[syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: b401b621758e Linux 6.8-rc5
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12f63152180000
kernel config: https://syzkaller.appspot.com/x/.config?x=eff9f3183d0a20dd
dashboard link: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d31bbc7def2b/disk-b401b621.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/92891f219eae/vmlinux-b401b621.xz
kernel image: https://storage.googleapis.com/syzbot-assets/aedf35bce0a0/bzImage-b401b621.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+31c2f6...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: slab-use-after-free in l2cap_build_cmd net/bluetooth/l2cap_core.c:3100 [inline]
BUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x679/0x8d0 net/bluetooth/l2cap_core.c:958
Read of size 4 at addr ffff88802b3d7010 by task kworker/u5:7/5112

CPU: 0 PID: 5112 Comm: kworker/u5:7 Not tainted 6.8.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
Workqueue: hci3 hci_rx_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x167/0x540 mm/kasan/report.c:488
kasan_report+0x142/0x180 mm/kasan/report.c:601
l2cap_build_cmd net/bluetooth/l2cap_core.c:3100 [inline]
l2cap_send_cmd+0x679/0x8d0 net/bluetooth/l2cap_core.c:958
l2cap_recv_frame+0xfe9/0x8bd0
hci_acldata_packet net/bluetooth/hci_core.c:3875 [inline]
hci_rx_work+0x50f/0xca0 net/bluetooth/hci_core.c:4110
process_one_work kernel/workqueue.c:2633 [inline]
process_scheduled_works+0x915/0x1420 kernel/workqueue.c:2706
worker_thread+0xa5f/0x1000 kernel/workqueue.c:2787
kthread+0x2f1/0x390 kernel/kthread.c:388
ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242
</TASK>

Allocated by task 5104:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:372 [inline]
__kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:389
kasan_kmalloc include/linux/kasan.h:211 [inline]
kmalloc_trace+0x1d6/0x360 mm/slub.c:4012
kmalloc include/linux/slab.h:590 [inline]
kzalloc include/linux/slab.h:711 [inline]
l2cap_conn_add+0xb6/0xc10 net/bluetooth/l2cap_core.c:7855
l2cap_connect_cfm+0x138/0x1290 net/bluetooth/l2cap_core.c:8252
hci_connect_cfm+0xa4/0x150 include/net/bluetooth/hci_core.h:1986
le_conn_complete_evt+0xd10/0x1290 net/bluetooth/hci_event.c:6025
hci_le_conn_complete_evt+0x18c/0x420 net/bluetooth/hci_event.c:6051
hci_event_func net/bluetooth/hci_event.c:7679 [inline]
hci_event_packet+0xa59/0x1540 net/bluetooth/hci_event.c:7734
hci_rx_work+0x3e8/0xca0 net/bluetooth/hci_core.c:4105
process_one_work kernel/workqueue.c:2633 [inline]
process_scheduled_works+0x915/0x1420 kernel/workqueue.c:2706
worker_thread+0xa5f/0x1000 kernel/workqueue.c:2787
kthread+0x2f1/0x390 kernel/kthread.c:388
ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242

Freed by task 5316:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x4e/0x60 mm/kasan/generic.c:640
poison_slab_object+0xa6/0xe0 mm/kasan/common.c:241
__kasan_slab_free+0x34/0x70 mm/kasan/common.c:257
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2121 [inline]
slab_free mm/slub.c:4299 [inline]
kfree+0x14a/0x380 mm/slub.c:4409
l2cap_connect_cfm+0x121/0x1290 net/bluetooth/l2cap_core.c:8248
hci_connect_cfm include/net/bluetooth/hci_core.h:1986 [inline]
hci_conn_failed+0x1f8/0x340 net/bluetooth/hci_conn.c:1289
hci_abort_conn_sync+0x583/0xde0 net/bluetooth/hci_sync.c:5356
hci_cmd_sync_work+0x22d/0x400 net/bluetooth/hci_sync.c:306
process_one_work kernel/workqueue.c:2633 [inline]
process_scheduled_works+0x915/0x1420 kernel/workqueue.c:2706
worker_thread+0xa5f/0x1000 kernel/workqueue.c:2787
kthread+0x2f1/0x390 kernel/kthread.c:388
ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242

Last potentially related work creation:
kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47
__kasan_record_aux_stack+0xae/0x100 mm/kasan/generic.c:586
insert_work+0x3e/0x330 kernel/workqueue.c:1653
__queue_work+0xcdb/0x1000 kernel/workqueue.c:1806
queue_work_on+0x14f/0x250 kernel/workqueue.c:1837
queue_work include/linux/workqueue.h:548 [inline]
l2cap_conn_ready net/bluetooth/l2cap_core.c:1779 [inline]
l2cap_connect_cfm+0xf34/0x1290 net/bluetooth/l2cap_core.c:8293
hci_connect_cfm+0xa4/0x150 include/net/bluetooth/hci_core.h:1986
le_conn_complete_evt+0xd10/0x1290 net/bluetooth/hci_event.c:6025
hci_le_conn_complete_evt+0x18c/0x420 net/bluetooth/hci_event.c:6051
hci_event_func net/bluetooth/hci_event.c:7679 [inline]
hci_event_packet+0xa59/0x1540 net/bluetooth/hci_event.c:7734
hci_rx_work+0x3e8/0xca0 net/bluetooth/hci_core.c:4105
process_one_work kernel/workqueue.c:2633 [inline]
process_scheduled_works+0x915/0x1420 kernel/workqueue.c:2706
worker_thread+0xa5f/0x1000 kernel/workqueue.c:2787
kthread+0x2f1/0x390 kernel/kthread.c:388
ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242

The buggy address belongs to the object at ffff88802b3d7000
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 16 bytes inside of
freed 1024-byte region [ffff88802b3d7000, ffff88802b3d7400)

The buggy address belongs to the physical page:
page:ffffea0000acf400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2b3d0
head:ffffea0000acf400 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000840 ffff888014c41dc0 ffffea000080da00 dead000000000002
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 17603844133, free_ts 0
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1533
prep_new_page mm/page_alloc.c:1540 [inline]
get_page_from_freelist+0x33ea/0x3580 mm/page_alloc.c:3311
__alloc_pages+0x255/0x680 mm/page_alloc.c:4567
__alloc_pages_node include/linux/gfp.h:238 [inline]
alloc_pages_node include/linux/gfp.h:261 [inline]
alloc_slab_page+0x5f/0x160 mm/slub.c:2190
allocate_slab mm/slub.c:2354 [inline]
new_slab+0x84/0x2f0 mm/slub.c:2407
___slab_alloc+0xd17/0x13e0 mm/slub.c:3540
__slab_alloc mm/slub.c:3625 [inline]
__slab_alloc_node mm/slub.c:3678 [inline]
slab_alloc_node mm/slub.c:3850 [inline]
__do_kmalloc_node mm/slub.c:3980 [inline]
__kmalloc+0x2e0/0x490 mm/slub.c:3994
kmalloc include/linux/slab.h:594 [inline]
kzalloc include/linux/slab.h:711 [inline]
net_alloc_generic net/core/net_namespace.c:75 [inline]
net_assign_generic net/core/net_namespace.c:95 [inline]
ops_init+0x203/0x610 net/core/net_namespace.c:130
__register_pernet_operations net/core/net_namespace.c:1214 [inline]
register_pernet_operations+0x2cb/0x660 net/core/net_namespace.c:1283
register_pernet_device+0x33/0x80 net/core/net_namespace.c:1370
dp_init+0x95/0x160 net/openvswitch/datapath.c:2745
do_one_initcall+0x23a/0x830 init/main.c:1236
do_initcall_level+0x157/0x210 init/main.c:1298
do_initcalls+0x3f/0x80 init/main.c:1314
kernel_init_freeable+0x42f/0x5d0 init/main.c:1551
kernel_init+0x1d/0x2a0 init/main.c:1441
page_owner free stack trace missing

Memory state around the buggy address:
ffff88802b3d6f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88802b3d6f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88802b3d7000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88802b3d7080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88802b3d7100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: ab75170520d4 Merge tag 'linux-watchdog-6.13-rc6' of git://..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=17f4330f980000
kernel config: https://syzkaller.appspot.com/x/.config?x=1c541fa8af5c9cc7

dashboard link: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11261edf980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17fa36f8580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/1740fef78c43/disk-ab751705.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a74d1ace549b/vmlinux-ab751705.xz
kernel image: https://storage.googleapis.com/syzbot-assets/524d100d5187/bzImage-ab751705.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+31c2f6...@syzkaller.appspotmail.com

BUG: KASAN: slab-use-after-free in l2cap_build_cmd net/bluetooth/l2cap_core.c:2964 [inline]
BUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954
Read of size 8 at addr ffff8880271a4000 by task kworker/u9:2/5837

CPU: 0 UID: 0 PID: 5837 Comm: kworker/u9:2 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: hci1 hci_rx_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x169/0x550 mm/kasan/report.c:489
kasan_report+0x143/0x180 mm/kasan/report.c:602
l2cap_build_cmd net/bluetooth/l2cap_core.c:2964 [inline]
l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954
l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline]
l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline]
l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817
hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline]
hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>

Allocated by task 5837:

kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68

poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329
kmalloc_noprof include/linux/slab.h:901 [inline]
kzalloc_noprof include/linux/slab.h:1037 [inline]
l2cap_conn_add+0xa9/0x8e0 net/bluetooth/l2cap_core.c:6860
l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7239
hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726
hci_event_func net/bluetooth/hci_event.c:7473 [inline]
hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525
hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Freed by task 54:

kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68

kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2353 [inline]
slab_free mm/slub.c:4613 [inline]
kfree+0x196/0x430 mm/slub.c:4761
l2cap_connect_cfm+0xcc/0x1090 net/bluetooth/l2cap_core.c:7235
hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
hci_conn_failed+0x287/0x400 net/bluetooth/hci_conn.c:1266
hci_abort_conn_sync+0x56c/0x11f0 net/bluetooth/hci_sync.c:5603
hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Last potentially related work creation:
kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47

__kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:544
insert_work+0x3e/0x330 kernel/workqueue.c:2183
__queue_work+0xc8b/0xf50 kernel/workqueue.c:2339
call_timer_fn+0x187/0x650 kernel/time/timer.c:1793
expire_timers kernel/time/timer.c:1839 [inline]
__run_timers kernel/time/timer.c:2418 [inline]
__run_timer_base+0x695/0x8e0 kernel/time/timer.c:2430
run_timer_base kernel/time/timer.c:2439 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2449
handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561
__do_softirq kernel/softirq.c:595 [inline]
invoke_softirq kernel/softirq.c:435 [inline]
__irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662
irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702

Second to last potentially related work creation:
kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47
__kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:544
insert_work+0x3e/0x330 kernel/workqueue.c:2183
__queue_work+0xb66/0xf50 kernel/workqueue.c:2343
queue_work_on+0x1c2/0x380 kernel/workqueue.c:2390
queue_work include/linux/workqueue.h:662 [inline]
l2cap_conn_ready net/bluetooth/l2cap_core.c:1640 [inline]
l2cap_connect_cfm+0xdd5/0x1090 net/bluetooth/l2cap_core.c:7280
hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726
hci_event_func net/bluetooth/hci_event.c:7473 [inline]
hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525
hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

