siblings, 0 replies; 44+ messages in thread
From: syzbot @ 2024-09-08 13:10 UTC (permalink / raw)
  To: hdanton, linux-kernel, syzkaller-bugs

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in l2cap_recv_acldata

==================================================================
BUG: KASAN: slab-use-after-free in l2cap_recv_acldata+0xa0b/0xb70 net/bluetooth/l2cap_core.c:7480
Read of size 8 at addr ffff888031b08fe8 by task kworker/u9:8/7223

CPU: 0 UID: 0 PID: 7223 Comm: kworker/u9:8 Not tainted 6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: hci0 hci_rx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:93 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0xc3/0x620 mm/kasan/report.c:488
 kasan_report+0xd9/0x110 mm/kasan/report.c:601
 l2cap_recv_acldata+0xa0b/0xb70 net/bluetooth/l2cap_core.c:7480
 hci_acldata_packet net/bluetooth/hci_core.c:3792 [inline]
 hci_rx_work+0xac0/0x1630 net/bluetooth/hci_core.c:4030
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>

Allocated by task 6015:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:387
 kmalloc_noprof include/linux/slab.h:681 [inline]
 kzalloc_noprof include/linux/slab.h:807 [inline]
 __hci_conn_add+0x131/0x1a50 net/bluetooth/hci_conn.c:934
 hci_conn_add_unset+0x6d/0x100 net/bluetooth/hci_conn.c:1043
 hci_conn_request_evt+0x8c4/0xb40 net/bluetooth/hci_event.c:3288
 hci_event_func net/bluetooth/hci_event.c:7446 [inline]
 hci_event_packet+0x9eb/0x1180 net/bluetooth/hci_event.c:7498
 hci_rx_work+0x2c6/0x1630 net/bluetooth/hci_core.c:4025
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Freed by task 6017:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
 poison_slab_object+0xf7/0x160 mm/kasan/common.c:240
 __kasan_slab_free+0x32/0x50 mm/kasan/common.c:256
 kasan_slab_free include/linux/kasan.h:184 [inline]
 slab_free_hook mm/slub.c:2256 [inline]
 slab_free mm/slub.c:4477 [inline]
 kfree+0x12a/0x3b0 mm/slub.c:4598
 device_release+0xa1/0x240 drivers/base/core.c:2582
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x1e4/0x5a0 lib/kobject.c:737
 put_device drivers/base/core.c:3790 [inline]
 device_unregister+0x2f/0xc0 drivers/base/core.c:3913
 hci_conn_del_sysfs+0xb4/0x180 net/bluetooth/hci_sysfs.c:86
 hci_conn_cleanup net/bluetooth/hci_conn.c:175 [inline]
 hci_conn_del+0x54e/0xdb0 net/bluetooth/hci_conn.c:1162
 hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583
 abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2917
 hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

The buggy address belongs to the object at ffff888031b08000
 which belongs to the cache kmalloc-8k of size 8192
The buggy address is located 4072 bytes inside of
 freed 8192-byte region [ffff888031b08000, ffff888031b0a000)

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888031b0c000 pfn:0x31b08
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
ksm flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xfdffffff(slab)
raw: 00fff00000000040 ffff88801ac42280 ffffea0001f09000 0000000000000003
raw: ffff888031b0c000 0000000000020001 00000001fdffffff 0000000000000000
head: 00fff00000000040 ffff88801ac42280 ffffea0001f09000 0000000000000003
head: ffff888031b0c000 0000000000020001 00000001fdffffff 0000000000000000
head: 00fff00000000003 ffffea0000c6c201 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 6015, tgid 6015 (kworker/u9:6), ts 133220298161, free_ts 131544899649
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1500
 prep_new_page mm/page_alloc.c:1508 [inline]
 get_page_from_freelist+0x1351/0x2e50 mm/page_alloc.c:3446
 __alloc_pages_noprof+0x22b/0x2460 mm/page_alloc.c:4702
 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
 alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
 alloc_slab_page+0x4e/0xf0 mm/slub.c:2325
 allocate_slab mm/slub.c:2488 [inline]
 new_slab+0x84/0x260 mm/slub.c:2541
 ___slab_alloc+0xdac/0x1870 mm/slub.c:3727
 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3817
 __slab_alloc_node mm/slub.c:3870 [inline]
 slab_alloc_node mm/slub.c:4029 [inline]
 __kmalloc_cache_noprof+0x2b4/0x300 mm/slub.c:4188
 kmalloc_noprof include/linux/slab.h:681 [inline]
 kzalloc_noprof include/linux/slab.h:807 [inline]
 __hci_conn_add+0x131/0x1a50 net/bluetooth/hci_conn.c:934
 hci_conn_add_unset+0x6d/0x100 net/bluetooth/hci_conn.c:1043
 hci_conn_request_evt+0x8c4/0xb40 net/bluetooth/hci_event.c:3288
 hci_event_func net/bluetooth/hci_event.c:7446 [inline]
 hci_event_packet+0x9eb/0x1180 net/bluetooth/hci_event.c:7498
 hci_rx_work+0x2c6/0x1630 net/bluetooth/hci_core.c:4025
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
page last free pid 5957 tgid 5957 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1101 [inline]
 free_unref_page+0x64a/0xe40 mm/page_alloc.c:2619
 __put_partials+0x14c/0x170 mm/slub.c:3055
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x4e/0x140 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:322
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook mm/slub.c:3992 [inline]
 slab_alloc_node mm/slub.c:4041 [inline]
 kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4048
 ptlock_alloc mm/memory.c:6589 [inline]
 ptlock_init include/linux/mm.h:2944 [inline]
 pmd_ptlock_init include/linux/mm.h:3048 [inline]
 pagetable_pmd_ctor include/linux/mm.h:3086 [inline]
 pmd_alloc_one_noprof include/asm-generic/pgalloc.h:141 [inline]
 __pmd_alloc+0xc3/0x820 mm/memory.c:6079
 pmd_alloc include/linux/mm.h:2835 [inline]
 alloc_new_pmd mm/mremap.c:96 [inline]
 move_page_tables+0x2218/0x3780 mm/mremap.c:608
 shift_arg_pages+0x1eb/0x410 fs/exec.c:758
 setup_arg_pages+0x516/0xc70 fs/exec.c:880
 load_elf_binary+0xa66/0x4d90 fs/binfmt_elf.c:1014
 search_binary_handler fs/exec.c:1827 [inline]
 exec_binprm fs/exec.c:1869 [inline]
 bprm_execve fs/exec.c:1920 [inline]
 bprm_execve+0x703/0x1960 fs/exec.c:1896
 do_execveat_common.isra.0+0x4f1/0x630 fs/exec.c:2027
 do_execve fs/exec.c:2101 [inline]
 __do_sys_execve fs/exec.c:2177 [inline]
 __se_sys_execve fs/exec.c:2172 [inline]
 __x64_sys_execve+0x8c/0xb0 fs/exec.c:2172
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff888031b08e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888031b08f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888031b08f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                          ^
 ffff888031b09000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888031b09080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


Tested on:

commit:         d1f2d51b Merge tag 'clk-fixes-for-linus' of git://git...
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14151f29980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=15449ffb980000


^ permalink raw reply	[flat|nested] 44+ messages in thread

* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
  2024-09-07 14:42 ` syzbot
                     ` (10 preceding siblings ...)
  2024-09-08 12:50   ` Hillf Danton
@ 2024-09-08 13:37   ` Hillf Danton
  2024-09-08 13:58     ` syzbot
  2024-09-09 11:06   ` Hillf Danton
                     ` (2 subsequent siblings)
  14 siblings, 1 reply; 44+ messages in thread
From: Hillf Danton @ 2024-09-08 13:37 UTC (permalink / raw)
  To: syzbot; +Cc: linux-kernel, syzkaller-bugs

On Sat, 07 Sep 2024 07:42:26 -0700
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    788220eee30d Merge tag 'pm-6.11-rc7' of git://git.kernel.o..
> git tree:       upstream
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1304189f980000

#syz test

--- x/net/bluetooth/hci_core.c
+++ y/net/bluetooth/hci_core.c
@@ -3782,13 +3782,18 @@ static void hci_acldata_packet(struct hc
 
 	hci_dev_lock(hdev);
 	conn = hci_conn_hash_lookup_handle(hdev, handle);
+	if (conn)
+		hci_conn_get(conn);
 	hci_dev_unlock(hdev);
 
 	if (conn) {
 		hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
 
+		hci_req_sync_lock(hdev);
 		/* Send to upper protocol */
 		l2cap_recv_acldata(conn, skb, flags);
+		hci_req_sync_unlock(hdev);
+		hci_conn_put(conn);
 		return;
 	} else {
 		bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
--

^ permalink raw reply	[flat|nested] 44+ messages in thread

* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
  2024-09-08 13:37   ` Hillf Danton
@ 2024-09-08 13:58     ` syzbot
  0 siblings, 0 replies; 44+ messages in thread
From: syzbot @ 2024-09-08 13:58 UTC (permalink / raw)
  To: hdanton, linux-kernel, syzkaller-bugs

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
possible deadlock in hci_dev_do_close

======================================================
WARNING: possible circular locking dependency detected
6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0 Not tainted
------------------------------------------------------
syz-executor/5776 is trying to acquire lock:
ffff88807d6ca148 ((wq_completion)hci1#2){+.+.}-{0:0}, at: touch_wq_lockdep_map+0x6e/0x120 kernel/workqueue.c:3875

but task is already holding lock:
ffff888060a68d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close+0x26/0x90 net/bluetooth/hci_core.c:481

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #2 (&hdev->req_lock){+.+.}-{3:3}:
       __mutex_lock_common kernel/locking/mutex.c:608 [inline]
       __mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
       hci_acldata_packet net/bluetooth/hci_core.c:3792 [inline]
       hci_rx_work+0xabf/0x1650 net/bluetooth/hci_core.c:4033
       process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
       process_scheduled_works kernel/workqueue.c:3312 [inline]
       worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
       kthread+0x2c1/0x3a0 kernel/kthread.c:389
       ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

-> #1 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}:
       process_one_work+0x927/0x1b40 kernel/workqueue.c:3207
       process_scheduled_works kernel/workqueue.c:3312 [inline]
       worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
       kthread+0x2c1/0x3a0 kernel/kthread.c:389
       ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

