* [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
@ 2024-06-24 20:23 syzbot
2024-09-07 14:42 ` syzbot
2024-09-10 18:43 ` syzbot
0 siblings, 2 replies; 34+ messages in thread
From: syzbot @ 2024-06-24 20:23 UTC (permalink / raw)
To: johan.hedberg, linux-bluetooth, linux-kernel, luiz.dentz, marcel,
syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 5f583a3162ff Merge tag 'rust-fixes-6.10' of https://github..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11170741980000
kernel config: https://syzkaller.appspot.com/x/.config?x=f413acf5b1eb4093
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f530c7950839/disk-5f583a31.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/b4f810bbc13e/vmlinux-5f583a31.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a49ec6dadbad/bzImage-5f583a31.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c12e2f941af1feb5632c@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: slab-use-after-free in l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949
Read of size 8 at addr ffff88802af53000 by task kworker/u9:4/5114
CPU: 1 PID: 5114 Comm: kworker/u9:4 Not tainted 6.10.0-rc4-syzkaller-00301-g5f583a3162ff #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Workqueue: hci1 hci_rx_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114
print_address_description mm/kasan/report.c:377 [inline]
print_report+0xc3/0x620 mm/kasan/report.c:488
kasan_report+0xd9/0x110 mm/kasan/report.c:601
l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949
l2cap_connect_req net/bluetooth/l2cap_core.c:4080 [inline]
l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4772 [inline]
l2cap_sig_channel net/bluetooth/l2cap_core.c:5543 [inline]
l2cap_recv_frame+0xf07/0x8e50 net/bluetooth/l2cap_core.c:6821
l2cap_recv_acldata+0x9ac/0xb60 net/bluetooth/l2cap_core.c:7510
hci_acldata_packet net/bluetooth/hci_core.c:3842 [inline]
hci_rx_work+0xaa7/0x1610 net/bluetooth/hci_core.c:4079
process_one_work+0x9fb/0x1b60 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Allocated by task 4480:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:387
kmalloc_noprof include/linux/slab.h:660 [inline]
kzalloc_noprof include/linux/slab.h:778 [inline]
l2cap_conn_add.part.0+0x60/0xa60 net/bluetooth/l2cap_core.c:6864
l2cap_conn_add net/bluetooth/l2cap_core.c:69 [inline]
l2cap_connect_cfm+0x428/0xf80 net/bluetooth/l2cap_core.c:7241
hci_connect_cfm include/net/bluetooth/hci_core.h:1970 [inline]
hci_remote_features_evt+0x548/0x9e0 net/bluetooth/hci_event.c:3721
hci_event_func net/bluetooth/hci_event.c:7417 [inline]
hci_event_packet+0x9e3/0x1170 net/bluetooth/hci_event.c:7469
hci_rx_work+0x2c4/0x1610 net/bluetooth/hci_core.c:4074
process_one_work+0x9fb/0x1b60 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Freed by task 5112:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
poison_slab_object+0xf7/0x160 mm/kasan/common.c:240
__kasan_slab_free+0x32/0x50 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2196 [inline]
slab_free mm/slub.c:4437 [inline]
kfree+0x12a/0x3b0 mm/slub.c:4558
l2cap_conn_free net/bluetooth/l2cap_core.c:1810 [inline]
kref_put include/linux/kref.h:65 [inline]
l2cap_conn_put net/bluetooth/l2cap_core.c:1822 [inline]
l2cap_conn_del+0x59d/0x740 net/bluetooth/l2cap_core.c:1802
l2cap_connect_cfm+0x9e6/0xf80 net/bluetooth/l2cap_core.c:7237
hci_connect_cfm include/net/bluetooth/hci_core.h:1970 [inline]
hci_conn_failed+0x1c3/0x370 net/bluetooth/hci_conn.c:1257
hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5450
abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2909
hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:310
process_one_work+0x9fb/0x1b60 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Last potentially related work creation:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
__kasan_record_aux_stack+0xba/0xd0 mm/kasan/generic.c:541
insert_work+0x36/0x230 kernel/workqueue.c:2207
__queue_work+0x944/0x1020 kernel/workqueue.c:2359
call_timer_fn+0x1a0/0x610 kernel/time/timer.c:1792
expire_timers kernel/time/timer.c:1838 [inline]
__run_timers+0x567/0xaf0 kernel/time/timer.c:2417
__run_timer_base kernel/time/timer.c:2428 [inline]
__run_timer_base kernel/time/timer.c:2421 [inline]
run_timer_base+0x111/0x190 kernel/time/timer.c:2437
run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2447
handle_softirqs+0x216/0x8f0 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu kernel/softirq.c:637 [inline]
irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1043
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
Second to last potentially related work creation:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
__kasan_record_aux_stack+0xba/0xd0 mm/kasan/generic.c:541
insert_work+0x36/0x230 kernel/workqueue.c:2207
__queue_work+0x525/0x1020 kernel/workqueue.c:2363
queue_work_on+0x11a/0x140 kernel/workqueue.c:2410
queue_work include/linux/workqueue.h:621 [inline]
l2cap_conn_ready net/bluetooth/l2cap_core.c:1640 [inline]
l2cap_connect_cfm+0x9c9/0xf80 net/bluetooth/l2cap_core.c:7282
hci_connect_cfm include/net/bluetooth/hci_core.h:1970 [inline]
hci_remote_features_evt+0x548/0x9e0 net/bluetooth/hci_event.c:3721
hci_event_func net/bluetooth/hci_event.c:7417 [inline]
hci_event_packet+0x9e3/0x1170 net/bluetooth/hci_event.c:7469
hci_rx_work+0x2c4/0x1610 net/bluetooth/hci_core.c:4074
process_one_work+0x9fb/0x1b60 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
The buggy address belongs to the object at ffff88802af53000
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 0 bytes inside of
freed 1024-byte region [ffff88802af53000, ffff88802af53400)
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2af50
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffefff(slab)
raw: 00fff00000000040 ffff888015441dc0 0000000000000000 dead000000000001
raw: 0000000000000000 0000000000100010 00000001ffffefff 0000000000000000
head: 00fff00000000040 ffff888015441dc0 0000000000000000 dead000000000001
head: 0000000000000000 0000000000100010 00000001ffffefff 0000000000000000
head: 00fff00000000003 ffffea0000abd401 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4752, tgid 4752 (dhcpcd), ts 66098690934, free_ts 66038999175
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1468
prep_new_page mm/page_alloc.c:1476 [inline]
get_page_from_freelist+0x136a/0x2e50 mm/page_alloc.c:3420
__alloc_pages_noprof+0x22b/0x2460 mm/page_alloc.c:4678
__alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
alloc_slab_page+0x56/0x110 mm/slub.c:2265
allocate_slab mm/slub.c:2428 [inline]
new_slab+0x84/0x260 mm/slub.c:2481
___slab_alloc+0xdac/0x1870 mm/slub.c:3667
__slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3757
__slab_alloc_node mm/slub.c:3810 [inline]
slab_alloc_node mm/slub.c:3989 [inline]
__do_kmalloc_node mm/slub.c:4121 [inline]
kmalloc_node_track_caller_noprof+0x355/0x430 mm/slub.c:4142
kmemdup_noprof+0x29/0x60 mm/util.c:131
kmemdup_noprof include/linux/fortify-string.h:757 [inline]
bpf_migrate_filter+0xc6/0x390 net/core/filter.c:1268
bpf_prepare_filter+0x183/0x380 net/core/filter.c:1354
bpf_prog_create_from_user+0x1e4/0x2d0 net/core/filter.c:1448
seccomp_prepare_filter kernel/seccomp.c:680 [inline]
seccomp_prepare_user_filter kernel/seccomp.c:717 [inline]
seccomp_set_mode_filter kernel/seccomp.c:1935 [inline]
do_seccomp+0x7b6/0x2580 kernel/seccomp.c:2055
prctl_set_seccomp+0x4b/0x70 kernel/seccomp.c:2108
__do_sys_prctl+0xc83/0x1e40 kernel/sys.c:2539
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
page last free pid 4747 tgid 4747 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1088 [inline]
free_unref_page+0x64a/0xe40 mm/page_alloc.c:2583
__put_partials+0x14c/0x170 mm/slub.c:2995
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:322
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3941 [inline]
slab_alloc_node mm/slub.c:4001 [inline]
kmem_cache_alloc_lru_noprof+0x121/0x2f0 mm/slub.c:4020
shmem_alloc_inode+0x25/0x50 mm/shmem.c:4468
alloc_inode+0x5d/0x230 fs/inode.c:261
new_inode_pseudo fs/inode.c:1007 [inline]
new_inode+0x22/0x270 fs/inode.c:1033
__shmem_get_inode mm/shmem.c:2503 [inline]
shmem_get_inode+0x194/0xe80 mm/shmem.c:2574
shmem_mknod+0x66/0x240 mm/shmem.c:3268
shmem_mkdir+0x31/0x60 mm/shmem.c:3329
vfs_mkdir+0x57d/0x860 fs/namei.c:4131
do_mkdirat+0x301/0x3a0 fs/namei.c:4154
__do_sys_mkdir fs/namei.c:4174 [inline]
__se_sys_mkdir fs/namei.c:4172 [inline]
__x64_sys_mkdir+0xf1/0x140 fs/namei.c:4172
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
Memory state around the buggy address:
ffff88802af52f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88802af52f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88802af53000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88802af53080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88802af53100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 34+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
2024-06-24 20:23 syzbot
@ 2024-09-07 14:42 ` syzbot
2024-09-08 0:01 ` Hillf Danton
` (13 more replies)
2024-09-10 18:43 ` syzbot
1 sibling, 14 replies; 34+ messages in thread
From: syzbot @ 2024-09-07 14:42 UTC (permalink / raw)
To: johan.hedberg, linux-bluetooth, linux-kernel, luiz.dentz, marcel,
syzkaller-bugs
syzbot has found a reproducer for the following issue on:
HEAD commit: 788220eee30d Merge tag 'pm-6.11-rc7' of git://git.kernel.o..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=10502bc7980000
kernel config: https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11da6f29980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1304189f980000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e618b7c8e5a2/disk-788220ee.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/333bb524a2ba/vmlinux-788220ee.xz
kernel image: https://storage.googleapis.com/syzbot-assets/ad1779f24bb2/bzImage-788220ee.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c12e2f941af1feb5632c@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: slab-use-after-free in l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949
Read of size 8 at addr ffff8880241e9800 by task kworker/u9:0/54
CPU: 0 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.11.0-rc6-syzkaller-00268-g788220eee30d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: hci2 hci_rx_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
print_address_description mm/kasan/report.c:377 [inline]
print_report+0xc3/0x620 mm/kasan/report.c:488
kasan_report+0xd9/0x110 mm/kasan/report.c:601
l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949
l2cap_connect_req net/bluetooth/l2cap_core.c:4080 [inline]
l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4772 [inline]
l2cap_sig_channel net/bluetooth/l2cap_core.c:5543 [inline]
l2cap_recv_frame+0xf0b/0x8eb0 net/bluetooth/l2cap_core.c:6825
l2cap_recv_acldata+0x9b4/0xb70 net/bluetooth/l2cap_core.c:7514
hci_acldata_packet net/bluetooth/hci_core.c:3791 [inline]
hci_rx_work+0xaab/0x1610 net/bluetooth/hci_core.c:4028
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Allocated by task 5253:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:387
kmalloc_noprof include/linux/slab.h:681 [inline]
kzalloc_noprof include/linux/slab.h:807 [inline]
l2cap_conn_add.part.0+0x60/0xa60 net/bluetooth/l2cap_core.c:6868
l2cap_conn_add net/bluetooth/l2cap_core.c:69 [inline]
l2cap_connect_cfm+0x428/0xf80 net/bluetooth/l2cap_core.c:7245
hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
hci_remote_features_evt+0x548/0x9e0 net/bluetooth/hci_event.c:3721
hci_event_func net/bluetooth/hci_event.c:7446 [inline]
hci_event_packet+0x9eb/0x1180 net/bluetooth/hci_event.c:7498
hci_rx_work+0x2c6/0x1610 net/bluetooth/hci_core.c:4023
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Freed by task 5245:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
poison_slab_object+0xf7/0x160 mm/kasan/common.c:240
__kasan_slab_free+0x32/0x50 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2256 [inline]
slab_free mm/slub.c:4477 [inline]
kfree+0x12a/0x3b0 mm/slub.c:4598
l2cap_conn_free net/bluetooth/l2cap_core.c:1810 [inline]
kref_put include/linux/kref.h:65 [inline]
l2cap_conn_put net/bluetooth/l2cap_core.c:1822 [inline]
l2cap_conn_del+0x59d/0x730 net/bluetooth/l2cap_core.c:1802
l2cap_connect_cfm+0x9e6/0xf80 net/bluetooth/l2cap_core.c:7241
hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
hci_conn_failed+0x1c3/0x370 net/bluetooth/hci_conn.c:1265
hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583
abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2917
hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Last potentially related work creation:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
__kasan_record_aux_stack+0xba/0xd0 mm/kasan/generic.c:541
insert_work+0x36/0x230 kernel/workqueue.c:2185
__queue_work+0x97e/0x1070 kernel/workqueue.c:2341
call_timer_fn+0x1a0/0x610 kernel/time/timer.c:1792
expire_timers kernel/time/timer.c:1838 [inline]
__run_timers+0x567/0xaf0 kernel/time/timer.c:2417
__run_timer_base kernel/time/timer.c:2428 [inline]
__run_timer_base kernel/time/timer.c:2421 [inline]
run_timer_base+0x111/0x190 kernel/time/timer.c:2437
run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2447
handle_softirqs+0x216/0x8f0 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu kernel/softirq.c:637 [inline]
irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1043
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
Second to last potentially related work creation:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
__kasan_record_aux_stack+0xba/0xd0 mm/kasan/generic.c:541
insert_work+0x36/0x230 kernel/workqueue.c:2185
__queue_work+0x3f8/0x1070 kernel/workqueue.c:2345
queue_work_on+0x11a/0x140 kernel/workqueue.c:2392
queue_work include/linux/workqueue.h:621 [inline]
l2cap_conn_ready net/bluetooth/l2cap_core.c:1640 [inline]
l2cap_connect_cfm+0x9c9/0xf80 net/bluetooth/l2cap_core.c:7286
hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
hci_remote_features_evt+0x548/0x9e0 net/bluetooth/hci_event.c:3721
hci_event_func net/bluetooth/hci_event.c:7446 [inline]
hci_event_packet+0x9eb/0x1180 net/bluetooth/hci_event.c:7498
hci_rx_work+0x2c6/0x1610 net/bluetooth/hci_core.c:4023
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
The buggy address belongs to the object at ffff8880241e9800
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 0 bytes inside of
freed 1024-byte region [ffff8880241e9800, ffff8880241e9c00)
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x241e8
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xfdffffff(slab)
raw: 00fff00000000040 ffff88801ac41dc0 ffffea00007cac00 dead000000000002
raw: 0000000000000000 0000000000100010 00000001fdffffff 0000000000000000
head: 00fff00000000040 ffff88801ac41dc0 ffffea00007cac00 dead000000000002
head: 0000000000000000 0000000000100010 00000001fdffffff 0000000000000000
head: 00fff00000000003 ffffea0000907a01 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4642, tgid 4642 (init), ts 27796307015, free_ts 0
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1500
prep_new_page mm/page_alloc.c:1508 [inline]
get_page_from_freelist+0x1351/0x2e50 mm/page_alloc.c:3446
__alloc_pages_noprof+0x22b/0x2460 mm/page_alloc.c:4702
__alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
alloc_slab_page+0x4e/0xf0 mm/slub.c:2325
allocate_slab mm/slub.c:2488 [inline]
new_slab+0x84/0x260 mm/slub.c:2541
___slab_alloc+0xdac/0x1870 mm/slub.c:3727
__slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3817
__slab_alloc_node mm/slub.c:3870 [inline]
slab_alloc_node mm/slub.c:4029 [inline]
__do_kmalloc_node mm/slub.c:4161 [inline]
__kmalloc_noprof+0x367/0x400 mm/slub.c:4174
kmalloc_noprof include/linux/slab.h:685 [inline]
kzalloc_noprof include/linux/slab.h:807 [inline]
tomoyo_init_log+0x13ca/0x2180 security/tomoyo/audit.c:275
tomoyo_supervisor+0x30c/0xea0 security/tomoyo/common.c:2089
tomoyo_audit_env_log security/tomoyo/environ.c:36 [inline]
tomoyo_env_perm+0x193/0x210 security/tomoyo/environ.c:63
tomoyo_environ security/tomoyo/domain.c:672 [inline]
tomoyo_find_next_domain+0xef9/0x2020 security/tomoyo/domain.c:878
tomoyo_bprm_check_security security/tomoyo/tomoyo.c:102 [inline]
tomoyo_bprm_check_security+0x12e/0x1d0 security/tomoyo/tomoyo.c:92
security_bprm_check+0x65/0xb0 security/security.c:1191
search_binary_handler fs/exec.c:1815 [inline]
exec_binprm fs/exec.c:1869 [inline]
bprm_execve fs/exec.c:1920 [inline]
bprm_execve+0x642/0x1960 fs/exec.c:1896
do_execveat_common.isra.0+0x4f1/0x630 fs/exec.c:2027
page_owner free stack trace missing
Memory state around the buggy address:
ffff8880241e9700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8880241e9780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8880241e9800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880241e9880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880241e9900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 34+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
2024-09-07 14:42 ` syzbot
@ 2024-09-08 0:01 ` Hillf Danton
2024-09-08 0:24 ` syzbot
2024-09-08 1:28 ` Edward Adam Davis
` (12 subsequent siblings)
13 siblings, 1 reply; 34+ messages in thread
From: Hillf Danton @ 2024-09-08 0:01 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
On Sat, 07 Sep 2024 07:42:26 -0700
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 788220eee30d Merge tag 'pm-6.11-rc7' of git://git.kernel.o..
