[v5.15] WARNING in netdev_queue_update_kobjects (2)

8 views

Skip to first unread message

syzbot

unread,

Nov 1, 2024, 6:40:33 AM11/1/24

to syzkaller...@googlegroups.com

Hello,

syzbot found the following issue on:

HEAD commit: 72244eab0dad Linux 5.15.170
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=15d6e630580000
kernel config: https://syzkaller.appspot.com/x/.config?x=d85ac7994f3a5f02
dashboard link: https://syzkaller.appspot.com/bug?extid=32ac42fa2a157f6f3ddc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/a97549f813ef/disk-72244eab.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/399cdfbc4562/vmlinux-72244eab.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a7c1fce94960/Image-72244eab.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+32ac42...@syzkaller.appspotmail.com

------------[ cut here ]------------
sysfs group 'byte_queue_limits' not found for kobject 'tx-0'
WARNING: CPU: 1 PID: 4389 at fs/sysfs/group.c:281 sysfs_remove_group+0x174/0x288 fs/sysfs/group.c:279
Modules linked in:
CPU: 1 PID: 4389 Comm: kbnepd bnep0 Not tainted 5.15.170-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : sysfs_remove_group+0x174/0x288 fs/sysfs/group.c:279
lr : sysfs_remove_group+0x174/0x288 fs/sysfs/group.c:279
sp : ffff8000203a7830
x29: ffff8000203a7830 x28: 1fffe0001cf128bb x27: 0000000000000000
x26: 0000000000000000 x25: 1fffe0001cf12888 x24: 1ffff000026c5414
x23: dfff800000000000 x22: 0000000000000000 x21: ffff0000cdb39018
x20: ffff0000d97f2828 x19: ffff80001362a780 x18: 0000000000000001
x17: 0000000000000000 x16: ffff800011aba618 x15: 00000000ffffffff
x14: ffff0000c7f8b680 x13: 0000000000000001 x12: 0000000000000001
x11: 0000000000000000 x10: 0000000000000000 x9 : bdba435ecae59100
x8 : bdba435ecae59100 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff8000203a6f98 x4 : ffff800014ba05e0 x3 : ffff800008555e80
x2 : 0000000000000001 x1 : 0000000100000000 x0 : 000000000000003c
Call trace:
sysfs_remove_group+0x174/0x288 fs/sysfs/group.c:279
netdev_queue_update_kobjects+0x388/0x404 net/core/net-sysfs.c:1724
remove_queue_kobjects net/core/net-sysfs.c:1823 [inline]
netdev_unregister_kobject+0x100/0x204 net/core/net-sysfs.c:1976
unregister_netdevice_many+0x12c8/0x189c net/core/dev.c:11125
unregister_netdevice_queue net/core/dev.c:11031 [inline]
unregister_netdevice include/linux/netdevice.h:3012 [inline]
unregister_netdev+0x178/0x1f0 net/core/dev.c:11157
bnep_session+0x2274/0x2424 net/bluetooth/bnep/core.c:525
kthread+0x37c/0x45c kernel/kthread.c:334
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870
irq event stamp: 5824
hardirqs last enabled at (5823): [<ffff80000832c128>] __up_console_sem+0xb4/0x100 kernel/printk/printk.c:257
hardirqs last disabled at (5824): [<ffff800011ab5ca4>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:396
softirqs last enabled at (5752): [<ffff80000ff21d0c>] spin_unlock_bh include/linux/spinlock.h:408 [inline]
softirqs last enabled at (5752): [<ffff80000ff21d0c>] netif_addr_unlock_bh include/linux/netdevice.h:4617 [inline]
softirqs last enabled at (5752): [<ffff80000ff21d0c>] dev_mc_flush+0x1b4/0x1f8 net/core/dev_addr_lists.c:1001
softirqs last disabled at (5750): [<ffff80000ff22324>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:18
---[ end trace c0fc20d119037db1 ]---
------------[ cut here ]------------
sysfs group 'power' not found for kobject 'bnep0'
WARNING: CPU: 1 PID: 4389 at fs/sysfs/group.c:281 sysfs_remove_group+0x174/0x288 fs/sysfs/group.c:279
Modules linked in:
CPU: 1 PID: 4389 Comm: kbnepd bnep0 Tainted: G W 5.15.170-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : sysfs_remove_group+0x174/0x288 fs/sysfs/group.c:279
lr : sysfs_remove_group+0x174/0x288 fs/sysfs/group.c:279
sp : ffff8000203a7780
x29: ffff8000203a7780 x28: 1fffe00018ff16d4 x27: dfff800000000000
x26: ffff8000203a7840 x25: 1fffe0001cf128ca x24: 1ffff0000251c464
x23: dfff800000000000 x22: ffff0000e7894668 x21: ffff0000e7894608
x20: ffff0000c8692488 x19: ffff8000128e2300 x18: 0000000000000001
x17: 0000000000000000 x16: ffff8000083364dc x15: 00000000ffffffff
x14: ffff0000c7f8b680 x13: 0000000000000001 x12: 0000000000000001
x11: 0000000000000000 x10: 0000000000000000 x9 : bdba435ecae59100
x8 : bdba435ecae59100 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff8000203a6ef8 x4 : ffff800014ba05e0 x3 : ffff800008336628
x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000031
Call trace:
sysfs_remove_group+0x174/0x288 fs/sysfs/group.c:279
dpm_sysfs_remove+0xa4/0xd4 drivers/base/power/sysfs.c:837
device_del+0x268/0x9b4 drivers/base/core.c:3580
netdev_unregister_kobject+0x14c/0x204 net/core/net-sysfs.c:1980
unregister_netdevice_many+0x12c8/0x189c net/core/dev.c:11125
unregister_netdevice_queue net/core/dev.c:11031 [inline]
unregister_netdevice include/linux/netdevice.h:3012 [inline]
unregister_netdev+0x178/0x1f0 net/core/dev.c:11157
bnep_session+0x2274/0x2424 net/bluetooth/bnep/core.c:525
kthread+0x37c/0x45c kernel/kthread.c:334
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870
irq event stamp: 6370
hardirqs last enabled at (6369): [<ffff80000832c128>] __up_console_sem+0xb4/0x100 kernel/printk/printk.c:257
hardirqs last disabled at (6370): [<ffff800011ab5ca4>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:396
softirqs last enabled at (6278): [<ffff8000081b691c>] softirq_handle_end kernel/softirq.c:401 [inline]
softirqs last enabled at (6278): [<ffff8000081b691c>] handle_softirqs+0xb88/0xdbc kernel/softirq.c:586
softirqs last disabled at (5827): [<ffff8000081b6fb4>] __do_softirq kernel/softirq.c:592 [inline]
softirqs last disabled at (5827): [<ffff8000081b6fb4>] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
softirqs last disabled at (5827): [<ffff8000081b6fb4>] invoke_softirq kernel/softirq.c:439 [inline]
softirqs last disabled at (5827): [<ffff8000081b6fb4>] __irq_exit_rcu+0x268/0x4d8 kernel/softirq.c:641
---[ end trace c0fc20d119037db2 ]---
------------[ cut here ]------------
sysfs group 'statistics' not found for kobject 'bnep0'
WARNING: CPU: 1 PID: 4389 at fs/sysfs/group.c:281 sysfs_remove_group+0x174/0x288 fs/sysfs/group.c:279
Modules linked in:
CPU: 1 PID: 4389 Comm: kbnepd bnep0 Tainted: G W 5.15.170-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : sysfs_remove_group+0x174/0x288 fs/sysfs/group.c:279
lr : sysfs_remove_group+0x174/0x288 fs/sysfs/group.c:279
sp : ffff8000203a7740
x29: ffff8000203a7740 x28: 1fffe00018ff16d4 x27: dfff800000000000
x26: ffff0000c2b860a0 x25: ffff0000c2b860a0 x24: 1ffff000026c5430
x23: dfff800000000000 x22: dfff800000000000 x21: ffff0000e7894608
x20: ffff0000c8692488 x19: ffff80001362b000 x18: 0000000000000001
x17: 0000000000000000 x16: ffff8000083364dc x15: 00000000ffffffff
x14: ffff0000c7f8b680 x13: 0000000000000001 x12: 0000000000000001
x11: 0000000000000000 x10: 0000000000000000 x9 : bdba435ecae59100
x8 : bdba435ecae59100 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff8000203a6eb8 x4 : ffff800014ba05e0 x3 : ffff800008336628
x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000036
Call trace:
sysfs_remove_group+0x174/0x288 fs/sysfs/group.c:279
sysfs_remove_groups+0x5c/0xb4 fs/sysfs/group.c:313
device_remove_groups drivers/base/core.c:2501 [inline]
device_remove_attrs+0xc0/0x13c drivers/base/core.c:2701
device_del+0x574/0x9b4 drivers/base/core.c:3602
netdev_unregister_kobject+0x14c/0x204 net/core/net-sysfs.c:1980
unregister_netdevice_many+0x12c8/0x189c net/core/dev.c:11125
unregister_netdevice_queue net/core/dev.c:11031 [inline]
unregister_netdevice include/linux/netdevice.h:3012 [inline]
unregister_netdev+0x178/0x1f0 net/core/dev.c:11157
bnep_session+0x2274/0x2424 net/bluetooth/bnep/core.c:525
kthread+0x37c/0x45c kernel/kthread.c:334
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870
irq event stamp: 6582
hardirqs last enabled at (6581): [<ffff80000832c128>] __up_console_sem+0xb4/0x100 kernel/printk/printk.c:257
hardirqs last disabled at (6582): [<ffff800011ab5ca4>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:396
softirqs last enabled at (6568): [<ffff8000081b691c>] softirq_handle_end kernel/softirq.c:401 [inline]
softirqs last enabled at (6568): [<ffff8000081b691c>] handle_softirqs+0xb88/0xdbc kernel/softirq.c:586
softirqs last disabled at (6559): [<ffff8000081b6fb4>] __do_softirq kernel/softirq.c:592 [inline]
softirqs last disabled at (6559): [<ffff8000081b6fb4>] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
softirqs last disabled at (6559): [<ffff8000081b6fb4>] invoke_softirq kernel/softirq.c:439 [inline]
softirqs last disabled at (6559): [<ffff8000081b6fb4>] __irq_exit_rcu+0x268/0x4d8 kernel/softirq.c:641
---[ end trace c0fc20d119037db3 ]---