The buggy address belongs to the object at ffff8880271a4000

which belongs to the cache kmalloc-1k of size 1024

The buggy address is located 0 bytes inside of
freed 1024-byte region [ffff8880271a4000, ffff8880271a4400)

The buggy address belongs to the physical page:

page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x271a0
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801ac41dc0 ffffea0001c09800 dead000000000002
raw: 0000000000000000 0000000000100010 00000001f5000000 0000000000000000
head: 00fff00000000040 ffff88801ac41dc0 ffffea0001c09800 dead000000000002
head: 0000000000000000 0000000000100010 00000001f5000000 0000000000000000
head: 00fff00000000003 ffffea00009c6801 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000

page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 3, migratetype Unmovable, gfp_mask 0x252800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_THISNODE), pid 12, tgid 12 (kworker/u8:1), ts 7179124429, free_ts 0
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1558
prep_new_page mm/page_alloc.c:1566 [inline]
get_page_from_freelist+0x365c/0x37a0 mm/page_alloc.c:3476
__alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4753
__alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
alloc_slab_page+0x59/0x110 mm/slub.c:2425
allocate_slab+0x5a/0x2b0 mm/slub.c:2589
new_slab mm/slub.c:2642 [inline]
___slab_alloc+0xc27/0x14a0 mm/slub.c:3830
__slab_alloc+0x58/0xa0 mm/slub.c:3920
__slab_alloc_node mm/slub.c:3995 [inline]
slab_alloc_node mm/slub.c:4156 [inline]
__kmalloc_cache_node_noprof+0x294/0x3a0 mm/slub.c:4337
kmalloc_node_noprof include/linux/slab.h:924 [inline]
blk_mq_alloc_hctx block/blk-mq.c:3935 [inline]
blk_mq_alloc_and_init_hctx+0x17f/0xd50 block/blk-mq.c:4443
blk_mq_realloc_hw_ctxs+0x19c/0xb00 block/blk-mq.c:4476
blk_mq_init_allocated_queue+0x3f6/0x14c0 block/blk-mq.c:4530
blk_mq_alloc_queue+0x1d3/0x2f0 block/blk-mq.c:4343
scsi_alloc_sdev+0x76c/0xb80 drivers/scsi/scsi_scan.c:337
scsi_probe_and_add_lun+0x1d4/0x4bd0 drivers/scsi/scsi_scan.c:1210
__scsi_scan_target+0x205/0x1080 drivers/scsi/scsi_scan.c:1757
scsi_scan_channel drivers/scsi/scsi_scan.c:1845 [inline]
scsi_scan_host_selected+0x37e/0x690 drivers/scsi/scsi_scan.c:1874

page_owner free stack trace missing

Memory state around the buggy address:

ffff8880271a3f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8880271a3f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8880271a4000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880271a4080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880271a4100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

[Hillf Danton]

On Mon, 06 Jan 2025 01:04:23 -0800

> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: ab75170520d4 Merge tag 'linux-watchdog-6.13-rc6' of git://..
> git tree: upstream

> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17fa36f8580000

#syz test

--- xnet/bluetooth/l2cap_core.c
+++ ynet/bluetooth/l2cap_core.c
@@ -1747,6 +1747,8 @@ static void l2cap_unregister_all_users(s
}
}

+static DEFINE_SPINLOCK(l2cap_conn_del_lock);
+
static void l2cap_conn_del(struct hci_conn *hcon, int err)
{
struct l2cap_conn *conn = hcon->l2cap_data;
@@ -1797,7 +1799,9 @@ static void l2cap_conn_del(struct hci_co
if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
cancel_delayed_work_sync(&conn->info_timer);

+ spin_lock(&l2cap_conn_del_lock);
hcon->l2cap_data = NULL;
+ spin_unlock(&l2cap_conn_del_lock);
conn->hchan = NULL;
l2cap_conn_put(conn);
}
@@ -1819,6 +1823,8 @@ EXPORT_SYMBOL(l2cap_conn_get);

void l2cap_conn_put(struct l2cap_conn *conn)
{
+ if (!conn)
+ return;
kref_put(&conn->ref, l2cap_conn_free);
}
EXPORT_SYMBOL(l2cap_conn_put);
@@ -7477,6 +7483,13 @@ void l2cap_recv_acldata(struct hci_conn
if (!conn)
goto drop;

+ spin_lock(&l2cap_conn_del_lock);
+ conn = hcon->l2cap_data;
+ if (conn)
+ l2cap_conn_get(conn);
+ spin_unlock(&l2cap_conn_del_lock);
+ if (!conn)
+ goto drop;
BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags);

switch (flags) {
@@ -7503,6 +7516,7 @@ void l2cap_recv_acldata(struct hci_conn
if (len == skb->len) {
/* Complete frame received */
l2cap_recv_frame(conn, skb);
+ l2cap_conn_put(conn);
return;
}

@@ -7566,6 +7580,7 @@ void l2cap_recv_acldata(struct hci_conn
}

drop:
+ l2cap_conn_put(conn);
kfree_skb(skb);
}

--

[syzbot]

syzbot has bisected this issue to:

commit e7b02296fb400ee64822fbdd81a0718449066333
Author: Luiz Augusto von Dentz <luiz.vo...@intel.com>
Date: Thu Feb 1 16:18:58 2024 +0000

Bluetooth: Remove BT_HS

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=10665bc4580000
start commit: ab75170520d4 Merge tag 'linux-watchdog-6.13-rc6' of git://..
git tree: upstream
final oops: https://syzkaller.appspot.com/x/report.txt?x=12665bc4580000
console output: https://syzkaller.appspot.com/x/log.txt?x=14665bc4580000

kernel config: https://syzkaller.appspot.com/x/.config?x=1c541fa8af5c9cc7
dashboard link: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11261edf980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17fa36f8580000

Reported-by: syzbot+31c2f6...@syzkaller.appspotmail.com
Fixes: e7b02296fb40 ("Bluetooth: Remove BT_HS")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to apply patch:
can't find file to patch at input line 3
Perhaps you used the wrong -p or --strip option?
The text leading up to this was:
--------------------------
|--- xnet/bluetooth/l2cap_core.c
|+++ ynet/bluetooth/l2cap_core.c
--------------------------
No file to patch. Skipping patch.
6 out of 6 hunks ignored



Tested on:

commit: c45323b7 Merge tag 'mm-hotfixes-stable-2025-01-13-00-0..
git tree: upstream

kernel config: https://syzkaller.appspot.com/x/.config?x=1c541fa8af5c9cc7
dashboard link: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734

compiler:
patch: https://syzkaller.appspot.com/x/patch.diff?x=14e85bc4580000

[Hillf Danton]

On Mon, 06 Jan 2025 01:04:23 -0800

> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: ab75170520d4 Merge tag 'linux-watchdog-6.13-rc6' of git://..
> git tree: upstream

> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17fa36f8580000

#syz test

--- x/net/bluetooth/l2cap_core.c
+++ y/net/bluetooth/l2cap_core.c

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in hci_send_acl

Bluetooth: Wrong link type (-22)
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
CPU: 1 UID: 0 PID: 8192 Comm: kworker/u9:7 Not tainted 6.13.0-rc7-syzkaller-g619f0b6fad52-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Workqueue: hci5 hci_rx_work
RIP: 0010:hci_send_acl+0x3e/0xd00 net/bluetooth/hci_core.c:3232
Code: 00 89 54 24 04 49 89 f5 48 89 fb 49 bf 00 00 00 00 00 fc ff df e8 a2 93 e6 f6 48 89 5c 24 18 4c 8d 73 18 4c 89 f3 48 c1 eb 03 <42> 80 3c 3b 00 74 08 4c 89 f7 e8 c3 fd 4c f7 bd f8 0f 00 00 49 03
RSP: 0018:ffffc900057e72b8 EFLAGS: 00010206
RAX: ffffffff8ab8eece RBX: 0000000000000003 RCX: ffff8880304dbc00
RDX: 0000000000000000 RSI: ffff8880578f5c80 RDI: 0000000000000000
RBP: ffffc900057e7a98 R08: ffffffff8ac38d24 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed100dbd7003 R12: ffff88802d5c0f4b
R13: ffff8880578f5c80 R14: 0000000000000018 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c005688000 CR3: 0000000032a00000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5508 [inline]
l2cap_sig_channel net/bluetooth/l2cap_core.c:5544 [inline]
l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6823
l2cap_recv_acldata+0x51f/0x1530 net/bluetooth/l2cap_core.c:7518

hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline]
hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040

process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317
worker_thread+0x870/0xd30 kernel/workqueue.c:3398

kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>

Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:hci_send_acl+0x3e/0xd00 net/bluetooth/hci_core.c:3232
Code: 00 89 54 24 04 49 89 f5 48 89 fb 49 bf 00 00 00 00 00 fc ff df e8 a2 93 e6 f6 48 89 5c 24 18 4c 8d 73 18 4c 89 f3 48 c1 eb 03 <42> 80 3c 3b 00 74 08 4c 89 f7 e8 c3 fd 4c f7 bd f8 0f 00 00 49 03
RSP: 0018:ffffc900057e72b8 EFLAGS: 00010206
RAX: ffffffff8ab8eece RBX: 0000000000000003 RCX: ffff8880304dbc00
RDX: 0000000000000000 RSI: ffff8880578f5c80 RDI: 0000000000000000
RBP: ffffc900057e7a98 R08: ffffffff8ac38d24 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed100dbd7003 R12: ffff88802d5c0f4b
R13: ffff8880578f5c80 R14: 0000000000000018 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c005688000 CR3: 000000000e736000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 00 89 54 24 04 49 add %cl,0x49042454(%rcx)
6: 89 f5 mov %esi,%ebp
8: 48 89 fb mov %rdi,%rbx
b: 49 bf 00 00 00 00 00 movabs $0xdffffc0000000000,%r15
12: fc ff df
15: e8 a2 93 e6 f6 call 0xf6e693bc
1a: 48 89 5c 24 18 mov %rbx,0x18(%rsp)
1f: 4c 8d 73 18 lea 0x18(%rbx),%r14
23: 4c 89 f3 mov %r14,%rbx
26: 48 c1 eb 03 shr $0x3,%rbx
* 2a: 42 80 3c 3b 00 cmpb $0x0,(%rbx,%r15,1) <-- trapping instruction
2f: 74 08 je 0x39
31: 4c 89 f7 mov %r14,%rdi
34: e8 c3 fd 4c f7 call 0xf74cfdfc
39: bd f8 0f 00 00 mov $0xff8,%ebp
3e: 49 rex.WB
3f: 03 .byte 0x3


Tested on:

commit: 619f0b6f Merge tag 'seccomp-v6.13-rc8' of git://git.ke..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=145ebcb0580000
kernel config: https://syzkaller.appspot.com/x/.config?x=aadf89e2f6db86cc
dashboard link: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734

compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=1276bcb0580000

[Edward Adam Davis]

#syz test: https://github.com/ea1davis/linux bthci/syz

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+31c2f6...@syzkaller.appspotmail.com
Tested-by: syzbot+31c2f6...@syzkaller.appspotmail.com

Tested on:

commit: a9b74d57 Bluetooth: hci_core: sync hci_rx_work and hci..
git tree: https://github.com/ea1davis/linux bthci/syz
console output: https://syzkaller.appspot.com/x/log.txt?x=133057c4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=82d76f5a1a8b5c36

dashboard link: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

Note: no patches were applied.
Note: testing is done by a robot and is best-effort only.

