KASAN: use-after-free Read in hci_send_acl
37 views
Skip to first unread message
syzbot
Aug 2, 2020, 10:47:16 AM8/2/20
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 7f2c5eb4 Linux 4.14.191
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=10756ccc900000
kernel config: https://syzkaller.appspot.com/x/.config?x=881f1aee9620bf9f
dashboard link: https://syzkaller.appspot.com/bug?extid=e930fd60eabac96a53b7
compiler: gcc (GCC) 10.1.0-syz 20200507
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15ca7c42900000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17f06ad4900000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e930fd...@syzkaller.appspotmail.com
batman_adv: batadv0: Interface activated: batadv_slave_1
IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
==================================================================
BUG: KASAN: use-after-free in hci_send_acl+0xac8/0xc60 net/bluetooth/hci_core.c:3540
Read of size 8 at addr ffff8880a459dd98 by task kworker/u5:1/6595
CPU: 0 PID: 6595 Comm: kworker/u5:1 Not tainted 4.14.191-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: hci0 hci_rx_work
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x283 lib/dump_stack.c:58
print_address_description.cold+0x54/0x1d3 mm/kasan/report.c:252
kasan_report_error.cold+0x8a/0x194 mm/kasan/report.c:351
kasan_report mm/kasan/report.c:409 [inline]
__asan_report_load8_noabort+0x68/0x70 mm/kasan/report.c:430
hci_send_acl+0xac8/0xc60 net/bluetooth/hci_core.c:3540
l2cap_send_cmd+0x19d/0x1f0 net/bluetooth/l2cap_core.c:874
l2cap_send_move_chan_cfm_icid net/bluetooth/l2cap_core.c:4655 [inline]
l2cap_move_fail net/bluetooth/l2cap_core.c:5140 [inline]
l2cap_move_channel_rsp net/bluetooth/l2cap_core.c:5179 [inline]
l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:5458 [inline]
l2cap_sig_channel net/bluetooth/l2cap_core.c:5793 [inline]
l2cap_recv_frame+0x5d9a/0x95c0 net/bluetooth/l2cap_core.c:7017
l2cap_recv_acldata+0x7a6/0x8b0 net/bluetooth/l2cap_core.c:7588
hci_acldata_packet net/bluetooth/hci_core.c:4066 [inline]
hci_rx_work+0x3d1/0x970 net/bluetooth/hci_core.c:4249
process_one_work+0x793/0x14a0 kernel/workqueue.c:2116
worker_thread+0x5cc/0xff0 kernel/workqueue.c:2250
kthread+0x30d/0x420 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
Allocated by task 1203:
save_stack mm/kasan/kasan.c:447 [inline]
set_track mm/kasan/kasan.c:459 [inline]
kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:551
kmem_cache_alloc_trace+0x131/0x3d0 mm/slab.c:3618
kmalloc include/linux/slab.h:488 [inline]
kzalloc include/linux/slab.h:661 [inline]
hci_chan_create+0x7c/0x300 net/bluetooth/hci_conn.c:1532
l2cap_conn_add.part.0+0x18/0xc20 net/bluetooth/l2cap_core.c:7056
l2cap_conn_add net/bluetooth/l2cap_core.c:7415 [inline]
l2cap_connect_cfm+0x1d2/0xce0 net/bluetooth/l2cap_core.c:7373
hci_connect_cfm include/net/bluetooth/hci_core.h:1211 [inline]
hci_remote_features_evt net/bluetooth/hci_event.c:2753 [inline]
hci_event_packet+0x1eb3/0x7c7a net/bluetooth/hci_event.c:5310
hci_rx_work+0x3e6/0x970 net/bluetooth/hci_core.c:4244
process_one_work+0x793/0x14a0 kernel/workqueue.c:2116
worker_thread+0x5cc/0xff0 kernel/workqueue.c:2250
kthread+0x30d/0x420 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
Freed by task 6595:
save_stack mm/kasan/kasan.c:447 [inline]
set_track mm/kasan/kasan.c:459 [inline]
kasan_slab_free+0xc3/0x1a0 mm/kasan/kasan.c:524
__cache_free mm/slab.c:3496 [inline]
kfree+0xc9/0x250 mm/slab.c:3815
hci_disconn_loglink_complete_evt net/bluetooth/hci_event.c:4433 [inline]
hci_event_packet+0xeae/0x7c7a net/bluetooth/hci_event.c:5437
hci_rx_work+0x3e6/0x970 net/bluetooth/hci_core.c:4244
process_one_work+0x793/0x14a0 kernel/workqueue.c:2116
worker_thread+0x5cc/0xff0 kernel/workqueue.c:2250
kthread+0x30d/0x420 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
The buggy address belongs to the object at ffff8880a459dd80