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

syzbot

unread,

Nov 1, 2024, 7:26:31 AM11/1/24

to syzkaller...@googlegroups.com

Hello,

syzbot found the following issue on:

HEAD commit: 7c15117f9468 Linux 6.1.115
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1253a187980000
kernel config: https://syzkaller.appspot.com/x/.config?x=73f576297a864465
dashboard link: https://syzkaller.appspot.com/bug?extid=8f0a1947e2930164aabf

compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:

disk image: https://storage.googleapis.com/syzbot-assets/11310d822a36/disk-7c15117f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/cbe095aa9884/vmlinux-7c15117f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/cf02c7ec296f/Image-7c15117f.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:

Reported-by: syzbot+8f0a19...@syzkaller.appspotmail.com

------------[ cut here ]------------
sysfs group 'byte_queue_limits' not found for kobject 'tx-0'

WARNING: CPU: 0 PID: 8192 at fs/sysfs/group.c:280 sysfs_remove_group+0x174/0x288 fs/sysfs/group.c:278
Modules linked in:
CPU: 0 PID: 8192 Comm: kbnepd bnep0 Not tainted 6.1.115-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)

pc : sysfs_remove_group+0x174/0x288 fs/sysfs/group.c:278
lr : sysfs_remove_group+0x174/0x288 fs/sysfs/group.c:278
sp : ffff800021ba7840
x29: ffff800021ba7840 x28: 1fffe000192fd0ca x27: 1fffe000192fd088
x26: 0000000000000000 x25: 00000000ffffffff x24: 1ffff00002860b9c
x23: dfff800000000000 x22: dfff800000000000 x21: ffff0000f1344c20
x20: ffff0000f188bae0 x19: ffff8000143063c0 x18: ffff800021ba6c40
x17: 0000000000000000 x16: ffff80001229a1fc x15: 0000000000000000
x14: 00000000ffffffff x13: 0000000000000001 x12: 0000000000000001
x11: 0000000000ff0100 x10: 0000000000000000 x9 : fd46d3514e9a4700
x8 : fd46d3514e9a4700 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff800021ba7138 x4 : ffff800015ab3880 x3 : ffff80000858b24c
x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000000
Call trace:
sysfs_remove_group+0x174/0x288 fs/sysfs/group.c:278
netdev_queue_update_kobjects+0x3d4/0x470 net/core/net-sysfs.c:1729
remove_queue_kobjects net/core/net-sysfs.c:1828 [inline]
netdev_unregister_kobject+0x100/0x204 net/core/net-sysfs.c:1981
unregister_netdevice_many+0x11b8/0x175c net/core/dev.c:10913
unregister_netdevice_queue net/core/dev.c:10817 [inline]
unregister_netdevice include/linux/netdevice.h:3045 [inline]
unregister_netdev+0x178/0x1f0 net/core/dev.c:10945
bnep_session+0x23c4/0x2584 net/bluetooth/bnep/core.c:525
kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864
irq event stamp: 12082
hardirqs last enabled at (12081): [<ffff8000083442f4>] __up_console_sem+0xb4/0x100 kernel/printk/printk.c:261
hardirqs last disabled at (12082): [<ffff800012295eb4>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last enabled at (11982): [<ffff8000105a8e3c>] spin_unlock_bh include/linux/spinlock.h:396 [inline]
softirqs last enabled at (11982): [<ffff8000105a8e3c>] netif_addr_unlock_bh include/linux/netdevice.h:4480 [inline]
softirqs last enabled at (11982): [<ffff8000105a8e3c>] dev_mc_flush+0x1b4/0x1f8 net/core/dev_addr_lists.c:1036
softirqs last disabled at (11980): [<ffff8000105a9374>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19
---[ end trace 0000000000000000 ]---
==================================================================
BUG: KASAN: use-after-free in device_for_each_child+0xa8/0x174 drivers/base/core.c:4018
Read of size 8 at addr ffff0000da1a94c0 by task kbnepd bnep0/8192

CPU: 0 PID: 8192 Comm: kbnepd bnep0 Tainted: G W 6.1.115-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024

Call trace:
dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:284 [inline]
print_report+0x174/0x4c0 mm/kasan/report.c:395
kasan_report+0xd4/0x130 mm/kasan/report.c:495
__asan_report_load8_noabort+0x2c/0x38 mm/kasan/report_generic.c:351
device_for_each_child+0xa8/0x174 drivers/base/core.c:4018
pm_runtime_set_memalloc_noio+0xf0/0x210 drivers/base/power/runtime.c:246
netdev_unregister_kobject+0x144/0x204 net/core/net-sysfs.c:1983
unregister_netdevice_many+0x11b8/0x175c net/core/dev.c:10913
unregister_netdevice_queue net/core/dev.c:10817 [inline]
unregister_netdevice include/linux/netdevice.h:3045 [inline]
unregister_netdev+0x178/0x1f0 net/core/dev.c:10945
bnep_session+0x23c4/0x2584 net/bluetooth/bnep/core.c:525
kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864