-> #0 ((wq_completion)hci1#2){+.+.}-{0:0}:
       check_prev_add kernel/locking/lockdep.c:3133 [inline]
       check_prevs_add kernel/locking/lockdep.c:3252 [inline]
       validate_chain kernel/locking/lockdep.c:3868 [inline]
       __lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142
       lock_acquire kernel/locking/lockdep.c:5759 [inline]
       lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
       touch_wq_lockdep_map+0x78/0x120 kernel/workqueue.c:3875
       __flush_workqueue+0x129/0x1200 kernel/workqueue.c:3917
       drain_workqueue+0x18f/0x3d0 kernel/workqueue.c:4081
       hci_dev_close_sync+0x333/0x1110 net/bluetooth/hci_sync.c:5181
       hci_dev_do_close+0x2e/0x90 net/bluetooth/hci_core.c:483
       hci_unregister_dev+0x213/0x620 net/bluetooth/hci_core.c:2698
       vhci_release+0x7f/0x100 drivers/bluetooth/hci_vhci.c:664
       __fput+0x408/0xbb0 fs/file_table.c:422
       task_work_run+0x14e/0x250 kernel/task_work.c:228
       exit_task_work include/linux/task_work.h:40 [inline]
       do_exit+0xaa3/0x2bb0 kernel/exit.c:882
       do_group_exit+0xd3/0x2a0 kernel/exit.c:1031
       get_signal+0x25fb/0x2770 kernel/signal.c:2917
       arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:310
       exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
       exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
       __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
       syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
       do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

other info that might help us debug this:

Chain exists of:
  (wq_completion)hci1#2 --> (work_completion)(&hdev->rx_work) --> &hdev->req_lock

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&hdev->req_lock);
                               lock((work_completion)(&hdev->rx_work));
                               lock(&hdev->req_lock);
  lock((wq_completion)hci1#2);

 *** DEADLOCK ***

1 lock held by syz-executor/5776:
 #0: ffff888060a68d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close+0x26/0x90 net/bluetooth/hci_core.c:481

stack backtrace:
CPU: 0 UID: 0 PID: 5776 Comm: syz-executor Not tainted 6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:93 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
 check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2186
 check_prev_add kernel/locking/lockdep.c:3133 [inline]
 check_prevs_add kernel/locking/lockdep.c:3252 [inline]
 validate_chain kernel/locking/lockdep.c:3868 [inline]
 __lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142
 lock_acquire kernel/locking/lockdep.c:5759 [inline]
 lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
 touch_wq_lockdep_map+0x78/0x120 kernel/workqueue.c:3875
 __flush_workqueue+0x129/0x1200 kernel/workqueue.c:3917
 drain_workqueue+0x18f/0x3d0 kernel/workqueue.c:4081
 hci_dev_close_sync+0x333/0x1110 net/bluetooth/hci_sync.c:5181
 hci_dev_do_close+0x2e/0x90 net/bluetooth/hci_core.c:483
 hci_unregister_dev+0x213/0x620 net/bluetooth/hci_core.c:2698
 vhci_release+0x7f/0x100 drivers/bluetooth/hci_vhci.c:664
 __fput+0x408/0xbb0 fs/file_table.c:422
 task_work_run+0x14e/0x250 kernel/task_work.c:228
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0xaa3/0x2bb0 kernel/exit.c:882
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1031
 get_signal+0x25fb/0x2770 kernel/signal.c:2917
 arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:310
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
 do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc96277bb8a
Code: Unable to access opcode bytes at 0x7fc96277bb60.
RSP: 002b:00007ffc87843a70 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 00007fc96277bb8a
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00007ffc87843abc R08: 00007ffc878433cc R09: 00007ffc878437d7
R10: 00007ffc87843450 R11: 0000000000000293 R12: 0000000000000032
R13: 0000000000045913 R14: 00000000000458e1 R15: 00007ffc87843b10
 </TASK>


Tested on:

commit:         d1f2d51b Merge tag 'clk-fixes-for-linus' of git://git...
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14dd1f29980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=10014877980000


^ permalink raw reply	[flat|nested] 44+ messages in thread

* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
  2024-09-07 14:42 ` syzbot
                     ` (11 preceding siblings ...)
  2024-09-08 13:37   ` Hillf Danton
@ 2024-09-09 11:06   ` Hillf Danton
  2024-09-09 11:31     ` syzbot
  2024-09-11 11:29   ` Hillf Danton
  2024-09-12 11:49   ` Hillf Danton
  14 siblings, 1 reply; 44+ messages in thread
From: Hillf Danton @ 2024-09-09 11:06 UTC (permalink / raw)
  To: syzbot; +Cc: linux-kernel, syzkaller-bugs

On Sat, 07 Sep 2024 07:42:26 -0700
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    788220eee30d Merge tag 'pm-6.11-rc7' of git://git.kernel.o..
> git tree:       upstream
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1304189f980000

#syz test

--- x/net/bluetooth/l2cap_core.c
+++ y/net/bluetooth/l2cap_core.c
@@ -1792,13 +1792,10 @@ static void l2cap_conn_del(struct hci_co
 
 	mutex_unlock(&conn->chan_lock);
 
-	hci_chan_del(conn->hchan);
-
 	if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
 		cancel_delayed_work_sync(&conn->info_timer);
 
 	hcon->l2cap_data = NULL;
-	conn->hchan = NULL;
 	l2cap_conn_put(conn);
 }
 
@@ -1806,6 +1803,7 @@ static void l2cap_conn_free(struct kref
 {
 	struct l2cap_conn *conn = container_of(ref, struct l2cap_conn, ref);
 
+	hci_chan_del(conn->hchan);
 	hci_conn_put(conn->hcon);
 	kfree(conn);
 }
@@ -7486,6 +7484,14 @@ void l2cap_recv_acldata(struct hci_conn
 	if (!conn)
 		goto drop;
 
+	hci_dev_lock(hcon->hdev);
+	if (conn != hcon->l2cap_data)
+		conn = NULL;
+	else
+		l2cap_conn_get(conn);
+	hci_dev_unlock(hcon->hdev);
+	if (!conn)
+		goto drop;
 	BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags);
 
 	switch (flags) {
@@ -7512,6 +7518,7 @@ void l2cap_recv_acldata(struct hci_conn
 		if (len == skb->len) {
 			/* Complete frame received */
 			l2cap_recv_frame(conn, skb);
+			l2cap_conn_put(conn);
 			return;
 		}
 
@@ -7576,6 +7583,8 @@ void l2cap_recv_acldata(struct hci_conn
 
 drop:
 	kfree_skb(skb);
+	if (conn)
+		l2cap_conn_put(conn);
 }
 
 static struct hci_cb l2cap_cb = {
--- x/net/bluetooth/hci_core.c
+++ y/net/bluetooth/hci_core.c
@@ -3782,6 +3782,8 @@ static void hci_acldata_packet(struct hc
 
 	hci_dev_lock(hdev);
 	conn = hci_conn_hash_lookup_handle(hdev, handle);
+	if (conn)
+		hci_conn_get(conn);
 	hci_dev_unlock(hdev);
 
 	if (conn) {
@@ -3789,6 +3791,7 @@ static void hci_acldata_packet(struct hc
 
 		/* Send to upper protocol */
 		l2cap_recv_acldata(conn, skb, flags);
+		hci_conn_put(conn);
 		return;
 	} else {
 		bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
--

^ permalink raw reply	[flat|nested] 44+ messages in thread

* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
  2024-09-09 11:06   ` Hillf Danton
@ 2024-09-09 11:31     ` syzbot
  0 siblings, 0 replies; 44+ messages in thread
From: syzbot @ 2024-09-09 11:31 UTC (permalink / raw)
  To: hdanton, linux-kernel, syzkaller-bugs

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in hci_send_acl

==================================================================
BUG: KASAN: slab-use-after-free in hci_send_acl+0xc03/0xd30 net/bluetooth/hci_core.c:3230
Read of size 8 at addr ffff8880291d1618 by task kworker/u9:8/7107

CPU: 1 UID: 0 PID: 7107 Comm: kworker/u9:8 Not tainted 6.11.0-rc7-syzkaller-gda3ea35007d0-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: hci1 hci_rx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:93 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0xc3/0x620 mm/kasan/report.c:488
 kasan_report+0xd9/0x110 mm/kasan/report.c:601
 hci_send_acl+0xc03/0xd30 net/bluetooth/hci_core.c:3230
 l2cap_send_cmd+0x6e5/0x920 net/bluetooth/l2cap_core.c:973
 l2cap_connect.constprop.0+0x6f7/0x1270 net/bluetooth/l2cap_core.c:4032
 l2cap_connect_req net/bluetooth/l2cap_core.c:4078 [inline]
 l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4770 [inline]
 l2cap_sig_channel net/bluetooth/l2cap_core.c:5541 [inline]
 l2cap_recv_frame+0xf0b/0x8eb0 net/bluetooth/l2cap_core.c:6823
 l2cap_recv_acldata+0xc03/0xf00 net/bluetooth/l2cap_core.c:7520
 hci_acldata_packet net/bluetooth/hci_core.c:3793 [inline]
 hci_rx_work+0xabe/0x1630 net/bluetooth/hci_core.c:4031
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>

Allocated by task 54:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:387
 kmalloc_noprof include/linux/slab.h:681 [inline]
 kzalloc_noprof include/linux/slab.h:807 [inline]
 hci_chan_create+0xa6/0x3d0 net/bluetooth/hci_conn.c:2732
 l2cap_conn_add.part.0+0x1a/0xa60 net/bluetooth/l2cap_core.c:6862
 l2cap_conn_add net/bluetooth/l2cap_core.c:69 [inline]
 l2cap_connect_cfm+0x428/0xf80 net/bluetooth/l2cap_core.c:7243
 hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
 hci_remote_features_evt+0x548/0x9e0 net/bluetooth/hci_event.c:3721
 hci_event_func net/bluetooth/hci_event.c:7446 [inline]
 hci_event_packet+0x9eb/0x1180 net/bluetooth/hci_event.c:7498
 hci_rx_work+0x2c6/0x1630 net/bluetooth/hci_core.c:4026
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Freed by task 5973:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
 poison_slab_object+0xf7/0x160 mm/kasan/common.c:240
 __kasan_slab_free+0x32/0x50 mm/kasan/common.c:256
 kasan_slab_free include/linux/kasan.h:184 [inline]
 slab_free_hook mm/slub.c:2256 [inline]
 slab_free mm/slub.c:4477 [inline]
 kfree+0x12a/0x3b0 mm/slub.c:4598
 hci_chan_list_flush+0x81/0xf0 net/bluetooth/hci_conn.c:2772
 hci_conn_cleanup net/bluetooth/hci_conn.c:150 [inline]
 hci_conn_del+0x1cc/0xdb0 net/bluetooth/hci_conn.c:1162
 hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583
 abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2917
 hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

The buggy address belongs to the object at ffff8880291d1600
 which belongs to the cache kmalloc-128 of size 128
The buggy address is located 24 bytes inside of
 freed 128-byte region [ffff8880291d1600, ffff8880291d1680)