which belongs to the cache kmalloc-128 of size 128
The buggy address is located 24 bytes inside of
128-byte region [ffff8880a459dd80, ffff8880a459de00)
The buggy address belongs to the page:
page:ffffea0002916740 count:1 mapcount:0 mapping:ffff8880a459d000 index:0x0
flags: 0xfffe0000000100(slab)
raw: 00fffe0000000100 ffff8880a459d000 0000000000000000 0000000100000015
raw: ffffea000290dba0 ffffea0002a2fde0 ffff88812fe52640 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8880a459dc80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
ffff8880a459dd00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff8880a459dd80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880a459de00: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
ffff8880a459de80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
syzbot found the following issue on:
HEAD commit: 7f2c5eb4 Linux 4.14.191
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=10756ccc900000
kernel config: https://syzkaller.appspot.com/x/.config?x=881f1aee9620bf9f
dashboard link: https://syzkaller.appspot.com/bug?extid=e930fd60eabac96a53b7
compiler: gcc (GCC) 10.1.0-syz 20200507
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15ca7c42900000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17f06ad4900000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e930fd...@syzkaller.appspotmail.com
batman_adv: batadv0: Interface activated: batadv_slave_1
IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
==================================================================
BUG: KASAN: use-after-free in hci_send_acl+0xac8/0xc60 net/bluetooth/hci_core.c:3540
Read of size 8 at addr ffff8880a459dd98 by task kworker/u5:1/6595
CPU: 0 PID: 6595 Comm: kworker/u5:1 Not tainted 4.14.191-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: hci0 hci_rx_work
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x283 lib/dump_stack.c:58
print_address_description.cold+0x54/0x1d3 mm/kasan/report.c:252
kasan_report_error.cold+0x8a/0x194 mm/kasan/report.c:351
kasan_report mm/kasan/report.c:409 [inline]
__asan_report_load8_noabort+0x68/0x70 mm/kasan/report.c:430
hci_send_acl+0xac8/0xc60 net/bluetooth/hci_core.c:3540
l2cap_send_cmd+0x19d/0x1f0 net/bluetooth/l2cap_core.c:874
l2cap_send_move_chan_cfm_icid net/bluetooth/l2cap_core.c:4655 [inline]
l2cap_move_fail net/bluetooth/l2cap_core.c:5140 [inline]
l2cap_move_channel_rsp net/bluetooth/l2cap_core.c:5179 [inline]
l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:5458 [inline]
l2cap_sig_channel net/bluetooth/l2cap_core.c:5793 [inline]
l2cap_recv_frame+0x5d9a/0x95c0 net/bluetooth/l2cap_core.c:7017
l2cap_recv_acldata+0x7a6/0x8b0 net/bluetooth/l2cap_core.c:7588
hci_acldata_packet net/bluetooth/hci_core.c:4066 [inline]
hci_rx_work+0x3d1/0x970 net/bluetooth/hci_core.c:4249
process_one_work+0x793/0x14a0 kernel/workqueue.c:2116
worker_thread+0x5cc/0xff0 kernel/workqueue.c:2250
kthread+0x30d/0x420 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
Allocated by task 1203:
save_stack mm/kasan/kasan.c:447 [inline]
set_track mm/kasan/kasan.c:459 [inline]
kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:551
kmem_cache_alloc_trace+0x131/0x3d0 mm/slab.c:3618
kmalloc include/linux/slab.h:488 [inline]
kzalloc include/linux/slab.h:661 [inline]
hci_chan_create+0x7c/0x300 net/bluetooth/hci_conn.c:1532
l2cap_conn_add.part.0+0x18/0xc20 net/bluetooth/l2cap_core.c:7056
l2cap_conn_add net/bluetooth/l2cap_core.c:7415 [inline]
l2cap_connect_cfm+0x1d2/0xce0 net/bluetooth/l2cap_core.c:7373
hci_connect_cfm include/net/bluetooth/hci_core.h:1211 [inline]
hci_remote_features_evt net/bluetooth/hci_event.c:2753 [inline]
hci_event_packet+0x1eb3/0x7c7a net/bluetooth/hci_event.c:5310
hci_rx_work+0x3e6/0x970 net/bluetooth/hci_core.c:4244
process_one_work+0x793/0x14a0 kernel/workqueue.c:2116
worker_thread+0x5cc/0xff0 kernel/workqueue.c:2250
kthread+0x30d/0x420 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