Allocated by task 6822:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4c/0x80 mm/kasan/common.c:52
kasan_save_alloc_info+0x24/0x30 mm/kasan/generic.c:505
____kasan_kmalloc mm/kasan/common.c:374 [inline]
__kasan_kmalloc+0xac/0xc4 mm/kasan/common.c:383
kasan_kmalloc include/linux/kasan.h:211 [inline]
__do_kmalloc_node mm/slab_common.c:936 [inline]
__kmalloc+0xd8/0x1c4 mm/slab_common.c:949
kmalloc include/linux/slab.h:562 [inline]
kzalloc include/linux/slab.h:693 [inline]
hci_alloc_dev_priv+0x30/0x18a8 net/bluetooth/hci_core.c:2436
hci_alloc_dev include/net/bluetooth/hci_core.h:1470 [inline]
__vhci_create_device drivers/bluetooth/hci_vhci.c:308 [inline]
vhci_create_device+0xf8/0x6d0 drivers/bluetooth/hci_vhci.c:379
vhci_get_user drivers/bluetooth/hci_vhci.c:436 [inline]
vhci_write+0x318/0x3b8 drivers/bluetooth/hci_vhci.c:516
call_write_iter include/linux/fs.h:2265 [inline]
new_sync_write fs/read_write.c:491 [inline]
vfs_write+0x610/0x91c fs/read_write.c:584
ksys_write+0x15c/0x26c fs/read_write.c:637
__do_sys_write fs/read_write.c:649 [inline]
__se_sys_write fs/read_write.c:646 [inline]
__arm64_sys_write+0x7c/0x90 fs/read_write.c:646
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

Freed by task 6822:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4c/0x80 mm/kasan/common.c:52
kasan_save_free_info+0x38/0x5c mm/kasan/generic.c:516
____kasan_slab_free+0x144/0x1c0 mm/kasan/common.c:236
__kasan_slab_free+0x18/0x28 mm/kasan/common.c:244
kasan_slab_free include/linux/kasan.h:177 [inline]
slab_free_hook mm/slub.c:1724 [inline]
slab_free_freelist_hook mm/slub.c:1750 [inline]
slab_free mm/slub.c:3661 [inline]
__kmem_cache_free+0x2c0/0x4b4 mm/slub.c:3674
kfree+0xcc/0x1b8 mm/slab_common.c:988
hci_release_dev+0x1064/0x11cc net/bluetooth/hci_core.c:2767
bt_host_release+0x70/0x88 net/bluetooth/hci_sysfs.c:92
device_release+0x8c/0x1ac
kobject_cleanup lib/kobject.c:681 [inline]
kobject_release lib/kobject.c:712 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x2a8/0x41c lib/kobject.c:729
put_device+0x28/0x40 drivers/base/core.c:3800
hci_free_dev+0x24/0x34 net/bluetooth/hci_core.c:2559
vhci_release+0x84/0xcc drivers/bluetooth/hci_vhci.c:574
__fput+0x1c8/0x7c8 fs/file_table.c:320
____fput+0x20/0x30 fs/file_table.c:348
task_work_run+0x240/0x2f0 kernel/task_work.c:203
exit_task_work include/linux/task_work.h:39 [inline]
do_exit+0x554/0x1a88 kernel/exit.c:871
do_group_exit+0x194/0x22c kernel/exit.c:1021
get_signal+0x14a0/0x158c kernel/signal.c:2870
do_signal arch/arm64/kernel/signal.c:1076 [inline]
do_notify_resume+0x3ac/0x3474 arch/arm64/kernel/signal.c:1129
prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
el0_svc+0x9c/0x168 arch/arm64/kernel/entry-common.c:638
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

Last potentially related work creation:
kasan_save_stack+0x40/0x70 mm/kasan/common.c:45
__kasan_record_aux_stack+0xcc/0xe8 mm/kasan/generic.c:486
kasan_record_aux_stack_noalloc+0x14/0x20 mm/kasan/generic.c:496
insert_work+0x64/0x384 kernel/workqueue.c:1361
__queue_work+0xd48/0x136c kernel/workqueue.c:1520
queue_work_on+0xc0/0x16c kernel/workqueue.c:1548
queue_work include/linux/workqueue.h:512 [inline]
hci_send_acl+0x904/0xc48 net/bluetooth/hci_core.c:3238
l2cap_do_send+0x238/0x350
l2cap_chan_send+0x190c/0x1e5c
l2cap_sock_sendmsg+0x184/0x2a8 net/bluetooth/l2cap_sock.c:1162
sock_sendmsg_nosec net/socket.c:718 [inline]
__sock_sendmsg net/socket.c:730 [inline]
sock_sendmsg net/socket.c:753 [inline]
kernel_sendmsg+0x1c8/0x2a0 net/socket.c:777
bnep_tx_frame net/bluetooth/bnep/core.c:466 [inline]
bnep_session+0x1f28/0x2584 net/bluetooth/bnep/core.c:509
kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864

Second to last potentially related work creation:
kasan_save_stack+0x40/0x70 mm/kasan/common.c:45
__kasan_record_aux_stack+0xcc/0xe8 mm/kasan/generic.c:486
kasan_record_aux_stack_noalloc+0x14/0x20 mm/kasan/generic.c:496
insert_work+0x64/0x384 kernel/workqueue.c:1361
__queue_work+0xd48/0x136c kernel/workqueue.c:1520
queue_work_on+0xc0/0x16c kernel/workqueue.c:1548
queue_work include/linux/workqueue.h:512 [inline]
hci_send_acl+0x904/0xc48 net/bluetooth/hci_core.c:3238
l2cap_do_send+0x238/0x350
l2cap_chan_send+0x190c/0x1e5c
l2cap_sock_sendmsg+0x184/0x2a8 net/bluetooth/l2cap_sock.c:1162
sock_sendmsg_nosec net/socket.c:718 [inline]
__sock_sendmsg net/socket.c:730 [inline]
____sys_sendmsg+0x55c/0x848 net/socket.c:2519
___sys_sendmsg net/socket.c:2573 [inline]
__sys_sendmmsg+0x318/0x7d8 net/socket.c:2659
__do_sys_sendmmsg net/socket.c:2688 [inline]
__se_sys_sendmmsg net/socket.c:2685 [inline]
__arm64_sys_sendmmsg+0xa0/0xbc net/socket.c:2685
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

The buggy address belongs to the object at ffff0000da1a8000
which belongs to the cache kmalloc-8k of size 8192
The buggy address is located 5312 bytes inside of
8192-byte region [ffff0000da1a8000, ffff0000da1aa000)

The buggy address belongs to the physical page:
page:00000000f1577146 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11a1a8
head:00000000f1577146 order:3 compound_mapcount:0 compound_pincount:0
flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000010200 0000000000000000 dead000000000001 ffff0000c0002c00
raw: 0000000000000000 0000000000020002 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
ffff0000da1a9380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff0000da1a9400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff0000da1a9480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff0000da1a9500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff0000da1a9580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
================================================================================
UBSAN: array-index-out-of-bounds in kernel/locking/qspinlock.c:131:9
index 15441 is out of range for type 'unsigned long[8]'
CPU: 0 PID: 8192 Comm: kbnepd bnep0 Tainted: G B W 6.1.115-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024

Call trace:
dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
ubsan_epilogue lib/ubsan.c:151 [inline]
__ubsan_handle_out_of_bounds+0xfc/0x148 lib/ubsan.c:282
decode_tail kernel/locking/qspinlock.c:131 [inline]
queued_spin_lock_slowpath+0x9fc/0xe48 kernel/locking/qspinlock.c:471
queued_spin_lock include/asm-generic/qspinlock.h:114 [inline]
do_raw_spin_lock+0x330/0x358 kernel/locking/spinlock_debug.c:115
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:111 [inline]
_raw_spin_lock_irqsave+0x74/0xb4 kernel/locking/spinlock.c:162
klist_next+0x8c/0x2e4 lib/klist.c:382
next_device drivers/base/core.c:3943 [inline]
device_for_each_child+0xc0/0x174 drivers/base/core.c:4022
pm_runtime_set_memalloc_noio+0xf0/0x210 drivers/base/power/runtime.c:246
netdev_unregister_kobject+0x144/0x204 net/core/net-sysfs.c:1983
unregister_netdevice_many+0x11b8/0x175c net/core/dev.c:10913
unregister_netdevice_queue net/core/dev.c:10817 [inline]
unregister_netdevice include/linux/netdevice.h:3045 [inline]
unregister_netdev+0x178/0x1f0 net/core/dev.c:10945
bnep_session+0x23c4/0x2584 net/bluetooth/bnep/core.c:525
kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864
================================================================================

syzbot

unread,

Nov 3, 2024, 2:28:25 AM11/3/24

to syzkaller...@googlegroups.com

syzbot has found a reproducer for the following issue on:

HEAD commit: 72244eab0dad Linux 5.15.170
git tree: linux-5.15.y

console output: https://syzkaller.appspot.com/x/log.txt?x=15b2e987980000

kernel config: https://syzkaller.appspot.com/x/.config?x=d85ac7994f3a5f02
dashboard link: https://syzkaller.appspot.com/bug?extid=32ac42fa2a157f6f3ddc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=159b0d5f980000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/a97549f813ef/disk-72244eab.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/399cdfbc4562/vmlinux-72244eab.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a7c1fce94960/Image-72244eab.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+32ac42...@syzkaller.appspotmail.com

------------[ cut here ]------------
sysfs group 'byte_queue_limits' not found for kobject 'tx-0'

WARNING: CPU: 0 PID: 4220 at fs/sysfs/group.c:281 sysfs_remove_group+0x174/0x288 fs/sysfs/group.c:279
Modules linked in:
CPU: 0 PID: 4220 Comm: kbnepd bnep0 Not tainted 5.15.170-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : sysfs_remove_group+0x174/0x288 fs/sysfs/group.c:279
lr : sysfs_remove_group+0x174/0x288 fs/sysfs/group.c:279

sp : ffff800020777830
x29: ffff800020777830 x28: 1fffe00018421cbb x27: 0000000000000000
x26: 0000000000000000 x25: 1fffe00018421c88 x24: 1ffff000026c5414
x23: dfff800000000000 x22: 0000000000000000 x21: ffff0000edb08018
x20: ffff0000cfab3d98 x19: ffff80001362a780 x18: 0000000000000001

x17: 0000000000000000 x16: ffff800011aba618 x15: 00000000ffffffff

x14: ffff0000ccc79b40 x13: 0000000000000001 x12: 0000000000000001
x11: 0000000000000000 x10: 0000000000000000 x9 : 71f99dccc15a9700
x8 : 71f99dccc15a9700 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff800020776f98 x4 : ffff800014ba05e0 x3 : ffff800008555e80

x2 : 0000000000000001 x1 : 0000000100000000 x0 : 000000000000003c
Call trace:
sysfs_remove_group+0x174/0x288 fs/sysfs/group.c:279
netdev_queue_update_kobjects+0x388/0x404 net/core/net-sysfs.c:1724
remove_queue_kobjects net/core/net-sysfs.c:1823 [inline]
netdev_unregister_kobject+0x100/0x204 net/core/net-sysfs.c:1976
unregister_netdevice_many+0x12c8/0x189c net/core/dev.c:11125
unregister_netdevice_queue net/core/dev.c:11031 [inline]
unregister_netdevice include/linux/netdevice.h:3012 [inline]
unregister_netdev+0x178/0x1f0 net/core/dev.c:11157
bnep_session+0x2274/0x2424 net/bluetooth/bnep/core.c:525
kthread+0x37c/0x45c kernel/kthread.c:334
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870

irq event stamp: 8584
hardirqs last enabled at (8583): [<ffff80000832c128>] __up_console_sem+0xb4/0x100 kernel/printk/printk.c:257
hardirqs last disabled at (8584): [<ffff800011ab5ca4>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:396
softirqs last enabled at (8508): [<ffff80000ff21d0c>] spin_unlock_bh include/linux/spinlock.h:408 [inline]
softirqs last enabled at (8508): [<ffff80000ff21d0c>] netif_addr_unlock_bh include/linux/netdevice.h:4617 [inline]
softirqs last enabled at (8508): [<ffff80000ff21d0c>] dev_mc_flush+0x1b4/0x1f8 net/core/dev_addr_lists.c:1001
softirqs last disabled at (8506): [<ffff80000ff22324>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:18
---[ end trace 397b9a4e2a03ed15 ]---
==================================================================
BUG: KASAN: use-after-free in device_for_each_child+0xa8/0x174 drivers/base/core.c:3731
Read of size 8 at addr ffff0000d6b69388 by task kbnepd bnep0/4220

CPU: 0 PID: 4220 Comm: kbnepd bnep0 Tainted: G W 5.15.170-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024

Call trace:
dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216

__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106

print_address_description+0x7c/0x3f0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:434 [inline]
kasan_report+0x174/0x1e4 mm/kasan/report.c:451
__asan_report_load8_noabort+0x44/0x50 mm/kasan/report_generic.c:309
device_for_each_child+0xa8/0x174 drivers/base/core.c:3731
pm_runtime_set_memalloc_noio+0xf0/0x210 drivers/base/power/runtime.c:246
netdev_unregister_kobject+0x144/0x204 net/core/net-sysfs.c:1978

unregister_netdevice_many+0x12c8/0x189c net/core/dev.c:11125
unregister_netdevice_queue net/core/dev.c:11031 [inline]
unregister_netdevice include/linux/netdevice.h:3012 [inline]
unregister_netdev+0x178/0x1f0 net/core/dev.c:11157
bnep_session+0x2274/0x2424 net/bluetooth/bnep/core.c:525
kthread+0x37c/0x45c kernel/kthread.c:334
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870

Allocated by task 4153:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:434 [inline]
____kasan_kmalloc+0xbc/0xfc mm/kasan/common.c:513
__kasan_kmalloc+0x10/0x1c mm/kasan/common.c:522
kasan_kmalloc include/linux/kasan.h:264 [inline]
__kmalloc+0x29c/0x4c8 mm/slub.c:4407
kmalloc include/linux/slab.h:596 [inline]
kzalloc include/linux/slab.h:721 [inline]
hci_alloc_dev_priv+0x30/0x18b0 net/bluetooth/hci_core.c:3775
hci_alloc_dev include/net/bluetooth/hci_core.h:1242 [inline]
__vhci_create_device drivers/bluetooth/hci_vhci.c:102 [inline]
vhci_create_device+0xf8/0x568 drivers/bluetooth/hci_vhci.c:153
vhci_get_user drivers/bluetooth/hci_vhci.c:210 [inline]
vhci_write+0x318/0x3b8 drivers/bluetooth/hci_vhci.c:290
call_write_iter include/linux/fs.h:2174 [inline]
new_sync_write fs/read_write.c:507 [inline]
vfs_write+0x884/0xb44 fs/read_write.c:594
ksys_write+0x15c/0x26c fs/read_write.c:647
__do_sys_write fs/read_write.c:659 [inline]
__se_sys_write fs/read_write.c:656 [inline]
__arm64_sys_write+0x7c/0x90 fs/read_write.c:656
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

Freed by task 4153:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track+0x4c/0x84 mm/kasan/common.c:46
kasan_set_free_info+0x28/0x4c mm/kasan/generic.c:360
____kasan_slab_free+0x118/0x164 mm/kasan/common.c:366
__kasan_slab_free+0x18/0x28 mm/kasan/common.c:374
kasan_slab_free include/linux/kasan.h:230 [inline]
slab_free_hook mm/slub.c:1705 [inline]
slab_free_freelist_hook+0x128/0x1ec mm/slub.c:1731
slab_free mm/slub.c:3499 [inline]
kfree+0x178/0x410 mm/slub.c:4559
hci_release_dev+0x1004/0x116c net/bluetooth/hci_core.c:4096
bt_host_release+0x70/0x88 net/bluetooth/hci_sysfs.c:92
device_release+0x8c/0x1ac
kobject_cleanup lib/kobject.c:713 [inline]
kobject_release lib/kobject.c:744 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x2c4/0x438 lib/kobject.c:761
put_device+0x28/0x40 drivers/base/core.c:3523
hci_free_dev+0x24/0x34 net/bluetooth/hci_core.c:3895
vhci_release+0x7c/0xc4 drivers/bluetooth/hci_vhci.c:346
__fput+0x1c4/0x800 fs/file_table.c:280
____fput+0x20/0x30 fs/file_table.c:308
task_work_run+0x130/0x1e4 kernel/task_work.c:188
exit_task_work include/linux/task_work.h:33 [inline]
do_exit+0x670/0x20bc kernel/exit.c:874
do_group_exit+0x110/0x268 kernel/exit.c:996
get_signal+0x634/0x1550 kernel/signal.c:2900
do_signal arch/arm64/kernel/signal.c:890 [inline]
do_notify_resume+0x3d0/0x32b8 arch/arm64/kernel/signal.c:943
prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:133 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:138 [inline]
el0_svc+0xfc/0x1f0 arch/arm64/kernel/entry-common.c:609
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