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880291d1900 pfn:0x291d1
flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xfdffffff(slab)
raw: 00fff00000000200 ffff88801ac41a00 ffffea0001fd5a90 ffffea00009ed310
raw: ffff8880291d1900 000000000010000d 00000001fdffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x352800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL|__GFP_THISNODE), pid 5909, tgid 5909 (syz-executor), ts 135353944743, free_ts 135353325117
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1500
 prep_new_page mm/page_alloc.c:1508 [inline]
 get_page_from_freelist+0x1351/0x2e50 mm/page_alloc.c:3446
 __alloc_pages_noprof+0x22b/0x2460 mm/page_alloc.c:4702
 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
 alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
 alloc_slab_page+0x4e/0xf0 mm/slub.c:2325
 allocate_slab mm/slub.c:2488 [inline]
 new_slab+0x84/0x260 mm/slub.c:2541
 ___slab_alloc+0xdac/0x1870 mm/slub.c:3727
 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3817
 __slab_alloc_node mm/slub.c:3870 [inline]
 slab_alloc_node mm/slub.c:4029 [inline]
 __do_kmalloc_node mm/slub.c:4161 [inline]
 __kmalloc_node_noprof+0x357/0x430 mm/slub.c:4168
 kmalloc_array_node_noprof include/linux/slab.h:788 [inline]
 alloc_slab_obj_exts+0x41/0xa0 mm/slub.c:1976
 __memcg_slab_post_alloc_hook+0x2bc/0x9c0 mm/memcontrol.c:3019
 memcg_slab_post_alloc_hook mm/slub.c:2164 [inline]
 slab_post_alloc_hook mm/slub.c:4002 [inline]
 slab_alloc_node mm/slub.c:4041 [inline]
 kmem_cache_alloc_noprof+0x2c6/0x2f0 mm/slub.c:4048
 copy_sighand+0x43/0x2c0 kernel/fork.c:1794
 copy_process+0x2771/0x8de0 kernel/fork.c:2368
 kernel_clone+0xfd/0x960 kernel/fork.c:2781
 __do_sys_clone+0xba/0x100 kernel/fork.c:2924
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
page last free pid 5909 tgid 5909 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1101 [inline]
 free_unref_page+0x64a/0xe40 mm/page_alloc.c:2619
 vfree+0x181/0x7a0 mm/vmalloc.c:3367
 copy_entries_to_user net/ipv6/netfilter/ip6_tables.c:882 [inline]
 get_entries net/ipv6/netfilter/ip6_tables.c:1039 [inline]
 do_ip6t_get_ctl+0x8ec/0xaf0 net/ipv6/netfilter/ip6_tables.c:1677
 nf_getsockopt+0x79/0xe0 net/netfilter/nf_sockopt.c:116
 ipv6_getsockopt+0x1fd/0x2c0 net/ipv6/ipv6_sockglue.c:1493
 tcp_getsockopt+0x9e/0x100 net/ipv4/tcp.c:4409
 do_sock_getsockopt+0x3fe/0x800 net/socket.c:2386
 __sys_getsockopt+0x1a1/0x270 net/socket.c:2415
 __do_sys_getsockopt net/socket.c:2425 [inline]
 __se_sys_getsockopt net/socket.c:2422 [inline]
 __x64_sys_getsockopt+0xbd/0x160 net/socket.c:2422
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff8880291d1500: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc
 ffff8880291d1580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8880291d1600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                            ^
 ffff8880291d1680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8880291d1700: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc
==================================================================


Tested on:

commit:         da3ea350 Linux 6.11-rc7
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15a3389f980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=28869f34c32848cf
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=131ace00580000


^ permalink raw reply	[flat|nested] 44+ messages in thread

* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
  2024-06-24 20:23 [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2) syzbot
  2024-09-07 14:42 ` syzbot
@ 2024-09-10 18:43 ` syzbot
  2024-09-23 16:13 ` [syzbot] Re: [PATCH] Bluetooth/l2cap: Fix uaf in l2cap_connect syzbot
  2 siblings, 0 replies; 44+ messages in thread
From: syzbot @ 2024-09-10 18:43 UTC (permalink / raw)
  To: eadavis, hdanton, johan.hedberg, linux-bluetooth, linux-kernel,
	luiz.dentz, luiz.von.dentz, marcel, syzkaller-bugs

syzbot has bisected this issue to:

commit 5af1f84ed13a416297ab9ced7537f4d5ae7f329a
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date:   Thu Aug 3 18:04:51 2023 +0000

    Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=12477bc7980000
start commit:   788220eee30d Merge tag 'pm-6.11-rc7' of git://git.kernel.o..
git tree:       upstream
final oops:     https://syzkaller.appspot.com/x/report.txt?x=11477bc7980000
console output: https://syzkaller.appspot.com/x/log.txt?x=16477bc7980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11da6f29980000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1304189f980000

Reported-by: syzbot+c12e2f941af1feb5632c@syzkaller.appspotmail.com
Fixes: 5af1f84ed13a ("Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

^ permalink raw reply	[flat|nested] 44+ messages in thread

* Re: [PATCH] Bluetooth/l2cap: Fix uaf in l2cap_connect
  2024-09-08  7:22   ` [PATCH] Bluetooth/l2cap: Fix uaf in l2cap_connect Edward Adam Davis
@ 2024-09-10 20:56     ` Luiz Augusto von Dentz
  2024-09-20 15:07       ` Luiz Augusto von Dentz
  2024-09-21 10:56       ` Hillf Danton
  0 siblings, 2 replies; 44+ messages in thread
From: Luiz Augusto von Dentz @ 2024-09-10 20:56 UTC (permalink / raw)
  To: Edward Adam Davis
  Cc: syzbot+c12e2f941af1feb5632c, johan.hedberg, linux-bluetooth,
	linux-kernel, marcel, syzkaller-bugs

Hi Edward,

On Sun, Sep 8, 2024 at 3:22 AM Edward Adam Davis <eadavis@qq.com> wrote:
>
> [Syzbot reported]
> BUG: KASAN: slab-use-after-free in l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949
> Read of size 8 at addr ffff8880241e9800 by task kworker/u9:0/54
>
> CPU: 0 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.11.0-rc6-syzkaller-00268-g788220eee30d #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
> Workqueue: hci2 hci_rx_work
> Call Trace:
>  <TASK>
>  __dump_stack lib/dump_stack.c:93 [inline]
>  dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
>  print_address_description mm/kasan/report.c:377 [inline]
>  print_report+0xc3/0x620 mm/kasan/report.c:488
>  kasan_report+0xd9/0x110 mm/kasan/report.c:601
>  l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949
>  l2cap_connect_req net/bluetooth/l2cap_core.c:4080 [inline]
>  l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4772 [inline]
>  l2cap_sig_channel net/bluetooth/l2cap_core.c:5543 [inline]
>  l2cap_recv_frame+0xf0b/0x8eb0 net/bluetooth/l2cap_core.c:6825
>  l2cap_recv_acldata+0x9b4/0xb70 net/bluetooth/l2cap_core.c:7514
>  hci_acldata_packet net/bluetooth/hci_core.c:3791 [inline]
>  hci_rx_work+0xaab/0x1610 net/bluetooth/hci_core.c:4028
>  process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
>  process_scheduled_works kernel/workqueue.c:3312 [inline]
>  worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
>  kthread+0x2c1/0x3a0 kernel/kthread.c:389
>  ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
>  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> ...
>
> Freed by task 5245:
>  kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
>  kasan_save_track+0x14/0x30 mm/kasan/common.c:68
>  kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
>  poison_slab_object+0xf7/0x160 mm/kasan/common.c:240
>  __kasan_slab_free+0x32/0x50 mm/kasan/common.c:256
>  kasan_slab_free include/linux/kasan.h:184 [inline]
>  slab_free_hook mm/slub.c:2256 [inline]
>  slab_free mm/slub.c:4477 [inline]
>  kfree+0x12a/0x3b0 mm/slub.c:4598
>  l2cap_conn_free net/bluetooth/l2cap_core.c:1810 [inline]
>  kref_put include/linux/kref.h:65 [inline]
>  l2cap_conn_put net/bluetooth/l2cap_core.c:1822 [inline]
>  l2cap_conn_del+0x59d/0x730 net/bluetooth/l2cap_core.c:1802
>  l2cap_connect_cfm+0x9e6/0xf80 net/bluetooth/l2cap_core.c:7241
>  hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
>  hci_conn_failed+0x1c3/0x370 net/bluetooth/hci_conn.c:1265
>  hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583
>  abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2917
>  hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328
>  process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
>  process_scheduled_works kernel/workqueue.c:3312 [inline]
>  worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
>  kthread+0x2c1/0x3a0 kernel/kthread.c:389
>  ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
>  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
>
> [Analysis]
> There was a data race when accessing conn in hci_rx_work and hci_cmd_sync_work.
> This is because the hci dev lock was prematurely exited when executing
> hci_acldata_macket() in hci_rx_work, which resulted in it being released
> by hci_cmd_sync_work when accessing conn outside the lock.
>
> Reported-and-tested-by: syzbot+c12e2f941af1feb5632c@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
> Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> ---
>  net/bluetooth/hci_core.c   | 3 ++-
>  net/bluetooth/l2cap_core.c | 2 --
>  2 files changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
> index f25a21f532aa..4f7b45bb863f 100644
> --- a/net/bluetooth/hci_core.c
> +++ b/net/bluetooth/hci_core.c
> @@ -3776,18 +3776,19 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
>
>         hci_dev_lock(hdev);
>         conn = hci_conn_hash_lookup_handle(hdev, handle);
> -       hci_dev_unlock(hdev);
>
>         if (conn) {
>                 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
>
>                 /* Send to upper protocol */
>                 l2cap_recv_acldata(conn, skb, flags);
> +               hci_dev_unlock(hdev);
>                 return;
>         } else {
>                 bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
>                            handle);
>         }
> +       hci_dev_unlock(hdev);

This is sort of risky, we shouldn't be calling this deep into the
stack with hci_dev_lock held.

>
>         kfree_skb(skb);
>  }
> diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> index 9988ba382b68..b948b0a3b2f2 100644
> --- a/net/bluetooth/l2cap_core.c
> +++ b/net/bluetooth/l2cap_core.c
> @@ -4072,10 +4072,8 @@ static int l2cap_connect_req(struct l2cap_conn *conn,
>         if (cmd_len < sizeof(struct l2cap_conn_req))
>                 return -EPROTO;
>
> -       hci_dev_lock(hdev);
>         if (hci_dev_test_flag(hdev, HCI_MGMT))
>                 mgmt_device_connected(hdev, hcon, NULL, 0);
> -       hci_dev_unlock(hdev);

So this might explain why things gets freed while processing the
request, we are locking to call mgmt_device_connected which I suspect
is no longer needed ever since:

commit db11223571d489d1aab575a4ac4b7352d2d54e2f
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date:   Tue Oct 25 14:12:58 2022 -0700

    Bluetooth: btusb: Default CONFIG_BT_HCIBTUSB_POLL_SYNC=y

    poll_sync has been proven to fix races of USB data and event endpoints
    so this enables it by default.