> git tree: upstream
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1304189f980000
#syz test
--- l/net/bluetooth/l2cap_core.c
+++ c/net/bluetooth/l2cap_core.c
@@ -1797,6 +1797,7 @@ static void l2cap_conn_del(struct hci_co
if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
cancel_delayed_work_sync(&conn->info_timer);
+ cancel_work_sync(&hcon->hdev->rx_work);
hcon->l2cap_data = NULL;
conn->hchan = NULL;
l2cap_conn_put(conn);
--
^ permalink raw reply [flat|nested] 34+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
2024-09-08 0:01 ` Hillf Danton
@ 2024-09-08 0:24 ` syzbot
0 siblings, 0 replies; 34+ messages in thread
From: syzbot @ 2024-09-08 0:24 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
possible deadlock in hci_conn_failed
======================================================
WARNING: possible circular locking dependency detected
6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0 Not tainted
------------------------------------------------------
kworker/u9:5/5970 is trying to acquire lock:
ffff888032308aa0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: touch_work_lockdep_map kernel/workqueue.c:3890 [inline]
ffff888032308aa0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: start_flush_work kernel/workqueue.c:4144 [inline]
ffff888032308aa0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: __flush_work+0x46d/0xc30 kernel/workqueue.c:4176
but task is already holding lock:
ffffffff8fc9caa8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1957 [inline]
ffffffff8fc9caa8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_failed+0x158/0x370 net/bluetooth/hci_conn.c:1265
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (hci_cb_list_lock){+.+.}-{3:3}
:
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
hci_connect_cfm include/net/bluetooth/hci_core.h:1957 [inline]
hci_remote_features_evt+0x4dc/0x9e0 net/bluetooth/hci_event.c:3721
hci_event_func net/bluetooth/hci_event.c:7446 [inline]
hci_event_packet+0x9eb/0x1180 net/bluetooth/hci_event.c:7498
hci_rx_work+0x2c6/0x1610 net/bluetooth/hci_core.c:4023
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
-> #1 (&hdev->lock){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
hci_store_wake_reason net/bluetooth/hci_event.c:7191 [inline]
hci_event_packet+0x323/0x1180 net/bluetooth/hci_event.c:7494
hci_rx_work+0x2c6/0x1610 net/bluetooth/hci_core.c:4023
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
-> #0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3133 [inline]
check_prevs_add kernel/locking/lockdep.c:3252 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]
__lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142
lock_acquire kernel/locking/lockdep.c:5759 [inline]
lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
touch_work_lockdep_map kernel/workqueue.c:3890 [inline]
start_flush_work kernel/workqueue.c:4144 [inline]
__flush_work+0x477/0xc30 kernel/workqueue.c:4176
__cancel_work_sync+0x10c/0x130 kernel/workqueue.c:4332
l2cap_conn_del+0x4a6/0x760 net/bluetooth/l2cap_core.c:1800
l2cap_connect_cfm+0x9e6/0xf80 net/bluetooth/l2cap_core.c:7242
hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
hci_conn_failed+0x1c3/0x370 net/bluetooth/hci_conn.c:1265
hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583
abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2917
hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
other info that might help us debug this:
Chain exists of:
(work_completion)(&hdev->rx_work) --> &hdev->lock --> hci_cb_list_lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(hci_cb_list_lock);
lock(&hdev->lock);
lock(hci_cb_list_lock);
lock((work_completion)(&hdev->rx_work));
*** DEADLOCK ***
6 locks held by kworker/u9:5/5970:
#0: ffff8880280f7948 ((wq_completion)hci4){+.+.}-{0:0}, at: process_one_work+0x1277/0x1b40 kernel/workqueue.c:3206
#1: ffffc9000305fd80 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x921/0x1b40 kernel/workqueue.c:3207
#2: ffff888032308d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x170/0x410 net/bluetooth/hci_sync.c:327
#3: ffff888032308078 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x150/0xb50 net/bluetooth/hci_sync.c:5564
#4: ffffffff8fc9caa8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1957 [inline]
#4: ffffffff8fc9caa8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_failed+0x158/0x370 net/bluetooth/hci_conn.c:1265
#5: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:326 [inline]
#5: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#5: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: start_flush_work kernel/workqueue.c:4118 [inline]
#5: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: __flush_work+0x103/0xc30 kernel/workqueue.c:4176
stack backtrace:
CPU: 1 UID: 0 PID: 5970 Comm: kworker/u9:5 Not tainted 6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: hci4 hci_cmd_sync_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2186
check_prev_add kernel/locking/lockdep.c:3133 [inline]
check_prevs_add kernel/locking/lockdep.c:3252 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]
__lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142
lock_acquire kernel/locking/lockdep.c:5759 [inline]
lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
touch_work_lockdep_map kernel/workqueue.c:3890 [inline]
start_flush_work kernel/workqueue.c:4144 [inline]
__flush_work+0x477/0xc30 kernel/workqueue.c:4176
__cancel_work_sync+0x10c/0x130 kernel/workqueue.c:4332
l2cap_conn_del+0x4a6/0x760 net/bluetooth/l2cap_core.c:1800
l2cap_connect_cfm+0x9e6/0xf80 net/bluetooth/l2cap_core.c:7242
hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
hci_conn_failed+0x1c3/0x370 net/bluetooth/hci_conn.c:1265
hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583
abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2917
hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Tested on:
commit: d1f2d51b Merge tag 'clk-fixes-for-linus' of git://git...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13100e00580000
kernel config: https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=163c989f980000
^ permalink raw reply [flat|nested] 34+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
2024-09-07 14:42 ` syzbot
2024-09-08 0:01 ` Hillf Danton
@ 2024-09-08 1:28 ` Edward Adam Davis
2024-09-08 1:51 ` syzbot
2024-09-08 2:06 ` Edward Adam Davis
` (11 subsequent siblings)
13 siblings, 1 reply; 34+ messages in thread
From: Edward Adam Davis @ 2024-09-08 1:28 UTC (permalink / raw)
To: syzbot+c12e2f941af1feb5632c; +Cc: linux-kernel, syzkaller-bugs
after release conn, we need to cancle rx_work
#syz test
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 9988ba382b68..afa02e0d7917 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1800,6 +1800,7 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
hcon->l2cap_data = NULL;
conn->hchan = NULL;
l2cap_conn_put(conn);
+ cancel_work_sync(&hcon->hdev->rx_work);
}
static void l2cap_conn_free(struct kref *ref)
^ permalink raw reply related [flat|nested] 34+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
2024-09-08 1:28 ` Edward Adam Davis
@ 2024-09-08 1:51 ` syzbot
0 siblings, 0 replies; 34+ messages in thread
From: syzbot @ 2024-09-08 1:51 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
possible deadlock in hci_conn_failed
======================================================
WARNING: possible circular locking dependency detected
6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0 Not tainted
------------------------------------------------------
kworker/u9:6/7098 is trying to acquire lock:
ffff888025470aa0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: touch_work_lockdep_map kernel/workqueue.c:3890 [inline]
ffff888025470aa0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: start_flush_work kernel/workqueue.c:4144 [inline]
ffff888025470aa0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: __flush_work+0x46d/0xc30 kernel/workqueue.c:4176
but task is already holding lock:
ffffffff8fc9caa8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1957 [inline]
ffffffff8fc9caa8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_failed+0x158/0x370 net/bluetooth/hci_conn.c:1265
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (
hci_cb_list_lock){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
hci_connect_cfm include/net/bluetooth/hci_core.h:1957 [inline]
hci_remote_features_evt+0x4dc/0x9e0 net/bluetooth/hci_event.c:3721
hci_event_func net/bluetooth/hci_event.c:7446 [inline]
hci_event_packet+0x9eb/0x1180 net/bluetooth/hci_event.c:7498
hci_rx_work+0x2c6/0x1610 net/bluetooth/hci_core.c:4023
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
-> #1 (&hdev->lock){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
hci_store_wake_reason net/bluetooth/hci_event.c:7191 [inline]
hci_event_packet+0x323/0x1180 net/bluetooth/hci_event.c:7494
hci_rx_work+0x2c6/0x1610 net/bluetooth/hci_core.c:4023
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
-> #0
((work_completion)(&hdev->rx_work)){+.+.}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3133 [inline]
check_prevs_add kernel/locking/lockdep.c:3252 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]
__lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142
lock_acquire kernel/locking/lockdep.c:5759 [inline]
lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
touch_work_lockdep_map kernel/workqueue.c:3890 [inline]
start_flush_work kernel/workqueue.c:4144 [inline]
__flush_work+0x477/0xc30 kernel/workqueue.c:4176
__cancel_work_sync+0x10c/0x130 kernel/workqueue.c:4332
l2cap_conn_del+0x55c/0x780 net/bluetooth/l2cap_core.c:1803
l2cap_connect_cfm+0x9e6/0xf80 net/bluetooth/l2cap_core.c:7242
hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
hci_conn_failed+0x1c3/0x370 net/bluetooth/hci_conn.c:1265
hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583
abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2917
hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
other info that might help us debug this:
Chain exists of:
(work_completion)(&hdev->rx_work) --> &hdev->lock --> hci_cb_list_lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(hci_cb_list_lock);
lock(&hdev->lock);
lock(hci_cb_list_lock);
lock((work_completion)(&hdev->rx_work));
*** DEADLOCK ***
6 locks held by kworker/u9:6/7098:
#0:
ffff88803384c148 (
(wq_completion)hci2
){+.+.}-{0:0}, at: process_one_work+0x1277/0x1b40 kernel/workqueue.c:3206
#1: ffffc9000adcfd80 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x921/0x1b40 kernel/workqueue.c:3207
#2: ffff888025470d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x170/0x410 net/bluetooth/hci_sync.c:327
#3: ffff888025470078
(&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x150/0xb50 net/bluetooth/hci_sync.c:5564
#4: ffffffff8fc9caa8 (hci_cb_list_lock){+.+.}-{3:3}
, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1957 [inline]
, at: hci_conn_failed+0x158/0x370 net/bluetooth/hci_conn.c:1265
#5: ffffffff8ddb9fe0
(rcu_read_lock
){....}-{1:2}
, at: rcu_lock_acquire include/linux/rcupdate.h:326 [inline]
, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
, at: start_flush_work kernel/workqueue.c:4118 [inline]
, at: __flush_work+0x103/0xc30 kernel/workqueue.c:4176
stack backtrace:
CPU: 1 UID: 0 PID: 7098 Comm: kworker/u9:6 Not tainted 6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: hci2 hci_cmd_sync_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2186
check_prev_add kernel/locking/lockdep.c:3133 [inline]
check_prevs_add kernel/locking/lockdep.c:3252 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]
__lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142
lock_acquire kernel/locking/lockdep.c:5759 [inline]
lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
touch_work_lockdep_map kernel/workqueue.c:3890 [inline]
start_flush_work kernel/workqueue.c:4144 [inline]
__flush_work+0x477/0xc30 kernel/workqueue.c:4176
__cancel_work_sync+0x10c/0x130 kernel/workqueue.c:4332
l2cap_conn_del+0x55c/0x780 net/bluetooth/l2cap_core.c:1803
l2cap_connect_cfm+0x9e6/0xf80 net/bluetooth/l2cap_core.c:7242
hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
hci_conn_failed+0x1c3/0x370 net/bluetooth/hci_conn.c:1265
hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583
abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2917
hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Tested on:
commit: d1f2d51b Merge tag 'clk-fixes-for-linus' of git://git...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12acabc7980000
kernel config: https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=10640e00580000
^ permalink raw reply [flat|nested] 34+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
2024-09-07 14:42 ` syzbot
2024-09-08 0:01 ` Hillf Danton
2024-09-08 1:28 ` Edward Adam Davis
@ 2024-09-08 2:06 ` Edward Adam Davis
2024-09-08 2:29 ` syzbot
2024-09-08 2:41 ` Edward Adam Davis
` (10 subsequent siblings)
13 siblings, 1 reply; 34+ messages in thread
From: Edward Adam Davis @ 2024-09-08 2:06 UTC (permalink / raw)
To: syzbot+c12e2f941af1feb5632c; +Cc: linux-kernel, syzkaller-bugs
after release conn, we need to cancle rx_work
#syz test
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 8e48ccd2af30..5050d20e9cd1 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -1264,6 +1264,7 @@ void hci_conn_failed(struct hci_conn *conn, u8 status)
conn->state = BT_CLOSED;
hci_connect_cfm(conn, status);
hci_conn_del(conn);
+ cancel_work_sync(&hdev->rx_work);
}
/* This function requires the caller holds hdev->lock */
^ permalink raw reply related [flat|nested] 34+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
2024-09-08 2:06 ` Edward Adam Davis