Last potentially related work creation:

kasan_save_stack+0x38/0x68 mm/kasan/common.c:38
kasan_record_aux_stack+0xd4/0x11c mm/kasan/generic.c:348
insert_work+0x64/0x394 kernel/workqueue.c:1366
__queue_work+0xb84/0x114c kernel/workqueue.c:1532
queue_work_on+0xc4/0x17c kernel/workqueue.c:1559
queue_work include/linux/workqueue.h:512 [inline]
hci_send_acl+0x7a8/0xaa4 net/bluetooth/hci_core.c:4439
l2cap_do_send+0x238/0x350
l2cap_chan_send+0x190c/0x1e5c
l2cap_sock_sendmsg+0x184/0x2a8 net/bluetooth/l2cap_sock.c:1173
sock_sendmsg_nosec net/socket.c:704 [inline]
__sock_sendmsg net/socket.c:716 [inline]
sock_sendmsg net/socket.c:739 [inline]
kernel_sendmsg+0x1c8/0x2a0 net/socket.c:763
bnep_tx_frame net/bluetooth/bnep/core.c:466 [inline]
bnep_session+0x1e38/0x2424 net/bluetooth/bnep/core.c:509

kthread+0x37c/0x45c kernel/kthread.c:334
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870

Second to last potentially related work creation:

kthread+0x37c/0x45c kernel/kthread.c:334
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870

The buggy address belongs to the object at ffff0000d6b68000

which belongs to the cache kmalloc-8k of size 8192

The buggy address is located 5000 bytes inside of
8192-byte region [ffff0000d6b68000, ffff0000d6b6a000)
The buggy address belongs to the page:
page:0000000078f41fe3 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x116b68
head:0000000078f41fe3 order:3 compound_mapcount:0 compound_pincount:0

flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff)

raw: 05ffc00000010200 0000000000000000 0000000100000001 ffff0000c0002c00

raw: 0000000000000000 0000000000020002 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:

ffff0000d6b69280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff0000d6b69300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff0000d6b69380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff0000d6b69400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff0000d6b69480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
================================================================================
UBSAN: array-index-out-of-bounds in kernel/locking/qspinlock.c:130:9
index 15079 is out of range for type 'unsigned long[8]'
CPU: 0 PID: 4220 Comm: kbnepd bnep0 Tainted: G B W 5.15.170-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024

Call trace:
dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216

__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
ubsan_epilogue lib/ubsan.c:151 [inline]

__ubsan_handle_out_of_bounds+0x108/0x15c lib/ubsan.c:282
decode_tail kernel/locking/qspinlock.c:130 [inline]
queued_spin_lock_slowpath+0x854/0x938 kernel/locking/qspinlock.c:468
queued_spin_lock include/asm-generic/qspinlock.h:85 [inline]
do_raw_spin_lock+0x334/0x35c kernel/locking/spinlock_debug.c:115
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:117 [inline]
_raw_spin_lock_irqsave+0xcc/0x14c kernel/locking/spinlock.c:162
klist_next+0x8c/0x2f4 lib/klist.c:382
next_device drivers/base/core.c:3656 [inline]
device_for_each_child+0xc0/0x174 drivers/base/core.c:3735
pm_runtime_set_memalloc_noio+0xf0/0x210 drivers/base/power/runtime.c:246
netdev_unregister_kobject+0x144/0x204 net/core/net-sysfs.c:1978

================================================================================
Unable to handle kernel paging request at virtual address ffff800014a27700
Mem abort info:
ESR = 0x0000000096000047
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x07: level 3 translation fault
Data abort info:
ISV = 0, ISS = 0x00000047
CM = 0, WnR = 1
swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000001ae2e0000
[ffff800014a27700] pgd=100000023ffff003, p4d=100000023ffff003, pud=100000023fffe003, pmd=100000023fff9003, pte=0000000000000000
Internal error: Oops: 0000000096000047 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 4220 Comm: kbnepd bnep0 Tainted: G B W 5.15.170-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024

pstate: 804000c5 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : queued_spin_lock_slowpath+0x36c/0x938 kernel/locking/qspinlock.c:471
lr : decode_tail kernel/locking/qspinlock.c:130 [inline]
lr : queued_spin_lock_slowpath+0x854/0x938 kernel/locking/qspinlock.c:468
sp : ffff800020777580
x29: ffff800020777620 x28: 1ffff000040eeebc x27: 0000000000000000
x26: dfff800000000000 x25: ffff7000040eeeb4 x24: 0000000000040000
x23: ffff800014a27700 x22: ffff0001b41a1708 x21: ffff0001b41a1700
x20: ffff800014a27700 x19: ffff0000ec35ac00 x18: 0000000000000002

x17: 0000000000000000 x16: ffff800011aba618 x15: 00000000ffffffff

x14: ffff0000ccc79b40 x13: 0000000000000001 x12: ffff700002e22364
x11: 0000000000000001 x10: ffff800014a27700 x9 : 0000000000000000
x8 : 0000000000000000 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff800020776c78 x4 : ffff800014ba05e0 x3 : ffff80000819c3ec
x2 : 0000000000000001 x1 : 0000000000000004 x0 : ffff0001b41a1708
Call trace:
queued_spin_lock_slowpath+0x36c/0x938 kernel/locking/qspinlock.c:474
queued_spin_lock include/asm-generic/qspinlock.h:85 [inline]
do_raw_spin_lock+0x334/0x35c kernel/locking/spinlock_debug.c:115
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:117 [inline]
_raw_spin_lock_irqsave+0xcc/0x14c kernel/locking/spinlock.c:162
klist_next+0x8c/0x2f4 lib/klist.c:382
next_device drivers/base/core.c:3656 [inline]
device_for_each_child+0xc0/0x174 drivers/base/core.c:3735
pm_runtime_set_memalloc_noio+0xf0/0x210 drivers/base/power/runtime.c:246
netdev_unregister_kobject+0x144/0x204 net/core/net-sysfs.c:1978

Code: aa1703e0 9417404a aa1603e0 52800081 (f90002f5)
---[ end trace 397b9a4e2a03ed16 ]---
----------------
Code disassembly (best guess):
0: aa1703e0 mov x0, x23
4: 9417404a bl 0x5d012c
8: aa1603e0 mov x0, x22
c: 52800081 mov w1, #0x4 // #4
* 10: f90002f5 str x21, [x23] <-- trapping instruction

---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

syzbot

unread,

Nov 9, 2024, 12:30:26 AM11/9/24

to syzkaller...@googlegroups.com

syzbot has found a reproducer for the following issue on:

HEAD commit: d7039b844a1c Linux 6.1.116
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=14b89e30580000
kernel config: https://syzkaller.appspot.com/x/.config?x=e70423a11a31a773

dashboard link: https://syzkaller.appspot.com/bug?extid=8f0a1947e2930164aabf
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=142daea7980000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/3797d90cbed7/disk-d7039b84.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/9726bc0bc28f/vmlinux-d7039b84.xz
kernel image: https://storage.googleapis.com/syzbot-assets/0b4bbd21cac0/Image-d7039b84.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8f0a19...@syzkaller.appspotmail.com

------------[ cut here ]------------
sysfs group 'byte_queue_limits' not found for kobject 'tx-0'

