[v5.15] general protection fault in lock_sock_nested

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 9465fef4ae35 Linux 5.15.153
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=14ae6223180000
kernel config: https://syzkaller.appspot.com/x/.config?x=176c746ee3348b33
dashboard link: https://syzkaller.appspot.com/bug?extid=919d4e1e5bdfd4fa9abb
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/2962c02652ce/disk-9465fef4.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/d0f5a1ce082d/vmlinux-9465fef4.xz
kernel image: https://storage.googleapis.com/syzbot-assets/86b5b1eea636/bzImage-9465fef4.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+919d4e...@syzkaller.appspotmail.com

general protection fault, probably for non-canonical address 0xdffffc0000000024: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000120-0x0000000000000127]
CPU: 1 PID: 8498 Comm: kworker/1:17 Not tainted 5.15.153-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: events l2cap_info_timeout
RIP: 0010:__lock_acquire+0x69/0x1ff0 kernel/locking/lockdep.c:4882
Code: 84 c0 48 89 7c 24 08 0f 85 3f 16 00 00 83 3d f1 36 81 0c 00 0f 84 ec 14 00 00 83 3d e0 55 1c 0b 00 74 2d 48 89 f8 48 c1 e8 03 <80> 3c 10 00 74 14 e8 ac 66 67 00 48 8b 7c 24 08 48 ba 00 00 00 00
RSP: 0018:ffffc90003dd7800 EFLAGS: 00010006
RAX: 0000000000000024 RBX: 0000000000000000 RCX: 0000000000000000
RDX: dffffc0000000000 RSI: 0000000000000000 RDI: 0000000000000120
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000000
R13: ffff88805f258000 R14: 0000000000000000 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f5b6aaa6988 CR3: 00000000642a0000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
lock_sock_nested+0x44/0x100 net/core/sock.c:3250
lock_sock include/net/sock.h:1668 [inline]
l2cap_sock_ready_cb+0x43/0x130 net/bluetooth/l2cap_sock.c:1648
l2cap_chan_ready net/bluetooth/l2cap_core.c:1382 [inline]
l2cap_conn_start+0x8c9/0x10a0 net/bluetooth/l2cap_core.c:1640
process_one_work+0x8a1/0x10c0 kernel/workqueue.c:2310
worker_thread+0xaca/0x1280 kernel/workqueue.c:2457
kthread+0x3f6/0x4f0 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
</TASK>
Modules linked in:
---[ end trace 4e9347c5914cb51f ]---
RIP: 0010:__lock_acquire+0x69/0x1ff0 kernel/locking/lockdep.c:4882
Code: 84 c0 48 89 7c 24 08 0f 85 3f 16 00 00 83 3d f1 36 81 0c 00 0f 84 ec 14 00 00 83 3d e0 55 1c 0b 00 74 2d 48 89 f8 48 c1 e8 03 <80> 3c 10 00 74 14 e8 ac 66 67 00 48 8b 7c 24 08 48 ba 00 00 00 00
RSP: 0018:ffffc90003dd7800 EFLAGS: 00010006
RAX: 0000000000000024 RBX: 0000000000000000 RCX: 0000000000000000
RDX: dffffc0000000000 RSI: 0000000000000000 RDI: 0000000000000120
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000000
R13: ffff88805f258000 R14: 0000000000000000 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f5b6aaa6988 CR3: 00000000642a0000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 84 c0 test %al,%al
2: 48 89 7c 24 08 mov %rdi,0x8(%rsp)
7: 0f 85 3f 16 00 00 jne 0x164c
d: 83 3d f1 36 81 0c 00 cmpl $0x0,0xc8136f1(%rip) # 0xc813705
14: 0f 84 ec 14 00 00 je 0x1506
1a: 83 3d e0 55 1c 0b 00 cmpl $0x0,0xb1c55e0(%rip) # 0xb1c5601
21: 74 2d je 0x50
23: 48 89 f8 mov %rdi,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 80 3c 10 00 cmpb $0x0,(%rax,%rdx,1) <-- trapping instruction
2e: 74 14 je 0x44
30: e8 ac 66 67 00 call 0x6766e1
35: 48 8b 7c 24 08 mov 0x8(%rsp),%rdi
3a: 48 rex.W
3b: ba 00 00 00 00 mov $0x0,%edx