[Edward Adam Davis]

syzbot reported a slab-use-after-free Read in l2cap_send_cmd. [1]

After the hci sync command releases l2cap_conn, the hci receive data work
queue references the released l2cap_conn when sending to the upper layer.
Add hci dev lock to the hci receive data work queue to synchronize the two.

[1]

Reported-by: syzbot+31c2f6...@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734
Tested-by: syzbot+31c2f6...@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <ead...@qq.com>
---
net/bluetooth/hci_core.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index f9e19f9cb5a3..88c8aa37eb64 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -3798,7 +3798,9 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);

/* Send to upper protocol */
+ hci_dev_lock(hdev);
l2cap_recv_acldata(conn, skb, flags);
+ hci_dev_unlock(hdev);
return;
} else {
bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
--
2.47.0

[Hillf Danton]

On Mon, 06 Jan 2025 01:04:23 -0800

> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: ab75170520d4 Merge tag 'linux-watchdog-6.13-rc6' of git://..
> git tree: upstream

> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17fa36f8580000

#syz test

--- x/net/bluetooth/l2cap_core.c
+++ y/net/bluetooth/l2cap_core.c
@@ -1747,6 +1747,8 @@ static void l2cap_unregister_all_users(s
}
}

+static DEFINE_MUTEX(l2cap_conn_del_lock);

+
static void l2cap_conn_del(struct hci_conn *hcon, int err)
{
struct l2cap_conn *conn = hcon->l2cap_data;

@@ -1797,8 +1799,10 @@ static void l2cap_conn_del(struct hci_co

if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
cancel_delayed_work_sync(&conn->info_timer);

+ mutex_lock(&l2cap_conn_del_lock);
hcon->l2cap_data = NULL;
conn->hchan = NULL;
+ mutex_unlock(&l2cap_conn_del_lock);
l2cap_conn_put(conn);
}

@@ -7470,6 +7474,7 @@ void l2cap_recv_acldata(struct hci_conn

{
struct l2cap_conn *conn = hcon->l2cap_data;

int len;
+ int locked = 0;

if (!conn)
conn = l2cap_conn_add(hcon);
@@ -7477,6 +7482,11 @@ void l2cap_recv_acldata(struct hci_conn
if (!conn)
goto drop;

+ mutex_lock(&l2cap_conn_del_lock);
+ locked = 1;

+ conn = hcon->l2cap_data;

+ if (!conn)
+ goto drop;
BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags);

switch (flags) {

@@ -7503,6 +7513,7 @@ void l2cap_recv_acldata(struct hci_conn

if (len == skb->len) {
/* Complete frame received */
l2cap_recv_frame(conn, skb);

+ mutex_unlock(&l2cap_conn_del_lock);
return;
}

@@ -7566,6 +7577,8 @@ void l2cap_recv_acldata(struct hci_conn
}

drop:
+ if (locked)
+ mutex_unlock(&l2cap_conn_del_lock);
kfree_skb(skb);
}

--

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

INFO: task hung in disable_work_sync

INFO: task syz-executor:13931 blocked for more than 143 seconds.
Not tainted 6.13.0-rc7-syzkaller-g619f0b6fad52-dirty #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor state:D stack:20544 pid:13931 tgid:13931 ppid:1 flags:0x00004006
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5369 [inline]
__schedule+0x1850/0x4c30 kernel/sched/core.c:6756
__schedule_loop kernel/sched/core.c:6833 [inline]
schedule+0x14b/0x320 kernel/sched/core.c:6848
schedule_timeout+0xb0/0x290 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:95 [inline]
__wait_for_common kernel/sched/completion.c:116 [inline]
wait_for_common kernel/sched/completion.c:127 [inline]
wait_for_completion+0x355/0x620 kernel/sched/completion.c:148
__flush_work+0xa47/0xc60 kernel/workqueue.c:4242
__cancel_work_sync kernel/workqueue.c:4362 [inline]
disable_work_sync+0xba/0xe0 kernel/workqueue.c:4473
hci_unregister_dev+0x149/0x510 net/bluetooth/hci_core.c:2687
vhci_release+0x80/0xd0 drivers/bluetooth/hci_vhci.c:664
__fput+0x23c/0xa50 fs/file_table.c:450
task_work_run+0x24f/0x310 kernel/task_work.c:239
exit_task_work include/linux/task_work.h:43 [inline]
do_exit+0xa2a/0x28e0 kernel/exit.c:938
do_group_exit+0x207/0x2c0 kernel/exit.c:1087
get_signal+0x16b2/0x1750 kernel/signal.c:3017
arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0xce/0x340 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1b7bf8453a
RSP: 002b:00007f1b7c29ecc8 EFLAGS: 00000286
ORIG_RAX: 0000000000000106
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f1b7bf8453a
RDX: 00007f1b7c29ecf0 RSI: 00007f1b7c29ed80 RDI: 00000000ffffff9c
RBP: 00007f1b7c29ed80 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000100 R11: 0000000000000286 R12: 00007f1b7c29fe00
R13: 00007f1b7c0018f4 R14: 00007f1b7c29fe40 R15: 0000000000000258
</TASK>
INFO: task syz-executor:14434 blocked for more than 144 seconds.
Not tainted 6.13.0-rc7-syzkaller-g619f0b6fad52-dirty #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor state:D
stack:19936 pid:14434 tgid:14434 ppid:1 flags:0x00004006
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5369 [inline]
__schedule+0x1850/0x4c30 kernel/sched/core.c:6756
__schedule_loop kernel/sched/core.c:6833 [inline]
schedule+0x14b/0x320 kernel/sched/core.c:6848
schedule_timeout+0xb0/0x290 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:95 [inline]
__wait_for_common kernel/sched/completion.c:116 [inline]
wait_for_common kernel/sched/completion.c:127 [inline]
wait_for_completion+0x355/0x620 kernel/sched/completion.c:148
__flush_work+0xa47/0xc60 kernel/workqueue.c:4242
__cancel_work_sync kernel/workqueue.c:4362 [inline]
disable_work_sync+0xba/0xe0 kernel/workqueue.c:4473
hci_unregister_dev+0x149/0x510 net/bluetooth/hci_core.c:2687
vhci_release+0x80/0xd0 drivers/bluetooth/hci_vhci.c:664
__fput+0x23c/0xa50 fs/file_table.c:450
task_work_run+0x24f/0x310 kernel/task_work.c:239
exit_task_work include/linux/task_work.h:43 [inline]
do_exit+0xa2a/0x28e0 kernel/exit.c:938
do_group_exit+0x207/0x2c0 kernel/exit.c:1087
get_signal+0x16b2/0x1750 kernel/signal.c:3017
arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0xce/0x340 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f9b86587a6a
RSP: 002b:00007f9b8689f6c8 EFLAGS: 00000212
ORIG_RAX: 0000000000000037
RAX: 0000000000000000 RBX: 00007f9b8689f750 RCX: 00007f9b86587a6a
RDX: 0000000000000041 RSI: 0000000000000029 RDI: 0000000000000003
RBP: 0000000000000003 R08: 00007f9b8689f6ec R09: 0079746972756365
R10: 00007f9b8689f750 R11: 0000000000000212 R12: 00007f9b86746c80
R13: 00007f9b8689f6ec R14: 0000000000000000 R15: 00007f9b86748e40
</TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/30:
#0:
ffffffff8e937ae0 (rcu_read_lock
){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
){....}-{1:3}, at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6744
3 locks held by kworker/u9:0/54:
#0: ffff88805dbaa148
((wq_completion)hci3#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline]
((wq_completion)hci3#2){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1840 kernel/workqueue.c:3317
#1: ffffc90000be7d00
((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline]
((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1840 kernel/workqueue.c:3317
#2:
ffffffff8fe23c88
(l2cap_conn_del_lock){+.+.}-{4:4}, at: l2cap_recv_acldata+0x79/0x1300 net/bluetooth/l2cap_core.c:7485
3 locks held by kworker/u9:1/5146:
#0:
ffff8880298ad148
(
(wq_completion)hci10#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline]
(wq_completion)hci10#2){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1840 kernel/workqueue.c:3317
#1: ffffc9000ecc7d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}
, at: process_one_work kernel/workqueue.c:3212 [inline]
, at: process_scheduled_works+0x976/0x1840 kernel/workqueue.c:3317
#2: ffffffff8fe23c88 (l2cap_conn_del_lock){+.+.}-{4:4}, at: l2cap_recv_acldata+0x79/0x1300 net/bluetooth/l2cap_core.c:7485
2 locks held by getty/5588:
#0: ffff88803160e0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc90002fde2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x6a6/0x1e00 drivers/tty/n_tty.c:2211
3 locks held by kworker/u9:4/6605:
#0:
ffff88807a88d948
(
(wq_completion)hci5
#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline]
#2){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1840 kernel/workqueue.c:3317
#1: ffffc90003a17d00 ((work_completion)(&hdev->rx_work)
){+.+.}-{0:0}
, at: process_one_work kernel/workqueue.c:3212 [inline]
, at: process_scheduled_works+0x976/0x1840 kernel/workqueue.c:3317
#2: ffffffff8fe23c88 (l2cap_conn_del_lock){+.+.}-{4:4}, at: l2cap_recv_acldata+0x79/0x1300 net/bluetooth/l2cap_core.c:7485
3 locks held by kworker/u9:5/6607:
#0: ffff8880794e8148 (
(wq_completion)hci7#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline]
(wq_completion)hci7#2){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1840 kernel/workqueue.c:3317
#1:
ffffc90003967d00
((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline]
((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1840 kernel/workqueue.c:3317
#2:
ffffffff8fe23c88
(l2cap_conn_del_lock){+.+.}-{4:4}
, at: l2cap_recv_acldata+0x79/0x1300 net/bluetooth/l2cap_core.c:7485
3 locks held by kworker/u9:6/6609:
#0:
ffff88805b8a2148
(
(wq_completion)hci9
#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline]
#2){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1840 kernel/workqueue.c:3317
#1:
ffffc90003c87d00
(
(work_completion)(&hdev->rx_work)
){+.+.}-{0:0}
, at: process_one_work kernel/workqueue.c:3212 [inline]
, at: process_scheduled_works+0x976/0x1840 kernel/workqueue.c:3317
#2: ffffffff8fe23c88 (l2cap_conn_del_lock){+.+.}-{4:4}, at: l2cap_recv_acldata+0x79/0x1300 net/bluetooth/l2cap_core.c:7485
3 locks held by kworker/u9:7/6610:
#0:
ffff8880250d8148 ((wq_completion)hci1
#2
){+.+.}-{0:0}
, at: process_one_work kernel/workqueue.c:3211 [inline]
, at: process_scheduled_works+0x93b/0x1840 kernel/workqueue.c:3317
#1:
ffffc90003a87d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}
, at: process_one_work kernel/workqueue.c:3212 [inline]
, at: process_scheduled_works+0x976/0x1840 kernel/workqueue.c:3317
#2:
ffffffff8fe23c88
(l2cap_conn_del_lock){+.+.}-{4:4}
, at: l2cap_recv_acldata+0x79/0x1300 net/bluetooth/l2cap_core.c:7485
5 locks held by kworker/u9:8/14419:
3 locks held by kworker/u9:9/14841:
#0: ffff8880794ed948
((wq_completion)hci6#2){+.+.}-{0:0}
, at: process_one_work kernel/workqueue.c:3211 [inline]
, at: process_scheduled_works+0x93b/0x1840 kernel/workqueue.c:3317
#1:
ffffc9000c9f7d00
((work_completion)(&hdev->rx_work)
){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline]
){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1840 kernel/workqueue.c:3317
#2:
ffffffff8fe23c88
(l2cap_conn_del_lock
){+.+.}-{4:4}, at: l2cap_recv_acldata+0x79/0x1300 net/bluetooth/l2cap_core.c:7485
3 locks held by kworker/u9:11/15620:
#0: ffff88805dbae148
(
(wq_completion)hci4#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline]
(wq_completion)hci4#2){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1840 kernel/workqueue.c:3317
#1: ffffc9000cd17d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}
, at: process_one_work kernel/workqueue.c:3212 [inline]
, at: process_scheduled_works+0x976/0x1840 kernel/workqueue.c:3317
#2:
ffffffff8fe23c88
(
l2cap_conn_del_lock
){+.+.}-{4:4}, at: l2cap_recv_acldata+0x79/0x1300 net/bluetooth/l2cap_core.c:7485
3 locks held by kworker/u9:12/22957:
4 locks held by syz-executor920/22964:

=============================================

NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.13.0-rc7-syzkaller-g619f0b6fad52-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120

nmi_cpu_backtrace+0x49c/0x4d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:234 [inline]
watchdog+0xff6/0x1040 kernel/hung_task.c:397

kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>

Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 14419 Comm: kworker/u9:8 Not tainted 6.13.0-rc7-syzkaller-g619f0b6fad52-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Workqueue: hci8 hci_rx_work
RIP: 0010:io_serial_in+0x76/0xb0 drivers/tty/serial/8250/8250_port.c:409
Code: 10 2c 4f fc 89 e9 41 d3 e6 48 83 c3 40 48 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 31 96 b5 fc 44 03 33 44 89 f2 ec <0f> b6 c0 5b 41 5e 41 5f 5d c3 cc cc cc cc 89 e9 80 e1 07 38 c1 7c
RSP: 0018:ffffc9000dba6b98 EFLAGS: 00000002
RAX: 1ffffffff34de400 RBX: ffffffff9a6f27c0 RCX: 0000000000000000
RDX: 00000000000003fd RSI: 0000000000000000 RDI: 0000000000000020
RBP: 0000000000000000 R08: ffffffff85505656 R09: 1ffff11004a5c046
R10: dffffc0000000000 R11: ffffffff85505610 R12: dffffc0000000000
R13: ffffffff9a3ecf70 R14: 00000000000003fd R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 0000555578960788 CR3: 000000005b10e000 CR4: 00000000003526f0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:

<NMI>
</NMI>
<TASK>
serial_in drivers/tty/serial/8250/8250.h:137 [inline]
serial_lsr_in drivers/tty/serial/8250/8250.h:159 [inline]
wait_for_lsr drivers/tty/serial/8250/8250_port.c:2088 [inline]
serial8250_console_fifo_write drivers/tty/serial/8250/8250_port.c:3335 [inline]
serial8250_console_write+0x1373/0x1ed0 drivers/tty/serial/8250/8250_port.c:3413
console_emit_next_record kernel/printk/printk.c:3122 [inline]
console_flush_all+0x869/0xeb0 kernel/printk/printk.c:3210
__console_flush_and_unlock kernel/printk/printk.c:3269 [inline]
console_unlock+0x14f/0x3b0 kernel/printk/printk.c:3309
vprintk_emit+0x730/0xa10 kernel/printk/printk.c:2432
_printk+0xd5/0x120 kernel/printk/printk.c:2457
bt_err+0x127/0x180 net/bluetooth/lib.c:296
l2cap_sig_channel net/bluetooth/l2cap_core.c:5541 [inline]
l2cap_recv_frame+0x21ba/0x10db0 net/bluetooth/l2cap_core.c:6821
l2cap_recv_acldata+0x486/0x1300 net/bluetooth/l2cap_core.c:7515

hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline]
hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040

process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317
worker_thread+0x870/0xd30 kernel/workqueue.c:3398

kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>

Tested on:

commit: 619f0b6f Merge tag 'seccomp-v6.13-rc8' of git://git.ke..
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=12a5ce64580000
kernel config: https://syzkaller.appspot.com/x/.config?x=aadf89e2f6db86cc

dashboard link: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=11b789df980000

[Luiz Augusto von Dentz]

Hi Edward,

This will not gonna fly, there have been instances where l2cap code
needs to lock hdev so this most likely causes a deadlock, besides we
used to have such design of locking hdev for everything but that
doesn't scale very well.

Instead, perhaps we can do something like the following:

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 27b4c4a2ba1f..023e3ebe0e39 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -7466,6 +7466,16 @@ static void l2cap_recv_reset(struct l2cap_conn *conn)
conn->rx_len = 0;
}

+static struct l2cap_conn *l2cap_conn_hold_unless_zero(struct l2cap_conn *c)
+{
+ BT_DBG("conn %p orig refcnt %u", c, kref_read(&c->ref));
+
+ if (!kref_get_unless_zero(&c->ref))
+ return NULL;
+
+ return c;
+}
+
void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)

{
struct l2cap_conn *conn = hcon->l2cap_data;

@@ -7474,6 +7484,7 @@ void l2cap_recv_acldata(struct hci_conn *hcon,
struct sk_buff *skb, u16 flags)

if (!conn)
conn = l2cap_conn_add(hcon);

+ conn = l2cap_conn_hold_unless_zero(conn);
if (!conn)
goto drop;

@@ -7565,6 +7576,8 @@ void l2cap_recv_acldata(struct hci_conn *hcon,
struct sk_buff *skb, u16 flags)
break;
}

+ l2cap_conn_put(conn);
+
drop:
kfree_skb(skb);

}

> return;
> } else {
> bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
> --
> 2.47.0
>

--
Luiz Augusto von Dentz

[Hillf Danton]

On Wed, 15 Jan 2025 11:13:00 -0500 Luiz Augusto von Dentz <luiz....@gmail.com>

This does not work because conn can be freed before bumping refcnt up,
and bumpup alone does not help l2cap_send_cmd() in case conn->hchan has been
cleared in l2cap_conn_del().

[Luiz Augusto von Dentz]

Hi Hillf,

Well then perhaps we can use hdev lock just to protect l2cap_data:

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 27b4c4a2ba1f..00ef61609d49 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -7466,14 +7466,33 @@ static void l2cap_recv_reset(struct l2cap_conn *conn)

conn->rx_len = 0;
}

+static struct l2cap_conn *l2cap_conn_hold_unless_zero(struct l2cap_conn *c)
+{
+ BT_DBG("conn %p orig refcnt %u", c, kref_read(&c->ref));
+
+ if (!kref_get_unless_zero(&c->ref))
+ return NULL;
+
+ return c;
+}
+
void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
{

- struct l2cap_conn *conn = hcon->l2cap_data;
+ struct l2cap_conn *conn;
int len;

+ /* Lock hdev to access l2cap_data to avoid race with l2cap_conn_del */
+ hci_dev_lock(hcon->hdev);
+

+ conn = hcon->l2cap_data;
+

if (!conn)
conn = l2cap_conn_add(hcon);

+ conn = l2cap_conn_hold_unless_zero(conn);

+
+ hci_dev_unlock(hcon->hdev);
+
if (!conn)
goto drop;

@@ -7565,6 +7584,8 @@ void l2cap_recv_acldata(struct hci_conn *hcon,

struct sk_buff *skb, u16 flags)
break;
}

+ l2cap_conn_put(conn);
+
drop:
kfree_skb(skb);
}

>
> > if (!conn)
> > goto drop;
> >
> > @@ -7565,6 +7576,8 @@ void l2cap_recv_acldata(struct hci_conn *hcon,
> > struct sk_buff *skb, u16 flags)
> > break;
> > }
> >
> > + l2cap_conn_put(conn);
> > +
> > drop:
> > kfree_skb(skb);
> > }
> >
> > > return;
> > > } else {
> > > bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
> > > --
> > > 2.47.0

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.

***

Subject: Re: [PATCH v1] Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd
Author: luiz....@gmail.com

#syz test

On Thu, Jan 16, 2025 at 10:36 AM Luiz Augusto von Dentz
<luiz....@gmail.com> wrote:

>
> From: Luiz Augusto von Dentz <luiz.vo...@intel.com>
>
> After the hci sync command releases l2cap_conn, the hci receive data work
> queue references the released l2cap_conn when sending to the upper layer.
> Add hci dev lock to the hci receive data work queue to synchronize the two.
>
> [1]
> BUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954
> Read of size 8 at addr ffff8880271a4000 by task kworker/u9:2/5837
>

> CPU: 0 UID: 0 PID: 5837 Comm: kworker/u9:2 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
> Workqueue: hci1 hci_rx_work
> Call Trace:
> <TASK>

> __dump_stack lib/dump_stack.c:94 [inline]
> dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
> print_address_description mm/kasan/report.c:378 [inline]
> print_report+0x169/0x550 mm/kasan/report.c:489
> kasan_report+0x143/0x180 mm/kasan/report.c:602
> l2cap_build_cmd net/bluetooth/l2cap_core.c:2964 [inline]
> l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954
> l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline]
> l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline]
> l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817
> hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline]
> hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040
> process_one_work kernel/workqueue.c:3229 [inline]
> process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> worker_thread+0x870/0xd30 kernel/workqueue.c:3391
> kthread+0x2f0/0x390 kernel/kthread.c:389
> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> </TASK>
>
> Allocated by task 5837:

> kasan_save_stack mm/kasan/common.c:47 [inline]
> kasan_save_track+0x3f/0x80 mm/kasan/common.c:68

> poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
> __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
> kasan_kmalloc include/linux/kasan.h:260 [inline]
> __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329
> kmalloc_noprof include/linux/slab.h:901 [inline]
> kzalloc_noprof include/linux/slab.h:1037 [inline]
> l2cap_conn_add+0xa9/0x8e0 net/bluetooth/l2cap_core.c:6860
> l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7239
> hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
> hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726
> hci_event_func net/bluetooth/hci_event.c:7473 [inline]
> hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525
> hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035
> process_one_work kernel/workqueue.c:3229 [inline]
> process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> worker_thread+0x870/0xd30 kernel/workqueue.c:3391
> kthread+0x2f0/0x390 kernel/kthread.c:389
> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
>
> Freed by task 54:

> kasan_save_stack mm/kasan/common.c:47 [inline]
> kasan_save_track+0x3f/0x80 mm/kasan/common.c:68

> kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582
> poison_slab_object mm/kasan/common.c:247 [inline]
> __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
> kasan_slab_free include/linux/kasan.h:233 [inline]
> slab_free_hook mm/slub.c:2353 [inline]
> slab_free mm/slub.c:4613 [inline]
> kfree+0x196/0x430 mm/slub.c:4761
> l2cap_connect_cfm+0xcc/0x1090 net/bluetooth/l2cap_core.c:7235
> hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
> hci_conn_failed+0x287/0x400 net/bluetooth/hci_conn.c:1266
> hci_abort_conn_sync+0x56c/0x11f0 net/bluetooth/hci_sync.c:5603
> hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332
> process_one_work kernel/workqueue.c:3229 [inline]
> process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> worker_thread+0x870/0xd30 kernel/workqueue.c:3391
> kthread+0x2f0/0x390 kernel/kthread.c:389
> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
>
> Reported-by: syzbot+31c2f6...@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734
> Tested-by: syzbot+31c2f6...@syzkaller.appspotmail.com
> Signed-off-by: Edward Adam Davis <ead...@qq.com>

> Signed-off-by: Luiz Augusto von Dentz <luiz.vo...@intel.com>
> ---
> net/bluetooth/l2cap_core.c | 23 ++++++++++++++++++++++-
> 1 file changed, 22 insertions(+), 1 deletion(-)

> --
> 2.47.1

[Hillf Danton]

On Thu, 16 Jan 2025 10:31:03 -0500 Luiz Augusto von Dentz

This does not work either because after releasing lock bumpup alone can
not prevent conn->hchan from being cleared.