    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
    Tested-by: Tedd Ho-Jeong An <tedd.an@intel.com>

Anyway syzbot don't use btusb so I think this might be due some
command pending that the emulator is not responding and instead
sending data, and then there is the issue that 7b064edae38d
("Bluetooth: Fix authentication if acl data comes before remote
feature evt") attempted to fix which I think it actually made it worse
by moving the call to mgmt_device_connected into l2cap_core.c it sort
move the problem but didn't fix the actual problem.

Maybe something like the following would be a better approach:

https://gist.github.com/Vudentz/121a15fa4391b2b1f6c7e8d420a6846e

>
>         l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP);
>         return 0;
> --
> 2.43.0
>


-- 
Luiz Augusto von Dentz

^ permalink raw reply	[flat|nested] 44+ messages in thread

* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
  2024-09-07 14:42 ` syzbot
                     ` (12 preceding siblings ...)
  2024-09-09 11:06   ` Hillf Danton
@ 2024-09-11 11:29   ` Hillf Danton
  2024-09-11 11:59     ` syzbot
  2024-09-12 11:49   ` Hillf Danton
  14 siblings, 1 reply; 44+ messages in thread
From: Hillf Danton @ 2024-09-11 11:29 UTC (permalink / raw)
  To: syzbot; +Cc: linux-kernel, syzkaller-bugs

On Sat, 07 Sep 2024 07:42:26 -0700
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    788220eee30d Merge tag 'pm-6.11-rc7' of git://git.kernel.o..
> git tree:       upstream
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1304189f980000

#syz test

--- x/net/bluetooth/hci_core.c
+++ y/net/bluetooth/hci_core.c
@@ -3782,6 +3782,8 @@ static void hci_acldata_packet(struct hc
 
 	hci_dev_lock(hdev);
 	conn = hci_conn_hash_lookup_handle(hdev, handle);
+	if (conn)
+		hci_conn_get(conn);
 	hci_dev_unlock(hdev);
 
 	if (conn) {
@@ -3789,6 +3791,7 @@ static void hci_acldata_packet(struct hc
 
 		/* Send to upper protocol */
 		l2cap_recv_acldata(conn, skb, flags);
+		hci_conn_put(conn);
 		return;
 	} else {
 		bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
--- x/net/bluetooth/l2cap_core.c
+++ y/net/bluetooth/l2cap_core.c
@@ -1792,13 +1792,10 @@ static void l2cap_conn_del(struct hci_co
 
 	mutex_unlock(&conn->chan_lock);
 
-	hci_chan_del(conn->hchan);
-
 	if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
 		cancel_delayed_work_sync(&conn->info_timer);
 
 	hcon->l2cap_data = NULL;
-	conn->hchan = NULL;
 	l2cap_conn_put(conn);
 }
 
@@ -1806,6 +1803,7 @@ static void l2cap_conn_free(struct kref
 {
 	struct l2cap_conn *conn = container_of(ref, struct l2cap_conn, ref);
 
+	hci_chan_del(conn->hchan);
 	hci_conn_put(conn->hcon);
 	kfree(conn);
 }
@@ -4073,11 +4071,15 @@ static int l2cap_connect_req(struct l2ca
 		return -EPROTO;
 
 	hci_dev_lock(hdev);
+	if (hcon->state == BT_CLOSED) {
+		hci_dev_unlock(hdev);
+		return -EPROTO;
+	}
 	if (hci_dev_test_flag(hdev, HCI_MGMT))
 		mgmt_device_connected(hdev, hcon, NULL, 0);
-	hci_dev_unlock(hdev);
 
 	l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP);
+	hci_dev_unlock(hdev);
 	return 0;
 }
 
@@ -7486,6 +7488,14 @@ void l2cap_recv_acldata(struct hci_conn
 	if (!conn)
 		goto drop;
 
+	hci_dev_lock(hcon->hdev);
+	if (conn != hcon->l2cap_data)
+		conn = NULL;
+	else
+		l2cap_conn_get(conn);
+	hci_dev_unlock(hcon->hdev);
+	if (!conn)
+		goto drop;
 	BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags);
 
 	switch (flags) {
@@ -7512,6 +7522,7 @@ void l2cap_recv_acldata(struct hci_conn
 		if (len == skb->len) {
 			/* Complete frame received */
 			l2cap_recv_frame(conn, skb);
+			l2cap_conn_put(conn);
 			return;
 		}
 
@@ -7576,6 +7587,8 @@ void l2cap_recv_acldata(struct hci_conn
 
 drop:
 	kfree_skb(skb);
+	if (conn)
+		l2cap_conn_put(conn);
 }
 
 static struct hci_cb l2cap_cb = {
--

^ permalink raw reply	[flat|nested] 44+ messages in thread

* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
  2024-09-11 11:29   ` Hillf Danton
@ 2024-09-11 11:59     ` syzbot
  0 siblings, 0 replies; 44+ messages in thread
From: syzbot @ 2024-09-11 11:59 UTC (permalink / raw)
  To: hdanton, linux-kernel, syzkaller-bugs

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in hci_send_acl

Bluetooth: Wrong link type (-22)
Bluetooth: Wrong link type (-71)
==================================================================
BUG: KASAN: slab-use-after-free in hci_send_acl+0xc03/0xd30 net/bluetooth/hci_core.c:3230
Read of size 8 at addr ffff8880252f2018 by task kworker/u9:5/6019

CPU: 0 UID: 0 PID: 6019 Comm: kworker/u9:5 Not tainted 6.11.0-rc7-syzkaller-00020-g8d8d276ba2fb-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: hci2 hci_rx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:93 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0xc3/0x620 mm/kasan/report.c:488
 kasan_report+0xd9/0x110 mm/kasan/report.c:601
 hci_send_acl+0xc03/0xd30 net/bluetooth/hci_core.c:3230
 l2cap_send_cmd+0x6e5/0x920 net/bluetooth/l2cap_core.c:973
 l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5512 [inline]
 l2cap_sig_channel net/bluetooth/l2cap_core.c:5548 [inline]
 l2cap_recv_frame+0x21db/0x8f20 net/bluetooth/l2cap_core.c:6827
 l2cap_recv_acldata+0xc03/0xf00 net/bluetooth/l2cap_core.c:7524
 hci_acldata_packet net/bluetooth/hci_core.c:3793 [inline]
 hci_rx_work+0xabe/0x1630 net/bluetooth/hci_core.c:4031
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>

Allocated by task 6020:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:387
 kmalloc_noprof include/linux/slab.h:681 [inline]
 kzalloc_noprof include/linux/slab.h:807 [inline]
 hci_chan_create+0xa6/0x3d0 net/bluetooth/hci_conn.c:2732
 l2cap_conn_add.part.0+0x1a/0xa60 net/bluetooth/l2cap_core.c:6866
 l2cap_conn_add net/bluetooth/l2cap_core.c:69 [inline]
 l2cap_connect_cfm+0x428/0xf80 net/bluetooth/l2cap_core.c:7247
 hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
 hci_remote_features_evt+0x548/0x9e0 net/bluetooth/hci_event.c:3721
 hci_event_func net/bluetooth/hci_event.c:7446 [inline]
 hci_event_packet+0x9eb/0x1180 net/bluetooth/hci_event.c:7498
 hci_rx_work+0x2c6/0x1630 net/bluetooth/hci_core.c:4026
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Freed by task 5281:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
 poison_slab_object+0xf7/0x160 mm/kasan/common.c:240
 __kasan_slab_free+0x32/0x50 mm/kasan/common.c:256
 kasan_slab_free include/linux/kasan.h:184 [inline]
 slab_free_hook mm/slub.c:2256 [inline]
 slab_free mm/slub.c:4477 [inline]
 kfree+0x12a/0x3b0 mm/slub.c:4598
 hci_chan_list_flush+0x81/0xf0 net/bluetooth/hci_conn.c:2772
 hci_conn_cleanup net/bluetooth/hci_conn.c:150 [inline]
 hci_conn_del+0x1cc/0xdb0 net/bluetooth/hci_conn.c:1162
 hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583
 abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2917
 hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

The buggy address belongs to the object at ffff8880252f2000
 which belongs to the cache kmalloc-128 of size 128
The buggy address is located 24 bytes inside of
 freed 128-byte region [ffff8880252f2000, ffff8880252f2080)

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880252f2900 pfn:0x252f2
flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xfdffffff(slab)
raw: 00fff00000000200 ffff88801ac41a00 ffffea00007ba290 ffffea00008abdd0
raw: ffff8880252f2900 000000000010000c 00000001fdffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x152cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 6020, tgid 6020 (kworker/u9:6), ts 135162004436, free_ts 135147554210
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1500
 prep_new_page mm/page_alloc.c:1508 [inline]
 get_page_from_freelist+0x1351/0x2e50 mm/page_alloc.c:3446
 __alloc_pages_noprof+0x22b/0x2460 mm/page_alloc.c:4702
 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
 alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
 alloc_slab_page+0x4e/0xf0 mm/slub.c:2325
 allocate_slab mm/slub.c:2488 [inline]
 new_slab+0x84/0x260 mm/slub.c:2541
 ___slab_alloc+0xdac/0x1870 mm/slub.c:3727
 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3817
 __slab_alloc_node mm/slub.c:3870 [inline]
 slab_alloc_node mm/slub.c:4029 [inline]
 __kmalloc_cache_noprof+0x2b4/0x300 mm/slub.c:4188
 kmalloc_noprof include/linux/slab.h:681 [inline]
 kzalloc_noprof include/linux/slab.h:807 [inline]
 hci_chan_create+0xa6/0x3d0 net/bluetooth/hci_conn.c:2732
 l2cap_conn_add.part.0+0x1a/0xa60 net/bluetooth/l2cap_core.c:6866
 l2cap_conn_add net/bluetooth/l2cap_core.c:69 [inline]
 l2cap_connect_cfm+0x428/0xf80 net/bluetooth/l2cap_core.c:7247
 hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
 hci_remote_features_evt+0x548/0x9e0 net/bluetooth/hci_event.c:3721
 hci_event_func net/bluetooth/hci_event.c:7446 [inline]
 hci_event_packet+0x9eb/0x1180 net/bluetooth/hci_event.c:7498
 hci_rx_work+0x2c6/0x1630 net/bluetooth/hci_core.c:4026
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
page last free pid 5597 tgid 5597 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1101 [inline]
 free_unref_folios+0x9e9/0x1390 mm/page_alloc.c:2667
 folios_put_refs+0x560/0x760 mm/swap.c:1039
 free_pages_and_swap_cache+0x36d/0x510 mm/swap_state.c:332
 __tlb_batch_free_encoded_pages+0xf9/0x290 mm/mmu_gather.c:136
 tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:366 [inline]
 tlb_flush_mmu mm/mmu_gather.c:373 [inline]
 tlb_finish_mmu+0x168/0x7b0 mm/mmu_gather.c:465
 exit_mmap+0x3d1/0xb20 mm/mmap.c:3425
 __mmput+0x12a/0x480 kernel/fork.c:1345
 mmput+0x62/0x70 kernel/fork.c:1367
 exit_mm kernel/exit.c:571 [inline]
 do_exit+0x9bf/0x2bb0 kernel/exit.c:869
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1031
 __do_sys_exit_group kernel/exit.c:1042 [inline]
 __se_sys_exit_group kernel/exit.c:1040 [inline]
 __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1040
 x64_sys_call+0x14a9/0x16a0 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff8880252f1f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8880252f1f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8880252f2000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                            ^
 ffff8880252f2080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8880252f2100: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc
==================================================================


