Re: [syzbot] KASAN: slab-out-of-bounds Read in qrtr_endpoint_post (2)

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
BUG: sleeping function called from invalid context in lock_sock_nested

BUG: sleeping function called from invalid context at net/core/sock.c:3064
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 6123, name: syz-executor.4
1 lock held by syz-executor.4/6123:
#0: ffffffff8c1325e0 (hci_sk_list.lock){++++}-{2:2}, at: hci_sock_dev_event+0x39a/0x5a0 net/bluetooth/hci_sock.c:763
Preemption disabled at:
[<0000000000000000>] 0x0
CPU: 0 PID: 6123 Comm: syz-executor.4 Not tainted 5.13.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:79 [inline]
dump_stack+0x185/0x1e4 lib/dump_stack.c:120
___might_sleep.cold+0x1fd/0x266 kernel/sched/core.c:8338
lock_sock_nested+0x25/0x120 net/core/sock.c:3064
lock_sock include/net/sock.h:1610 [inline]
hci_sock_dev_event+0x413/0x5a0 net/bluetooth/hci_sock.c:765
hci_unregister_dev+0x2e1/0xff0 net/bluetooth/hci_core.c:4013
vhci_release+0x70/0xe0 drivers/bluetooth/hci_vhci.c:340
__fput+0x288/0x920 fs/file_table.c:280
task_work_run+0xdd/0x1a0 kernel/task_work.c:164
exit_task_work include/linux/task_work.h:32 [inline]
do_exit+0xca5/0x2b60 kernel/exit.c:826
do_group_exit+0x125/0x310 kernel/exit.c:923
__do_sys_exit_group kernel/exit.c:934 [inline]
__se_sys_exit_group kernel/exit.c:932 [inline]
__x64_sys_exit_group+0x3a/0x50 kernel/exit.c:932
do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x465769
Code: Unable to access opcode bytes at RIP 0x46573f.
RSP: 002b:00007ffed5890ff8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007ffed58911b8 RCX: 0000000000465769
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000043
RBP: 00000000004ae59f R08: 000000000000000c R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000010
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000400538

======================================================


Tested on:

commit: 009c9aa5 Linux 5.13-rc6
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=134f02f0300000
kernel config: https://syzkaller.appspot.com/x/.config?x=5fd082cb74d3903b
dashboard link: https://syzkaller.appspot.com/bug?extid=1917d778024161609247
compiler:
patch: https://syzkaller.appspot.com/x/patch.diff?x=15a426c0300000

[Pavel Skripkin]

On Mon, 14 Jun 2021 04:15:07 -0700
syzbot <syzbot+1917d7...@syzkaller.appspotmail.com> wrote:

> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still
> triggering an issue: BUG: sleeping function called from invalid
> context in lock_sock_nested

I guess, this bug is not related to my fix... Maybe, previous rc will be
ok


#syz test
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git v5.13-rc4



With regards,
Pavel Skripkin

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+1917d7...@syzkaller.appspotmail.com

Tested on:

commit: 8124c8a6 Linux 5.13-rc4
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git v5.13-rc4
kernel config: https://syzkaller.appspot.com/x/.config?x=ee296513253d075e

dashboard link: https://syzkaller.appspot.com/bug?extid=1917d778024161609247
compiler:

patch: https://syzkaller.appspot.com/x/patch.diff?x=11309bc0300000

Note: testing is done by a robot and is best-effort only.

[Pavel Skripkin]

Nice! I guess, previous bug is something new in rc6. Maybe, we can
somehow announce it. And there is a chance, that I missed it on the
dashboard...


With regards,
Pavel Skripkin

[Desmond Cheong Zhi Xi]

Fwiw, I ran into the same bug when testing another patch locally.

Best wishes,
Desmond

[Pavel Skripkin]

My local syzkaller instance hit this bug like a week ago.
It's very suprising, that syzbot did't catch it... I think, it's new in
rc6, try to test patch on previous rc releases, it should help :)




With regards,
Pavel Skripkin

[Pavel Skripkin]

BTW,
https://syzkaller.appspot.com/bug?id=42449ffe0b47ac85234265954c8004ec7fa2a83c here it is :)




With regards,
Pavel Skripkin