@ 2024-09-08 2:29 ` syzbot
0 siblings, 0 replies; 34+ messages in thread
From: syzbot @ 2024-09-08 2:29 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
possible deadlock in hci_abort_conn_sync
======================================================
WARNING: possible circular locking dependency detected
6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0 Not tainted
------------------------------------------------------
kworker/u9:2/5285 is trying to acquire lock:
ffff888043094aa0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: touch_work_lockdep_map kernel/workqueue.c:3890 [inline]
ffff888043094aa0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: start_flush_work kernel/workqueue.c:4144 [inline]
ffff888043094aa0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: __flush_work+0x46d/0xc30 kernel/workqueue.c:4176
but task is already holding lock:
ffff888043094078 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x150/0xb50 net/bluetooth/hci_sync.c:5564
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (&hdev->lock){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
hci_store_wake_reason net/bluetooth/hci_event.c:7191 [inline]
hci_event_packet+0x323/0x1180 net/bluetooth/hci_event.c:7494
hci_rx_work+0x2c6/0x1610 net/bluetooth/hci_core.c:4023
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
-> #0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3133 [inline]
check_prevs_add kernel/locking/lockdep.c:3252 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]
__lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142
lock_acquire kernel/locking/lockdep.c:5759 [inline]
lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
touch_work_lockdep_map kernel/workqueue.c:3890 [inline]
start_flush_work kernel/workqueue.c:4144 [inline]
__flush_work+0x477/0xc30 kernel/workqueue.c:4176
__cancel_work_sync+0x10c/0x130 kernel/workqueue.c:4332
hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583
abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2918
hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&hdev->lock);
lock((work_completion)(&hdev->rx_work));
lock(&hdev->lock);
lock((work_completion)(&hdev->rx_work));
*** DEADLOCK ***
5 locks held by kworker/u9:2/5285:
#0: ffff8880439ca148 ((wq_completion)hci0){+.+.}-{0:0}, at: process_one_work+0x1277/0x1b40 kernel/workqueue.c:3206
#1: ffffc9000392fd80 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x921/0x1b40 kernel/workqueue.c:3207
#2: ffff888043094d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x170/0x410 net/bluetooth/hci_sync.c:327
#3: ffff888043094078 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x150/0xb50 net/bluetooth/hci_sync.c:5564
#4: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:326 [inline]
#4: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#4: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: start_flush_work kernel/workqueue.c:4118 [inline]
#4: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: __flush_work+0x103/0xc30 kernel/workqueue.c:4176
stack backtrace:
CPU: 0 UID: 0 PID: 5285 Comm: kworker/u9:2 Not tainted 6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: hci0 hci_cmd_sync_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2186
check_prev_add kernel/locking/lockdep.c:3133 [inline]
check_prevs_add kernel/locking/lockdep.c:3252 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]
__lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142
lock_acquire kernel/locking/lockdep.c:5759 [inline]
lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
touch_work_lockdep_map kernel/workqueue.c:3890 [inline]
start_flush_work kernel/workqueue.c:4144 [inline]
__flush_work+0x477/0xc30 kernel/workqueue.c:4176
__cancel_work_sync+0x10c/0x130 kernel/workqueue.c:4332
hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583
abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2918
hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Tested on:
commit: d1f2d51b Merge tag 'clk-fixes-for-linus' of git://git...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=146feffb980000
kernel config: https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=175c0e00580000
^ permalink raw reply [flat|nested] 34+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
2024-09-07 14:42 ` syzbot
` (2 preceding siblings ...)
2024-09-08 2:06 ` Edward Adam Davis
@ 2024-09-08 2:41 ` Edward Adam Davis
2024-09-08 3:06 ` syzbot
2024-09-08 3:15 ` Edward Adam Davis
` (9 subsequent siblings)
13 siblings, 1 reply; 34+ messages in thread
From: Edward Adam Davis @ 2024-09-08 2:41 UTC (permalink / raw)
To: syzbot+c12e2f941af1feb5632c; +Cc: linux-kernel, syzkaller-bugs
after release conn, we need to cancle rx_work
#syz test
diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index e79cd40bd079..6d95e07d9ddd 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -5499,7 +5499,7 @@ static int hci_reject_conn_sync(struct hci_dev *hdev, struct hci_conn *conn,
int hci_abort_conn_sync(struct hci_dev *hdev, struct hci_conn *conn, u8 reason)
{
- int err = 0;
+ int err = 0, failed = 0;
u16 handle = conn->handle;
bool disconnect = false;
struct hci_conn *c;
@@ -5543,10 +5543,13 @@ int hci_abort_conn_sync(struct hci_dev *hdev, struct hci_conn *conn, u8 reason)
hci_conn_del(conn);
} else {
hci_conn_failed(conn, reason);
+ failed = 1;
}
unlock:
hci_dev_unlock(hdev);
+ if (failed)
+ cancel_work_sync(&hdev->rx_work);
return err;
}
^ permalink raw reply related [flat|nested] 34+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
2024-09-08 2:41 ` Edward Adam Davis
@ 2024-09-08 3:06 ` syzbot
0 siblings, 0 replies; 34+ messages in thread
From: syzbot @ 2024-09-08 3:06 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in l2cap_connect
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
==================================================================
BUG: KASAN: slab-use-after-free in l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949
Read of size 8 at addr ffff88807a217000 by task kworker/u9:0/54
CPU: 0 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: hci2 hci_rx_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
print_address_description mm/kasan/report.c:377 [inline]
print_report+0xc3/0x620 mm/kasan/report.c:488
kasan_report+0xd9/0x110 mm/kasan/report.c:601
l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949
l2cap_connect_req net/bluetooth/l2cap_core.c:4080 [inline]
l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4772 [inline]
l2cap_sig_channel net/bluetooth/l2cap_core.c:5543 [inline]
l2cap_recv_frame+0xf0b/0x8eb0 net/bluetooth/l2cap_core.c:6825
l2cap_recv_acldata+0x9b4/0xb70 net/bluetooth/l2cap_core.c:7514
hci_acldata_packet net/bluetooth/hci_core.c:3791 [inline]
hci_rx_work+0xaab/0x1610 net/bluetooth/hci_core.c:4028
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Allocated by task 6033:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:387
kmalloc_noprof include/linux/slab.h:681 [inline]
kzalloc_noprof include/linux/slab.h:807 [inline]
l2cap_conn_add.part.0+0x60/0xa60 net/bluetooth/l2cap_core.c:6868
l2cap_conn_add net/bluetooth/l2cap_core.c:69 [inline]
l2cap_connect_cfm+0x428/0xf80 net/bluetooth/l2cap_core.c:7245
hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
hci_remote_features_evt+0x548/0x9e0 net/bluetooth/hci_event.c:3721
hci_event_func net/bluetooth/hci_event.c:7446 [inline]
hci_event_packet+0x9eb/0x1180 net/bluetooth/hci_event.c:7498
hci_rx_work+0x2c6/0x1610 net/bluetooth/hci_core.c:4023
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Freed by task 7242:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
poison_slab_object+0xf7/0x160 mm/kasan/common.c:240
__kasan_slab_free+0x32/0x50 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2256 [inline]
slab_free mm/slub.c:4477 [inline]
kfree+0x12a/0x3b0 mm/slub.c:4598
l2cap_conn_free net/bluetooth/l2cap_core.c:1810 [inline]
kref_put include/linux/kref.h:65 [inline]
l2cap_conn_put net/bluetooth/l2cap_core.c:1822 [inline]
l2cap_conn_del+0x59d/0x730 net/bluetooth/l2cap_core.c:1802
l2cap_connect_cfm+0x9e6/0xf80 net/bluetooth/l2cap_core.c:7241
hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
hci_conn_failed+0x1c3/0x370 net/bluetooth/hci_conn.c:1265
hci_abort_conn_sync+0x5df/0xb90 net/bluetooth/hci_sync.c:5583
abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2917
hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Last potentially related work creation:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
__kasan_record_aux_stack+0xba/0xd0 mm/kasan/generic.c:541
insert_work+0x36/0x230 kernel/workqueue.c:2185
__queue_work+0x97e/0x1070 kernel/workqueue.c:2341
call_timer_fn+0x1a0/0x610 kernel/time/timer.c:1792
expire_timers kernel/time/timer.c:1838 [inline]
__run_timers+0x567/0xaf0 kernel/time/timer.c:2417
__run_timer_base kernel/time/timer.c:2428 [inline]
__run_timer_base kernel/time/timer.c:2421 [inline]
run_timer_base+0x111/0x190 kernel/time/timer.c:2437
run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2447
handle_softirqs+0x216/0x8f0 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu kernel/softirq.c:637 [inline]
irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1043
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
Second to last potentially related work creation:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
__kasan_record_aux_stack+0xba/0xd0 mm/kasan/generic.c:541
insert_work+0x36/0x230 kernel/workqueue.c:2185
__queue_work+0x3f8/0x1070 kernel/workqueue.c:2345
queue_work_on+0x11a/0x140 kernel/workqueue.c:2392
queue_work include/linux/workqueue.h:621 [inline]
l2cap_conn_ready net/bluetooth/l2cap_core.c:1640 [inline]
l2cap_connect_cfm+0x9c9/0xf80 net/bluetooth/l2cap_core.c:7286
hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
hci_remote_features_evt+0x548/0x9e0 net/bluetooth/hci_event.c:3721
hci_event_func net/bluetooth/hci_event.c:7446 [inline]
hci_event_packet+0x9eb/0x1180 net/bluetooth/hci_event.c:7498
hci_rx_work+0x2c6/0x1610 net/bluetooth/hci_core.c:4023
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
The buggy address belongs to the object at ffff88807a217000
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 0 bytes inside of
freed 1024-byte region [ffff88807a217000, ffff88807a217400)
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7a210
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xfdffffff(slab)
raw: 00fff00000000040 ffff88801ac41dc0 ffffea0001813a00 dead000000000002
raw: 0000000000000000 0000000000100010 00000001fdffffff 0000000000000000
head: 00fff00000000040 ffff88801ac41dc0 ffffea0001813a00 dead000000000002
head: 0000000000000000 0000000000100010 00000001fdffffff 0000000000000000
head: 00fff00000000003 ffffea0001e88401 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 6025, tgid 6025 (syz-executor), ts 135418734548, free_ts 135276394069
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1500
prep_new_page mm/page_alloc.c:1508 [inline]
get_page_from_freelist+0x1351/0x2e50 mm/page_alloc.c:3446
__alloc_pages_noprof+0x22b/0x2460 mm/page_alloc.c:4702
__alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
alloc_slab_page+0x4e/0xf0 mm/slub.c:2325
allocate_slab mm/slub.c:2488 [inline]
new_slab+0x84/0x260 mm/slub.c:2541
___slab_alloc+0xdac/0x1870 mm/slub.c:3727
__slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3817
__slab_alloc_node mm/slub.c:3870 [inline]
slab_alloc_node mm/slub.c:4029 [inline]
__do_kmalloc_node mm/slub.c:4161 [inline]
__kmalloc_node_track_caller_noprof+0x355/0x430 mm/slub.c:4181
kmemdup_noprof+0x29/0x60 mm/util.c:133
kmemdup_noprof include/linux/fortify-string.h:753 [inline]
setup_ipc_sysctls+0x5e/0x300 ipc/ipc_sysctl.c:251
create_ipc_ns ipc/namespace.c:81 [inline]
copy_ipcs+0x498/0x600 ipc/namespace.c:112
create_new_namespaces+0x20a/0xad0 kernel/nsproxy.c:90
unshare_nsproxy_namespaces+0xc0/0x1f0 kernel/nsproxy.c:228
ksys_unshare+0x419/0x970 kernel/fork.c:3309
__do_sys_unshare kernel/fork.c:3380 [inline]
__se_sys_unshare kernel/fork.c:3378 [inline]
__x64_sys_unshare+0x31/0x40 kernel/fork.c:3378
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
page last free pid 5878 tgid 5878 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1101 [inline]
free_unref_page+0x64a/0xe40 mm/page_alloc.c:2619
__put_partials+0x14c/0x170 mm/slub.c:3055
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:322
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3992 [inline]
slab_alloc_node mm/slub.c:4041 [inline]
__do_kmalloc_node mm/slub.c:4161 [inline]
__kmalloc_node_noprof+0x1c3/0x430 mm/slub.c:4168
kmalloc_node_noprof include/linux/slab.h:708 [inline]
__vmalloc_area_node mm/vmalloc.c:3642 [inline]
__vmalloc_node_range_noprof+0x3de/0x14e0 mm/vmalloc.c:3837
alloc_thread_stack_node kernel/fork.c:313 [inline]
dup_task_struct kernel/fork.c:1113 [inline]
copy_process+0x2f3b/0x8de0 kernel/fork.c:2204
kernel_clone+0xfd/0x960 kernel/fork.c:2781
__do_sys_clone3+0x1f5/0x270 kernel/fork.c:3085
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff88807a216f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88807a216f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88807a217000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88807a217080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88807a217100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Tested on:
commit: d1f2d51b Merge tag 'clk-fixes-for-linus' of git://git...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=116def29980000
kernel config: https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=133feffb980000
^ permalink raw reply [flat|nested] 34+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
2024-09-07 14:42 ` syzbot
` (3 preceding siblings ...)