Freed by task 6595:
save_stack mm/kasan/kasan.c:447 [inline]
set_track mm/kasan/kasan.c:459 [inline]
kasan_slab_free+0xc3/0x1a0 mm/kasan/kasan.c:524
__cache_free mm/slab.c:3496 [inline]
kfree+0xc9/0x250 mm/slab.c:3815
hci_disconn_loglink_complete_evt net/bluetooth/hci_event.c:4433 [inline]
hci_event_packet+0xeae/0x7c7a net/bluetooth/hci_event.c:5437
hci_rx_work+0x3e6/0x970 net/bluetooth/hci_core.c:4244
process_one_work+0x793/0x14a0 kernel/workqueue.c:2116
worker_thread+0x5cc/0xff0 kernel/workqueue.c:2250
kthread+0x30d/0x420 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
The buggy address belongs to the object at ffff8880a459dd80
which belongs to the cache kmalloc-128 of size 128
The buggy address is located 24 bytes inside of
128-byte region [ffff8880a459dd80, ffff8880a459de00)
The buggy address belongs to the page:
page:ffffea0002916740 count:1 mapcount:0 mapping:ffff8880a459d000 index:0x0
flags: 0xfffe0000000100(slab)
raw: 00fffe0000000100 ffff8880a459d000 0000000000000000 0000000100000015
raw: ffffea000290dba0 ffffea0002a2fde0 ffff88812fe52640 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8880a459dc80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
ffff8880a459dd00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff8880a459dd80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880a459de00: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
ffff8880a459de80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
syzbot
Aug 2, 2020, 5:29:27 PM8/2/20
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 13af6c74 Linux 4.19.136
syzbot found the following issue on:
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=162af3a2900000
kernel config: https://syzkaller.appspot.com/x/.config?x=5b7578d3b5457a49
dashboard link: https://syzkaller.appspot.com/bug?extid=48bc29a1de014a0776b9
compiler: gcc (GCC) 10.1.0-syz 20200507
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16b26d98900000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15c39d70900000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
==================================================================
BUG: KASAN: use-after-free in hci_send_acl+0xad6/0xc70 net/bluetooth/hci_core.c:3652
Read of size 8 at addr ffff88809f8e8798 by task kworker/u5:2/6507
CPU: 0 PID: 6507 Comm: kworker/u5:2 Not tainted 4.19.136-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: hci0 hci_rx_work
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
Workqueue: hci0 hci_rx_work
Call Trace:
dump_stack+0x1fc/0x2fe lib/dump_stack.c:118
print_address_description.cold+0x54/0x219 mm/kasan/report.c:256
kasan_report_error.cold+0x8a/0x1c7 mm/kasan/report.c:354
kasan_report mm/kasan/report.c:412 [inline]
__asan_report_load8_noabort+0x88/0x90 mm/kasan/report.c:433
hci_send_acl+0xad6/0xc70 net/bluetooth/hci_core.c:3652
l2cap_send_cmd+0x1bd/0x210 net/bluetooth/l2cap_core.c:874
l2cap_send_move_chan_cfm_icid net/bluetooth/l2cap_core.c:4655 [inline]
l2cap_move_fail net/bluetooth/l2cap_core.c:5140 [inline]
l2cap_move_channel_rsp net/bluetooth/l2cap_core.c:5179 [inline]
l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:5458 [inline]
l2cap_sig_channel net/bluetooth/l2cap_core.c:5793 [inline]
l2cap_recv_frame+0x6aa8/0xa550 net/bluetooth/l2cap_core.c:7017
l2cap_move_fail net/bluetooth/l2cap_core.c:5140 [inline]
l2cap_move_channel_rsp net/bluetooth/l2cap_core.c:5179 [inline]
l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:5458 [inline]
l2cap_sig_channel net/bluetooth/l2cap_core.c:5793 [inline]
l2cap_recv_acldata+0x80e/0x910 net/bluetooth/l2cap_core.c:7588
hci_acldata_packet net/bluetooth/hci_core.c:4178 [inline]
hci_rx_work+0x455/0xa90 net/bluetooth/hci_core.c:4364
process_one_work+0x864/0x1570 kernel/workqueue.c:2155
worker_thread+0x64c/0x1130 kernel/workqueue.c:2298
kthread+0x30b/0x410 kernel/kthread.c:246
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