Tested on:

commit:         8d8d276b Merge tag 'trace-v6.11-rc6' of git://git.kern..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11556100580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=28869f34c32848cf
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=162a07c7980000


^ permalink raw reply	[flat|nested] 44+ messages in thread

* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
  2024-09-07 14:42 ` syzbot
                     ` (13 preceding siblings ...)
  2024-09-11 11:29   ` Hillf Danton
@ 2024-09-12 11:49   ` Hillf Danton
  2024-09-12 14:51     ` syzbot
  14 siblings, 1 reply; 44+ messages in thread
From: Hillf Danton @ 2024-09-12 11:49 UTC (permalink / raw)
  To: syzbot; +Cc: linux-kernel, syzkaller-bugs

On Sat, 07 Sep 2024 07:42:26 -0700
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    788220eee30d Merge tag 'pm-6.11-rc7' of git://git.kernel.o..
> git tree:       upstream
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1304189f980000

#syz test

--- x/include/net/bluetooth/hci_core.h
+++ y/include/net/bluetooth/hci_core.h
@@ -511,6 +511,7 @@ struct hci_dev {
 	struct sk_buff		*recv_event;
 
 	struct mutex		req_lock;
+	struct mutex		rx_lock;
 	wait_queue_head_t	req_wait_q;
 	__u32			req_status;
 	__u32			req_result;
--- x/net/bluetooth/hci_core.c
+++ y/net/bluetooth/hci_core.c
@@ -2507,6 +2507,7 @@ struct hci_dev *hci_alloc_dev_priv(int s
 
 	mutex_init(&hdev->lock);
 	mutex_init(&hdev->req_lock);
+	mutex_init(&hdev->rx_lock);
 
 	ida_init(&hdev->unset_handle_ida);
 
@@ -3977,6 +3978,7 @@ static void hci_rx_work(struct work_stru
 
 	BT_DBG("%s", hdev->name);
 
+	mutex_lock(&hdev->rx_lock);
 	/* The kcov_remote functions used for collecting packet parsing
 	 * coverage information from this background thread and associate
 	 * the coverage with the syscall's thread which originally injected
@@ -4043,6 +4045,7 @@ static void hci_rx_work(struct work_stru
 			break;
 		}
 	}
+	mutex_unlock(&hdev->rx_lock);
 }
 
 static void hci_send_cmd_sync(struct hci_dev *hdev, struct sk_buff *skb)
--- x/net/bluetooth/hci_sync.c
+++ y/net/bluetooth/hci_sync.c
@@ -325,9 +325,11 @@ static void hci_cmd_sync_work(struct wor
 			int err;
 
 			hci_req_sync_lock(hdev);
+			mutex_lock(&hdev->rx_lock);
 			err = entry->func(hdev, entry->data);
 			if (entry->destroy)
 				entry->destroy(hdev, entry->data, err);
+			mutex_unlock(&hdev->rx_lock);
 			hci_req_sync_unlock(hdev);
 		}
 
--

^ permalink raw reply	[flat|nested] 44+ messages in thread

* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
  2024-09-12 11:49   ` Hillf Danton
@ 2024-09-12 14:51     ` syzbot
  0 siblings, 0 replies; 44+ messages in thread
From: syzbot @ 2024-09-12 14:51 UTC (permalink / raw)
  To: hdanton, linux-kernel, syzkaller-bugs

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+c12e2f941af1feb5632c@syzkaller.appspotmail.com
Tested-by: syzbot+c12e2f941af1feb5632c@syzkaller.appspotmail.com

Tested on:

commit:         77f58789 Merge tag 'arm-fixes-6.11-3' of git://git.ker..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1190149f980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=28869f34c32848cf
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=14c2d807980000

Note: testing is done by a robot and is best-effort only.

^ permalink raw reply	[flat|nested] 44+ messages in thread

* Re: [PATCH] Bluetooth/l2cap: Fix uaf in l2cap_connect
  2024-09-10 20:56     ` Luiz Augusto von Dentz
@ 2024-09-20 15:07       ` Luiz Augusto von Dentz
  2024-09-21  1:40         ` Edward Adam Davis
  2024-09-21 10:56       ` Hillf Danton
  1 sibling, 1 reply; 44+ messages in thread
From: Luiz Augusto von Dentz @ 2024-09-20 15:07 UTC (permalink / raw)
  To: Edward Adam Davis
  Cc: syzbot+c12e2f941af1feb5632c, johan.hedberg, linux-bluetooth,
	linux-kernel, marcel, syzkaller-bugs

Hi Edward,

On Tue, Sep 10, 2024 at 4:56 PM Luiz Augusto von Dentz
<luiz.dentz@gmail.com> wrote:
>
> Hi Edward,
>
> On Sun, Sep 8, 2024 at 3:22 AM Edward Adam Davis <eadavis@qq.com> wrote:
> >
> > [Syzbot reported]
> > BUG: KASAN: slab-use-after-free in l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949
> > Read of size 8 at addr ffff8880241e9800 by task kworker/u9:0/54
> >
> > CPU: 0 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.11.0-rc6-syzkaller-00268-g788220eee30d #0
> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
> > Workqueue: hci2 hci_rx_work
> > Call Trace:
> >  <TASK>
> >  __dump_stack lib/dump_stack.c:93 [inline]
> >  dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
> >  print_address_description mm/kasan/report.c:377 [inline]
> >  print_report+0xc3/0x620 mm/kasan/report.c:488
> >  kasan_report+0xd9/0x110 mm/kasan/report.c:601
> >  l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949
> >  l2cap_connect_req net/bluetooth/l2cap_core.c:4080 [inline]
> >  l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4772 [inline]
> >  l2cap_sig_channel net/bluetooth/l2cap_core.c:5543 [inline]
> >  l2cap_recv_frame+0xf0b/0x8eb0 net/bluetooth/l2cap_core.c:6825
> >  l2cap_recv_acldata+0x9b4/0xb70 net/bluetooth/l2cap_core.c:7514
> >  hci_acldata_packet net/bluetooth/hci_core.c:3791 [inline]
> >  hci_rx_work+0xaab/0x1610 net/bluetooth/hci_core.c:4028
> >  process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
> >  process_scheduled_works kernel/workqueue.c:3312 [inline]
> >  worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
> >  kthread+0x2c1/0x3a0 kernel/kthread.c:389
> >  ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
> >  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> > ...
> >
> > Freed by task 5245:
> >  kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
> >  kasan_save_track+0x14/0x30 mm/kasan/common.c:68
> >  kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
> >  poison_slab_object+0xf7/0x160 mm/kasan/common.c:240
> >  __kasan_slab_free+0x32/0x50 mm/kasan/common.c:256
> >  kasan_slab_free include/linux/kasan.h:184 [inline]
> >  slab_free_hook mm/slub.c:2256 [inline]
> >  slab_free mm/slub.c:4477 [inline]
> >  kfree+0x12a/0x3b0 mm/slub.c:4598
> >  l2cap_conn_free net/bluetooth/l2cap_core.c:1810 [inline]
> >  kref_put include/linux/kref.h:65 [inline]
> >  l2cap_conn_put net/bluetooth/l2cap_core.c:1822 [inline]
> >  l2cap_conn_del+0x59d/0x730 net/bluetooth/l2cap_core.c:1802
> >  l2cap_connect_cfm+0x9e6/0xf80 net/bluetooth/l2cap_core.c:7241
> >  hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
> >  hci_conn_failed+0x1c3/0x370 net/bluetooth/hci_conn.c:1265
> >  hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583
> >  abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2917
> >  hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328
> >  process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
> >  process_scheduled_works kernel/workqueue.c:3312 [inline]
> >  worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
> >  kthread+0x2c1/0x3a0 kernel/kthread.c:389
> >  ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
> >  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> >
> > [Analysis]
> > There was a data race when accessing conn in hci_rx_work and hci_cmd_sync_work.
> > This is because the hci dev lock was prematurely exited when executing
> > hci_acldata_macket() in hci_rx_work, which resulted in it being released
> > by hci_cmd_sync_work when accessing conn outside the lock.
> >
> > Reported-and-tested-by: syzbot+c12e2f941af1feb5632c@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
> > Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> > ---
> >  net/bluetooth/hci_core.c   | 3 ++-
> >  net/bluetooth/l2cap_core.c | 2 --
> >  2 files changed, 2 insertions(+), 3 deletions(-)
> >
> > diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
> > index f25a21f532aa..4f7b45bb863f 100644
> > --- a/net/bluetooth/hci_core.c
> > +++ b/net/bluetooth/hci_core.c
> > @@ -3776,18 +3776,19 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
> >
> >         hci_dev_lock(hdev);
> >         conn = hci_conn_hash_lookup_handle(hdev, handle);
> > -       hci_dev_unlock(hdev);
> >
> >         if (conn) {
> >                 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
> >
> >                 /* Send to upper protocol */
> >                 l2cap_recv_acldata(conn, skb, flags);
> > +               hci_dev_unlock(hdev);
> >                 return;
> >         } else {
> >                 bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
> >                            handle);
> >         }
> > +       hci_dev_unlock(hdev);
>
> This is sort of risky, we shouldn't be calling this deep into the
> stack with hci_dev_lock held.
>
> >
> >         kfree_skb(skb);
> >  }
> > diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> > index 9988ba382b68..b948b0a3b2f2 100644
> > --- a/net/bluetooth/l2cap_core.c
> > +++ b/net/bluetooth/l2cap_core.c
> > @@ -4072,10 +4072,8 @@ static int l2cap_connect_req(struct l2cap_conn *conn,
> >         if (cmd_len < sizeof(struct l2cap_conn_req))
> >                 return -EPROTO;
> >
> > -       hci_dev_lock(hdev);
> >         if (hci_dev_test_flag(hdev, HCI_MGMT))
> >                 mgmt_device_connected(hdev, hcon, NULL, 0);
> > -       hci_dev_unlock(hdev);
>
> So this might explain why things gets freed while processing the
> request, we are locking to call mgmt_device_connected which I suspect
> is no longer needed ever since:
>
> commit db11223571d489d1aab575a4ac4b7352d2d54e2f
> Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> Date:   Tue Oct 25 14:12:58 2022 -0700
>
>     Bluetooth: btusb: Default CONFIG_BT_HCIBTUSB_POLL_SYNC=y
>
>     poll_sync has been proven to fix races of USB data and event endpoints
>     so this enables it by default.
>
>     Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
>     Tested-by: Tedd Ho-Jeong An <tedd.an@intel.com>
>
> Anyway syzbot don't use btusb so I think this might be due some
> command pending that the emulator is not responding and instead
> sending data, and then there is the issue that 7b064edae38d
> ("Bluetooth: Fix authentication if acl data comes before remote
> feature evt") attempted to fix which I think it actually made it worse
> by moving the call to mgmt_device_connected into l2cap_core.c it sort
> move the problem but didn't fix the actual problem.
>
> Maybe something like the following would be a better approach:
>
> https://gist.github.com/Vudentz/121a15fa4391b2b1f6c7e8d420a6846e

Any comments? Are you still planning to work on this?

