[v6.1] BUG: unable to handle kernel paging request in bcsp_recv

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 535ec20c5027 Linux 6.1.135
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1766e270580000
kernel config: https://syzkaller.appspot.com/x/.config?x=c2afad13ffca3ea1
dashboard link: https://syzkaller.appspot.com/bug?extid=11e26c855707ac90e5df
compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/2c79bcda1589/disk-535ec20c.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/179c841623d5/vmlinux-535ec20c.xz
kernel image: https://storage.googleapis.com/syzbot-assets/669b3c281b37/Image-535ec20c.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+11e26c...@syzkaller.appspotmail.com

Unable to handle kernel paging request at virtual address dfff800000000021
KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]
Mem abort info:
ESR = 0x0000000096000006
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x06: level 2 translation fault
Data abort info:
ISV = 0, ISS = 0x00000006
CM = 0, WnR = 0
[dfff800000000021] address between user and kernel address ranges
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 6759 Comm: syz.0.578 Not tainted 6.1.135-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : bcsp_recv+0x9c/0x1164 drivers/bluetooth/hci_bcsp.c:590
lr : bcsp_recv+0x70/0x1164 drivers/bluetooth/hci_bcsp.c:589
sp : ffff800021977b20
x29: ffff800021977b70 x28: 000000000000017c x27: 0000000000000178
x26: 000000000000002f x25: dfff800000000000 x24: 0000000000000110
x23: 0000000000000021 x22: 0000000000000108 x21: ffff0000d32671b8
x20: ffff800021977c40 x19: 0000000000000001 x18: 0000000000000000
x17: ffff80001819f000 x16: ffff8000082d0758 x15: ffff800017c7ffc0
x14: ffff0000d1b9ddd8 x13: ffff0000d1b9de28 x12: 0000000000ff0100
x11: ff0080000eaebb8c x10: 0000000000000000 x9 : ffff0000d1b9d340
x8 : 0000000000000182 x7 : 0000000000000000 x6 : 0000000000000000
x5 : ffff8000184c2250 x4 : 0000000000000008 x3 : ffff8000082d0bd8
x2 : 0000000000000001 x1 : 0000000000000001 x0 : 0000000000000000
Call trace:
bcsp_recv+0x9c/0x1164 drivers/bluetooth/hci_bcsp.c:-1
hci_uart_tty_receive+0x140/0x1d4 drivers/bluetooth/hci_ldisc.c:624
tiocsti+0x234/0x2d8 drivers/tty/tty_io.c:2288
tty_ioctl+0x35c/0xd8c drivers/tty/tty_io.c:2690
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: d343ff7a f90017e8 a93e5fbb a93f73ba (38796ae8)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: d343ff7a lsr x26, x27, #3
4: f90017e8 str x8, [sp, #40]
8: a93e5fbb stp x27, x23, [x29, #-32]
c: a93f73ba stp x26, x28, [x29, #-16]
* 10: 38796ae8 ldrb w8, [x23, x25] <-- trapping instruction


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 535ec20c5027 Linux 6.1.135
git tree: linux-6.1.y

console output: https://syzkaller.appspot.com/x/log.txt?x=11cd8374580000

kernel config: https://syzkaller.appspot.com/x/.config?x=c2afad13ffca3ea1
dashboard link: https://syzkaller.appspot.com/bug?extid=11e26c855707ac90e5df
compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2
userspace arch: arm64

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14fee270580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15e12374580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/2c79bcda1589/disk-535ec20c.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/179c841623d5/vmlinux-535ec20c.xz
kernel image: https://storage.googleapis.com/syzbot-assets/669b3c281b37/Image-535ec20c.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+11e26c...@syzkaller.appspotmail.com

Unable to handle kernel paging request at virtual address dfff800000000021
KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]
Mem abort info:
ESR = 0x0000000096000006
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x06: level 2 translation fault
Data abort info:
ISV = 0, ISS = 0x00000006
CM = 0, WnR = 0
[dfff800000000021] address between user and kernel address ranges
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:

CPU: 0 PID: 4362 Comm: syz-executor160 Not tainted 6.1.135-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : bcsp_recv+0x9c/0x1164 drivers/bluetooth/hci_bcsp.c:590
lr : bcsp_recv+0x70/0x1164 drivers/bluetooth/hci_bcsp.c:589

sp : ffff800020ab7b20
x29: ffff800020ab7b70 x28: 000000000000017c x27: 0000000000000178

x26: 000000000000002f x25: dfff800000000000 x24: 0000000000000110

x23: 0000000000000021 x22: 0000000000000108 x21: ffff0000d9d915b8
x20: ffff800020ab7c40 x19: 0000000000000001 x18: 0000000000000000
x17: 0000000000000000 x16: ffff8000082d0758 x15: 0000000000000000
x14: 0000000080045440 x13: 1ffff00002a0e0b1 x12: 0000000000ff0100
x11: ff0080000eaebb8c x10: 0000000000000000 x9 : ffff0000d9821bc0
x8 : 0000000000000182 x7 : ffff80000eae73cc x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff8000131ed2a0

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

[syzbot]

syzbot suspects this issue was fixed by commit:

commit 8b892dbef3887dbe9afdc7176d1a5fd90e1636aa
Author: Ivan Pravdin <ipravdin...@gmail.com>
Date: Sat Aug 30 20:03:40 2025 +0000

Bluetooth: bcsp: receive data only if registered

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=124f369a580000
start commit: 535ec20c5027 Linux 6.1.135
git tree: linux-6.1.y

kernel config: https://syzkaller.appspot.com/x/.config?x=c2afad13ffca3ea1
dashboard link: https://syzkaller.appspot.com/bug?extid=11e26c855707ac90e5df

userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=142de270580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=148a30d4580000

If the result looks correct, please mark the issue as fixed by replying with:

#syz fix: Bluetooth: bcsp: receive data only if registered

For information about bisection process see: https://goo.gl/tpsmEJ#bisection