2024-09-08 2:41 ` Edward Adam Davis
@ 2024-09-08 3:15 ` Edward Adam Davis
2024-09-08 3:58 ` syzbot
2024-09-08 3:25 ` Hillf Danton
` (8 subsequent siblings)
13 siblings, 1 reply; 34+ messages in thread
From: Edward Adam Davis @ 2024-09-08 3:15 UTC (permalink / raw)
To: syzbot+c12e2f941af1feb5632c; +Cc: linux-kernel, syzkaller-bugs
after release conn, we need to cancle rx_work
#syz test
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index f25a21f532aa..4f7b45bb863f 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -3776,18 +3776,19 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
hci_dev_lock(hdev);
conn = hci_conn_hash_lookup_handle(hdev, handle);
- hci_dev_unlock(hdev);
if (conn) {
hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
/* Send to upper protocol */
l2cap_recv_acldata(conn, skb, flags);
+ hci_dev_unlock(hdev);
return;
} else {
bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
handle);
}
+ hci_dev_unlock(hdev);
kfree_skb(skb);
}
^ permalink raw reply related [flat|nested] 34+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
2024-09-07 14:42 ` syzbot
` (4 preceding siblings ...)
2024-09-08 3:15 ` Edward Adam Davis
@ 2024-09-08 3:25 ` Hillf Danton
2024-09-08 4:07 ` syzbot
2024-09-08 4:07 ` Edward Adam Davis
` (7 subsequent siblings)
13 siblings, 1 reply; 34+ messages in thread
From: Hillf Danton @ 2024-09-08 3:25 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
On Sat, 07 Sep 2024 07:42:26 -0700
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 788220eee30d Merge tag 'pm-6.11-rc7' of git://git.kernel.o..
> git tree: upstream
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1304189f980000
#syz test
--- l/net/bluetooth/l2cap_core.c
+++ c/net/bluetooth/l2cap_core.c
@@ -1747,6 +1747,8 @@ static void l2cap_unregister_all_users(s
}
}
+static DEFINE_MUTEX(l2cap_conn_del_mutex);
+
static void l2cap_conn_del(struct hci_conn *hcon, int err)
{
struct l2cap_conn *conn = hcon->l2cap_data;
@@ -1797,8 +1799,10 @@ static void l2cap_conn_del(struct hci_co
if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
cancel_delayed_work_sync(&conn->info_timer);
+ mutex_lock(&l2cap_conn_del_mutex);
hcon->l2cap_data = NULL;
conn->hchan = NULL;
+ mutex_unlock(&l2cap_conn_del_mutex);
l2cap_conn_put(conn);
}
@@ -7480,11 +7484,21 @@ void l2cap_recv_acldata(struct hci_conn
struct l2cap_conn *conn = hcon->l2cap_data;
int len;
- if (!conn)
+ if (!conn) {
conn = l2cap_conn_add(hcon);
-
- if (!conn)
- goto drop;
+ if (!conn)
+ goto drop;
+ l2cap_conn_get(conn);
+ } else {
+ mutex_lock(&l2cap_conn_del_mutex);
+ conn = hcon->l2cap_data;
+ if (conn)
+ if (!kref_get_unless_zero(&conn->ref))
+ conn = NULL;
+ mutex_unlock(&l2cap_conn_del_mutex);
+ if (!conn)
+ goto drop;
+ }
BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags);
@@ -7512,6 +7526,7 @@ void l2cap_recv_acldata(struct hci_conn
if (len == skb->len) {
/* Complete frame received */
l2cap_recv_frame(conn, skb);
+ l2cap_conn_put(conn);
return;
}
@@ -7576,6 +7591,8 @@ void l2cap_recv_acldata(struct hci_conn
drop:
kfree_skb(skb);
+ if (conn)
+ 2cap_conn_put(conn);
}
static struct hci_cb l2cap_cb = {
--
^ permalink raw reply [flat|nested] 34+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
2024-09-08 3:15 ` Edward Adam Davis
@ 2024-09-08 3:58 ` syzbot
0 siblings, 0 replies; 34+ messages in thread
From: syzbot @ 2024-09-08 3:58 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
possible deadlock in l2cap_recv_frame
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
============================================
WARNING: possible recursive locking detected
6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0 Not tainted
--------------------------------------------
kworker/u9:1/4615 is trying to acquire lock:
ffff888062afc078 (&hdev->lock){+.+.}-{3:3}, at: l2cap_connect_req net/bluetooth/l2cap_core.c:4075 [inline]
ffff888062afc078 (&hdev->lock){+.+.}-{3:3}, at: l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4772 [inline]
ffff888062afc078 (&hdev->lock){+.+.}-{3:3}, at: l2cap_sig_channel net/bluetooth/l2cap_core.c:5543 [inline]
ffff888062afc078 (&hdev->lock){+.+.}-{3:3}, at: l2cap_recv_frame+0xe9d/0x8eb0 net/bluetooth/l2cap_core.c:6825
but task is already holding lock:
ffff888062afc078 (&hdev->lock){+.+.}-{3:3}, at: hci_acldata_packet net/bluetooth/hci_core.c:3783 [inline]
ffff888062afc078 (&hdev->lock){+.+.}-{3:3}, at: hci_rx_work+0x96b/0x1610 net/bluetooth/hci_core.c:4029
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&hdev->lock);
lock(&hdev->lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
3 locks held by kworker/u9:1/4615:
#0: ffff8880301df948 ((wq_completion)hci2#2){+.+.}-{0:0}, at: process_one_work+0x1277/0x1b40 kernel/workqueue.c:3206
#1: ffffc9000d83fd80 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x921/0x1b40 kernel/workqueue.c:3207
#2: ffff888062afc078 (&hdev->lock){+.+.}-{3:3}, at: hci_acldata_packet net/bluetooth/hci_core.c:3783 [inline]
#2: ffff888062afc078 (&hdev->lock){+.+.}-{3:3}, at: hci_rx_work+0x96b/0x1610 net/bluetooth/hci_core.c:4029
stack backtrace:
CPU: 0 UID: 0 PID: 4615 Comm: kworker/u9:1 Not tainted 6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: hci2 hci_rx_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
check_deadlock kernel/locking/lockdep.c:3061 [inline]
validate_chain kernel/locking/lockdep.c:3855 [inline]
__lock_acquire+0x2167/0x3cb0 kernel/locking/lockdep.c:5142
lock_acquire kernel/locking/lockdep.c:5759 [inline]
lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
l2cap_connect_req net/bluetooth/l2cap_core.c:4075 [inline]
l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4772 [inline]
l2cap_sig_channel net/bluetooth/l2cap_core.c:5543 [inline]
l2cap_recv_frame+0xe9d/0x8eb0 net/bluetooth/l2cap_core.c:6825
l2cap_recv_acldata+0x9b4/0xb70 net/bluetooth/l2cap_core.c:7514
hci_acldata_packet net/bluetooth/hci_core.c:3790 [inline]
hci_rx_work+0xaa1/0x1610 net/bluetooth/hci_core.c:4029
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Tested on:
commit: d1f2d51b Merge tag 'clk-fixes-for-linus' of git://git...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1656abc7980000
kernel config: https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=165a0e00580000
^ permalink raw reply [flat|nested] 34+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
2024-09-08 3:25 ` Hillf Danton
@ 2024-09-08 4:07 ` syzbot
0 siblings, 0 replies; 34+ messages in thread
From: syzbot @ 2024-09-08 4:07 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
net/bluetooth/l2cap_core.c:7595:17: error: invalid suffix "cap_conn_put" on integer constant
Tested on:
commit: d1f2d51b Merge tag 'clk-fixes-for-linus' of git://git...
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=137def29980000
^ permalink raw reply [flat|nested] 34+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
2024-09-07 14:42 ` syzbot
` (5 preceding siblings ...)
2024-09-08 3:25 ` Hillf Danton
@ 2024-09-08 4:07 ` Edward Adam Davis
2024-09-08 4:37 ` syzbot
2024-09-08 8:32 ` Hillf Danton
` (6 subsequent siblings)
13 siblings, 1 reply; 34+ messages in thread
From: Edward Adam Davis @ 2024-09-08 4:07 UTC (permalink / raw)
To: syzbot+c12e2f941af1feb5632c; +Cc: linux-kernel, syzkaller-bugs
after release conn, we need to cancle rx_work
#syz test
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index f25a21f532aa..4f7b45bb863f 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -3776,18 +3776,19 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
hci_dev_lock(hdev);
conn = hci_conn_hash_lookup_handle(hdev, handle);
- hci_dev_unlock(hdev);
if (conn) {
hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
/* Send to upper protocol */
l2cap_recv_acldata(conn, skb, flags);
+ hci_dev_unlock(hdev);
return;
} else {
bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
handle);
}
+ hci_dev_unlock(hdev);
kfree_skb(skb);
}
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 9988ba382b68..b948b0a3b2f2 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -4072,10 +4072,8 @@ static int l2cap_connect_req(struct l2cap_conn *conn,
if (cmd_len < sizeof(struct l2cap_conn_req))
return -EPROTO;
- hci_dev_lock(hdev);
if (hci_dev_test_flag(hdev, HCI_MGMT))
mgmt_device_connected(hdev, hcon, NULL, 0);
- hci_dev_unlock(hdev);
l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP);
return 0;
^ permalink raw reply related [flat|nested] 34+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
2024-09-08 4:07 ` Edward Adam Davis
@ 2024-09-08 4:37 ` syzbot
0 siblings, 0 replies; 34+ messages in thread
From: syzbot @ 2024-09-08 4:37 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+c12e2f941af1feb5632c@syzkaller.appspotmail.com
Tested-by: syzbot+c12e2f941af1feb5632c@syzkaller.appspotmail.com
Tested on:
commit: d1f2d51b Merge tag 'clk-fixes-for-linus' of git://git...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1187ef29980000
kernel config: https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=11ad989f980000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 34+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
2024-09-07 14:42 ` syzbot
` (6 preceding siblings ...)
2024-09-08 4:07 ` Edward Adam Davis
@ 2024-09-08 8:32 ` Hillf Danton
2024-09-08 8:52 ` syzbot
2024-09-08 11:15 ` Hillf Danton
` (5 subsequent siblings)
13 siblings, 1 reply; 34+ messages in thread
From: Hillf Danton @ 2024-09-08 8:32 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
On Sat, 07 Sep 2024 07:42:26 -0700
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 788220eee30d Merge tag 'pm-6.11-rc7' of git://git.kernel.o..