> >
> >         l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP);
> >         return 0;
> > --
> > 2.43.0
> >
>
>
> --
> Luiz Augusto von Dentz



-- 
Luiz Augusto von Dentz

^ permalink raw reply	[flat|nested] 44+ messages in thread

* Re: [PATCH] Bluetooth/l2cap: Fix uaf in l2cap_connect
  2024-09-20 15:07       ` Luiz Augusto von Dentz
@ 2024-09-21  1:40         ` Edward Adam Davis
  0 siblings, 0 replies; 44+ messages in thread
From: Edward Adam Davis @ 2024-09-21  1:40 UTC (permalink / raw)
  To: luiz.dentz
  Cc: eadavis, johan.hedberg, linux-bluetooth, linux-kernel, marcel,
	syzbot+c12e2f941af1feb5632c, syzkaller-bugs

On Fri, 20 Sep 2024 11:07:05 -0400, Luiz Augusto von Dentz wrote:
> On Tue, Sep 10, 2024 at 4:56 PM Luiz Augusto von Dentz
> <luiz.dentz@gmail.com> wrote:
> >
> > Hi Edward,
> >
> > On Sun, Sep 8, 2024 at 3:22 AM Edward Adam Davis <eadavis@qq.com> wrote:
> > >
> > > [Syzbot reported]
> > > BUG: KASAN: slab-use-after-free in l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949
> > > Read of size 8 at addr ffff8880241e9800 by task kworker/u9:0/54
> > >
> > > CPU: 0 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.11.0-rc6-syzkaller-00268-g788220eee30d #0
> > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
> > > Workqueue: hci2 hci_rx_work
> > > Call Trace:
> > >  <TASK>
> > >  __dump_stack lib/dump_stack.c:93 [inline]
> > >  dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
> > >  print_address_description mm/kasan/report.c:377 [inline]
> > >  print_report+0xc3/0x620 mm/kasan/report.c:488
> > >  kasan_report+0xd9/0x110 mm/kasan/report.c:601
> > >  l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949
> > >  l2cap_connect_req net/bluetooth/l2cap_core.c:4080 [inline]
> > >  l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4772 [inline]
> > >  l2cap_sig_channel net/bluetooth/l2cap_core.c:5543 [inline]
> > >  l2cap_recv_frame+0xf0b/0x8eb0 net/bluetooth/l2cap_core.c:6825
> > >  l2cap_recv_acldata+0x9b4/0xb70 net/bluetooth/l2cap_core.c:7514
> > >  hci_acldata_packet net/bluetooth/hci_core.c:3791 [inline]
> > >  hci_rx_work+0xaab/0x1610 net/bluetooth/hci_core.c:4028
> > >  process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
> > >  process_scheduled_works kernel/workqueue.c:3312 [inline]
> > >  worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
> > >  kthread+0x2c1/0x3a0 kernel/kthread.c:389
> > >  ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
> > >  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> > > ...
> > >
> > > Freed by task 5245:
> > >  kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
> > >  kasan_save_track+0x14/0x30 mm/kasan/common.c:68
> > >  kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
> > >  poison_slab_object+0xf7/0x160 mm/kasan/common.c:240
> > >  __kasan_slab_free+0x32/0x50 mm/kasan/common.c:256
> > >  kasan_slab_free include/linux/kasan.h:184 [inline]
> > >  slab_free_hook mm/slub.c:2256 [inline]
> > >  slab_free mm/slub.c:4477 [inline]
> > >  kfree+0x12a/0x3b0 mm/slub.c:4598
> > >  l2cap_conn_free net/bluetooth/l2cap_core.c:1810 [inline]
> > >  kref_put include/linux/kref.h:65 [inline]
> > >  l2cap_conn_put net/bluetooth/l2cap_core.c:1822 [inline]
> > >  l2cap_conn_del+0x59d/0x730 net/bluetooth/l2cap_core.c:1802
> > >  l2cap_connect_cfm+0x9e6/0xf80 net/bluetooth/l2cap_core.c:7241
> > >  hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
> > >  hci_conn_failed+0x1c3/0x370 net/bluetooth/hci_conn.c:1265
> > >  hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583
> > >  abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2917
> > >  hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328
> > >  process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
> > >  process_scheduled_works kernel/workqueue.c:3312 [inline]
> > >  worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
> > >  kthread+0x2c1/0x3a0 kernel/kthread.c:389
> > >  ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
> > >  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> > >
> > > [Analysis]
> > > There was a data race when accessing conn in hci_rx_work and hci_cmd_sync_work.
> > > This is because the hci dev lock was prematurely exited when executing
> > > hci_acldata_macket() in hci_rx_work, which resulted in it being released
> > > by hci_cmd_sync_work when accessing conn outside the lock.
> > >
> > > Reported-and-tested-by: syzbot+c12e2f941af1feb5632c@syzkaller.appspotmail.com
> > > Closes: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
> > > Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> > > ---
> > >  net/bluetooth/hci_core.c   | 3 ++-
> > >  net/bluetooth/l2cap_core.c | 2 --
> > >  2 files changed, 2 insertions(+), 3 deletions(-)
> > >
> > > diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
> > > index f25a21f532aa..4f7b45bb863f 100644
> > > --- a/net/bluetooth/hci_core.c
> > > +++ b/net/bluetooth/hci_core.c
> > > @@ -3776,18 +3776,19 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
> > >
> > >         hci_dev_lock(hdev);
> > >         conn = hci_conn_hash_lookup_handle(hdev, handle);
> > > -       hci_dev_unlock(hdev);
> > >
> > >         if (conn) {
> > >                 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
> > >
> > >                 /* Send to upper protocol */
> > >                 l2cap_recv_acldata(conn, skb, flags);
> > > +               hci_dev_unlock(hdev);
> > >                 return;
> > >         } else {
> > >                 bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
> > >                            handle);
> > >         }
> > > +       hci_dev_unlock(hdev);
> >
> > This is sort of risky, we shouldn't be calling this deep into the
> > stack with hci_dev_lock held.
I haven't thought of any better way yet. I understand what you mean, holding
hci_dev_lock for a long time.
At present, it is not impossible to try some strong drugs.
> >
> > >
> > >         kfree_skb(skb);
> > >  }
> > > diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> > > index 9988ba382b68..b948b0a3b2f2 100644
> > > --- a/net/bluetooth/l2cap_core.c
> > > +++ b/net/bluetooth/l2cap_core.c
> > > @@ -4072,10 +4072,8 @@ static int l2cap_connect_req(struct l2cap_conn *conn,
> > >         if (cmd_len < sizeof(struct l2cap_conn_req))
> > >                 return -EPROTO;
> > >
> > > -       hci_dev_lock(hdev);
> > >         if (hci_dev_test_flag(hdev, HCI_MGMT))
> > >                 mgmt_device_connected(hdev, hcon, NULL, 0);
> > > -       hci_dev_unlock(hdev);
> >
> > So this might explain why things gets freed while processing the
> > request, we are locking to call mgmt_device_connected which I suspect
> > is no longer needed ever since:
> >
> > commit db11223571d489d1aab575a4ac4b7352d2d54e2f
> > Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> > Date:   Tue Oct 25 14:12:58 2022 -0700
> >
> >     Bluetooth: btusb: Default CONFIG_BT_HCIBTUSB_POLL_SYNC=y
> >
> >     poll_sync has been proven to fix races of USB data and event endpoints
> >     so this enables it by default.
> >
> >     Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> >     Tested-by: Tedd Ho-Jeong An <tedd.an@intel.com>
> >
> > Anyway syzbot don't use btusb so I think this might be due some
> > command pending that the emulator is not responding and instead
> > sending data, and then there is the issue that 7b064edae38d
> > ("Bluetooth: Fix authentication if acl data comes before remote
> > feature evt") attempted to fix which I think it actually made it worse
> > by moving the call to mgmt_device_connected into l2cap_core.c it sort
> > move the problem but didn't fix the actual problem.
I think 7B064edae38d is used to solve another issue.
> >
> > Maybe something like the following would be a better approach:
> >
> > https://gist.github.com/Vudentz/121a15fa4391b2b1f6c7e8d420a6846e
> 
> Any comments? Are you still planning to work on this?
Sorry for late.
> 
> > >
> > >         l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP);
> > >         return 0;
> > > --
> > > 2.43.0
> > >
> >
> >
> > --
> > Luiz Augusto von Dentz

BR,
Edward


^ permalink raw reply	[flat|nested] 44+ messages in thread

* Re: [PATCH] Bluetooth/l2cap: Fix uaf in l2cap_connect
  2024-09-10 20:56     ` Luiz Augusto von Dentz
  2024-09-20 15:07       ` Luiz Augusto von Dentz
@ 2024-09-21 10:56       ` Hillf Danton
  2024-09-23 14:32         ` Luiz Augusto von Dentz
  1 sibling, 1 reply; 44+ messages in thread
From: Hillf Danton @ 2024-09-21 10:56 UTC (permalink / raw)
  To: Luiz Augusto von Dentz
  Cc: Edward Adam Davis, syzbot+c12e2f941af1feb5632c, linux-bluetooth,
	linux-kernel, syzkaller-bugs

On Tue, Sep 10, 2024 at 4:56 PM Luiz Augusto von Dentz <luiz.dentz@gmail.com> wrote:
>
> Maybe something like the following would be a better approach:
>
> https://gist.github.com/Vudentz/121a15fa4391b2b1f6c7e8d420a6846e

If your idea is not bad, boy, feel free to win Tested-by from syzbot with it.

^ permalink raw reply	[flat|nested] 44+ messages in thread

* Re: [PATCH] Bluetooth/l2cap: Fix uaf in l2cap_connect
  2024-09-21 10:56       ` Hillf Danton
@ 2024-09-23 14:32         ` Luiz Augusto von Dentz
  2024-09-23 14:37           ` Aleksandr Nogikh
  0 siblings, 1 reply; 44+ messages in thread
From: Luiz Augusto von Dentz @ 2024-09-23 14:32 UTC (permalink / raw)
  To: Hillf Danton
  Cc: Edward Adam Davis, syzbot+c12e2f941af1feb5632c, linux-bluetooth,
	linux-kernel, syzkaller-bugs

Hi Hillf,

On Sat, Sep 21, 2024 at 6:56 AM Hillf Danton <hdanton@sina.com> wrote:
>
> On Tue, Sep 10, 2024 at 4:56 PM Luiz Augusto von Dentz <luiz.dentz@gmail.com> wrote:
> >
> > Maybe something like the following would be a better approach:
> >
> > https://gist.github.com/Vudentz/121a15fa4391b2b1f6c7e8d420a6846e
>
> If your idea is not bad, boy, feel free to win Tested-by from syzbot with it.