WARNING: CPU: 0 PID: 4447 at fs/sysfs/group.c:280 sysfs_remove_group+0x174/0x288 fs/sysfs/group.c:278
Modules linked in:
CPU: 0 PID: 4447 Comm: kbnepd bnep0 Not tainted 6.1.116-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : sysfs_remove_group+0x174/0x288 fs/sysfs/group.c:278
lr : sysfs_remove_group+0x174/0x288 fs/sysfs/group.c:278

sp : ffff8000212b7840
x29: ffff8000212b7840 x28: 1fffe0001ab688ca x27: 1fffe0001ab68888
x26: 0000000000000000 x25: 00000000ffffffff x24: 1ffff00002860bdc
x23: dfff800000000000 x22: dfff800000000000 x21: ffff0000d9c5d020
x20: ffff0000c9734000 x19: ffff8000143065c0 x18: ffff8000212b6c40
x17: 0000000000000000 x16: ffff8000122986bc x15: 0000000000000000

x14: 00000000ffffffff x13: 0000000000000001 x12: 0000000000000001

x11: 0000000000ff0100 x10: 0000000000000000 x9 : 68e2702f0d59c400
x8 : 68e2702f0d59c400 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff8000212b7138 x4 : ffff800015ac3800 x3 : ffff80000858aa4c

x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000000
Call trace:
sysfs_remove_group+0x174/0x288 fs/sysfs/group.c:278
netdev_queue_update_kobjects+0x3d4/0x470 net/core/net-sysfs.c:1729
remove_queue_kobjects net/core/net-sysfs.c:1828 [inline]
netdev_unregister_kobject+0x100/0x204 net/core/net-sysfs.c:1981

unregister_netdevice_many+0x11b8/0x175c net/core/dev.c:10917
unregister_netdevice_queue net/core/dev.c:10821 [inline]
unregister_netdevice include/linux/netdevice.h:3045 [inline]
unregister_netdev+0x178/0x1f0 net/core/dev.c:10949

bnep_session+0x23c4/0x2584 net/bluetooth/bnep/core.c:525
kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864

irq event stamp: 6620
hardirqs last enabled at (6619): [<ffff800008343af4>] __up_console_sem+0xb4/0x100 kernel/printk/printk.c:261
hardirqs last disabled at (6620): [<ffff800012294374>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last enabled at (6508): [<ffff8000105a61c4>] spin_unlock_bh include/linux/spinlock.h:396 [inline]
softirqs last enabled at (6508): [<ffff8000105a61c4>] netif_addr_unlock_bh include/linux/netdevice.h:4480 [inline]
softirqs last enabled at (6508): [<ffff8000105a61c4>] dev_mc_flush+0x1b4/0x1f8 net/core/dev_addr_lists.c:1036
softirqs last disabled at (6506): [<ffff8000105a66fc>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19

---[ end trace 0000000000000000 ]---
==================================================================

BUG: KASAN: use-after-free in device_for_each_child+0xa8/0x174 drivers/base/core.c:4015
Read of size 8 at addr ffff0000df2bd4c0 by task kbnepd bnep0/4447

CPU: 0 PID: 4447 Comm: kbnepd bnep0 Tainted: G W 6.1.116-syzkaller #0

device_for_each_child+0xa8/0x174 drivers/base/core.c:4015

pm_runtime_set_memalloc_noio+0xf0/0x210 drivers/base/power/runtime.c:246
netdev_unregister_kobject+0x144/0x204 net/core/net-sysfs.c:1983

bnep_session+0x23c4/0x2584 net/bluetooth/bnep/core.c:525
kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864

Allocated by task 4405:

Freed by task 4405:

kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4c/0x80 mm/kasan/common.c:52
kasan_save_free_info+0x38/0x5c mm/kasan/generic.c:516
____kasan_slab_free+0x144/0x1c0 mm/kasan/common.c:236
__kasan_slab_free+0x18/0x28 mm/kasan/common.c:244
kasan_slab_free include/linux/kasan.h:177 [inline]
slab_free_hook mm/slub.c:1724 [inline]
slab_free_freelist_hook mm/slub.c:1750 [inline]
slab_free mm/slub.c:3661 [inline]
__kmem_cache_free+0x2c0/0x4b4 mm/slub.c:3674
kfree+0xcc/0x1b8 mm/slab_common.c:988
hci_release_dev+0x1064/0x11cc net/bluetooth/hci_core.c:2767
bt_host_release+0x70/0x88 net/bluetooth/hci_sysfs.c:92
device_release+0x8c/0x1ac
kobject_cleanup lib/kobject.c:681 [inline]
kobject_release lib/kobject.c:712 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x2a8/0x41c lib/kobject.c:729

put_device+0x28/0x40 drivers/base/core.c:3797

The buggy address belongs to the object at ffff0000df2bc000

which belongs to the cache kmalloc-8k of size 8192
The buggy address is located 5312 bytes inside of

8192-byte region [ffff0000df2bc000, ffff0000df2be000)

The buggy address belongs to the physical page:

page:00000000b40ad272 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11f2b8
head:00000000b40ad272 order:3 compound_mapcount:0 compound_pincount:0

flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000010200 0000000000000000 dead000000000001 ffff0000c0002c00
raw: 0000000000000000 0000000000020002 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:

ffff0000df2bd380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff0000df2bd400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff0000df2bd480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff0000df2bd500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff0000df2bd580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb

==================================================================
================================================================================
UBSAN: array-index-out-of-bounds in kernel/locking/qspinlock.c:131:9

index 12563 is out of range for type 'unsigned long[8]'
CPU: 0 PID: 4447 Comm: kbnepd bnep0 Tainted: G B W 6.1.116-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call trace:
dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
ubsan_epilogue lib/ubsan.c:151 [inline]
__ubsan_handle_out_of_bounds+0xfc/0x148 lib/ubsan.c:282
decode_tail kernel/locking/qspinlock.c:131 [inline]
queued_spin_lock_slowpath+0x9fc/0xe48 kernel/locking/qspinlock.c:471
queued_spin_lock include/asm-generic/qspinlock.h:114 [inline]
do_raw_spin_lock+0x330/0x358 kernel/locking/spinlock_debug.c:115
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:111 [inline]
_raw_spin_lock_irqsave+0x74/0xb4 kernel/locking/spinlock.c:162
klist_next+0x8c/0x2e4 lib/klist.c:382

next_device drivers/base/core.c:3940 [inline]
device_for_each_child+0xc0/0x174 drivers/base/core.c:4019

pm_runtime_set_memalloc_noio+0xf0/0x210 drivers/base/power/runtime.c:246
netdev_unregister_kobject+0x144/0x204 net/core/net-sysfs.c:1983

bnep_session+0x23c4/0x2584 net/bluetooth/bnep/core.c:525
kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864
================================================================================

---

syzbot

unread,

Nov 21, 2024, 4:03:30 PM11/21/24

to syzkaller...@googlegroups.com

syzbot has found a reproducer for the following issue on:

HEAD commit: 0a51d2d4527b Linux 5.15.173
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=172d1b78580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f63d146f1af4415a

dashboard link: https://syzkaller.appspot.com/bug?extid=32ac42fa2a157f6f3ddc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10ad1b78580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17738ec0580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/733a95526889/disk-0a51d2d4.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/409603e5dc40/vmlinux-0a51d2d4.xz
kernel image: https://storage.googleapis.com/syzbot-assets/2d60efa369ee/bzImage-0a51d2d4.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/c28068fd815e/mount_4.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+32ac42...@syzkaller.appspotmail.com

------------[ cut here ]------------
sysfs group 'byte_queue_limits' not found for kobject 'tx-0'

WARNING: CPU: 0 PID: 4170 at fs/sysfs/group.c:281 sysfs_remove_group+0x179/0x2a0 fs/sysfs/group.c:279
Modules linked in:
CPU: 0 PID: 4170 Comm: kbnepd bnep0 Not tainted 5.15.173-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024
RIP: 0010:sysfs_remove_group+0x179/0x2a0 fs/sysfs/group.c:279
Code: 8b 36 4c 89 e0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 e7 e8 4a a1 cc ff 49 8b 14 24 48 c7 c7 40 bc 99 8a 4c 89 f6 e8 c7 64 4e ff <0f> 0b 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 e1 c8 82 ff
RSP: 0018:ffffc90002e47928 EFLAGS: 00010246
RAX: 4270ebfb42505600 RBX: ffff88802c2b0048 RCX: ffff888078239dc0
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffffffff81669a1c R09: ffffed10172067a8
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff88802c2b0018
R13: 1ffffffff16fd878 R14: ffffffff8b7ecae0 R15: ffff8881435f0d98
FS: 0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffdd9a2cf48 CR3: 000000002aa0e000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
netdev_queue_update_kobjects+0x37c/0x3f0 net/core/net-sysfs.c:1724
remove_queue_kobjects net/core/net-sysfs.c:1823 [inline]
netdev_unregister_kobject+0x10d/0x250 net/core/net-sysfs.c:1976
unregister_netdevice_many+0x13a6/0x18f0 net/core/dev.c:11129
unregister_netdevice_queue net/core/dev.c:11035 [inline]
unregister_netdevice include/linux/netdevice.h:3012 [inline]
unregister_netdev+0x19b/0x210 net/core/dev.c:11161
bnep_session+0x2b57/0x2d40 net/bluetooth/bnep/core.c:525
kthread+0x3f6/0x4f0 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
</TASK>

syzbot

unread,

Dec 8, 2024, 8:40:25 AM12/8/24

to syzkaller...@googlegroups.com

syzbot has found a reproducer for the following issue on:

HEAD commit: e4d90d63d385 Linux 6.1.119
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1067e4df980000
kernel config: https://syzkaller.appspot.com/x/.config?x=393f8074c5fb7ad6

dashboard link: https://syzkaller.appspot.com/bug?extid=8f0a1947e2930164aabf
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15fec820580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10438b30580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/3986cbf4f35a/disk-e4d90d63.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/d2963d16cebb/vmlinux-e4d90d63.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a877a1a23701/Image-e4d90d63.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/d9d9b403c575/mount_1.gz

WARNING: CPU: 1 PID: 4441 at fs/sysfs/group.c:280 sysfs_remove_group+0x174/0x288 fs/sysfs/group.c:278
Modules linked in:
CPU: 1 PID: 4441 Comm: kbnepd bnep0 Not tainted 6.1.119-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : sysfs_remove_group+0x174/0x288 fs/sysfs/group.c:278
lr : sysfs_remove_group+0x174/0x288 fs/sysfs/group.c:278

sp : ffff800021977840
x29: ffff800021977840 x28: 1fffe0001b3be0ca x27: 1fffe0001b3be088
x26: 0000000000000000 x25: 00000000ffffffff x24: 1ffff00002874750
x23: dfff800000000000 x22: dfff800000000000 x21: ffff0000d2b4a020
x20: ffff0000d91b40e8 x19: ffff8000143a4160 x18: ffff800021976c40
x17: 0000000000000000 x16: ffff800012325074 x15: 0000000000000000

x14: 00000000ffffffff x13: 0000000000000001 x12: 0000000000000001

x11: 0000000000ff0100 x10: 0000000000000000 x9 : 4a45226ce73fc200
x8 : 4a45226ce73fc200 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff800021977138 x4 : ffff800015b630e0 x3 : ffff800008585a08

bnep_session+0x23c4/0x2584 net/bluetooth/bnep/core.c:525
kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864

irq event stamp: 5094
hardirqs last enabled at (5093): [<ffff80000833eab0>] __up_console_sem+0xb4/0x100 kernel/printk/printk.c:261
hardirqs last disabled at (5094): [<ffff800012320d2c>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last enabled at (4996): [<ffff800010630e64>] spin_unlock_bh include/linux/spinlock.h:396 [inline]
softirqs last enabled at (4996): [<ffff800010630e64>] netif_addr_unlock_bh include/linux/netdevice.h:4480 [inline]
softirqs last enabled at (4996): [<ffff800010630e64>] dev_mc_flush+0x1b4/0x1f8 net/core/dev_addr_lists.c:1036
softirqs last disabled at (4994): [<ffff80001063139c>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19

---[ end trace 0000000000000000 ]---
==================================================================

BUG: KASAN: use-after-free in device_for_each_child+0xa8/0x174 drivers/base/core.c:4015
Read of size 8 at addr ffff0000da3614b8 by task kbnepd bnep0/4441

CPU: 0 PID: 4441 Comm: kbnepd bnep0 Tainted: G W 6.1.119-syzkaller #0

device_for_each_child+0xa8/0x174 drivers/base/core.c:4015

pm_runtime_set_memalloc_noio+0xf0/0x210 drivers/base/power/runtime.c:246
netdev_unregister_kobject+0x144/0x204 net/core/net-sysfs.c:1983

bnep_session+0x23c4/0x2584 net/bluetooth/bnep/core.c:525
kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864

Allocated by task 4301:

kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4c/0x80 mm/kasan/common.c:52
kasan_save_alloc_info+0x24/0x30 mm/kasan/generic.c:505
____kasan_kmalloc mm/kasan/common.c:374 [inline]
__kasan_kmalloc+0xac/0xc4 mm/kasan/common.c:383
kasan_kmalloc include/linux/kasan.h:211 [inline]
__do_kmalloc_node mm/slab_common.c:936 [inline]
__kmalloc+0xd8/0x1c4 mm/slab_common.c:949
kmalloc include/linux/slab.h:562 [inline]
kzalloc include/linux/slab.h:693 [inline]
hci_alloc_dev_priv+0x30/0x18a8 net/bluetooth/hci_core.c:2436

hci_alloc_dev include/net/bluetooth/hci_core.h:1469 [inline]

__vhci_create_device drivers/bluetooth/hci_vhci.c:308 [inline]
vhci_create_device+0xf8/0x6d0 drivers/bluetooth/hci_vhci.c:379
vhci_get_user drivers/bluetooth/hci_vhci.c:436 [inline]
vhci_write+0x318/0x3b8 drivers/bluetooth/hci_vhci.c:516
call_write_iter include/linux/fs.h:2265 [inline]
new_sync_write fs/read_write.c:491 [inline]
vfs_write+0x610/0x91c fs/read_write.c:584
ksys_write+0x15c/0x26c fs/read_write.c:637
__do_sys_write fs/read_write.c:649 [inline]
__se_sys_write fs/read_write.c:646 [inline]
__arm64_sys_write+0x7c/0x90 fs/read_write.c:646
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]

invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204

el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

Freed by task 4455:

hci_release_dev+0x1040/0x11a8 net/bluetooth/hci_core.c:2766

bt_host_release+0x70/0x88 net/bluetooth/hci_sysfs.c:92
device_release+0x8c/0x1ac
kobject_cleanup lib/kobject.c:681 [inline]
kobject_release lib/kobject.c:712 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x2a8/0x41c lib/kobject.c:729

put_device+0x28/0x40 drivers/base/core.c:3797

hci_free_dev+0x24/0x34 net/bluetooth/hci_core.c:2559
vhci_release+0x84/0xcc drivers/bluetooth/hci_vhci.c:574
__fput+0x1c8/0x7c8 fs/file_table.c:320
____fput+0x20/0x30 fs/file_table.c:348
task_work_run+0x240/0x2f0 kernel/task_work.c:203
exit_task_work include/linux/task_work.h:39 [inline]
do_exit+0x554/0x1a88 kernel/exit.c:871

__do_sys_exit kernel/exit.c:988 [inline]
__se_sys_exit kernel/exit.c:986 [inline]
do_group_exit+0x0/0x22c kernel/exit.c:986
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204

el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

Last potentially related work creation:
kasan_save_stack+0x40/0x70 mm/kasan/common.c:45
__kasan_record_aux_stack+0xcc/0xe8 mm/kasan/generic.c:486
kasan_record_aux_stack_noalloc+0x14/0x20 mm/kasan/generic.c:496
insert_work+0x64/0x384 kernel/workqueue.c:1361
__queue_work+0xd48/0x136c kernel/workqueue.c:1520
queue_work_on+0xc0/0x16c kernel/workqueue.c:1548
queue_work include/linux/workqueue.h:512 [inline]

hci_send_acl+0x904/0xc48 net/bluetooth/hci_core.c:3225

l2cap_do_send+0x238/0x350
l2cap_chan_send+0x190c/0x1e5c
l2cap_sock_sendmsg+0x184/0x2a8 net/bluetooth/l2cap_sock.c:1162
sock_sendmsg_nosec net/socket.c:718 [inline]
__sock_sendmsg net/socket.c:730 [inline]
sock_sendmsg net/socket.c:753 [inline]
kernel_sendmsg+0x1c8/0x2a0 net/socket.c:777
bnep_tx_frame net/bluetooth/bnep/core.c:466 [inline]
bnep_session+0x1f28/0x2584 net/bluetooth/bnep/core.c:509
kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864

