[syzbot] [bluetooth?] KASAN: null-ptr-deref Read in ida_free (4)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 9bacdd8996c7 Merge tag 'for-6.7-rc1-tag' of git://git.kern..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1121f91f680000
kernel config: https://syzkaller.appspot.com/x/.config?x=84217b7fc4acdc59
dashboard link: https://syzkaller.appspot.com/bug?extid=51baee846ddab52d5230
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8889f0a9f059/disk-9bacdd89.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f78cb4c03467/vmlinux-9bacdd89.xz
kernel image: https://storage.googleapis.com/syzbot-assets/bb88d4b4f745/bzImage-9bacdd89.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+51baee...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:68 [inline]
BUG: KASAN: null-ptr-deref in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
BUG: KASAN: null-ptr-deref in ida_free+0x218/0x2e0 lib/idr.c:511
Read of size 8 at addr 0000000000000050 by task kworker/u5:2/5100

CPU: 0 PID: 5100 Comm: kworker/u5:2 Not tainted 6.7.0-rc1-syzkaller-00012-g9bacdd8996c7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
Workqueue: hci4 hci_error_reset
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
kasan_report+0xda/0x110 mm/kasan/report.c:588
check_region_inline mm/kasan/generic.c:181 [inline]
kasan_check_range+0xef/0x190 mm/kasan/generic.c:187
instrument_atomic_read include/linux/instrumented.h:68 [inline]
_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
ida_free+0x218/0x2e0 lib/idr.c:511
hci_conn_cleanup net/bluetooth/hci_conn.c:157 [inline]
hci_conn_del+0x78c/0xe10 net/bluetooth/hci_conn.c:1182
hci_conn_hash_flush+0x189/0x260 net/bluetooth/hci_conn.c:2615
hci_dev_close_sync+0x5a7/0x1160 net/bluetooth/hci_sync.c:5021
hci_dev_do_close+0x2e/0x90 net/bluetooth/hci_core.c:554
hci_error_reset+0xa6/0x190 net/bluetooth/hci_core.c:1059
process_one_work+0x886/0x15d0 kernel/workqueue.c:2630
process_scheduled_works kernel/workqueue.c:2703 [inline]
worker_thread+0x8b9/0x1290 kernel/workqueue.c:2784
kthread+0x2c6/0x3a0 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242
</TASK>
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 8c9660f65153 Add linux-next specific files for 20231124
git tree: linux-next
console+strace: https://syzkaller.appspot.com/x/log.txt?x=1678a3cce80000
kernel config: https://syzkaller.appspot.com/x/.config?x=ca1e8655505e280

dashboard link: https://syzkaller.appspot.com/bug?extid=51baee846ddab52d5230
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10d54c08e80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=160ef1a4e80000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/345ed4af3a0d/disk-8c9660f6.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/191053c69d57/vmlinux-8c9660f6.xz
kernel image: https://storage.googleapis.com/syzbot-assets/aac7ee5e55e0/bzImage-8c9660f6.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+51baee...@syzkaller.appspotmail.com

Bluetooth: hci0: hardware error 0x00

==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:68 [inline]
BUG: KASAN: null-ptr-deref in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
BUG: KASAN: null-ptr-deref in ida_free+0x218/0x2e0 lib/idr.c:511

Read of size 8 at addr 0000000000000078 by task kworker/u5:1/4455

CPU: 1 PID: 4455 Comm: kworker/u5:1 Not tainted 6.7.0-rc2-next-20231124-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023

Workqueue: hci0 hci_error_reset

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106

kasan_report+0xd9/0x110 mm/kasan/report.c:588
check_region_inline mm/kasan/generic.c:182 [inline]
kasan_check_range+0xef/0x190 mm/kasan/generic.c:188

instrument_atomic_read include/linux/instrumented.h:68 [inline]
_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
ida_free+0x218/0x2e0 lib/idr.c:511
hci_conn_cleanup net/bluetooth/hci_conn.c:157 [inline]

hci_conn_del+0x78c/0xe10 net/bluetooth/hci_conn.c:1183
hci_conn_hash_flush+0x189/0x260 net/bluetooth/hci_conn.c:2643

hci_dev_close_sync+0x5a7/0x1160 net/bluetooth/hci_sync.c:5021
hci_dev_do_close+0x2e/0x90 net/bluetooth/hci_core.c:554
hci_error_reset+0xa6/0x190 net/bluetooth/hci_core.c:1059

process_one_work+0x8a4/0x15f0 kernel/workqueue.c:2633
process_scheduled_works kernel/workqueue.c:2706 [inline]
worker_thread+0x8b6/0x1290 kernel/workqueue.c:2787
kthread+0x2c1/0x3a0 kernel/kthread.c:389

ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242
</TASK>
==================================================================


---

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

[syzbot]

syzbot has bisected this issue to:

commit 181a42edddf51d5d9697ecdf365d72ebeab5afb0
Author: Ziyang Xuan <william.x...@huawei.com>
Date: Wed Oct 11 09:57:31 2023 +0000

Bluetooth: Make handle of hci_conn be unique

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1345177ce80000
start commit: 8c9660f65153 Add linux-next specific files for 20231124
git tree: linux-next
final oops: https://syzkaller.appspot.com/x/report.txt?x=10c5177ce80000
console output: https://syzkaller.appspot.com/x/log.txt?x=1745177ce80000

kernel config: https://syzkaller.appspot.com/x/.config?x=ca1e8655505e280
dashboard link: https://syzkaller.appspot.com/bug?extid=51baee846ddab52d5230

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10d54c08e80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=160ef1a4e80000

Reported-by: syzbot+51baee...@syzkaller.appspotmail.com
Fixes: 181a42edddf5 ("Bluetooth: Make handle of hci_conn be unique")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

[Dmitry Vyukov]

Wonder if this is fixed with:

ida: Fix crash in ida_free when the bitmap is empty

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=af73483f4e8b6f5c68c9aa63257bdd929a9c194a

?

> ida_free+0x218/0x2e0 lib/idr.c:511
> hci_conn_cleanup net/bluetooth/hci_conn.c:157 [inline]
> hci_conn_del+0x78c/0xe10 net/bluetooth/hci_conn.c:1183
> hci_conn_hash_flush+0x189/0x260 net/bluetooth/hci_conn.c:2643
> hci_dev_close_sync+0x5a7/0x1160 net/bluetooth/hci_sync.c:5021
> hci_dev_do_close+0x2e/0x90 net/bluetooth/hci_core.c:554
> hci_error_reset+0xa6/0x190 net/bluetooth/hci_core.c:1059
> process_one_work+0x8a4/0x15f0 kernel/workqueue.c:2633
> process_scheduled_works kernel/workqueue.c:2706 [inline]
> worker_thread+0x8b6/0x1290 kernel/workqueue.c:2787
> kthread+0x2c1/0x3a0 kernel/kthread.c:389
> ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242
> </TASK>
> ==================================================================
>
>
> ---
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
>

> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bug...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/00000000000037f0f3060af9e763%40google.com.

[Matthew Wilcox]

Should be. The backtrace below looks like it's the same bug that got
reported 3-4 weeks ago.

[Dmitry Vyukov]

On second thought, perhaps the bluetooth stack shouldn't free invalid
ids in the first place.
It may even take these bogus ids from the wire, which would be pretty bad.

[Matthew Wilcox]

Oh, that was my first response. Unfortunately, the original reporter was
all "I filed a CVE and this is S3CUR1+Y F!X" so none of that interaction
is public.

What my patch will do is convert this NULL pointer dereference into a
warning (which will still be noticed by syzbot). The bluetooth stack
still needs to be fixed to not free invalid IDs.

[syzbot]

syzbot suspects this issue was fixed by commit:

commit af73483f4e8b6f5c68c9aa63257bdd929a9c194a
Author: Matthew Wilcox (Oracle) <wi...@infradead.org>
Date: Thu Dec 21 16:53:57 2023 +0000

ida: Fix crash in ida_free when the bitmap is empty

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=12fc6ba2180000
start commit: b46ae77f6787 Merge tag 'xfs-6.7-fixes-3' of git://git.kern..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=6ae1a4ee971a7305
dashboard link: https://syzkaller.appspot.com/bug?extid=51baee846ddab52d5230
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=127837cce80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12779dc8e80000

If the result looks correct, please mark the issue as fixed by replying with:

#syz fix: ida: Fix crash in ida_free when the bitmap is empty

[Aleksandr Nogikh]

Looks reasonable, judging by the commit title.

#syz fix: ida: Fix crash in ida_free when the bitmap is empty

> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bug...@googlegroups.com.

> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/000000000000d4a29506111827e7%40google.com.