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: cd5d98c0556c Linux 6.1.86
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=14d9a7cb180000
kernel config: https://syzkaller.appspot.com/x/.config?x=1002eed7bd96ee12
dashboard link: https://syzkaller.appspot.com/bug?extid=8c1526bae66de4a558da

compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:

disk image: https://storage.googleapis.com/syzbot-assets/22fd59eeffbc/disk-cd5d98c0.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/064559777212/vmlinux-cd5d98c0.xz
kernel image: https://storage.googleapis.com/syzbot-assets/11c6ce06eda3/bzImage-cd5d98c0.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:

Reported-by: syzbot+8c1526...@syzkaller.appspotmail.com

general protection fault, probably for non-canonical address 0xdffffc0000000026: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000130-0x0000000000000137]
CPU: 0 PID: 3607 Comm: kworker/0:5 Not tainted 6.1.86-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: events l2cap_info_timeout

RIP: 0010:__lock_acquire+0x69/0x1f80 kernel/locking/lockdep.c:4919
Code: df 0f b6 04 10 84 c0 0f 85 fb 15 00 00 83 3d 61 41 09 0d 00 0f 84 a8 14 00 00 83 3d b0 22 95 0b 00 74 2b 4c 89 f0 48 c1 e8 03 <80> 3c 10 00 74 12 4c 89 f7 e8 69 9a 77 00 48 ba 00 00 00 00 00 fc
RSP: 0018:ffffc90004c4f800 EFLAGS: 00010002
RAX: 0000000000000026 RBX: 0000000000000000 RCX: 0000000000000000
RDX: dffffc0000000000 RSI: 0000000000000000 RDI: 0000000000000130

RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000000

R13: ffff88807b878000 R14: 0000000000000130 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 0000001b31e21000 CR3: 00000000575db000 CR4: 00000000003506f0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>

lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
lock_sock_nested+0x44/0x100 net/core/sock.c:3484
lock_sock include/net/sock.h:1745 [inline]
l2cap_sock_ready_cb+0x43/0x130 net/bluetooth/l2cap_sock.c:1649

l2cap_chan_ready net/bluetooth/l2cap_core.c:1382 [inline]
l2cap_conn_start+0x8c9/0x10a0 net/bluetooth/l2cap_core.c:1640

process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292
worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
kthread+0x28d/0x320 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__lock_acquire+0x69/0x1f80 kernel/locking/lockdep.c:4919
Code: df 0f b6 04 10 84 c0 0f 85 fb 15 00 00 83 3d 61 41 09 0d 00 0f 84 a8 14 00 00 83 3d b0 22 95 0b 00 74 2b 4c 89 f0 48 c1 e8 03 <80> 3c 10 00 74 12 4c 89 f7 e8 69 9a 77 00 48 ba 00 00 00 00 00 fc
RSP: 0018:ffffc90004c4f800 EFLAGS: 00010002
RAX: 0000000000000026 RBX: 0000000000000000 RCX: 0000000000000000
RDX: dffffc0000000000 RSI: 0000000000000000 RDI: 0000000000000130

RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000000

R13: ffff88807b878000 R14: 0000000000000130 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 0000001b31e21000 CR3: 00000000575db000 CR4: 00000000003506f0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):

0: df 0f fisttps (%rdi)
2: b6 04 mov $0x4,%dh
4: 10 84 c0 0f 85 fb 15 adc %al,0x15fb850f(%rax,%rax,8)
b: 00 00 add %al,(%rax)
d: 83 3d 61 41 09 0d 00 cmpl $0x0,0xd094161(%rip) # 0xd094175
14: 0f 84 a8 14 00 00 je 0x14c2
1a: 83 3d b0 22 95 0b 00 cmpl $0x0,0xb9522b0(%rip) # 0xb9522d1
21: 74 2b je 0x4e
23: 4c 89 f0 mov %r14,%rax