> git tree: upstream
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1304189f980000
#syz test
--- l/net/bluetooth/l2cap_core.c
+++ c/net/bluetooth/l2cap_core.c
@@ -1747,6 +1747,8 @@ static void l2cap_unregister_all_users(s
}
}
+static DEFINE_MUTEX(l2cap_conn_del_mutex);
+
static void l2cap_conn_del(struct hci_conn *hcon, int err)
{
struct l2cap_conn *conn = hcon->l2cap_data;
@@ -1797,8 +1799,10 @@ static void l2cap_conn_del(struct hci_co
if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
cancel_delayed_work_sync(&conn->info_timer);
+ mutex_lock(&l2cap_conn_del_mutex);
hcon->l2cap_data = NULL;
conn->hchan = NULL;
+ mutex_unlock(&l2cap_conn_del_mutex);
l2cap_conn_put(conn);
}
@@ -7480,11 +7484,21 @@ void l2cap_recv_acldata(struct hci_conn
struct l2cap_conn *conn = hcon->l2cap_data;
int len;
- if (!conn)
+ if (!conn) {
conn = l2cap_conn_add(hcon);
-
- if (!conn)
- goto drop;
+ if (!conn)
+ goto drop;
+ l2cap_conn_get(conn);
+ } else {
+ mutex_lock(&l2cap_conn_del_mutex);
+ conn = hcon->l2cap_data;
+ if (conn)
+ if (!kref_get_unless_zero(&conn->ref))
+ conn = NULL;
+ mutex_unlock(&l2cap_conn_del_mutex);
+ if (!conn)
+ goto drop;
+ }
BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags);
@@ -7512,6 +7526,7 @@ void l2cap_recv_acldata(struct hci_conn
if (len == skb->len) {
/* Complete frame received */
l2cap_recv_frame(conn, skb);
+ l2cap_conn_put(conn);
return;
}
@@ -7576,6 +7591,8 @@ void l2cap_recv_acldata(struct hci_conn
drop:
kfree_skb(skb);
+ if (conn)
+ l2cap_conn_put(conn);
}
static struct hci_cb l2cap_cb = {
--
^ permalink raw reply [flat|nested] 34+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
2024-09-08 8:32 ` Hillf Danton
@ 2024-09-08 8:52 ` syzbot
0 siblings, 0 replies; 34+ messages in thread
From: syzbot @ 2024-09-08 8:52 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in hci_send_acl
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
CPU: 1 UID: 0 PID: 7269 Comm: kworker/u9:8 Not tainted 6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: hci2 hci_rx_work
RIP: 0010:hci_send_acl+0x35/0xd30 net/bluetooth/hci_core.c:3230
Code: 41 55 41 54 55 49 8d 6f 18 53 48 89 f3 48 83 ec 70 89 14 24 e8 1c 18 83 f7 48 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 bc 0b 00 00 49 8b 47 18 48 8d b8 e0 0f 00 00 48
RSP: 0018:ffffc9000ae676e0 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: ffff888030adc500 RCX: ffffffff8a1303d4
RDX: 0000000000000003 RSI: ffffffff8a08b834 RDI: 0000000000000000
RBP: 0000000000000018 R08: 0000000000000001 R09: 0000000000000080
R10: 0000000000000001 R11: 0000000000000000 R12: ffff888011da0000
R13: 0000000000000002 R14: ffffc9000ae67880 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b8900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000080 CR3: 00000000781ba000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
l2cap_send_cmd+0x6e5/0x920 net/bluetooth/l2cap_core.c:973
l2cap_connect.constprop.0+0x6f7/0x1270 net/bluetooth/l2cap_core.c:4038
l2cap_connect_req net/bluetooth/l2cap_core.c:4084 [inline]
l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4776 [inline]
l2cap_sig_channel net/bluetooth/l2cap_core.c:5547 [inline]
l2cap_recv_frame+0xf0b/0x8eb0 net/bluetooth/l2cap_core.c:6829
l2cap_recv_acldata+0xd58/0xfd0 net/bluetooth/l2cap_core.c:7528
hci_acldata_packet net/bluetooth/hci_core.c:3791 [inline]
hci_rx_work+0xaab/0x1610 net/bluetooth/hci_core.c:4028
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:hci_send_acl+0x35/0xd30 net/bluetooth/hci_core.c:3230
Code: 41 55 41 54 55 49 8d 6f 18 53 48 89 f3 48 83 ec 70 89 14 24 e8 1c 18 83 f7 48 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 bc 0b 00 00 49 8b 47 18 48 8d b8 e0 0f 00 00 48
RSP: 0018:ffffc9000ae676e0 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: ffff888030adc500 RCX: ffffffff8a1303d4
RDX: 0000000000000003 RSI: ffffffff8a08b834 RDI: 0000000000000000
RBP: 0000000000000018 R08: 0000000000000001 R09: 0000000000000080
R10: 0000000000000001 R11: 0000000000000000 R12: ffff888011da0000
R13: 0000000000000002 R14: ffffc9000ae67880 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b8800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000080 CR3: 00000000781ba000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 41 55 push %r13
2: 41 54 push %r12
4: 55 push %rbp
5: 49 8d 6f 18 lea 0x18(%r15),%rbp
9: 53 push %rbx
a: 48 89 f3 mov %rsi,%rbx
d: 48 83 ec 70 sub $0x70,%rsp
11: 89 14 24 mov %edx,(%rsp)
14: e8 1c 18 83 f7 call 0xf7831835
19: 48 89 ea mov %rbp,%rdx
1c: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
23: fc ff df
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
2e: 0f 85 bc 0b 00 00 jne 0xbf0
34: 49 8b 47 18 mov 0x18(%r15),%rax
38: 48 8d b8 e0 0f 00 00 lea 0xfe0(%rax),%rdi
3f: 48 rex.W
Tested on:
commit: d1f2d51b Merge tag 'clk-fixes-for-linus' of git://git...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13f51ffb980000
kernel config: https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=11651ffb980000
^ permalink raw reply [flat|nested] 34+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
2024-09-07 14:42 ` syzbot
` (7 preceding siblings ...)
2024-09-08 8:32 ` Hillf Danton
@ 2024-09-08 11:15 ` Hillf Danton
2024-09-08 11:33 ` syzbot
2024-09-08 12:50 ` Hillf Danton
` (4 subsequent siblings)
13 siblings, 1 reply; 34+ messages in thread
From: Hillf Danton @ 2024-09-08 11:15 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
On Sat, 07 Sep 2024 07:42:26 -0700
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 788220eee30d Merge tag 'pm-6.11-rc7' of git://git.kernel.o..
> git tree: upstream
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1304189f980000
#syz test
--- l/net/bluetooth/l2cap_core.c
+++ c/net/bluetooth/l2cap_core.c
@@ -1747,6 +1747,8 @@ static void l2cap_unregister_all_users(s
}
}
+static DEFINE_MUTEX(l2cap_conn_del_mutex);
+
static void l2cap_conn_del(struct hci_conn *hcon, int err)
{
struct l2cap_conn *conn = hcon->l2cap_data;
@@ -1792,14 +1794,15 @@ static void l2cap_conn_del(struct hci_co
mutex_unlock(&conn->chan_lock);
- hci_chan_del(conn->hchan);
-
if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
cancel_delayed_work_sync(&conn->info_timer);
+ mutex_lock(&l2cap_conn_del_mutex);
hcon->l2cap_data = NULL;
+ hci_chan_del(conn->hchan);
conn->hchan = NULL;
l2cap_conn_put(conn);
+ mutex_unlock(&l2cap_conn_del_mutex);
}
static void l2cap_conn_free(struct kref *ref)
@@ -7480,6 +7483,7 @@ void l2cap_recv_acldata(struct hci_conn
struct l2cap_conn *conn = hcon->l2cap_data;
int len;
+ mutex_lock(&l2cap_conn_del_mutex);
if (!conn)
conn = l2cap_conn_add(hcon);
@@ -7512,6 +7516,7 @@ void l2cap_recv_acldata(struct hci_conn
if (len == skb->len) {
/* Complete frame received */
l2cap_recv_frame(conn, skb);
+ mutex_unlock(&l2cap_conn_del_mutex);
return;
}
@@ -7576,6 +7581,7 @@ void l2cap_recv_acldata(struct hci_conn
drop:
kfree_skb(skb);
+ mutex_unlock(&l2cap_conn_del_mutex);
}
static struct hci_cb l2cap_cb = {
--
^ permalink raw reply [flat|nested] 34+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
2024-09-08 11:15 ` Hillf Danton
@ 2024-09-08 11:33 ` syzbot
0 siblings, 0 replies; 34+ messages in thread
From: syzbot @ 2024-09-08 11:33 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
possible deadlock in l2cap_recv_frame
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
======================================================
WARNING: possible circular locking dependency detected
6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0 Not tainted
------------------------------------------------------
kworker/u9:2/5273 is trying to acquire lock:
ffff888031c20078 (&hdev->lock){+.+.}-{3:3}, at: l2cap_connect_req net/bluetooth/l2cap_core.c:4078 [inline]
ffff888031c20078 (&hdev->lock){+.+.}-{3:3}, at: l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4775 [inline]
ffff888031c20078 (&hdev->lock){+.+.}-{3:3}, at: l2cap_sig_channel net/bluetooth/l2cap_core.c:5546 [inline]
ffff888031c20078 (&hdev->lock){+.+.}-{3:3}, at: l2cap_recv_frame+0xe9d/0x8eb0 net/bluetooth/l2cap_core.c:6828
but task is already holding lock:
ffffffff8fcb1c28 (l2cap_conn_del_mutex){+.+.}-{3:3}, at: l2cap_recv_acldata+0x57/0xbd0 net/bluetooth/l2cap_core.c:7486
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (l2cap_conn_del_mutex){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
l2cap_conn_del+0x462/0x750 net/bluetooth/l2cap_core.c:1800
l2cap_disconn_cfm net/bluetooth/l2cap_core.c:7310 [inline]
l2cap_disconn_cfm+0x96/0xd0 net/bluetooth/l2cap_core.c:7303
hci_disconn_cfm include/net/bluetooth/hci_core.h:1975 [inline]
hci_conn_hash_flush+0x114/0x260 net/bluetooth/hci_conn.c:2592
hci_dev_close_sync+0x59e/0x1110 net/bluetooth/hci_sync.c:5195
hci_dev_do_close+0x2e/0x90 net/bluetooth/hci_core.c:483
hci_unregister_dev+0x213/0x620 net/bluetooth/hci_core.c:2698
vhci_release+0x7f/0x100 drivers/bluetooth/hci_vhci.c:664
__fput+0x408/0xbb0 fs/file_table.c:422
task_work_run+0x14e/0x250 kernel/task_work.c:228
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0xaa3/0x2bb0 kernel/exit.c:882
do_group_exit+0xd3/0x2a0 kernel/exit.c:1031
get_signal+0x25fb/0x2770 kernel/signal.c:2917
arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #1 (hci_cb_list_lock){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
hci_connect_cfm include/net/bluetooth/hci_core.h:1957 [inline]
hci_remote_features_evt+0x4dc/0x9e0 net/bluetooth/hci_event.c:3721
hci_event_func net/bluetooth/hci_event.c:7446 [inline]
hci_event_packet+0x9eb/0x1180 net/bluetooth/hci_event.c:7498
hci_rx_work+0x2c6/0x1610 net/bluetooth/hci_core.c:4023
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
-> #0 (&hdev->lock){+.+.}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3133 [inline]
check_prevs_add kernel/locking/lockdep.c:3252 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]
__lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142
lock_acquire kernel/locking/lockdep.c:5759 [inline]
lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
l2cap_connect_req net/bluetooth/l2cap_core.c:4078 [inline]
l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4775 [inline]
l2cap_sig_channel net/bluetooth/l2cap_core.c:5546 [inline]
l2cap_recv_frame+0xe9d/0x8eb0 net/bluetooth/l2cap_core.c:6828
l2cap_recv_acldata+0x9fe/0xbd0 net/bluetooth/l2cap_core.c:7518
hci_acldata_packet net/bluetooth/hci_core.c:3791 [inline]
hci_rx_work+0xaab/0x1610 net/bluetooth/hci_core.c:4028
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
other info that might help us debug this:
Chain exists of:
&hdev->lock --> hci_cb_list_lock --> l2cap_conn_del_mutex
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(l2cap_conn_del_mutex);
lock(hci_cb_list_lock);
lock(l2cap_conn_del_mutex);
lock(&hdev->lock);
*** DEADLOCK ***
3 locks held by kworker/u9:2/5273:
#0: ffff888062dda148 ((wq_completion)hci1#2){+.+.}-{0:0}, at: process_one_work+0x1277/0x1b40 kernel/workqueue.c:3206
#1: ffffc9000379fd80 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x921/0x1b40 kernel/workqueue.c:3207
#2: ffffffff8fcb1c28 (l2cap_conn_del_mutex){+.+.}-{3:3}, at: l2cap_recv_acldata+0x57/0xbd0 net/bluetooth/l2cap_core.c:7486
stack backtrace:
CPU: 1 UID: 0 PID: 5273 Comm: kworker/u9:2 Not tainted 6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: hci1 hci_rx_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2186
check_prev_add kernel/locking/lockdep.c:3133 [inline]
check_prevs_add kernel/locking/lockdep.c:3252 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]
__lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142
lock_acquire kernel/locking/lockdep.c:5759 [inline]
lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
l2cap_connect_req net/bluetooth/l2cap_core.c:4078 [inline]
l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4775 [inline]
l2cap_sig_channel net/bluetooth/l2cap_core.c:5546 [inline]
l2cap_recv_frame+0xe9d/0x8eb0 net/bluetooth/l2cap_core.c:6828
l2cap_recv_acldata+0x9fe/0xbd0 net/bluetooth/l2cap_core.c:7518
hci_acldata_packet net/bluetooth/hci_core.c:3791 [inline]
hci_rx_work+0xaab/0x1610 net/bluetooth/hci_core.c:4028
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0c
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0d
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x0f
Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
Tested on:
commit: d1f2d51b Merge tag 'clk-fixes-for-linus' of git://git...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=103f1ffb980000
kernel config: https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=15508e00580000
^ permalink raw reply [flat|nested] 34+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
2024-09-07 14:42 ` syzbot
` (8 preceding siblings ...)
2024-09-08 11:15 ` Hillf Danton
@ 2024-09-08 12:50 ` Hillf Danton
2024-09-08 13:10 ` syzbot
2024-09-08 13:37 ` Hillf Danton
` (3 subsequent siblings)
13 siblings, 1 reply; 34+ messages in thread
From: Hillf Danton @ 2024-09-08 12:50 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
On Sat, 07 Sep 2024 07:42:26 -0700
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 788220eee30d Merge tag 'pm-6.11-rc7' of git://git.kernel.o..