Allocated by task 1226:
kmem_cache_alloc_trace+0x12f/0x380 mm/slab.c:3625
kmalloc include/linux/slab.h:515 [inline]
kzalloc include/linux/slab.h:709 [inline]
hci_chan_create+0x8e/0x310 net/bluetooth/hci_conn.c:1651
l2cap_conn_add.part.0+0x18/0xc40 net/bluetooth/l2cap_core.c:7056
l2cap_conn_add net/bluetooth/l2cap_core.c:7415 [inline]
l2cap_connect_cfm+0x236/0xe70 net/bluetooth/l2cap_core.c:7373
hci_connect_cfm include/net/bluetooth/hci_core.h:1246 [inline]
hci_remote_features_evt net/bluetooth/hci_event.c:3017 [inline]
hci_event_packet+0x3a31/0x858f net/bluetooth/hci_event.c:5779
hci_rx_work+0x46b/0xa90 net/bluetooth/hci_core.c:4359
process_one_work+0x864/0x1570 kernel/workqueue.c:2155
worker_thread+0x64c/0x1130 kernel/workqueue.c:2298
kthread+0x30b/0x410 kernel/kthread.c:246
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
Freed by task 6507:
__cache_free mm/slab.c:3503 [inline]
kfree+0xcc/0x210 mm/slab.c:3822
hci_disconn_loglink_complete_evt net/bluetooth/hci_event.c:4755 [inline]
hci_event_packet+0xf52/0x858f net/bluetooth/hci_event.c:5906
hci_rx_work+0x46b/0xa90 net/bluetooth/hci_core.c:4359
process_one_work+0x864/0x1570 kernel/workqueue.c:2155
worker_thread+0x64c/0x1130 kernel/workqueue.c:2298
kthread+0x30b/0x410 kernel/kthread.c:246
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
The buggy address belongs to the object at ffff88809f8e8780
which belongs to the cache kmalloc-128 of size 128
The buggy address is located 24 bytes inside of
128-byte region [ffff88809f8e8780, ffff88809f8e8800)
The buggy address is located 24 bytes inside of
The buggy address belongs to the page:
page:ffffea00027e3a00 count:1 mapcount:0 mapping:ffff88812c39c640 index:0x0
flags: 0xfffe0000000100(slab)
raw: 00fffe0000000100 ffffea0002806bc8 ffffea00027ed848 ffff88812c39c640
raw: 0000000000000000 ffff88809f8e8000 0000000100000015 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88809f8e8680: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
Memory state around the buggy address:
ffff88809f8e8700: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff88809f8e8780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88809f8e8800: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
ffff88809f8e8880: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
syzbot
Jun 20, 2021, 4:27:06 AM6/20/21
to syzkaller...@googlegroups.com
syzbot suspects this issue was fixed by commit:
commit 75e26178e26f910f7f26c79c2824b726eecf0dfb
Author: Archie Pusaka <apu...@chromium.org>
Date: Mon Mar 22 06:03:11 2021 +0000
Bluetooth: verify AMP hci_chan before amp_destroy
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=136d30c8300000
start commit: 13af6c74 Linux 4.19.136
git tree: linux-4.19.y
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=128f0f04900000
If the result looks correct, please mark the issue as fixed by replying with:
#syz fix: Bluetooth: verify AMP hci_chan before amp_destroy
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
commit 75e26178e26f910f7f26c79c2824b726eecf0dfb
Author: Archie Pusaka <apu...@chromium.org>
Date: Mon Mar 22 06:03:11 2021 +0000
Bluetooth: verify AMP hci_chan before amp_destroy
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=136d30c8300000
start commit: 13af6c74 Linux 4.19.136
git tree: linux-4.19.y
kernel config: https://syzkaller.appspot.com/x/.config?x=5b7578d3b5457a49
dashboard link: https://syzkaller.appspot.com/bug?extid=48bc29a1de014a0776b9
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e49d14900000
dashboard link: https://syzkaller.appspot.com/bug?extid=48bc29a1de014a0776b9
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=128f0f04900000
If the result looks correct, please mark the issue as fixed by replying with:
#syz fix: Bluetooth: verify AMP hci_chan before amp_destroy
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
Reply all
Reply to author
Forward
0 new messages