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

general protection fault in hci_send_acl

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]

CPU: 0 UID: 0 PID: 6555 Comm: kworker/u9:3 Not tainted 6.13.0-rc7-syzkaller-00102-gce69b4019001-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Workqueue: hci3 hci_rx_work

RIP: 0010:hci_send_acl+0x3e/0xd00 net/bluetooth/hci_core.c:3232

Code: 00 89 54 24 04 49 89 f5 48 89 fb 49 bf 00 00 00 00 00 fc ff df e8 e2 91 e6 f6 48 89 5c 24 18 4c 8d 73 18 4c 89 f3 48 c1 eb 03 <42> 80 3c 3b 00 74 08 4c 89 f7 e8 03 fc 4c f7 bd f8 0f 00 00 49 03
RSP: 0018:ffffc90003627238 EFLAGS: 00010206
RAX: ffffffff8ab8f08e RBX: 0000000000000003 RCX: ffff88802f890000
RDX: 0000000000000000 RSI: ffff888029522b40 RDI: 0000000000000000
RBP: ffffc90003627a10 R08: ffffffff8ac38ee4 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed100e8028c3 R12: ffff888031548629
R13: ffff888029522b40 R14: 0000000000000018 R15: dffffc0000000000

FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007f2c547452d8 CR3: 000000000e736000 CR4: 00000000003526f0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:

<TASK>

l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline]
l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline]
l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817

l2cap_recv_acldata+0x700/0x1a50 net/bluetooth/l2cap_core.c:7524

hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline]
hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040

process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317
worker_thread+0x870/0xd30 kernel/workqueue.c:3398

kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>

Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:hci_send_acl+0x3e/0xd00 net/bluetooth/hci_core.c:3232

Code: 00 89 54 24 04 49 89 f5 48 89 fb 49 bf 00 00 00 00 00 fc ff df e8 e2 91 e6 f6 48 89 5c 24 18 4c 8d 73 18 4c 89 f3 48 c1 eb 03 <42> 80 3c 3b 00 74 08 4c 89 f7 e8 03 fc 4c f7 bd f8 0f 00 00 49 03
RSP: 0018:ffffc90003627238 EFLAGS: 00010206
RAX: ffffffff8ab8f08e RBX: 0000000000000003 RCX: ffff88802f890000
RDX: 0000000000000000 RSI: ffff888029522b40 RDI: 0000000000000000
RBP: ffffc90003627a10 R08: ffffffff8ac38ee4 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed100e8028c3 R12: ffff888031548629
R13: ffff888029522b40 R14: 0000000000000018 R15: dffffc0000000000

FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 0000564e8bb3fdc8 CR3: 000000000e736000 CR4: 00000000003526f0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

----------------
Code disassembly (best guess):
0: 00 89 54 24 04 49 add %cl,0x49042454(%rcx)
6: 89 f5 mov %esi,%ebp
8: 48 89 fb mov %rdi,%rbx
b: 49 bf 00 00 00 00 00 movabs $0xdffffc0000000000,%r15
12: fc ff df

15: e8 e2 91 e6 f6 call 0xf6e691fc

1a: 48 89 5c 24 18 mov %rbx,0x18(%rsp)
1f: 4c 8d 73 18 lea 0x18(%rbx),%r14
23: 4c 89 f3 mov %r14,%rbx
26: 48 c1 eb 03 shr $0x3,%rbx
* 2a: 42 80 3c 3b 00 cmpb $0x0,(%rbx,%r15,1) <-- trapping instruction
2f: 74 08 je 0x39
31: 4c 89 f7 mov %r14,%rdi

34: e8 03 fc 4c f7 call 0xf74cfc3c

39: bd f8 0f 00 00 mov $0xff8,%ebp
3e: 49 rex.WB
3f: 03 .byte 0x3


Tested on:

commit: ce69b401 Merge tag 'net-6.13-rc8' of git://git.kernel...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=10e782b0580000

kernel config: https://syzkaller.appspot.com/x/.config?x=aadf89e2f6db86cc
dashboard link: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=154721f8580000

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.

***

Subject: Re: [PATCH v2] Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd
Author: luiz....@gmail.com

#syz test

On Fri, Jan 17, 2025 at 10:56 AM Luiz Augusto von Dentz

<luiz....@gmail.com> wrote:
>
> From: Luiz Augusto von Dentz <luiz.vo...@intel.com>
>
> After the hci sync command releases l2cap_conn, the hci receive data work
> queue references the released l2cap_conn when sending to the upper layer.
> Add hci dev lock to the hci receive data work queue to synchronize the two.
>
> [1]
> BUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954
> Read of size 8 at addr ffff8880271a4000 by task kworker/u9:2/5837
>

> CPU: 0 UID: 0 PID: 5837 Comm: kworker/u9:2 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
> Workqueue: hci1 hci_rx_work
> Call Trace:
> <TASK>

> __dump_stack lib/dump_stack.c:94 [inline]
> dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
> print_address_description mm/kasan/report.c:378 [inline]
> print_report+0x169/0x550 mm/kasan/report.c:489
> kasan_report+0x143/0x180 mm/kasan/report.c:602
> l2cap_build_cmd net/bluetooth/l2cap_core.c:2964 [inline]
> l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954

> l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline]
> l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline]
> l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817

> hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline]
> hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040

> process_one_work kernel/workqueue.c:3229 [inline]
> process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> worker_thread+0x870/0xd30 kernel/workqueue.c:3391

> kthread+0x2f0/0x390 kernel/kthread.c:389
> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> </TASK>
>

> Allocated by task 5837:

> kasan_save_stack mm/kasan/common.c:47 [inline]
> kasan_save_track+0x3f/0x80 mm/kasan/common.c:68

> poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
> __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
> kasan_kmalloc include/linux/kasan.h:260 [inline]
> __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329
> kmalloc_noprof include/linux/slab.h:901 [inline]
> kzalloc_noprof include/linux/slab.h:1037 [inline]
> l2cap_conn_add+0xa9/0x8e0 net/bluetooth/l2cap_core.c:6860
> l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7239
> hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
> hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726
> hci_event_func net/bluetooth/hci_event.c:7473 [inline]
> hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525
> hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035
> process_one_work kernel/workqueue.c:3229 [inline]
> process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> worker_thread+0x870/0xd30 kernel/workqueue.c:3391

> kthread+0x2f0/0x390 kernel/kthread.c:389
> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
>

> Freed by task 54:

> kasan_save_stack mm/kasan/common.c:47 [inline]
> kasan_save_track+0x3f/0x80 mm/kasan/common.c:68

> kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582
> poison_slab_object mm/kasan/common.c:247 [inline]
> __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
> kasan_slab_free include/linux/kasan.h:233 [inline]
> slab_free_hook mm/slub.c:2353 [inline]
> slab_free mm/slub.c:4613 [inline]
> kfree+0x196/0x430 mm/slub.c:4761
> l2cap_connect_cfm+0xcc/0x1090 net/bluetooth/l2cap_core.c:7235
> hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
> hci_conn_failed+0x287/0x400 net/bluetooth/hci_conn.c:1266
> hci_abort_conn_sync+0x56c/0x11f0 net/bluetooth/hci_sync.c:5603
> hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332
> process_one_work kernel/workqueue.c:3229 [inline]
> process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> worker_thread+0x870/0xd30 kernel/workqueue.c:3391

> kthread+0x2f0/0x390 kernel/kthread.c:389
> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
>

> Reported-by: syzbot+31c2f6...@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734
> Tested-by: syzbot+31c2f6...@syzkaller.appspotmail.com
> Signed-off-by: Edward Adam Davis <ead...@qq.com>
> Signed-off-by: Luiz Augusto von Dentz <luiz.vo...@intel.com>
> ---

> net/bluetooth/l2cap_core.c | 38 ++++++++++++++++++++++++++++++++++++--
> 1 file changed, 36 insertions(+), 2 deletions(-)
>
> diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> index 27b4c4a2ba1f..025bb038e304 100644
> --- a/net/bluetooth/l2cap_core.c
> +++ b/net/bluetooth/l2cap_core.c
> @@ -951,11 +951,18 @@ static u8 l2cap_get_ident(struct l2cap_conn *conn)
> static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
> void *data)
> {
> - struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
> + struct sk_buff *skb;
> u8 flags;
>
> + /* Check if HCI_CONN_DROP has been set since it means hci_chan_del has
> + * been called.
> + */
> + if (test_bit(HCI_CONN_DROP, &conn->hcon->flags))
> + return;
> +
> BT_DBG("code 0x%2.2x", code);
>
> + skb = l2cap_build_cmd(conn, code, ident, len, data);
> if (!skb)
> return;
>
> @@ -6785,6 +6792,12 @@ static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
> u16 cid, len;
> __le16 psm;
>
> + /* Check if hcon has been dropped then drop its packets as well */
> + if (test_bit(HCI_CONN_DROP, &hcon->flags)) {
> + kfree_skb(skb);
> + return;
> + }
> +
> if (hcon->state != BT_CONNECTED) {
> BT_DBG("queueing pending rx skb");
> skb_queue_tail(&conn->pending_rx, skb);
> @@ -7466,14 +7479,33 @@ static void l2cap_recv_reset(struct l2cap_conn *conn)

> if (!conn)
> goto drop;
>
> @@ -7565,6 +7597,8 @@ void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

general protection fault in l2cap_send_cmd

Bluetooth: Wrong link type (-22)

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000064: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000320-0x0000000000000327]
CPU: 0 UID: 0 PID: 8403 Comm: kworker/u9:10 Not tainted 6.13.0-rc7-syzkaller-g9bffa1ad25b8 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Workqueue: hci4 hci_rx_work