> git tree: upstream
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1304189f980000
#syz test
--- x/net/bluetooth/hci_core.c
+++ y/net/bluetooth/hci_core.c
@@ -3787,8 +3787,10 @@ static void hci_acldata_packet(struct hc
if (conn) {
hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
+ hci_req_sync_lock(hdev);
/* Send to upper protocol */
l2cap_recv_acldata(conn, skb, flags);
+ hci_req_sync_unlock(hdev);
return;
} else {
bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
--
^ permalink raw reply [flat|nested] 34+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
2024-09-08 12:50 ` Hillf Danton
@ 2024-09-08 13:10 ` syzbot
0 siblings, 0 replies; 34+ messages in thread
From: syzbot @ 2024-09-08 13:10 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in l2cap_recv_acldata
==================================================================
BUG: KASAN: slab-use-after-free in l2cap_recv_acldata+0xa0b/0xb70 net/bluetooth/l2cap_core.c:7480
Read of size 8 at addr ffff888031b08fe8 by task kworker/u9:8/7223
CPU: 0 UID: 0 PID: 7223 Comm: kworker/u9:8 Not tainted 6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: hci0 hci_rx_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
print_address_description mm/kasan/report.c:377 [inline]
print_report+0xc3/0x620 mm/kasan/report.c:488
kasan_report+0xd9/0x110 mm/kasan/report.c:601
l2cap_recv_acldata+0xa0b/0xb70 net/bluetooth/l2cap_core.c:7480
hci_acldata_packet net/bluetooth/hci_core.c:3792 [inline]
hci_rx_work+0xac0/0x1630 net/bluetooth/hci_core.c:4030
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Allocated by task 6015:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:387
kmalloc_noprof include/linux/slab.h:681 [inline]
kzalloc_noprof include/linux/slab.h:807 [inline]
__hci_conn_add+0x131/0x1a50 net/bluetooth/hci_conn.c:934
hci_conn_add_unset+0x6d/0x100 net/bluetooth/hci_conn.c:1043
hci_conn_request_evt+0x8c4/0xb40 net/bluetooth/hci_event.c:3288
hci_event_func net/bluetooth/hci_event.c:7446 [inline]
hci_event_packet+0x9eb/0x1180 net/bluetooth/hci_event.c:7498
hci_rx_work+0x2c6/0x1630 net/bluetooth/hci_core.c:4025
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Freed by task 6017:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
poison_slab_object+0xf7/0x160 mm/kasan/common.c:240
__kasan_slab_free+0x32/0x50 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2256 [inline]
slab_free mm/slub.c:4477 [inline]
kfree+0x12a/0x3b0 mm/slub.c:4598
device_release+0xa1/0x240 drivers/base/core.c:2582
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x1e4/0x5a0 lib/kobject.c:737
put_device drivers/base/core.c:3790 [inline]
device_unregister+0x2f/0xc0 drivers/base/core.c:3913
hci_conn_del_sysfs+0xb4/0x180 net/bluetooth/hci_sysfs.c:86
hci_conn_cleanup net/bluetooth/hci_conn.c:175 [inline]
hci_conn_del+0x54e/0xdb0 net/bluetooth/hci_conn.c:1162
hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583
abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2917
hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
The buggy address belongs to the object at ffff888031b08000
which belongs to the cache kmalloc-8k of size 8192
The buggy address is located 4072 bytes inside of
freed 8192-byte region [ffff888031b08000, ffff888031b0a000)
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888031b0c000 pfn:0x31b08
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
ksm flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xfdffffff(slab)
raw: 00fff00000000040 ffff88801ac42280 ffffea0001f09000 0000000000000003
raw: ffff888031b0c000 0000000000020001 00000001fdffffff 0000000000000000
head: 00fff00000000040 ffff88801ac42280 ffffea0001f09000 0000000000000003
head: ffff888031b0c000 0000000000020001 00000001fdffffff 0000000000000000
head: 00fff00000000003 ffffea0000c6c201 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 6015, tgid 6015 (kworker/u9:6), ts 133220298161, free_ts 131544899649
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1500
prep_new_page mm/page_alloc.c:1508 [inline]
get_page_from_freelist+0x1351/0x2e50 mm/page_alloc.c:3446
__alloc_pages_noprof+0x22b/0x2460 mm/page_alloc.c:4702
__alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
alloc_slab_page+0x4e/0xf0 mm/slub.c:2325
allocate_slab mm/slub.c:2488 [inline]
new_slab+0x84/0x260 mm/slub.c:2541
___slab_alloc+0xdac/0x1870 mm/slub.c:3727
__slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3817
__slab_alloc_node mm/slub.c:3870 [inline]
slab_alloc_node mm/slub.c:4029 [inline]
__kmalloc_cache_noprof+0x2b4/0x300 mm/slub.c:4188
kmalloc_noprof include/linux/slab.h:681 [inline]
kzalloc_noprof include/linux/slab.h:807 [inline]
__hci_conn_add+0x131/0x1a50 net/bluetooth/hci_conn.c:934
hci_conn_add_unset+0x6d/0x100 net/bluetooth/hci_conn.c:1043
hci_conn_request_evt+0x8c4/0xb40 net/bluetooth/hci_event.c:3288
hci_event_func net/bluetooth/hci_event.c:7446 [inline]
hci_event_packet+0x9eb/0x1180 net/bluetooth/hci_event.c:7498
hci_rx_work+0x2c6/0x1630 net/bluetooth/hci_core.c:4025
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
page last free pid 5957 tgid 5957 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1101 [inline]
free_unref_page+0x64a/0xe40 mm/page_alloc.c:2619
__put_partials+0x14c/0x170 mm/slub.c:3055
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:322
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3992 [inline]
slab_alloc_node mm/slub.c:4041 [inline]
kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4048
ptlock_alloc mm/memory.c:6589 [inline]
ptlock_init include/linux/mm.h:2944 [inline]
pmd_ptlock_init include/linux/mm.h:3048 [inline]
pagetable_pmd_ctor include/linux/mm.h:3086 [inline]
pmd_alloc_one_noprof include/asm-generic/pgalloc.h:141 [inline]
__pmd_alloc+0xc3/0x820 mm/memory.c:6079
pmd_alloc include/linux/mm.h:2835 [inline]
alloc_new_pmd mm/mremap.c:96 [inline]
move_page_tables+0x2218/0x3780 mm/mremap.c:608
shift_arg_pages+0x1eb/0x410 fs/exec.c:758
setup_arg_pages+0x516/0xc70 fs/exec.c:880
load_elf_binary+0xa66/0x4d90 fs/binfmt_elf.c:1014
search_binary_handler fs/exec.c:1827 [inline]
exec_binprm fs/exec.c:1869 [inline]
bprm_execve fs/exec.c:1920 [inline]
bprm_execve+0x703/0x1960 fs/exec.c:1896
do_execveat_common.isra.0+0x4f1/0x630 fs/exec.c:2027
do_execve fs/exec.c:2101 [inline]
__do_sys_execve fs/exec.c:2177 [inline]
__se_sys_execve fs/exec.c:2172 [inline]
__x64_sys_execve+0x8c/0xb0 fs/exec.c:2172
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888031b08e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888031b08f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888031b08f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888031b09000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888031b09080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Tested on:
commit: d1f2d51b Merge tag 'clk-fixes-for-linus' of git://git...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14151f29980000
kernel config: https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=15449ffb980000
^ permalink raw reply [flat|nested] 34+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
2024-09-07 14:42 ` syzbot
` (9 preceding siblings ...)
2024-09-08 12:50 ` Hillf Danton
@ 2024-09-08 13:37 ` Hillf Danton
2024-09-08 13:58 ` syzbot
2024-09-09 11:06 ` Hillf Danton
` (2 subsequent siblings)
13 siblings, 1 reply; 34+ messages in thread
From: Hillf Danton @ 2024-09-08 13:37 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
On Sat, 07 Sep 2024 07:42:26 -0700
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 788220eee30d Merge tag 'pm-6.11-rc7' of git://git.kernel.o..
> git tree: upstream
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1304189f980000
#syz test
--- x/net/bluetooth/hci_core.c
+++ y/net/bluetooth/hci_core.c
@@ -3782,13 +3782,18 @@ static void hci_acldata_packet(struct hc
hci_dev_lock(hdev);
conn = hci_conn_hash_lookup_handle(hdev, handle);
+ if (conn)
+ hci_conn_get(conn);
hci_dev_unlock(hdev);
if (conn) {
hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
+ hci_req_sync_lock(hdev);
/* Send to upper protocol */
l2cap_recv_acldata(conn, skb, flags);
+ hci_req_sync_unlock(hdev);
+ hci_conn_put(conn);
return;
} else {
bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
--
^ permalink raw reply [flat|nested] 34+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
2024-09-08 13:37 ` Hillf Danton
@ 2024-09-08 13:58 ` syzbot
0 siblings, 0 replies; 34+ messages in thread
From: syzbot @ 2024-09-08 13:58 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
possible deadlock in hci_dev_do_close
======================================================
WARNING: possible circular locking dependency detected
6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0 Not tainted
------------------------------------------------------
syz-executor/5776 is trying to acquire lock:
ffff88807d6ca148 ((wq_completion)hci1#2){+.+.}-{0:0}, at: touch_wq_lockdep_map+0x6e/0x120 kernel/workqueue.c:3875
but task is already holding lock:
ffff888060a68d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close+0x26/0x90 net/bluetooth/hci_core.c:481
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&hdev->req_lock){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
hci_acldata_packet net/bluetooth/hci_core.c:3792 [inline]
hci_rx_work+0xabf/0x1650 net/bluetooth/hci_core.c:4033
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
-> #1 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}:
process_one_work+0x927/0x1b40 kernel/workqueue.c:3207
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
-> #0 ((wq_completion)hci1#2){+.+.}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3133 [inline]
check_prevs_add kernel/locking/lockdep.c:3252 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]
__lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142
lock_acquire kernel/locking/lockdep.c:5759 [inline]
lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
touch_wq_lockdep_map+0x78/0x120 kernel/workqueue.c:3875
__flush_workqueue+0x129/0x1200 kernel/workqueue.c:3917
drain_workqueue+0x18f/0x3d0 kernel/workqueue.c:4081
hci_dev_close_sync+0x333/0x1110 net/bluetooth/hci_sync.c:5181
hci_dev_do_close+0x2e/0x90 net/bluetooth/hci_core.c:483
hci_unregister_dev+0x213/0x620 net/bluetooth/hci_core.c:2698
vhci_release+0x7f/0x100 drivers/bluetooth/hci_vhci.c:664
__fput+0x408/0xbb0 fs/file_table.c:422
task_work_run+0x14e/0x250 kernel/task_work.c:228
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0xaa3/0x2bb0 kernel/exit.c:882
do_group_exit+0xd3/0x2a0 kernel/exit.c:1031
get_signal+0x25fb/0x2770 kernel/signal.c:2917
arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
other info that might help us debug this:
Chain exists of:
(wq_completion)hci1#2 --> (work_completion)(&hdev->rx_work) --> &hdev->req_lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&hdev->req_lock);
lock((work_completion)(&hdev->rx_work));
lock(&hdev->req_lock);
lock((wq_completion)hci1#2);
*** DEADLOCK ***
1 lock held by syz-executor/5776:
#0: ffff888060a68d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close+0x26/0x90 net/bluetooth/hci_core.c:481
stack backtrace:
CPU: 0 UID: 0 PID: 5776 Comm: syz-executor Not tainted 6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2186
check_prev_add kernel/locking/lockdep.c:3133 [inline]
check_prevs_add kernel/locking/lockdep.c:3252 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]
__lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142
lock_acquire kernel/locking/lockdep.c:5759 [inline]
lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
touch_wq_lockdep_map+0x78/0x120 kernel/workqueue.c:3875
__flush_workqueue+0x129/0x1200 kernel/workqueue.c:3917
drain_workqueue+0x18f/0x3d0 kernel/workqueue.c:4081
hci_dev_close_sync+0x333/0x1110 net/bluetooth/hci_sync.c:5181
hci_dev_do_close+0x2e/0x90 net/bluetooth/hci_core.c:483
hci_unregister_dev+0x213/0x620 net/bluetooth/hci_core.c:2698
vhci_release+0x7f/0x100 drivers/bluetooth/hci_vhci.c:664
__fput+0x408/0xbb0 fs/file_table.c:422
task_work_run+0x14e/0x250 kernel/task_work.c:228
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0xaa3/0x2bb0 kernel/exit.c:882
do_group_exit+0xd3/0x2a0 kernel/exit.c:1031
get_signal+0x25fb/0x2770 kernel/signal.c:2917
arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc96277bb8a
Code: Unable to access opcode bytes at 0x7fc96277bb60.
RSP: 002b:00007ffc87843a70 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 00007fc96277bb8a
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00007ffc87843abc R08: 00007ffc878433cc R09: 00007ffc878437d7
R10: 00007ffc87843450 R11: 0000000000000293 R12: 0000000000000032
R13: 0000000000045913 R14: 00000000000458e1 R15: 00007ffc87843b10
</TASK>
Tested on:
commit: d1f2d51b Merge tag 'clk-fixes-for-linus' of git://git...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14dd1f29980000
kernel config: https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=10014877980000
^ permalink raw reply [flat|nested] 34+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
2024-09-07 14:42 ` syzbot
` (10 preceding siblings ...)
2024-09-08 13:37 ` Hillf Danton
@ 2024-09-09 11:06 ` Hillf Danton
2024-09-09 11:31 ` syzbot
2024-09-11 11:29 ` Hillf Danton
2024-09-12 11:49 ` Hillf Danton
13 siblings, 1 reply; 34+ messages in thread
From: Hillf Danton @ 2024-09-09 11:06 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
On Sat, 07 Sep 2024 07:42:26 -0700
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 788220eee30d Merge tag 'pm-6.11-rc7' of git://git.kernel.o..
