[syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap

syzbot

unread,

Jun 24, 2024, 4:23:30 PMJun 24

to johan....@gmail.com, linux-b...@vger.kernel.org, linux-...@vger.kernel.org, luiz....@gmail.com, mar...@holtmann.org, syzkall...@googlegroups.com

Hello,

syzbot found the following issue on:

HEAD commit: 5f583a3162ff Merge tag 'rust-fixes-6.10' of https://github..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11170741980000
kernel config: https://syzkaller.appspot.com/x/.config?x=f413acf5b1eb4093
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f530c7950839/disk-5f583a31.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/b4f810bbc13e/vmlinux-5f583a31.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a49ec6dadbad/bzImage-5f583a31.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c12e2f...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: slab-use-after-free in l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949
Read of size 8 at addr ffff88802af53000 by task kworker/u9:4/5114

CPU: 1 PID: 5114 Comm: kworker/u9:4 Not tainted 6.10.0-rc4-syzkaller-00301-g5f583a3162ff #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Workqueue: hci1 hci_rx_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114
print_address_description mm/kasan/report.c:377 [inline]
print_report+0xc3/0x620 mm/kasan/report.c:488
kasan_report+0xd9/0x110 mm/kasan/report.c:601
l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949
l2cap_connect_req net/bluetooth/l2cap_core.c:4080 [inline]
l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4772 [inline]
l2cap_sig_channel net/bluetooth/l2cap_core.c:5543 [inline]
l2cap_recv_frame+0xf07/0x8e50 net/bluetooth/l2cap_core.c:6821
l2cap_recv_acldata+0x9ac/0xb60 net/bluetooth/l2cap_core.c:7510
hci_acldata_packet net/bluetooth/hci_core.c:3842 [inline]
hci_rx_work+0xaa7/0x1610 net/bluetooth/hci_core.c:4079
process_one_work+0x9fb/0x1b60 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>

Allocated by task 4480:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:387
kmalloc_noprof include/linux/slab.h:660 [inline]
kzalloc_noprof include/linux/slab.h:778 [inline]
l2cap_conn_add.part.0+0x60/0xa60 net/bluetooth/l2cap_core.c:6864
l2cap_conn_add net/bluetooth/l2cap_core.c:69 [inline]
l2cap_connect_cfm+0x428/0xf80 net/bluetooth/l2cap_core.c:7241
hci_connect_cfm include/net/bluetooth/hci_core.h:1970 [inline]
hci_remote_features_evt+0x548/0x9e0 net/bluetooth/hci_event.c:3721
hci_event_func net/bluetooth/hci_event.c:7417 [inline]
hci_event_packet+0x9e3/0x1170 net/bluetooth/hci_event.c:7469
hci_rx_work+0x2c4/0x1610 net/bluetooth/hci_core.c:4074
process_one_work+0x9fb/0x1b60 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Freed by task 5112:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
poison_slab_object+0xf7/0x160 mm/kasan/common.c:240
__kasan_slab_free+0x32/0x50 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2196 [inline]
slab_free mm/slub.c:4437 [inline]
kfree+0x12a/0x3b0 mm/slub.c:4558
l2cap_conn_free net/bluetooth/l2cap_core.c:1810 [inline]
kref_put include/linux/kref.h:65 [inline]
l2cap_conn_put net/bluetooth/l2cap_core.c:1822 [inline]
l2cap_conn_del+0x59d/0x740 net/bluetooth/l2cap_core.c:1802
l2cap_connect_cfm+0x9e6/0xf80 net/bluetooth/l2cap_core.c:7237
hci_connect_cfm include/net/bluetooth/hci_core.h:1970 [inline]
hci_conn_failed+0x1c3/0x370 net/bluetooth/hci_conn.c:1257
hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5450
abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2909
hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:310
process_one_work+0x9fb/0x1b60 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Last potentially related work creation:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
__kasan_record_aux_stack+0xba/0xd0 mm/kasan/generic.c:541
insert_work+0x36/0x230 kernel/workqueue.c:2207
__queue_work+0x944/0x1020 kernel/workqueue.c:2359
call_timer_fn+0x1a0/0x610 kernel/time/timer.c:1792
expire_timers kernel/time/timer.c:1838 [inline]
__run_timers+0x567/0xaf0 kernel/time/timer.c:2417
__run_timer_base kernel/time/timer.c:2428 [inline]
__run_timer_base kernel/time/timer.c:2421 [inline]
run_timer_base+0x111/0x190 kernel/time/timer.c:2437
run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2447
handle_softirqs+0x216/0x8f0 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu kernel/softirq.c:637 [inline]
irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1043
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702