Second to last potentially related work creation:
kasan_save_stack+0x40/0x70 mm/kasan/common.c:45
__kasan_record_aux_stack+0xcc/0xe8 mm/kasan/generic.c:486
kasan_record_aux_stack_noalloc+0x14/0x20 mm/kasan/generic.c:496
insert_work+0x64/0x384 kernel/workqueue.c:1361
__queue_work+0xd48/0x136c kernel/workqueue.c:1520
queue_work_on+0xc0/0x16c kernel/workqueue.c:1548
queue_work include/linux/workqueue.h:512 [inline]

hci_cmd_sync_submit+0x200/0x230 net/bluetooth/hci_sync.c:734
hci_cmd_sync_queue net/bluetooth/hci_sync.c:755 [inline]
hci_update_passive_scan+0x1ac/0x1c8 net/bluetooth/hci_sync.c:3026
le_conn_complete_evt+0x864/0xfe0 net/bluetooth/hci_event.c:5879
hci_le_conn_complete_evt+0x114/0x404 net/bluetooth/hci_event.c:5890
hci_le_meta_evt+0x2b8/0x47c net/bluetooth/hci_event.c:7059
hci_event_func net/bluetooth/hci_event.c:7370 [inline]
hci_event_packet+0x6f8/0x109c net/bluetooth/hci_event.c:7425
hci_rx_work+0x318/0xa68 net/bluetooth/hci_core.c:4085
process_one_work+0x7ac/0x1404 kernel/workqueue.c:2292
worker_thread+0x8e4/0xfec kernel/workqueue.c:2439

kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864

The buggy address belongs to the object at ffff0000da360000

which belongs to the cache kmalloc-8k of size 8192

The buggy address is located 5304 bytes inside of
8192-byte region [ffff0000da360000, ffff0000da362000)

The buggy address belongs to the physical page:

page:000000001ee9ebd2 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11a360
head:000000001ee9ebd2 order:3 compound_mapcount:0 compound_pincount:0

flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff)

raw: 05ffc00000010200 0000000000000000 dead000000000122 ffff0000c0002c00

raw: 0000000000000000 0000000000020002 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:

ffff0000da361380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff0000da361400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff0000da361480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff0000da361500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff0000da361580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb

index 12549 is out of range for type 'unsigned long[8]'
CPU: 0 PID: 4441 Comm: kbnepd bnep0 Tainted: G B W 6.1.119-syzkaller #0

next_device drivers/base/core.c:3940 [inline]
device_for_each_child+0xc0/0x174 drivers/base/core.c:4019

pm_runtime_set_memalloc_noio+0xf0/0x210 drivers/base/power/runtime.c:246
netdev_unregister_kobject+0x144/0x204 net/core/net-sysfs.c:1983

Unable to handle kernel paging request at virtual address ffff8000159e7f70
KASAN: probably user-memory-access in range [0x00000000acf3fb80-0x00000000acf3fb87]

Mem abort info:
ESR = 0x0000000096000047
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x07: level 3 translation fault
Data abort info:
ISV = 0, ISS = 0x00000047
CM = 0, WnR = 1

swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000001ab212000
[ffff8000159e7f70] pgd=100000023ffff003, p4d=100000023ffff003, pud=100000023fffe003, pmd=100000023fffa003, pte=0000000000000000

Internal error: Oops: 0000000096000047 [#1] PREEMPT SMP

Modules linked in:
CPU: 0 PID: 4441 Comm: kbnepd bnep0 Tainted: G B W 6.1.119-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024

pstate: 804000c5 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : queued_spin_lock_slowpath+0x3f4/0xe48 kernel/locking/qspinlock.c:474
lr : decode_tail kernel/locking/qspinlock.c:131 [inline]
lr : queued_spin_lock_slowpath+0x9fc/0xe48 kernel/locking/qspinlock.c:471
sp : ffff8000219775a0
x29: ffff800021977640 x28: 000000000000c41b x27: 1ffff0000432eec0
x26: dfff800000000000 x25: 1fffe00019cb6280 x24: 0000000000040000
x23: ffff0001b3cf5f48 x22: ffff8000159e7f70 x21: ffff0001b3cf5f40
x20: 1fffe0003679ebe8 x19: ffff0000ce5b1400 x18: 1fffe0003679c376
x17: 3d3d3d3d3d3d3d3d x16: ffff800012325074 x15: 0000000000000000
x14: 00000000ffffffff x13: 0000000000000001 x12: ffff7000030c3ab0
x11: 0000000000ff0100 x10: ffff8000159e7f40 x9 : 0000000000000003
x8 : 0000000000000000 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff800021976e58 x4 : ffff800015b630e0 x3 : ffff8000081a7abc
x2 : 0000000000000001 x1 : 0000000000000004 x0 : ffff0001b3cf5f48
Call trace:
queued_spin_lock_slowpath+0x3f4/0xe48 kernel/locking/qspinlock.c:477

queued_spin_lock include/asm-generic/qspinlock.h:114 [inline]
do_raw_spin_lock+0x330/0x358 kernel/locking/spinlock_debug.c:115
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:111 [inline]
_raw_spin_lock_irqsave+0x74/0xb4 kernel/locking/spinlock.c:162
klist_next+0x8c/0x2e4 lib/klist.c:382

next_device drivers/base/core.c:3940 [inline]
device_for_each_child+0xc0/0x174 drivers/base/core.c:4019

pm_runtime_set_memalloc_noio+0xf0/0x210 drivers/base/power/runtime.c:246
netdev_unregister_kobject+0x144/0x204 net/core/net-sysfs.c:1983

bnep_session+0x23c4/0x2584 net/bluetooth/bnep/core.c:525
kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864

Code: aa1603e0 976c7a11 aa1703e0 52800081 (f90002d5)

---[ end trace 0000000000000000 ]---

----------------
Code disassembly (best guess):

0: aa1603e0 mov x0, x22
4: 976c7a11 bl 0xfffffffffdb1e848
8: aa1703e0 mov x0, x23

c: 52800081 mov w1, #0x4 // #4

* 10: f90002d5 str x21, [x22] <-- trapping instruction

syzbot

unread,

Jan 24, 2025, 5:16:04 PM1/24/25

to syzkaller...@googlegroups.com

syzbot suspects this issue was fixed by commit:

commit 0f67ca2a80acf8b207240405b7f72d660665d3df
Author: Dmitry Antipov <dman...@yandex.ru>
Date: Fri Nov 1 11:44:10 2024 +0000

Bluetooth: fix use-after-free in device_for_each_child()

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=14ad19f8580000
start commit: e4d90d63d385 Linux 6.1.119
git tree: linux-6.1.y

kernel config: https://syzkaller.appspot.com/x/.config?x=393f8074c5fb7ad6
dashboard link: https://syzkaller.appspot.com/bug?extid=8f0a1947e2930164aabf

userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15fec820580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10438b30580000

If the result looks correct, please mark the issue as fixed by replying with:

#syz fix: Bluetooth: fix use-after-free in device_for_each_child()

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

syzbot

unread,

Jan 24, 2025, 11:09:05 PM1/24/25

to syzkaller...@googlegroups.com

syzbot suspects this issue was fixed by commit:

commit a9584c897d1cba6265c78010bbb45ca5722c88bc

Author: Dmitry Antipov <dman...@yandex.ru>
Date: Fri Nov 1 11:44:10 2024 +0000

Bluetooth: fix use-after-free in device_for_each_child()

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=178555df980000
start commit: 0a51d2d4527b Linux 5.15.173
git tree: linux-5.15.y

kernel config: https://syzkaller.appspot.com/x/.config?x=f63d146f1af4415a
dashboard link: https://syzkaller.appspot.com/bug?extid=32ac42fa2a157f6f3ddc

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10ad1b78580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17738ec0580000

Reply all

Reply to author

Forward

0 new messages