> git tree: upstream
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1304189f980000
#syz test
--- x/net/bluetooth/l2cap_core.c
+++ y/net/bluetooth/l2cap_core.c
@@ -1792,13 +1792,10 @@ static void l2cap_conn_del(struct hci_co
mutex_unlock(&conn->chan_lock);
- hci_chan_del(conn->hchan);
-
if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
cancel_delayed_work_sync(&conn->info_timer);
hcon->l2cap_data = NULL;
- conn->hchan = NULL;
l2cap_conn_put(conn);
}
@@ -1806,6 +1803,7 @@ static void l2cap_conn_free(struct kref
{
struct l2cap_conn *conn = container_of(ref, struct l2cap_conn, ref);
+ hci_chan_del(conn->hchan);
hci_conn_put(conn->hcon);
kfree(conn);
}
@@ -7486,6 +7484,14 @@ void l2cap_recv_acldata(struct hci_conn
if (!conn)
goto drop;
+ hci_dev_lock(hcon->hdev);
+ if (conn != hcon->l2cap_data)
+ conn = NULL;
+ else
+ l2cap_conn_get(conn);
+ hci_dev_unlock(hcon->hdev);
+ if (!conn)
+ goto drop;
BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags);
switch (flags) {
@@ -7512,6 +7518,7 @@ void l2cap_recv_acldata(struct hci_conn
if (len == skb->len) {
/* Complete frame received */
l2cap_recv_frame(conn, skb);
+ l2cap_conn_put(conn);
return;
}
@@ -7576,6 +7583,8 @@ void l2cap_recv_acldata(struct hci_conn
drop:
kfree_skb(skb);
+ if (conn)
+ l2cap_conn_put(conn);
}
static struct hci_cb l2cap_cb = {
--- x/net/bluetooth/hci_core.c
+++ y/net/bluetooth/hci_core.c
@@ -3782,6 +3782,8 @@ static void hci_acldata_packet(struct hc
hci_dev_lock(hdev);
conn = hci_conn_hash_lookup_handle(hdev, handle);
+ if (conn)
+ hci_conn_get(conn);
hci_dev_unlock(hdev);
if (conn) {
@@ -3789,6 +3791,7 @@ static void hci_acldata_packet(struct hc
/* Send to upper protocol */
l2cap_recv_acldata(conn, skb, flags);
+ hci_conn_put(conn);
return;
} else {
bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
--
^ permalink raw reply [flat|nested] 34+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
2024-09-09 11:06 ` Hillf Danton
@ 2024-09-09 11:31 ` syzbot
0 siblings, 0 replies; 34+ messages in thread
From: syzbot @ 2024-09-09 11:31 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in hci_send_acl
==================================================================
BUG: KASAN: slab-use-after-free in hci_send_acl+0xc03/0xd30 net/bluetooth/hci_core.c:3230
Read of size 8 at addr ffff8880291d1618 by task kworker/u9:8/7107
CPU: 1 UID: 0 PID: 7107 Comm: kworker/u9:8 Not tainted 6.11.0-rc7-syzkaller-gda3ea35007d0-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: hci1 hci_rx_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
print_address_description mm/kasan/report.c:377 [inline]
print_report+0xc3/0x620 mm/kasan/report.c:488
kasan_report+0xd9/0x110 mm/kasan/report.c:601
hci_send_acl+0xc03/0xd30 net/bluetooth/hci_core.c:3230
l2cap_send_cmd+0x6e5/0x920 net/bluetooth/l2cap_core.c:973
l2cap_connect.constprop.0+0x6f7/0x1270 net/bluetooth/l2cap_core.c:4032
l2cap_connect_req net/bluetooth/l2cap_core.c:4078 [inline]
l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4770 [inline]
l2cap_sig_channel net/bluetooth/l2cap_core.c:5541 [inline]
l2cap_recv_frame+0xf0b/0x8eb0 net/bluetooth/l2cap_core.c:6823
l2cap_recv_acldata+0xc03/0xf00 net/bluetooth/l2cap_core.c:7520
hci_acldata_packet net/bluetooth/hci_core.c:3793 [inline]
hci_rx_work+0xabe/0x1630 net/bluetooth/hci_core.c:4031
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Allocated by task 54:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:387
kmalloc_noprof include/linux/slab.h:681 [inline]
kzalloc_noprof include/linux/slab.h:807 [inline]
hci_chan_create+0xa6/0x3d0 net/bluetooth/hci_conn.c:2732
l2cap_conn_add.part.0+0x1a/0xa60 net/bluetooth/l2cap_core.c:6862
l2cap_conn_add net/bluetooth/l2cap_core.c:69 [inline]
l2cap_connect_cfm+0x428/0xf80 net/bluetooth/l2cap_core.c:7243
hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
hci_remote_features_evt+0x548/0x9e0 net/bluetooth/hci_event.c:3721
hci_event_func net/bluetooth/hci_event.c:7446 [inline]
hci_event_packet+0x9eb/0x1180 net/bluetooth/hci_event.c:7498
hci_rx_work+0x2c6/0x1630 net/bluetooth/hci_core.c:4026
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Freed by task 5973:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
poison_slab_object+0xf7/0x160 mm/kasan/common.c:240
__kasan_slab_free+0x32/0x50 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2256 [inline]
slab_free mm/slub.c:4477 [inline]
kfree+0x12a/0x3b0 mm/slub.c:4598
hci_chan_list_flush+0x81/0xf0 net/bluetooth/hci_conn.c:2772
hci_conn_cleanup net/bluetooth/hci_conn.c:150 [inline]
hci_conn_del+0x1cc/0xdb0 net/bluetooth/hci_conn.c:1162
hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583
abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2917
hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
The buggy address belongs to the object at ffff8880291d1600
which belongs to the cache kmalloc-128 of size 128
The buggy address is located 24 bytes inside of
freed 128-byte region [ffff8880291d1600, ffff8880291d1680)
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880291d1900 pfn:0x291d1
flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xfdffffff(slab)
raw: 00fff00000000200 ffff88801ac41a00 ffffea0001fd5a90 ffffea00009ed310
raw: ffff8880291d1900 000000000010000d 00000001fdffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x352800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL|__GFP_THISNODE), pid 5909, tgid 5909 (syz-executor), ts 135353944743, free_ts 135353325117
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1500
prep_new_page mm/page_alloc.c:1508 [inline]
get_page_from_freelist+0x1351/0x2e50 mm/page_alloc.c:3446
__alloc_pages_noprof+0x22b/0x2460 mm/page_alloc.c:4702
__alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
alloc_slab_page+0x4e/0xf0 mm/slub.c:2325
allocate_slab mm/slub.c:2488 [inline]
new_slab+0x84/0x260 mm/slub.c:2541
___slab_alloc+0xdac/0x1870 mm/slub.c:3727
__slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3817
__slab_alloc_node mm/slub.c:3870 [inline]
slab_alloc_node mm/slub.c:4029 [inline]
__do_kmalloc_node mm/slub.c:4161 [inline]
__kmalloc_node_noprof+0x357/0x430 mm/slub.c:4168
kmalloc_array_node_noprof include/linux/slab.h:788 [inline]
alloc_slab_obj_exts+0x41/0xa0 mm/slub.c:1976
__memcg_slab_post_alloc_hook+0x2bc/0x9c0 mm/memcontrol.c:3019
memcg_slab_post_alloc_hook mm/slub.c:2164 [inline]
slab_post_alloc_hook mm/slub.c:4002 [inline]
slab_alloc_node mm/slub.c:4041 [inline]
kmem_cache_alloc_noprof+0x2c6/0x2f0 mm/slub.c:4048
copy_sighand+0x43/0x2c0 kernel/fork.c:1794
copy_process+0x2771/0x8de0 kernel/fork.c:2368
kernel_clone+0xfd/0x960 kernel/fork.c:2781
__do_sys_clone+0xba/0x100 kernel/fork.c:2924
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
page last free pid 5909 tgid 5909 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1101 [inline]
free_unref_page+0x64a/0xe40 mm/page_alloc.c:2619
vfree+0x181/0x7a0 mm/vmalloc.c:3367
copy_entries_to_user net/ipv6/netfilter/ip6_tables.c:882 [inline]
get_entries net/ipv6/netfilter/ip6_tables.c:1039 [inline]
do_ip6t_get_ctl+0x8ec/0xaf0 net/ipv6/netfilter/ip6_tables.c:1677
nf_getsockopt+0x79/0xe0 net/netfilter/nf_sockopt.c:116
ipv6_getsockopt+0x1fd/0x2c0 net/ipv6/ipv6_sockglue.c:1493
tcp_getsockopt+0x9e/0x100 net/ipv4/tcp.c:4409
do_sock_getsockopt+0x3fe/0x800 net/socket.c:2386
__sys_getsockopt+0x1a1/0x270 net/socket.c:2415
__do_sys_getsockopt net/socket.c:2425 [inline]
__se_sys_getsockopt net/socket.c:2422 [inline]
__x64_sys_getsockopt+0xbd/0x160 net/socket.c:2422
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff8880291d1500: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc
ffff8880291d1580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8880291d1600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880291d1680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8880291d1700: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc
==================================================================
Tested on:
commit: da3ea350 Linux 6.11-rc7
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15a3389f980000
kernel config: https://syzkaller.appspot.com/x/.config?x=28869f34c32848cf
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=131ace00580000
^ permalink raw reply [flat|nested] 34+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
2024-06-24 20:23 syzbot
2024-09-07 14:42 ` syzbot
@ 2024-09-10 18:43 ` syzbot
1 sibling, 0 replies; 34+ messages in thread
From: syzbot @ 2024-09-10 18:43 UTC (permalink / raw)
To: eadavis, hdanton, johan.hedberg, linux-bluetooth, linux-kernel,
luiz.dentz, luiz.von.dentz, marcel, syzkaller-bugs
syzbot has bisected this issue to:
commit 5af1f84ed13a416297ab9ced7537f4d5ae7f329a
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: Thu Aug 3 18:04:51 2023 +0000
Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=12477bc7980000
start commit: 788220eee30d Merge tag 'pm-6.11-rc7' of git://git.kernel.o..
git tree: upstream
final oops: https://syzkaller.appspot.com/x/report.txt?x=11477bc7980000
console output: https://syzkaller.appspot.com/x/log.txt?x=16477bc7980000
kernel config: https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11da6f29980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1304189f980000
Reported-by: syzbot+c12e2f941af1feb5632c@syzkaller.appspotmail.com
Fixes: 5af1f84ed13a ("Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync")
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
^ permalink raw reply [flat|nested] 34+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
2024-09-07 14:42 ` syzbot
` (11 preceding siblings ...)
2024-09-09 11:06 ` Hillf Danton
@ 2024-09-11 11:29 ` Hillf Danton
2024-09-11 11:59 ` syzbot
2024-09-12 11:49 ` Hillf Danton
13 siblings, 1 reply; 34+ messages in thread
From: Hillf Danton @ 2024-09-11 11:29 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
On Sat, 07 Sep 2024 07:42:26 -0700
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 788220eee30d Merge tag 'pm-6.11-rc7' of git://git.kernel.o..