26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 80 3c 10 00 cmpb $0x0,(%rax,%rdx,1) <-- trapping instruction

2e: 74 12 je 0x42
30: 4c 89 f7 mov %r14,%rdi
33: e8 69 9a 77 00 call 0x779aa1
38: 48 rex.W
39: ba 00 00 00 00 mov $0x0,%edx
3e: 00 fc add %bh,%ah

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: fa3df276cd36 Linux 5.15.155
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=13319b63180000
kernel config: https://syzkaller.appspot.com/x/.config?x=fa45dfd65a261480

dashboard link: https://syzkaller.appspot.com/bug?extid=919d4e1e5bdfd4fa9abb
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14dbb7cd180000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0dc19fc63531/disk-fa3df276.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/fae4c89e243a/vmlinux-fa3df276.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a5c832fcb939/Image-fa3df276.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+919d4e...@syzkaller.appspotmail.com

Unable to handle kernel paging request at virtual address dfff800000000024
Mem abort info:
ESR = 0x0000000096000006
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x06: level 2 translation fault
Data abort info:
ISV = 0, ISS = 0x00000006
CM = 0, WnR = 0
[dfff800000000024] address between user and kernel address ranges
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 4191 Comm: kworker/1:13 Not tainted 5.15.155-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: events l2cap_info_timeout

pstate: 804000c5 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __lock_acquire+0x104/0x7638 kernel/locking/lockdep.c:4882
lr : lock_acquire+0x240/0x77c kernel/locking/lockdep.c:5623
sp : ffff80001d877480
x29: ffff80001d877720 x28: 1ffff00002928069 x27: 0000000000000001
x26: ffff800010d4002c x25: ffff700003b0eeb4 x24: 0000000000000000
x23: 0000000000000000 x22: ffff0000c836d1c0 x21: 0000000000000000
x20: 0000000000000000 x19: 0000000000000120 x18: ffff80001d877440
x17: 0000000000000000 x16: ffff8000119973c0 x15: 000000000002b229
x14: ffff800016f7d500 x13: ffff80001d8775a0 x12: dfff800000000000
x11: ffff8000082f0050 x10: ffff80001494034c x9 : 00000000000000f3
x8 : 0000000000000024 x7 : ffff800010d4002c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000120
Call trace:
__lock_acquire+0x104/0x7638 kernel/locking/lockdep.c:4882
lock_acquire+0x240/0x77c kernel/locking/lockdep.c:5623
lock_sock_nested+0xec/0x1ec net/core/sock.c:3250
lock_sock include/net/sock.h:1668 [inline]
l2cap_sock_ready_cb+0x4c/0x130 net/bluetooth/l2cap_sock.c:1648
l2cap_chan_ready net/bluetooth/l2cap_core.c:1382 [inline]
l2cap_conn_start+0x668/0xd28 net/bluetooth/l2cap_core.c:1640
l2cap_info_timeout+0x68/0xb8 net/bluetooth/l2cap_core.c:1807
process_one_work+0x790/0x11b8 kernel/workqueue.c:2310
worker_thread+0x910/0x1034 kernel/workqueue.c:2457
kthread+0x37c/0x45c kernel/kthread.c:334
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870
Code: 90063788 b94ee108 34000208 d343fe68 (386c6908)
---[ end trace ba7c33e15b08fd6f ]---

----------------
Code disassembly (best guess):

0: 90063788 adrp x8, 0xc6f0000
4: b94ee108 ldr w8, [x8, #3808]
8: 34000208 cbz w8, 0x48
c: d343fe68 lsr x8, x19, #3
* 10: 386c6908 ldrb w8, [x8, x12] <-- trapping instruction


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.