Is there a way to quickly check a patch with syzbot?

-- 
Luiz Augusto von Dentz

^ permalink raw reply	[flat|nested] 44+ messages in thread

* Re: [PATCH] Bluetooth/l2cap: Fix uaf in l2cap_connect
  2024-09-23 14:32         ` Luiz Augusto von Dentz
@ 2024-09-23 14:37           ` Aleksandr Nogikh
  2024-09-23 15:20             ` Luiz Augusto von Dentz
  0 siblings, 1 reply; 44+ messages in thread
From: Aleksandr Nogikh @ 2024-09-23 14:37 UTC (permalink / raw)
  To: Luiz Augusto von Dentz
  Cc: Hillf Danton, Edward Adam Davis, syzbot+c12e2f941af1feb5632c,
	linux-bluetooth, linux-kernel, syzkaller-bugs

On Mon, Sep 23, 2024 at 4:33 PM Luiz Augusto von Dentz
<luiz.dentz@gmail.com> wrote:
>
> Hi Hillf,
>
> On Sat, Sep 21, 2024 at 6:56 AM Hillf Danton <hdanton@sina.com> wrote:
> >
> > On Tue, Sep 10, 2024 at 4:56 PM Luiz Augusto von Dentz <luiz.dentz@gmail.com> wrote:
> > >
> > > Maybe something like the following would be a better approach:
> > >
> > > https://gist.github.com/Vudentz/121a15fa4391b2b1f6c7e8d420a6846e
> >
> > If your idea is not bad, boy, feel free to win Tested-by from syzbot with it.
>
> Is there a way to quickly check a patch with syzbot?

You can send a `#syz test` command in a reply to syzbot and attach the
patch-to-test to the email message.

See https://github.com/google/syzkaller/blob/master/docs/syzbot.md#testing-patches

-- 
Aleksandr

>
> --
> Luiz Augusto von Dentz
>

^ permalink raw reply	[flat|nested] 44+ messages in thread

* Re: [PATCH] Bluetooth/l2cap: Fix uaf in l2cap_connect
  2024-09-23 14:37           ` Aleksandr Nogikh
@ 2024-09-23 15:20             ` Luiz Augusto von Dentz
  2024-09-23 15:28               ` [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2) syzbot
                                 ` (2 more replies)
  0 siblings, 3 replies; 44+ messages in thread
From: Luiz Augusto von Dentz @ 2024-09-23 15:20 UTC (permalink / raw)
  To: Aleksandr Nogikh
  Cc: Hillf Danton, Edward Adam Davis, syzbot+c12e2f941af1feb5632c,
	linux-bluetooth, linux-kernel, syzkaller-bugs

Hi Aleksandr,

On Mon, Sep 23, 2024 at 10:37 AM Aleksandr Nogikh <nogikh@google.com> wrote:
>
> On Mon, Sep 23, 2024 at 4:33 PM Luiz Augusto von Dentz
> <luiz.dentz@gmail.com> wrote:
> >
> > Hi Hillf,
> >
> > On Sat, Sep 21, 2024 at 6:56 AM Hillf Danton <hdanton@sina.com> wrote:
> > >
> > > On Tue, Sep 10, 2024 at 4:56 PM Luiz Augusto von Dentz <luiz.dentz@gmail.com> wrote:
> > > >
> > > > Maybe something like the following would be a better approach:
> > > >
> > > > https://gist.github.com/Vudentz/121a15fa4391b2b1f6c7e8d420a6846e
> > >
> > > If your idea is not bad, boy, feel free to win Tested-by from syzbot with it.
> >
> > Is there a way to quickly check a patch with syzbot?
>
> You can send a `#syz test` command in a reply to syzbot and attach the
> patch-to-test to the email message.
>
> See https://github.com/google/syzkaller/blob/master/docs/syzbot.md#testing-patches

Thanks, lets see if this works:

#syz test

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index d6976db02c06..b2f8f9c5b610 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -3782,6 +3782,8 @@ static void hci_acldata_packet(struct hci_dev
*hdev, struct sk_buff *skb)

        hci_dev_lock(hdev);
        conn = hci_conn_hash_lookup_handle(hdev, handle);
+       if (conn && hci_dev_test_flag(hdev, HCI_MGMT))
+               mgmt_device_connected(hdev, conn, NULL, 0);
        hci_dev_unlock(hdev);

        if (conn) {
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 1c82dcdf6e8f..b87c0f1dab9e 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -3706,7 +3706,7 @@ static void hci_remote_features_evt(struct
hci_dev *hdev, void *data,
                goto unlock;
        }

-       if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
+       if (!ev->status) {
                struct hci_cp_remote_name_req cp;
                memset(&cp, 0, sizeof(cp));
                bacpy(&cp.bdaddr, &conn->dst);
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 9988ba382b68..6544c1ed7143 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -4066,17 +4066,9 @@ static void l2cap_connect(struct l2cap_conn
*conn, struct l2cap_cmd_hdr *cmd,
 static int l2cap_connect_req(struct l2cap_conn *conn,
                             struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
 {
-       struct hci_dev *hdev = conn->hcon->hdev;
-       struct hci_conn *hcon = conn->hcon;
-
        if (cmd_len < sizeof(struct l2cap_conn_req))
                return -EPROTO;

-       hci_dev_lock(hdev);
-       if (hci_dev_test_flag(hdev, HCI_MGMT))
-               mgmt_device_connected(hdev, hcon, NULL, 0);
-       hci_dev_unlock(hdev);
-
        l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP);
        return 0;
 }

^ permalink raw reply related	[flat|nested] 44+ messages in thread

* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
  2024-09-23 15:20             ` Luiz Augusto von Dentz
@ 2024-09-23 15:28               ` syzbot
  2024-09-23 15:38               ` [PATCH] Bluetooth/l2cap: Fix uaf in l2cap_connect Aleksandr Nogikh
  2024-09-23 15:48               ` Luiz Augusto von Dentz
  2 siblings, 0 replies; 44+ messages in thread
From: syzbot @ 2024-09-23 15:28 UTC (permalink / raw)
  To: eadavis, hdanton, linux-bluetooth, linux-kernel, luiz.dentz,
	nogikh, syzkaller-bugs

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to apply patch:
checking file net/bluetooth/hci_core.c
patch: **** malformed patch at line 6: diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c




Tested on:

commit:         de5cb0dc Merge branch 'address-masking'
git tree:       upstream
kernel config:  https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler:       
patch:          https://syzkaller.appspot.com/x/patch.diff?x=127c12a9980000


^ permalink raw reply	[flat|nested] 44+ messages in thread

* Re: [PATCH] Bluetooth/l2cap: Fix uaf in l2cap_connect
  2024-09-23 15:20             ` Luiz Augusto von Dentz
  2024-09-23 15:28               ` [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2) syzbot
@ 2024-09-23 15:38               ` Aleksandr Nogikh
  2024-09-23 15:48               ` Luiz Augusto von Dentz
  2 siblings, 0 replies; 44+ messages in thread
From: Aleksandr Nogikh @ 2024-09-23 15:38 UTC (permalink / raw)
  To: Luiz Augusto von Dentz
  Cc: Hillf Danton, Edward Adam Davis, syzbot+c12e2f941af1feb5632c,
	linux-bluetooth, linux-kernel, syzkaller-bugs

Hi Luiz,

On Mon, Sep 23, 2024 at 5:20 PM Luiz Augusto von Dentz
<luiz.dentz@gmail.com> wrote:
>
> Hi Aleksandr,
>
> On Mon, Sep 23, 2024 at 10:37 AM Aleksandr Nogikh <nogikh@google.com> wrote:
> >
> > On Mon, Sep 23, 2024 at 4:33 PM Luiz Augusto von Dentz
> > <luiz.dentz@gmail.com> wrote:
> > >
> > > Hi Hillf,
> > >
> > > On Sat, Sep 21, 2024 at 6:56 AM Hillf Danton <hdanton@sina.com> wrote:
> > > >
> > > > On Tue, Sep 10, 2024 at 4:56 PM Luiz Augusto von Dentz <luiz.dentz@gmail.com> wrote:
> > > > >
> > > > > Maybe something like the following would be a better approach:
> > > > >
> > > > > https://gist.github.com/Vudentz/121a15fa4391b2b1f6c7e8d420a6846e
> > > >
> > > > If your idea is not bad, boy, feel free to win Tested-by from syzbot with it.
> > >
> > > Is there a way to quickly check a patch with syzbot?
> >
> > You can send a `#syz test` command in a reply to syzbot and attach the
> > patch-to-test to the email message.
> >
> > See https://github.com/google/syzkaller/blob/master/docs/syzbot.md#testing-patches
>
> Thanks, lets see if this works:
>
> #syz test
>
> diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
> index d6976db02c06..b2f8f9c5b610 100644
> --- a/net/bluetooth/hci_core.c
> +++ b/net/bluetooth/hci_core.c
> @@ -3782,6 +3782,8 @@ static void hci_acldata_packet(struct hci_dev
> *hdev, struct sk_buff *skb)
>
>         hci_dev_lock(hdev);
>         conn = hci_conn_hash_lookup_handle(hdev, handle);
> +       if (conn && hci_dev_test_flag(hdev, HCI_MGMT))
> +               mgmt_device_connected(hdev, conn, NULL, 0);
>         hci_dev_unlock(hdev);
>

^^ Patch parsing will fail here because it expects to see the git diff
output as is -- i.e. if some line only consisted of a single
whitespace (= it was an empty line and it did not change), it must
remain so. Sometimes these whitespaces get lost during copy-pasting
and it confuses syzbot.