RIP: 0010:l2cap_send_cmd+0x563/0x8d0 net/bluetooth/l2cap_core.c:964
Code: fc ff df 80 3c 08 00 74 08 48 89 df e8 f6 54 42 f7 bd 22 03 00 00 48 03 2b 48 89 e8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 11 01 00 00 0f b6 5d 00 89 de 83 e6 40 31
RSP: 0018:ffffc9000557f378 EFLAGS: 00010202

RAX: 0000000000000064 RBX: ffff88801eb23c78 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff888034724000
RBP: 0000000000000322 R08: ffffffff8ac395c4 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed100f588363 R12: ffff888034724000
R13: ffff888034724010 R14: ffff88801eb22c80 R15: ffff888063932140

FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 000055558b7da5c8 CR3: 000000002974a000 CR4: 00000000003526f0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>

l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline]
l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline]
l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817
hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline]
hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040

process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317
worker_thread+0x870/0xd30 kernel/workqueue.c:3398

kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>

Modules linked in:
---[ end trace 0000000000000000 ]---

RIP: 0010:l2cap_send_cmd+0x563/0x8d0 net/bluetooth/l2cap_core.c:964
Code: fc ff df 80 3c 08 00 74 08 48 89 df e8 f6 54 42 f7 bd 22 03 00 00 48 03 2b 48 89 e8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 11 01 00 00 0f b6 5d 00 89 de 83 e6 40 31
RSP: 0018:ffffc9000557f378 EFLAGS: 00010202

RAX: 0000000000000064 RBX: ffff88801eb23c78 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff888034724000
----------------
Code disassembly (best guess), 2 bytes skipped:
0: df 80 3c 08 00 74 filds 0x7400083c(%rax)
6: 08 48 89 or %cl,-0x77(%rax)
9: df e8 fucomip %st(0),%st
b: f6 54 42 f7 notb -0x9(%rdx,%rax,2)
f: bd 22 03 00 00 mov $0x322,%ebp
14: 48 03 2b add (%rbx),%rbp
17: 48 89 e8 mov %rbp,%rax
1a: 48 c1 e8 03 shr $0x3,%rax
1e: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx
25: fc ff df
* 28: 0f b6 04 08 movzbl (%rax,%rcx,1),%eax <-- trapping instruction
2c: 84 c0 test %al,%al
2e: 0f 85 11 01 00 00 jne 0x145
34: 0f b6 5d 00 movzbl 0x0(%rbp),%ebx
38: 89 de mov %ebx,%esi
3a: 83 e6 40 and $0x40,%esi
3d: 31 .byte 0x31


Tested on:

commit: 9bffa1ad Merge tag 'drm-fixes-2025-01-17' of https://g..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16139fc4580000

kernel config: https://syzkaller.appspot.com/x/.config?x=aadf89e2f6db86cc
dashboard link: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.

***

Subject: Re: [PATCH v3] Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd
Author: luiz....@gmail.com

#syz test

On Fri, Jan 17, 2025 at 12:14 PM Luiz Augusto von Dentz

<luiz....@gmail.com> wrote:
>
> From: Luiz Augusto von Dentz <luiz.vo...@intel.com>
>
> After the hci sync command releases l2cap_conn, the hci receive data work
> queue references the released l2cap_conn when sending to the upper layer.
> Add hci dev lock to the hci receive data work queue to synchronize the two.
>
> [1]
> BUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954
> Read of size 8 at addr ffff8880271a4000 by task kworker/u9:2/5837
>

> CPU: 0 UID: 0 PID: 5837 Comm: kworker/u9:2 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
> Workqueue: hci1 hci_rx_work
> Call Trace:
> <TASK>

> __dump_stack lib/dump_stack.c:94 [inline]
> dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
> print_address_description mm/kasan/report.c:378 [inline]
> print_report+0x169/0x550 mm/kasan/report.c:489
> kasan_report+0x143/0x180 mm/kasan/report.c:602
> l2cap_build_cmd net/bluetooth/l2cap_core.c:2964 [inline]
> l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954

> l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline]
> l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline]
> l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817
> hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline]
> hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040

> process_one_work kernel/workqueue.c:3229 [inline]
> process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> worker_thread+0x870/0xd30 kernel/workqueue.c:3391

> kthread+0x2f0/0x390 kernel/kthread.c:389
> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> </TASK>
>

> Allocated by task 5837:

> kasan_save_stack mm/kasan/common.c:47 [inline]
> kasan_save_track+0x3f/0x80 mm/kasan/common.c:68

> poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
> __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
> kasan_kmalloc include/linux/kasan.h:260 [inline]
> __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329
> kmalloc_noprof include/linux/slab.h:901 [inline]
> kzalloc_noprof include/linux/slab.h:1037 [inline]
> l2cap_conn_add+0xa9/0x8e0 net/bluetooth/l2cap_core.c:6860
> l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7239
> hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
> hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726
> hci_event_func net/bluetooth/hci_event.c:7473 [inline]
> hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525
> hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035
> process_one_work kernel/workqueue.c:3229 [inline]
> process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> worker_thread+0x870/0xd30 kernel/workqueue.c:3391

> kthread+0x2f0/0x390 kernel/kthread.c:389
> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
>

> Freed by task 54:

> kasan_save_stack mm/kasan/common.c:47 [inline]
> kasan_save_track+0x3f/0x80 mm/kasan/common.c:68

> kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582
> poison_slab_object mm/kasan/common.c:247 [inline]
> __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
> kasan_slab_free include/linux/kasan.h:233 [inline]
> slab_free_hook mm/slub.c:2353 [inline]
> slab_free mm/slub.c:4613 [inline]
> kfree+0x196/0x430 mm/slub.c:4761
> l2cap_connect_cfm+0xcc/0x1090 net/bluetooth/l2cap_core.c:7235
> hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
> hci_conn_failed+0x287/0x400 net/bluetooth/hci_conn.c:1266
> hci_abort_conn_sync+0x56c/0x11f0 net/bluetooth/hci_sync.c:5603
> hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332
> process_one_work kernel/workqueue.c:3229 [inline]
> process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> worker_thread+0x870/0xd30 kernel/workqueue.c:3391

> kthread+0x2f0/0x390 kernel/kthread.c:389
> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
>

> Reported-by: syzbot+31c2f6...@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734
> Tested-by: syzbot+31c2f6...@syzkaller.appspotmail.com
> Signed-off-by: Edward Adam Davis <ead...@qq.com>
> Signed-off-by: Luiz Augusto von Dentz <luiz.vo...@intel.com>
> ---
> net/bluetooth/l2cap_core.c | 38 ++++++++++++++++++++++++++++++++++++--
> 1 file changed, 36 insertions(+), 2 deletions(-)
>
> diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c

> index 27b4c4a2ba1f..cf3597682011 100644

> --- a/net/bluetooth/l2cap_core.c
> +++ b/net/bluetooth/l2cap_core.c
> @@ -951,11 +951,18 @@ static u8 l2cap_get_ident(struct l2cap_conn *conn)
> static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
> void *data)
> {
> - struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
> + struct sk_buff *skb;
> u8 flags;
>

> + /* Check if hchan has been dropped since it means hci_chan_del has

> + * been called.
> + */

> + if (!conn->hchan)

> + return;
> +
> BT_DBG("code 0x%2.2x", code);
>
> + skb = l2cap_build_cmd(conn, code, ident, len, data);
> if (!skb)
> return;
>
> @@ -6785,6 +6792,12 @@ static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
> u16 cid, len;
> __le16 psm;
>

> + /* Check if hchan has been dropped then drop any packets as well */
> + if (!conn->hchan) {

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

KASAN: slab-use-after-free Read in l2cap_send_cmd

Bluetooth: Wrong link type (-22)

==================================================================
BUG: KASAN: slab-use-after-free in l2cap_build_cmd net/bluetooth/l2cap_core.c:2951 [inline]
BUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x67b/0x8d0 net/bluetooth/l2cap_core.c:954
Read of size 4 at addr ffff88805bd45810 by task kworker/u9:8/6565

CPU: 1 UID: 0 PID: 6565 Comm: kworker/u9:8 Not tainted 6.13.0-rc7-syzkaller-gad26fc09dabf #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Workqueue: hci5 hci_rx_work

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x169/0x550 mm/kasan/report.c:489
kasan_report+0x143/0x180 mm/kasan/report.c:602

l2cap_build_cmd net/bluetooth/l2cap_core.c:2951 [inline]
l2cap_send_cmd+0x67b/0x8d0 net/bluetooth/l2cap_core.c:954

l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline]
l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline]
l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817
hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline]
hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040

process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317
worker_thread+0x870/0xd30 kernel/workqueue.c:3398

kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>

Allocated by task 6556:

kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329
kmalloc_noprof include/linux/slab.h:901 [inline]
kzalloc_noprof include/linux/slab.h:1037 [inline]
l2cap_conn_add+0xa9/0x8e0 net/bluetooth/l2cap_core.c:6860
l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7239
hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726
hci_event_func net/bluetooth/hci_event.c:7473 [inline]
hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525
hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035

process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317
worker_thread+0x870/0xd30 kernel/workqueue.c:3398

kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Freed by task 6556:

kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2353 [inline]
slab_free mm/slub.c:4613 [inline]
kfree+0x196/0x430 mm/slub.c:4761
l2cap_connect_cfm+0xcc/0x1090 net/bluetooth/l2cap_core.c:7235
hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
hci_conn_failed+0x287/0x400 net/bluetooth/hci_conn.c:1266

hci_abort_conn_sync+0x56c/0x11f0 net/bluetooth/hci_sync.c:5604
hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332

process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317
worker_thread+0x870/0xd30 kernel/workqueue.c:3398

kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726
hci_event_func net/bluetooth/hci_event.c:7473 [inline]
hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525
hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035

process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317
worker_thread+0x870/0xd30 kernel/workqueue.c:3398

kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

The buggy address belongs to the object at ffff88805bd45800

which belongs to the cache kmalloc-1k of size 1024

The buggy address is located 16 bytes inside of
freed 1024-byte region [ffff88805bd45800, ffff88805bd45c00)

The buggy address belongs to the physical page:

page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5bd40

head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)

raw: 00fff00000000040 ffff88801ac41dc0 dead000000000100 dead000000000122

raw: 0000000000000000 0000000000100010 00000001f5000000 0000000000000000

head: 00fff00000000040 ffff88801ac41dc0 dead000000000100 dead000000000122

head: 0000000000000000 0000000000100010 00000001f5000000 0000000000000000

head: 00fff00000000003 ffffea00016f5001 ffffffffffffffff 0000000000000000

head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 52, tgid 52 (kworker/u8:3), ts 110221332948, free_ts 104807511653

set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1558
prep_new_page mm/page_alloc.c:1566 [inline]
get_page_from_freelist+0x365c/0x37a0 mm/page_alloc.c:3476
__alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4753

alloc_pages_mpol_noprof+0x3e1/0x780 mm/mempolicy.c:2269
alloc_slab_page+0x6a/0x110 mm/slub.c:2423

allocate_slab+0x5a/0x2b0 mm/slub.c:2589
new_slab mm/slub.c:2642 [inline]
___slab_alloc+0xc27/0x14a0 mm/slub.c:3830
__slab_alloc+0x58/0xa0 mm/slub.c:3920
__slab_alloc_node mm/slub.c:3995 [inline]
slab_alloc_node mm/slub.c:4156 [inline]