> git tree: upstream
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1304189f980000
#syz test
--- x/net/bluetooth/hci_core.c
+++ y/net/bluetooth/hci_core.c
@@ -3782,6 +3782,8 @@ static void hci_acldata_packet(struct hc
hci_dev_lock(hdev);
conn = hci_conn_hash_lookup_handle(hdev, handle);
+ if (conn)
+ hci_conn_get(conn);
hci_dev_unlock(hdev);
if (conn) {
@@ -3789,6 +3791,7 @@ static void hci_acldata_packet(struct hc
/* Send to upper protocol */
l2cap_recv_acldata(conn, skb, flags);
+ hci_conn_put(conn);
return;
} else {
bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
--- x/net/bluetooth/l2cap_core.c
+++ y/net/bluetooth/l2cap_core.c
@@ -1792,13 +1792,10 @@ static void l2cap_conn_del(struct hci_co
mutex_unlock(&conn->chan_lock);
- hci_chan_del(conn->hchan);
-
if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
cancel_delayed_work_sync(&conn->info_timer);
hcon->l2cap_data = NULL;
- conn->hchan = NULL;
l2cap_conn_put(conn);
}
@@ -1806,6 +1803,7 @@ static void l2cap_conn_free(struct kref
{
struct l2cap_conn *conn = container_of(ref, struct l2cap_conn, ref);
+ hci_chan_del(conn->hchan);
hci_conn_put(conn->hcon);
kfree(conn);
}
@@ -4073,11 +4071,15 @@ static int l2cap_connect_req(struct l2ca
return -EPROTO;
hci_dev_lock(hdev);
+ if (hcon->state == BT_CLOSED) {
+ hci_dev_unlock(hdev);
+ return -EPROTO;
+ }
if (hci_dev_test_flag(hdev, HCI_MGMT))
mgmt_device_connected(hdev, hcon, NULL, 0);
- hci_dev_unlock(hdev);
l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP);
+ hci_dev_unlock(hdev);
return 0;
}
@@ -7486,6 +7488,14 @@ void l2cap_recv_acldata(struct hci_conn
if (!conn)
goto drop;
+ hci_dev_lock(hcon->hdev);
+ if (conn != hcon->l2cap_data)
+ conn = NULL;
+ else
+ l2cap_conn_get(conn);
+ hci_dev_unlock(hcon->hdev);
+ if (!conn)
+ goto drop;
BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags);
switch (flags) {
@@ -7512,6 +7522,7 @@ void l2cap_recv_acldata(struct hci_conn
if (len == skb->len) {
/* Complete frame received */
l2cap_recv_frame(conn, skb);
+ l2cap_conn_put(conn);
return;
}
@@ -7576,6 +7587,8 @@ void l2cap_recv_acldata(struct hci_conn
drop:
kfree_skb(skb);
+ if (conn)
+ l2cap_conn_put(conn);
}
static struct hci_cb l2cap_cb = {
--
^ permalink raw reply [flat|nested] 34+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
2024-09-11 11:29 ` Hillf Danton
@ 2024-09-11 11:59 ` syzbot
0 siblings, 0 replies; 34+ messages in thread
From: syzbot @ 2024-09-11 11:59 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in hci_send_acl
Bluetooth: Wrong link type (-22)
Bluetooth: Wrong link type (-71)
==================================================================
BUG: KASAN: slab-use-after-free in hci_send_acl+0xc03/0xd30 net/bluetooth/hci_core.c:3230
Read of size 8 at addr ffff8880252f2018 by task kworker/u9:5/6019
CPU: 0 UID: 0 PID: 6019 Comm: kworker/u9:5 Not tainted 6.11.0-rc7-syzkaller-00020-g8d8d276ba2fb-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: hci2 hci_rx_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
print_address_description mm/kasan/report.c:377 [inline]
print_report+0xc3/0x620 mm/kasan/report.c:488
kasan_report+0xd9/0x110 mm/kasan/report.c:601
hci_send_acl+0xc03/0xd30 net/bluetooth/hci_core.c:3230
l2cap_send_cmd+0x6e5/0x920 net/bluetooth/l2cap_core.c:973
l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5512 [inline]
l2cap_sig_channel net/bluetooth/l2cap_core.c:5548 [inline]
l2cap_recv_frame+0x21db/0x8f20 net/bluetooth/l2cap_core.c:6827
l2cap_recv_acldata+0xc03/0xf00 net/bluetooth/l2cap_core.c:7524
hci_acldata_packet net/bluetooth/hci_core.c:3793 [inline]
hci_rx_work+0xabe/0x1630 net/bluetooth/hci_core.c:4031
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Allocated by task 6020:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:387
kmalloc_noprof include/linux/slab.h:681 [inline]
kzalloc_noprof include/linux/slab.h:807 [inline]
hci_chan_create+0xa6/0x3d0 net/bluetooth/hci_conn.c:2732
l2cap_conn_add.part.0+0x1a/0xa60 net/bluetooth/l2cap_core.c:6866
l2cap_conn_add net/bluetooth/l2cap_core.c:69 [inline]
l2cap_connect_cfm+0x428/0xf80 net/bluetooth/l2cap_core.c:7247
hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
hci_remote_features_evt+0x548/0x9e0 net/bluetooth/hci_event.c:3721
hci_event_func net/bluetooth/hci_event.c:7446 [inline]
hci_event_packet+0x9eb/0x1180 net/bluetooth/hci_event.c:7498
hci_rx_work+0x2c6/0x1630 net/bluetooth/hci_core.c:4026
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Freed by task 5281:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
poison_slab_object+0xf7/0x160 mm/kasan/common.c:240
__kasan_slab_free+0x32/0x50 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2256 [inline]
slab_free mm/slub.c:4477 [inline]
kfree+0x12a/0x3b0 mm/slub.c:4598
hci_chan_list_flush+0x81/0xf0 net/bluetooth/hci_conn.c:2772
hci_conn_cleanup net/bluetooth/hci_conn.c:150 [inline]
hci_conn_del+0x1cc/0xdb0 net/bluetooth/hci_conn.c:1162
hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583
abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2917
hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
The buggy address belongs to the object at ffff8880252f2000
which belongs to the cache kmalloc-128 of size 128
The buggy address is located 24 bytes inside of
freed 128-byte region [ffff8880252f2000, ffff8880252f2080)
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880252f2900 pfn:0x252f2
flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xfdffffff(slab)
raw: 00fff00000000200 ffff88801ac41a00 ffffea00007ba290 ffffea00008abdd0
raw: ffff8880252f2900 000000000010000c 00000001fdffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x152cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 6020, tgid 6020 (kworker/u9:6), ts 135162004436, free_ts 135147554210
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1500
prep_new_page mm/page_alloc.c:1508 [inline]
get_page_from_freelist+0x1351/0x2e50 mm/page_alloc.c:3446
__alloc_pages_noprof+0x22b/0x2460 mm/page_alloc.c:4702
__alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
alloc_slab_page+0x4e/0xf0 mm/slub.c:2325
allocate_slab mm/slub.c:2488 [inline]
new_slab+0x84/0x260 mm/slub.c:2541
___slab_alloc+0xdac/0x1870 mm/slub.c:3727
__slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3817
__slab_alloc_node mm/slub.c:3870 [inline]
slab_alloc_node mm/slub.c:4029 [inline]
__kmalloc_cache_noprof+0x2b4/0x300 mm/slub.c:4188
kmalloc_noprof include/linux/slab.h:681 [inline]
kzalloc_noprof include/linux/slab.h:807 [inline]
hci_chan_create+0xa6/0x3d0 net/bluetooth/hci_conn.c:2732
l2cap_conn_add.part.0+0x1a/0xa60 net/bluetooth/l2cap_core.c:6866
l2cap_conn_add net/bluetooth/l2cap_core.c:69 [inline]
l2cap_connect_cfm+0x428/0xf80 net/bluetooth/l2cap_core.c:7247
hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
hci_remote_features_evt+0x548/0x9e0 net/bluetooth/hci_event.c:3721
hci_event_func net/bluetooth/hci_event.c:7446 [inline]
hci_event_packet+0x9eb/0x1180 net/bluetooth/hci_event.c:7498
hci_rx_work+0x2c6/0x1630 net/bluetooth/hci_core.c:4026
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
page last free pid 5597 tgid 5597 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1101 [inline]
free_unref_folios+0x9e9/0x1390 mm/page_alloc.c:2667
folios_put_refs+0x560/0x760 mm/swap.c:1039
free_pages_and_swap_cache+0x36d/0x510 mm/swap_state.c:332
__tlb_batch_free_encoded_pages+0xf9/0x290 mm/mmu_gather.c:136
tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:366 [inline]
tlb_flush_mmu mm/mmu_gather.c:373 [inline]
tlb_finish_mmu+0x168/0x7b0 mm/mmu_gather.c:465
exit_mmap+0x3d1/0xb20 mm/mmap.c:3425
__mmput+0x12a/0x480 kernel/fork.c:1345
mmput+0x62/0x70 kernel/fork.c:1367
exit_mm kernel/exit.c:571 [inline]
do_exit+0x9bf/0x2bb0 kernel/exit.c:869
do_group_exit+0xd3/0x2a0 kernel/exit.c:1031
__do_sys_exit_group kernel/exit.c:1042 [inline]
__se_sys_exit_group kernel/exit.c:1040 [inline]
__x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1040
x64_sys_call+0x14a9/0x16a0 arch/x86/include/generated/asm/syscalls_64.h:232
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff8880252f1f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8880252f1f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8880252f2000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880252f2080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8880252f2100: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc
==================================================================
Tested on:
commit: 8d8d276b Merge tag 'trace-v6.11-rc6' of git://git.kern..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11556100580000
kernel config: https://syzkaller.appspot.com/x/.config?x=28869f34c32848cf
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=162a07c7980000
^ permalink raw reply [flat|nested] 34+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
2024-09-07 14:42 ` syzbot
` (12 preceding siblings ...)
2024-09-11 11:29 ` Hillf Danton
@ 2024-09-12 11:49 ` Hillf Danton
2024-09-12 14:51 ` syzbot
13 siblings, 1 reply; 34+ messages in thread
From: Hillf Danton @ 2024-09-12 11:49 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
On Sat, 07 Sep 2024 07:42:26 -0700
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 788220eee30d Merge tag 'pm-6.11-rc7' of git://git.kernel.o..
> git tree: upstream
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1304189f980000
#syz test
--- x/include/net/bluetooth/hci_core.h
+++ y/include/net/bluetooth/hci_core.h
@@ -511,6 +511,7 @@ struct hci_dev {
struct sk_buff *recv_event;
struct mutex req_lock;
+ struct mutex rx_lock;
wait_queue_head_t req_wait_q;
__u32 req_status;
__u32 req_result;
--- x/net/bluetooth/hci_core.c
+++ y/net/bluetooth/hci_core.c
@@ -2507,6 +2507,7 @@ struct hci_dev *hci_alloc_dev_priv(int s
mutex_init(&hdev->lock);
mutex_init(&hdev->req_lock);
+ mutex_init(&hdev->rx_lock);
ida_init(&hdev->unset_handle_ida);
@@ -3977,6 +3978,7 @@ static void hci_rx_work(struct work_stru
BT_DBG("%s", hdev->name);
+ mutex_lock(&hdev->rx_lock);
/* The kcov_remote functions used for collecting packet parsing
* coverage information from this background thread and associate
* the coverage with the syscall's thread which originally injected
@@ -4043,6 +4045,7 @@ static void hci_rx_work(struct work_stru
break;
}
}
+ mutex_unlock(&hdev->rx_lock);
}
static void hci_send_cmd_sync(struct hci_dev *hdev, struct sk_buff *skb)
--- x/net/bluetooth/hci_sync.c
+++ y/net/bluetooth/hci_sync.c
@@ -325,9 +325,11 @@ static void hci_cmd_sync_work(struct wor
int err;
hci_req_sync_lock(hdev);
+ mutex_lock(&hdev->rx_lock);
err = entry->func(hdev, entry->data);
if (entry->destroy)
entry->destroy(hdev, entry->data, err);
+ mutex_unlock(&hdev->rx_lock);
hci_req_sync_unlock(hdev);
}
--
^ permalink raw reply [flat|nested] 34+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
2024-09-12 11:49 ` Hillf Danton
@ 2024-09-12 14:51 ` syzbot
0 siblings, 0 replies; 34+ messages in thread
From: syzbot @ 2024-09-12 14:51 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+c12e2f941af1feb5632c@syzkaller.appspotmail.com
Tested-by: syzbot+c12e2f941af1feb5632c@syzkaller.appspotmail.com
Tested on:
commit: 77f58789 Merge tag 'arm-fixes-6.11-3' of git://git.ker..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1190149f980000
kernel config: https://syzkaller.appspot.com/x/.config?x=28869f34c32848cf
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=14c2d807980000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 34+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
2024-09-23 15:20 [PATCH] Bluetooth/l2cap: Fix uaf in l2cap_connect Luiz Augusto von Dentz
@ 2024-09-23 15:28 ` syzbot
0 siblings, 0 replies; 34+ messages in thread
From: syzbot @ 2024-09-23 15:28 UTC (permalink / raw)
To: eadavis, hdanton, linux-bluetooth, linux-kernel, luiz.dentz,
nogikh, syzkaller-bugs
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
failed to apply patch:
checking file net/bluetooth/hci_core.c
patch: **** malformed patch at line 6: diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
Tested on:
commit: de5cb0dc Merge branch 'address-masking'
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler:
patch: https://syzkaller.appspot.com/x/patch.diff?x=127c12a9980000
^ permalink raw reply [flat|nested] 34+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
2024-09-23 15:48 [PATCH] Bluetooth/l2cap: Fix uaf in l2cap_connect Luiz Augusto von Dentz
@ 2024-09-23 16:21 ` syzbot
0 siblings, 0 replies; 34+ messages in thread
From: syzbot @ 2024-09-23 16:21 UTC (permalink / raw)
To: eadavis, hdanton, linux-bluetooth, linux-kernel, luiz.dentz,
nogikh, syzkaller-bugs
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
failed to apply patch:
checking file net/bluetooth/hci_core.c
patch: **** malformed patch at line 6: diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
Tested on:
commit: de5cb0dc Merge branch 'address-masking'
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler:
patch: https://syzkaller.appspot.com/x/patch.diff?x=11f72107980000
^ permalink raw reply [flat|nested] 34+ messages in thread
* Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
[not found] <CABBYNZ+Fj1bDqSG7PkF5OFEx_OWkgm2gEm8640odaQX5EBGxPg@mail.gmail.com>
@ 2024-09-23 16:45 ` syzbot
0 siblings, 0 replies; 34+ messages in thread
From: syzbot @ 2024-09-23 16:45 UTC (permalink / raw)
To: linux-kernel, luiz.dentz, nogikh, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+c12e2f941af1feb5632c@syzkaller.appspotmail.com
Tested-by: syzbot+c12e2f941af1feb5632c@syzkaller.appspotmail.com
Tested on:
commit: de5cb0dc Merge branch 'address-masking'
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13874a27980000
kernel config: https://syzkaller.appspot.com/x/.config?x=40f2e89a3d19f42c
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=11bff480580000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 34+ messages in thread
end of thread, other threads:[~2024-09-23 16:45 UTC | newest]
Thread overview: 34+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <CABBYNZ+Fj1bDqSG7PkF5OFEx_OWkgm2gEm8640odaQX5EBGxPg@mail.gmail.com>
2024-09-23 16:45 ` [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2) syzbot
2024-09-23 15:48 [PATCH] Bluetooth/l2cap: Fix uaf in l2cap_connect Luiz Augusto von Dentz
2024-09-23 16:21 ` [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2) syzbot
-- strict thread matches above, loose matches on Subject: below --
2024-09-23 15:20 [PATCH] Bluetooth/l2cap: Fix uaf in l2cap_connect Luiz Augusto von Dentz
2024-09-23 15:28 ` [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2) syzbot
2024-06-24 20:23 syzbot
2024-09-07 14:42 ` syzbot
2024-09-08 0:01 ` Hillf Danton
2024-09-08 0:24 ` syzbot
2024-09-08 1:28 ` Edward Adam Davis
2024-09-08 1:51 ` syzbot
2024-09-08 2:06 ` Edward Adam Davis
2024-09-08 2:29 ` syzbot
2024-09-08 2:41 ` Edward Adam Davis
2024-09-08 3:06 ` syzbot
2024-09-08 3:15 ` Edward Adam Davis
2024-09-08 3:58 ` syzbot
2024-09-08 3:25 ` Hillf Danton
2024-09-08 4:07 ` syzbot
2024-09-08 4:07 ` Edward Adam Davis
2024-09-08 4:37 ` syzbot
2024-09-08 8:32 ` Hillf Danton
2024-09-08 8:52 ` syzbot
2024-09-08 11:15 ` Hillf Danton
2024-09-08 11:33 ` syzbot
2024-09-08 12:50 ` Hillf Danton
2024-09-08 13:10 ` syzbot
2024-09-08 13:37 ` Hillf Danton
2024-09-08 13:58 ` syzbot
2024-09-09 11:06 ` Hillf Danton
2024-09-09 11:31 ` syzbot
2024-09-11 11:29 ` Hillf Danton
2024-09-11 11:59 ` syzbot
2024-09-12 11:49 ` Hillf Danton
2024-09-12 14:51 ` syzbot
2024-09-10 18:43 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).