>         if (conn) {
> diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
> index 1c82dcdf6e8f..b87c0f1dab9e 100644
> --- a/net/bluetooth/hci_event.c
> +++ b/net/bluetooth/hci_event.c
> @@ -3706,7 +3706,7 @@ static void hci_remote_features_evt(struct
> hci_dev *hdev, void *data,
>                 goto unlock;
>         }
>
> -       if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
> +       if (!ev->status) {
>                 struct hci_cp_remote_name_req cp;
>                 memset(&cp, 0, sizeof(cp));
>                 bacpy(&cp.bdaddr, &conn->dst);
> diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> index 9988ba382b68..6544c1ed7143 100644
> --- a/net/bluetooth/l2cap_core.c
> +++ b/net/bluetooth/l2cap_core.c
> @@ -4066,17 +4066,9 @@ static void l2cap_connect(struct l2cap_conn
> *conn, struct l2cap_cmd_hdr *cmd,
>  static int l2cap_connect_req(struct l2cap_conn *conn,
>                              struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
>  {
> -       struct hci_dev *hdev = conn->hcon->hdev;
> -       struct hci_conn *hcon = conn->hcon;
> -
>         if (cmd_len < sizeof(struct l2cap_conn_req))
>                 return -EPROTO;
>
> -       hci_dev_lock(hdev);
> -       if (hci_dev_test_flag(hdev, HCI_MGMT))
> -               mgmt_device_connected(hdev, hcon, NULL, 0);
> -       hci_dev_unlock(hdev);
> -
>         l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP);
>         return 0;
>  }

-- 
Aleksandr

^ permalink raw reply	[flat|nested] 44+ messages in thread

* Re: [PATCH] Bluetooth/l2cap: Fix uaf in l2cap_connect
  2024-09-23 15:20             ` Luiz Augusto von Dentz
  2024-09-23 15:28               ` [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2) syzbot
  2024-09-23 15:38               ` [PATCH] Bluetooth/l2cap: Fix uaf in l2cap_connect Aleksandr Nogikh
@ 2024-09-23 15:48               ` Luiz Augusto von Dentz
  2024-09-23 16:21                 ` [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2) syzbot
  2 siblings, 1 reply; 44+ messages in thread
From: Luiz Augusto von Dentz @ 2024-09-23 15:48 UTC (permalink / raw)
  To: Aleksandr Nogikh
  Cc: Hillf Danton, Edward Adam Davis, syzbot+c12e2f941af1feb5632c,
	linux-bluetooth, linux-kernel, syzkaller-bugs

Hi,

On Mon, Sep 23, 2024 at 11:20 AM Luiz Augusto von Dentz
<luiz.dentz@gmail.com> wrote:
>
> Hi Aleksandr,
>
> On Mon, Sep 23, 2024 at 10:37 AM Aleksandr Nogikh <nogikh@google.com> wrote:
> >
> > On Mon, Sep 23, 2024 at 4:33 PM Luiz Augusto von Dentz
> > <luiz.dentz@gmail.com> wrote:
> > >
> > > Hi Hillf,
> > >
> > > On Sat, Sep 21, 2024 at 6:56 AM Hillf Danton <hdanton@sina.com> wrote:
> > > >
> > > > On Tue, Sep 10, 2024 at 4:56 PM Luiz Augusto von Dentz <luiz.dentz@gmail.com> wrote:
> > > > >
> > > > > Maybe something like the following would be a better approach:
> > > > >
> > > > > https://gist.github.com/Vudentz/121a15fa4391b2b1f6c7e8d420a6846e
> > > >
> > > > If your idea is not bad, boy, feel free to win Tested-by from syzbot with it.
> > >
> > > Is there a way to quickly check a patch with syzbot?
> >
> > You can send a `#syz test` command in a reply to syzbot and attach the
> > patch-to-test to the email message.
> >
> > See https://github.com/google/syzkaller/blob/master/docs/syzbot.md#testing-patches
>

Lets try again with git diff output:

#syz test

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index d6976db02c06..b2f8f9c5b610 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -3782,6 +3782,8 @@ static void hci_acldata_packet(struct hci_dev
*hdev, struct sk_buff *skb)

     hci_dev_lock(hdev);
     conn = hci_conn_hash_lookup_handle(hdev, handle);
+    if (conn && hci_dev_test_flag(hdev, HCI_MGMT))
+        mgmt_device_connected(hdev, conn, NULL, 0);
     hci_dev_unlock(hdev);

     if (conn) {
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 1c82dcdf6e8f..b87c0f1dab9e 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -3706,7 +3706,7 @@ static void hci_remote_features_evt(struct
hci_dev *hdev, void *data,
         goto unlock;
     }

-    if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
+    if (!ev->status) {
         struct hci_cp_remote_name_req cp;
         memset(&cp, 0, sizeof(cp));
         bacpy(&cp.bdaddr, &conn->dst);
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 9988ba382b68..6544c1ed7143 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -4066,17 +4066,9 @@ static void l2cap_connect(struct l2cap_conn
*conn, struct l2cap_cmd_hdr *cmd,
 static int l2cap_connect_req(struct l2cap_conn *conn,
                  struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
 {
-    struct hci_dev *hdev = conn->hcon->hdev;
-    struct hci_conn *hcon = conn->hcon;
-
     if (cmd_len < sizeof(struct l2cap_conn_req))
         return -EPROTO;

-    hci_dev_lock(hdev);
-    if (hci_dev_test_flag(hdev, HCI_MGMT))
-        mgmt_device_connected(hdev, hcon, NULL, 0);
-    hci_dev_unlock(hdev);
-
     l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP);
     return 0;
 }

^ permalink raw reply related	[flat|nested] 44+ messages in thread

* Re: [syzbot] Re: [PATCH] Bluetooth/l2cap: Fix uaf in l2cap_connect
  2024-06-24 20:23 [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2) syzbot
  2024-09-07 14:42 ` syzbot
  2024-09-10 18:43 ` syzbot
@ 2024-09-23 16:13 ` syzbot
  2 siblings, 0 replies; 44+ messages in thread
From: syzbot @ 2024-09-23 16:13 UTC (permalink / raw)
  To: linux-kernel

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: Re: [PATCH] Bluetooth/l2cap: Fix uaf in l2cap_connect
Author: luiz.dentz@gmail.com

Hi Aleksandr,

On Mon, Sep 23, 2024 at 11:52 AM Aleksandr Nogikh <nogikh@google.com> wrote:
>
> (removed public mailing lists from Cc)
>
> On Mon, Sep 23, 2024 at 5:48 PM Luiz Augusto von Dentz
> <luiz.dentz@gmail.com> wrote:
> >
> > Hi,
> >
> > On Mon, Sep 23, 2024 at 11:20 AM Luiz Augusto von Dentz
> > <luiz.dentz@gmail.com> wrote:
> > >
> > > Hi Aleksandr,
> > >
> > > On Mon, Sep 23, 2024 at 10:37 AM Aleksandr Nogikh <nogikh@google.com> wrote:
> > > >
> > > > On Mon, Sep 23, 2024 at 4:33 PM Luiz Augusto von Dentz
> > > > <luiz.dentz@gmail.com> wrote:
> > > > >
> > > > > Hi Hillf,
> > > > >
> > > > > On Sat, Sep 21, 2024 at 6:56 AM Hillf Danton <hdanton@sina.com> wrote:
> > > > > >
> > > > > > On Tue, Sep 10, 2024 at 4:56 PM Luiz Augusto von Dentz <luiz.dentz@gmail.com> wrote:
> > > > > > >
> > > > > > > Maybe something like the following would be a better approach:
> > > > > > >
> > > > > > > https://gist.github.com/Vudentz/121a15fa4391b2b1f6c7e8d420a6846e
> > > > > >
> > > > > > If your idea is not bad, boy, feel free to win Tested-by from syzbot with it.
> > > > >
> > > > > Is there a way to quickly check a patch with syzbot?
> > > >
> > > > You can send a `#syz test` command in a reply to syzbot and attach the
> > > > patch-to-test to the email message.
> > > >
> > > > See https://github.com/google/syzkaller/blob/master/docs/syzbot.md#testing-patches
> > >
> Looks like the whitespaces still got lost while copy-pasting :(
> As an option, you can also just attach the patch as a file.

Yeah, looks like gmail web client screwing things up, anyway lets try
attaching the patch:

#syz test


-- 
Luiz Augusto von Dentz

^ permalink raw reply	[flat|nested] 44+ messages in thread

* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
  2024-09-23 15:48               ` Luiz Augusto von Dentz
@ 2024-09-23 16:21                 ` syzbot
  0 siblings, 0 replies; 44+ messages in thread
From: syzbot @ 2024-09-23 16:21 UTC (permalink / raw)
  To: eadavis, hdanton, linux-bluetooth, linux-kernel, luiz.dentz,
	nogikh, syzkaller-bugs

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to apply patch:
checking file net/bluetooth/hci_core.c
patch: **** malformed patch at line 6: diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c




Tested on:

commit:         de5cb0dc Merge branch 'address-masking'
git tree:       upstream
kernel config:  https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler:       
patch:          https://syzkaller.appspot.com/x/patch.diff?x=11f72107980000


^ permalink raw reply	[flat|nested] 44+ messages in thread

end of thread, other threads:[~2024-09-23 16:21 UTC | newest]

Thread overview: 44+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-06-24 20:23 [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2) syzbot
2024-09-07 14:42 ` syzbot
2024-09-08  0:01   ` Hillf Danton
2024-09-08  0:24     ` syzbot
2024-09-08  1:28   ` Edward Adam Davis
2024-09-08  1:51     ` syzbot
2024-09-08  2:06   ` Edward Adam Davis
2024-09-08  2:29     ` syzbot
2024-09-08  2:41   ` Edward Adam Davis
2024-09-08  3:06     ` syzbot
2024-09-08  3:15   ` Edward Adam Davis
2024-09-08  3:58     ` syzbot
2024-09-08  3:25   ` Hillf Danton
2024-09-08  4:07     ` syzbot
2024-09-08  4:07   ` Edward Adam Davis
2024-09-08  4:37     ` syzbot
2024-09-08  7:22   ` [PATCH] Bluetooth/l2cap: Fix uaf in l2cap_connect Edward Adam Davis
2024-09-10 20:56     ` Luiz Augusto von Dentz
2024-09-20 15:07       ` Luiz Augusto von Dentz
2024-09-21  1:40         ` Edward Adam Davis
2024-09-21 10:56       ` Hillf Danton
2024-09-23 14:32         ` Luiz Augusto von Dentz
2024-09-23 14:37           ` Aleksandr Nogikh
2024-09-23 15:20             ` Luiz Augusto von Dentz
2024-09-23 15:28               ` [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2) syzbot
2024-09-23 15:38               ` [PATCH] Bluetooth/l2cap: Fix uaf in l2cap_connect Aleksandr Nogikh
2024-09-23 15:48               ` Luiz Augusto von Dentz
2024-09-23 16:21                 ` [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2) syzbot
2024-09-08  8:32   ` Hillf Danton
2024-09-08  8:52     ` syzbot
2024-09-08 11:15   ` Hillf Danton
2024-09-08 11:33     ` syzbot
2024-09-08 12:50   ` Hillf Danton
2024-09-08 13:10     ` syzbot
2024-09-08 13:37   ` Hillf Danton
2024-09-08 13:58     ` syzbot
2024-09-09 11:06   ` Hillf Danton
2024-09-09 11:31     ` syzbot
2024-09-11 11:29   ` Hillf Danton
2024-09-11 11:59     ` syzbot
2024-09-12 11:49   ` Hillf Danton
2024-09-12 14:51     ` syzbot
2024-09-10 18:43 ` syzbot
2024-09-23 16:13 ` [syzbot] Re: [PATCH] Bluetooth/l2cap: Fix uaf in l2cap_connect syzbot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).