__do_kmalloc_node mm/slub.c:4297 [inline]
__kmalloc_node_track_caller_noprof+0x2e9/0x4c0 mm/slub.c:4317
kmalloc_reserve+0x111/0x2a0 net/core/skbuff.c:609
__alloc_skb+0x1f3/0x440 net/core/skbuff.c:678
alloc_skb include/linux/skbuff.h:1323 [inline]
nlmsg_new include/net/netlink.h:1018 [inline]
inet6_rt_notify+0xba/0x240 net/ipv6/route.c:6195
fib6_add_rt2node net/ipv6/ip6_fib.c:1259 [inline]
fib6_add+0x1e33/0x4420 net/ipv6/ip6_fib.c:1488
__ip6_ins_rt net/ipv6/route.c:1317 [inline]
ip6_ins_rt+0x106/0x170 net/ipv6/route.c:1327
__ipv6_ifa_notify+0x5d2/0x1230 net/ipv6/addrconf.c:6282
ipv6_ifa_notify net/ipv6/addrconf.c:6321 [inline]
addrconf_dad_completed+0x181/0xcd0 net/ipv6/addrconf.c:4341
page last free pid 6489 tgid 6489 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1127 [inline]
free_unref_page+0xd3f/0x1010 mm/page_alloc.c:2659
vfree+0x1c3/0x360 mm/vmalloc.c:3383
kcov_put kernel/kcov.c:439 [inline]
kcov_close+0x28/0x50 kernel/kcov.c:535

__fput+0x23c/0xa50 fs/file_table.c:450
task_work_run+0x24f/0x310 kernel/task_work.c:239
exit_task_work include/linux/task_work.h:43 [inline]
do_exit+0xa2a/0x28e0 kernel/exit.c:938
do_group_exit+0x207/0x2c0 kernel/exit.c:1087
get_signal+0x16b2/0x1750 kernel/signal.c:3017
arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0xce/0x340 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:

ffff88805bd45700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88805bd45780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88805bd45800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88805bd45880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88805bd45900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


Tested on:

commit: ad26fc09 Merge tag 'mm-hotfixes-stable-2025-01-16-21-1..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=162c3a18580000

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.

***

Subject: Re: [PATCH v4] Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd
Author: luiz....@gmail.com

#syz test

On Fri, Jan 17, 2025 at 1:42 PM Luiz Augusto von Dentz

<luiz....@gmail.com> wrote:
>
> From: Luiz Augusto von Dentz <luiz.vo...@intel.com>
>
> After the hci sync command releases l2cap_conn, the hci receive data work
> queue references the released l2cap_conn when sending to the upper layer.
> Add hci dev lock to the hci receive data work queue to synchronize the two.
>
> [1]
> BUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954
> Read of size 8 at addr ffff8880271a4000 by task kworker/u9:2/5837
>

> CPU: 0 UID: 0 PID: 5837 Comm: kworker/u9:2 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
> Workqueue: hci1 hci_rx_work
> Call Trace:
> <TASK>

> __dump_stack lib/dump_stack.c:94 [inline]
> dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
> print_address_description mm/kasan/report.c:378 [inline]
> print_report+0x169/0x550 mm/kasan/report.c:489
> kasan_report+0x143/0x180 mm/kasan/report.c:602

> l2cap_build_cmd net/bluetooth/l2cap_core.c:2964 [inline]
> l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954

> l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline]
> l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline]
> l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817
> hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline]
> hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040

> process_one_work kernel/workqueue.c:3229 [inline]
> process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> worker_thread+0x870/0xd30 kernel/workqueue.c:3391

> kthread+0x2f0/0x390 kernel/kthread.c:389
> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> </TASK>
>

> Allocated by task 5837:

> kasan_save_stack mm/kasan/common.c:47 [inline]
> kasan_save_track+0x3f/0x80 mm/kasan/common.c:68

> poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
> __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
> kasan_kmalloc include/linux/kasan.h:260 [inline]
> __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329
> kmalloc_noprof include/linux/slab.h:901 [inline]
> kzalloc_noprof include/linux/slab.h:1037 [inline]
> l2cap_conn_add+0xa9/0x8e0 net/bluetooth/l2cap_core.c:6860
> l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7239
> hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
> hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726
> hci_event_func net/bluetooth/hci_event.c:7473 [inline]
> hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525
> hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035

> process_one_work kernel/workqueue.c:3229 [inline]
> process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> worker_thread+0x870/0xd30 kernel/workqueue.c:3391

> kthread+0x2f0/0x390 kernel/kthread.c:389
> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
>

> Freed by task 54:

> kasan_save_stack mm/kasan/common.c:47 [inline]
> kasan_save_track+0x3f/0x80 mm/kasan/common.c:68

> kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582
> poison_slab_object mm/kasan/common.c:247 [inline]
> __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
> kasan_slab_free include/linux/kasan.h:233 [inline]
> slab_free_hook mm/slub.c:2353 [inline]
> slab_free mm/slub.c:4613 [inline]
> kfree+0x196/0x430 mm/slub.c:4761
> l2cap_connect_cfm+0xcc/0x1090 net/bluetooth/l2cap_core.c:7235
> hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
> hci_conn_failed+0x287/0x400 net/bluetooth/hci_conn.c:1266

> hci_abort_conn_sync+0x56c/0x11f0 net/bluetooth/hci_sync.c:5603
> hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332

> process_one_work kernel/workqueue.c:3229 [inline]
> process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> worker_thread+0x870/0xd30 kernel/workqueue.c:3391

> kthread+0x2f0/0x390 kernel/kthread.c:389
> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
>

> Reported-by: syzbot+31c2f6...@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734
> Tested-by: syzbot+31c2f6...@syzkaller.appspotmail.com
> Signed-off-by: Edward Adam Davis <ead...@qq.com>
> Signed-off-by: Luiz Augusto von Dentz <luiz.vo...@intel.com>
> ---

> net/bluetooth/l2cap_core.c | 45 ++++++++++++++++++++++++++++++++++----
> 1 file changed, 41 insertions(+), 4 deletions(-)
>
> diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> index 27b4c4a2ba1f..cc730135e5d9 100644

> --- a/net/bluetooth/l2cap_core.c
> +++ b/net/bluetooth/l2cap_core.c
> @@ -951,11 +951,18 @@ static u8 l2cap_get_ident(struct l2cap_conn *conn)
> static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
> void *data)
> {
> - struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
> + struct sk_buff *skb;
> u8 flags;
>
> + /* Check if hchan has been dropped since it means hci_chan_del has
> + * been called.
> + */
> + if (!conn->hchan)
> + return;
> +
> BT_DBG("code 0x%2.2x", code);
>
> + skb = l2cap_build_cmd(conn, code, ident, len, data);
> if (!skb)
> return;
>

> @@ -1751,12 +1758,16 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
> {

> struct l2cap_conn *conn = hcon->l2cap_data;

> struct l2cap_chan *chan, *l;
> + struct hci_chan *hchan;
>
> if (!conn)
> return;
>
> BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
>
> + hchan = conn->hchan;
> + conn->hchan = NULL;
> +
> kfree_skb(conn->rx_skb);
>
> skb_queue_purge(&conn->pending_rx);
> @@ -1792,13 +1803,12 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
>
> mutex_unlock(&conn->chan_lock);
>
> - hci_chan_del(conn->hchan);
> + hci_chan_del(hchan);

>
> if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
> cancel_delayed_work_sync(&conn->info_timer);
>

> hcon->l2cap_data = NULL;
> - conn->hchan = NULL;
> l2cap_conn_put(conn);
> }
>
> @@ -6785,6 +6795,12 @@ static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)

> u16 cid, len;
> __le16 psm;
>
> + /* Check if hchan has been dropped then drop any packets as well */
> + if (!conn->hchan) {
> + kfree_skb(skb);
> + return;
> + }
> +
> if (hcon->state != BT_CONNECTED) {
> BT_DBG("queueing pending rx skb");
> skb_queue_tail(&conn->pending_rx, skb);

> @@ -7466,14 +7482,33 @@ static void l2cap_recv_reset(struct l2cap_conn *conn)

> @@ -7565,6 +7600,8 @@ void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+31c2f6...@syzkaller.appspotmail.com
Tested-by: syzbot+31c2f6...@syzkaller.appspotmail.com

Tested on:

commit: ad26fc09 Merge tag 'mm-hotfixes-stable-2025-01-16-21-1..
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=17ec5fc4580000

kernel config: https://syzkaller.appspot.com/x/.config?x=aadf89e2f6db86cc
dashboard link: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=122bc2b0580000

[Hillf Danton]

On Fri, 17 Jan 2025 13:42:02 -0500

This does not work because nothing prevents ->hchan from being freed after this check.

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.

***

Subject: Re: [PATCH v4] Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd
Author: luiz....@gmail.com

#syz test

On Fri, Jan 17, 2025 at 3:48 PM Luiz Augusto von Dentz

<luiz....@gmail.com> wrote:
>
> #syz test
>
> On Fri, Jan 17, 2025 at 1:42 PM Luiz Augusto von Dentz
> <luiz....@gmail.com> wrote:
> >

> > From: Luiz Augusto von Dentz <luiz.vo...@intel.com>
> >
> > After the hci sync command releases l2cap_conn, the hci receive data work
> > queue references the released l2cap_conn when sending to the upper layer.
> > Add hci dev lock to the hci receive data work queue to synchronize the two.
> >
> > [1]
> > BUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954
> > Read of size 8 at addr ffff8880271a4000 by task kworker/u9:2/5837
> >

> > CPU: 0 UID: 0 PID: 5837 Comm: kworker/u9:2 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0
> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
> > Workqueue: hci1 hci_rx_work
> > Call Trace:
> > <TASK>

> > __dump_stack lib/dump_stack.c:94 [inline]
> > dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
> > print_address_description mm/kasan/report.c:378 [inline]
> > print_report+0x169/0x550 mm/kasan/report.c:489
> > kasan_report+0x143/0x180 mm/kasan/report.c:602
> > l2cap_build_cmd net/bluetooth/l2cap_core.c:2964 [inline]
> > l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954
> > l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline]
> > l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline]
> > l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817
> > hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline]
> > hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040
> > process_one_work kernel/workqueue.c:3229 [inline]
> > process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> > worker_thread+0x870/0xd30 kernel/workqueue.c:3391
> > kthread+0x2f0/0x390 kernel/kthread.c:389
> > ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> > </TASK>
> >
> > Allocated by task 5837:

> > kasan_save_stack mm/kasan/common.c:47 [inline]
> > kasan_save_track+0x3f/0x80 mm/kasan/common.c:68

> > poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
> > __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
> > kasan_kmalloc include/linux/kasan.h:260 [inline]
> > __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329
> > kmalloc_noprof include/linux/slab.h:901 [inline]
> > kzalloc_noprof include/linux/slab.h:1037 [inline]
> > l2cap_conn_add+0xa9/0x8e0 net/bluetooth/l2cap_core.c:6860
> > l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7239
> > hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
> > hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726
> > hci_event_func net/bluetooth/hci_event.c:7473 [inline]
> > hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525
> > hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035
> > process_one_work kernel/workqueue.c:3229 [inline]
> > process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> > worker_thread+0x870/0xd30 kernel/workqueue.c:3391
> > kthread+0x2f0/0x390 kernel/kthread.c:389
> > ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> >
> > Freed by task 54:

> > kasan_save_stack mm/kasan/common.c:47 [inline]
> > kasan_save_track+0x3f/0x80 mm/kasan/common.c:68

> > @@ -6785,6 +6795,12 @@ static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
> > u16 cid, len;
> > __le16 psm;
> >

> > + /* Check if hchan has been dropped then drop any packets as well */
> > + if (!conn->hchan) {

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

KASAN: slab-use-after-free Read in hci_send_acl

Bluetooth: Unknown BR/EDR signaling command 0x10

Bluetooth: Wrong link type (-22)
==================================================================

BUG: KASAN: slab-use-after-free in hci_send_acl+0x4d/0xd00 net/bluetooth/hci_core.c:3232
Read of size 8 at addr ffff88802f536f18 by task kworker/u9:5/6557

CPU: 0 UID: 0 PID: 6557 Comm: kworker/u9:5 Not tainted 6.13.0-syzkaller-02469-gd0f93ac2c384-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Workqueue: hci4 hci_rx_work

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x169/0x550 mm/kasan/report.c:489
kasan_report+0x143/0x180 mm/kasan/report.c:602

hci_send_acl+0x4d/0xd00 net/bluetooth/hci_core.c:3232
l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5500 [inline]
l2cap_sig_channel net/bluetooth/l2cap_core.c:5536 [inline]
l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6815
l2cap_recv_acldata+0x700/0x1a70 net/bluetooth/l2cap_core.c:7522

hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline]
hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040

process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317
worker_thread+0x870/0xd30 kernel/workqueue.c:3398

kthread+0x7a9/0x920 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>

Allocated by task 54:

kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68

poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329
kmalloc_noprof include/linux/slab.h:901 [inline]
kzalloc_noprof include/linux/slab.h:1037 [inline]

hci_chan_create+0xc8/0x310 net/bluetooth/hci_conn.c:2838
l2cap_conn_add+0x69/0x8e0 net/bluetooth/l2cap_core.c:6854
l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7237

hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726
hci_event_func net/bluetooth/hci_event.c:7473 [inline]
hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525
hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035

process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317
worker_thread+0x870/0xd30 kernel/workqueue.c:3398

kthread+0x7a9/0x920 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Freed by task 6554:

kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2353 [inline]
slab_free mm/slub.c:4613 [inline]
kfree+0x196/0x430 mm/slub.c:4761

hci_chan_list_flush net/bluetooth/hci_conn.c:2878 [inline]
hci_conn_cleanup net/bluetooth/hci_conn.c:149 [inline]
hci_conn_del+0x4b5/0xc40 net/bluetooth/hci_conn.c:1164
hci_conn_failed+0x319/0x400 net/bluetooth/hci_conn.c:1267
hci_abort_conn_sync+0x56c/0x11f0 net/bluetooth/hci_sync.c:5604
hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332

process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317
worker_thread+0x870/0xd30 kernel/workqueue.c:3398

kthread+0x7a9/0x920 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

The buggy address belongs to the object at ffff88802f536f00
which belongs to the cache kmalloc-128 of size 128
The buggy address is located 24 bytes inside of
freed 128-byte region [ffff88802f536f00, ffff88802f536f80)

The buggy address belongs to the physical page:

page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88802f536d00 pfn:0x2f536
flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000200 ffff88801ac41a00 ffffea000187a110 ffffea0001882ad0
raw: ffff88802f536d00 0000000000100005 00000001f5000000 0000000000000000

page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 6482, tgid 6482 (udevd), ts 109120173001, free_ts 109113912385

set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1558
prep_new_page mm/page_alloc.c:1566 [inline]
get_page_from_freelist+0x365c/0x37a0 mm/page_alloc.c:3476
__alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4753
alloc_pages_mpol_noprof+0x3e1/0x780 mm/mempolicy.c:2269
alloc_slab_page+0x6a/0x110 mm/slub.c:2423
allocate_slab+0x5a/0x2b0 mm/slub.c:2589
new_slab mm/slub.c:2642 [inline]
___slab_alloc+0xc27/0x14a0 mm/slub.c:3830
__slab_alloc+0x58/0xa0 mm/slub.c:3920
__slab_alloc_node mm/slub.c:3995 [inline]
slab_alloc_node mm/slub.c:4156 [inline]

__kmalloc_cache_noprof+0x27b/0x390 mm/slub.c:4324

kmalloc_noprof include/linux/slab.h:901 [inline]
kzalloc_noprof include/linux/slab.h:1037 [inline]

kernfs_get_open_node fs/kernfs/file.c:525 [inline]
kernfs_fop_open+0x826/0xd10 fs/kernfs/file.c:700
do_dentry_open+0xbe1/0x1b70 fs/open.c:938
vfs_open+0x3e/0x330 fs/open.c:1068
do_open fs/namei.c:3828 [inline]
path_openat+0x2c84/0x3590 fs/namei.c:3987
do_filp_open+0x27f/0x4e0 fs/namei.c:4014
do_sys_openat2+0x13e/0x1d0 fs/open.c:1395
do_sys_open fs/open.c:1410 [inline]
__do_sys_openat fs/open.c:1426 [inline]
__se_sys_openat fs/open.c:1421 [inline]
__x64_sys_openat+0x247/0x2a0 fs/open.c:1421
page last free pid 6511 tgid 6511 stack trace:

reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1127 [inline]

free_unref_folios+0xe39/0x18b0 mm/page_alloc.c:2706
folios_put_refs+0x76c/0x860 mm/swap.c:962
free_pages_and_swap_cache+0x5c8/0x690 mm/swap_state.c:335
__tlb_batch_free_encoded_pages mm/mmu_gather.c:136 [inline]
tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:366 [inline]
tlb_flush_mmu+0x3a3/0x680 mm/mmu_gather.c:373
tlb_finish_mmu+0xd4/0x200 mm/mmu_gather.c:465
exit_mmap+0x4d5/0xca0 mm/mmap.c:1685
__mmput+0x115/0x3c0 kernel/fork.c:1345
exit_mm+0x220/0x310 kernel/exit.c:570
do_exit+0x9ad/0x28e0 kernel/exit.c:925
do_group_exit+0x207/0x2c0 kernel/exit.c:1087
get_signal+0x16b2/0x1750 kernel/signal.c:3036

arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0xce/0x340 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:

ffff88802f536e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc
ffff88802f536e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88802f536f00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88802f536f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88802f537000: 00 00 00 00 fc fc fc fc fa fb fb fb fc fc fc fc
==================================================================


Tested on:

commit: d0f93ac2 Merge tag 'docs-6.14' of git://git.lwn.net/li..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=112b8ab0580000
kernel config: https://syzkaller.appspot.com/x/.config?x=11ecbacf9de73733

dashboard link: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=16e82238580000

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.

***

Subject: Re: [PATCH v4] Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd
Author: luiz....@gmail.com

#syz test

On Tue, Jan 21, 2025 at 1:08 PM Luiz Augusto von Dentz

<luiz....@gmail.com> wrote:
>
> #syz test
>
> On Fri, Jan 17, 2025 at 3:48 PM Luiz Augusto von Dentz
> <luiz....@gmail.com> wrote:
> >
> > #syz test
> >
> > On Fri, Jan 17, 2025 at 1:42 PM Luiz Augusto von Dentz
> > <luiz....@gmail.com> wrote:
> > >
> > > From: Luiz Augusto von Dentz <luiz.vo...@intel.com>
> > >
> > > After the hci sync command releases l2cap_conn, the hci receive data work
> > > queue references the released l2cap_conn when sending to the upper layer.
> > > Add hci dev lock to the hci receive data work queue to synchronize the two.
> > >
> > > [1]
> > > BUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954
> > > Read of size 8 at addr ffff8880271a4000 by task kworker/u9:2/5837
> > >

> > > CPU: 0 UID: 0 PID: 5837 Comm: kworker/u9:2 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0
> > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
> > > Workqueue: hci1 hci_rx_work

> > > Call Trace:
> > > <TASK>
> > > __dump_stack lib/dump_stack.c:94 [inline]
> > > dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
> > > print_address_description mm/kasan/report.c:378 [inline]
> > > print_report+0x169/0x550 mm/kasan/report.c:489
> > > kasan_report+0x143/0x180 mm/kasan/report.c:602

> > > l2cap_build_cmd net/bluetooth/l2cap_core.c:2964 [inline]
> > > l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954
> > > l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline]
> > > l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline]
> > > l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817

> > > hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline]
> > > hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040

> > > process_one_work kernel/workqueue.c:3229 [inline]
> > > process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> > > worker_thread+0x870/0xd30 kernel/workqueue.c:3391
> > > kthread+0x2f0/0x390 kernel/kthread.c:389
> > > ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147

> > > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> > > </TASK>
> > >
> > > Allocated by task 5837:

> > > kasan_save_stack mm/kasan/common.c:47 [inline]
> > > kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
> > > poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
> > > __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
> > > kasan_kmalloc include/linux/kasan.h:260 [inline]
> > > __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329
> > > kmalloc_noprof include/linux/slab.h:901 [inline]
> > > kzalloc_noprof include/linux/slab.h:1037 [inline]

> > > l2cap_conn_add+0xa9/0x8e0 net/bluetooth/l2cap_core.c:6860
> > > l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7239

> > > hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
> > > hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726
> > > hci_event_func net/bluetooth/hci_event.c:7473 [inline]
> > > hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525
> > > hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035

> > > process_one_work kernel/workqueue.c:3229 [inline]
> > > process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
> > > worker_thread+0x870/0xd30 kernel/workqueue.c:3391
> > > kthread+0x2f0/0x390 kernel/kthread.c:389
> > > ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147

> > > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> > >
> > > Freed by task 54:

> > > kasan_save_stack mm/kasan/common.c:47 [inline]
> > > kasan_save_track+0x3f/0x80 mm/kasan/common.c:68

> > > kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582
> > > poison_slab_object mm/kasan/common.c:247 [inline]
> > > __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
> > > kasan_slab_free include/linux/kasan.h:233 [inline]
> > > slab_free_hook mm/slub.c:2353 [inline]
> > > slab_free mm/slub.c:4613 [inline]
> > > kfree+0x196/0x430 mm/slub.c:4761

> > > l2cap_connect_cfm+0xcc/0x1090 net/bluetooth/l2cap_core.c:7235
> > > hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]
> > > hci_conn_failed+0x287/0x400 net/bluetooth/hci_conn.c:1266
> > > hci_abort_conn_sync+0x56c/0x11f0 net/bluetooth/hci_sync.c:5603

> > > hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+31c2f6...@syzkaller.appspotmail.com
Tested-by: syzbot+31c2f6...@syzkaller.appspotmail.com

Tested on:

commit: c4b9570c Merge tag 'audit-pr-20250121' of git://git.ke..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=126f1824580000
kernel config: https://syzkaller.appspot.com/x/.config?x=5d46425e33fe266e

dashboard link: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=147b1824580000