Second to last potentially related work creation:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
__kasan_record_aux_stack+0xba/0xd0 mm/kasan/generic.c:541
insert_work+0x36/0x230 kernel/workqueue.c:2207
__queue_work+0x525/0x1020 kernel/workqueue.c:2363
queue_work_on+0x11a/0x140 kernel/workqueue.c:2410
queue_work include/linux/workqueue.h:621 [inline]
l2cap_conn_ready net/bluetooth/l2cap_core.c:1640 [inline]
l2cap_connect_cfm+0x9c9/0xf80 net/bluetooth/l2cap_core.c:7282
hci_connect_cfm include/net/bluetooth/hci_core.h:1970 [inline]
hci_remote_features_evt+0x548/0x9e0 net/bluetooth/hci_event.c:3721
hci_event_func net/bluetooth/hci_event.c:7417 [inline]
hci_event_packet+0x9e3/0x1170 net/bluetooth/hci_event.c:7469
hci_rx_work+0x2c4/0x1610 net/bluetooth/hci_core.c:4074
process_one_work+0x9fb/0x1b60 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

The buggy address belongs to the object at ffff88802af53000
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 0 bytes inside of
freed 1024-byte region [ffff88802af53000, ffff88802af53400)

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2af50
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffefff(slab)
raw: 00fff00000000040 ffff888015441dc0 0000000000000000 dead000000000001
raw: 0000000000000000 0000000000100010 00000001ffffefff 0000000000000000
head: 00fff00000000040 ffff888015441dc0 0000000000000000 dead000000000001
head: 0000000000000000 0000000000100010 00000001ffffefff 0000000000000000
head: 00fff00000000003 ffffea0000abd401 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4752, tgid 4752 (dhcpcd), ts 66098690934, free_ts 66038999175
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1468
prep_new_page mm/page_alloc.c:1476 [inline]
get_page_from_freelist+0x136a/0x2e50 mm/page_alloc.c:3420
__alloc_pages_noprof+0x22b/0x2460 mm/page_alloc.c:4678
__alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
alloc_slab_page+0x56/0x110 mm/slub.c:2265
allocate_slab mm/slub.c:2428 [inline]
new_slab+0x84/0x260 mm/slub.c:2481
___slab_alloc+0xdac/0x1870 mm/slub.c:3667
__slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3757
__slab_alloc_node mm/slub.c:3810 [inline]
slab_alloc_node mm/slub.c:3989 [inline]
__do_kmalloc_node mm/slub.c:4121 [inline]
kmalloc_node_track_caller_noprof+0x355/0x430 mm/slub.c:4142
kmemdup_noprof+0x29/0x60 mm/util.c:131
kmemdup_noprof include/linux/fortify-string.h:757 [inline]
bpf_migrate_filter+0xc6/0x390 net/core/filter.c:1268
bpf_prepare_filter+0x183/0x380 net/core/filter.c:1354
bpf_prog_create_from_user+0x1e4/0x2d0 net/core/filter.c:1448
seccomp_prepare_filter kernel/seccomp.c:680 [inline]
seccomp_prepare_user_filter kernel/seccomp.c:717 [inline]
seccomp_set_mode_filter kernel/seccomp.c:1935 [inline]
do_seccomp+0x7b6/0x2580 kernel/seccomp.c:2055
prctl_set_seccomp+0x4b/0x70 kernel/seccomp.c:2108
__do_sys_prctl+0xc83/0x1e40 kernel/sys.c:2539
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
page last free pid 4747 tgid 4747 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1088 [inline]
free_unref_page+0x64a/0xe40 mm/page_alloc.c:2583
__put_partials+0x14c/0x170 mm/slub.c:2995
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:322
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3941 [inline]
slab_alloc_node mm/slub.c:4001 [inline]
kmem_cache_alloc_lru_noprof+0x121/0x2f0 mm/slub.c:4020
shmem_alloc_inode+0x25/0x50 mm/shmem.c:4468
alloc_inode+0x5d/0x230 fs/inode.c:261
new_inode_pseudo fs/inode.c:1007 [inline]
new_inode+0x22/0x270 fs/inode.c:1033
__shmem_get_inode mm/shmem.c:2503 [inline]
shmem_get_inode+0x194/0xe80 mm/shmem.c:2574
shmem_mknod+0x66/0x240 mm/shmem.c:3268
shmem_mkdir+0x31/0x60 mm/shmem.c:3329
vfs_mkdir+0x57d/0x860 fs/namei.c:4131
do_mkdirat+0x301/0x3a0 fs/namei.c:4154
__do_sys_mkdir fs/namei.c:4174 [inline]
__se_sys_mkdir fs/namei.c:4172 [inline]
__x64_sys_mkdir+0xf1/0x140 fs/namei.c:4172
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83

Memory state around the buggy address:
ffff88802af52f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88802af52f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88802af53000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88802af53080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88802af53100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

syzbot

unread,

Sep 7, 2024, 10:42:27 AMSep 7

to johan....@gmail.com, linux-b...@vger.kernel.org, linux-...@vger.kernel.org, luiz....@gmail.com, mar...@holtmann.org, syzkall...@googlegroups.com

syzbot has found a reproducer for the following issue on:

HEAD commit: 788220eee30d Merge tag 'pm-6.11-rc7' of git://git.kernel.o..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=10502bc7980000
kernel config: https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2

dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11da6f29980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1304189f980000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e618b7c8e5a2/disk-788220ee.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/333bb524a2ba/vmlinux-788220ee.xz
kernel image: https://storage.googleapis.com/syzbot-assets/ad1779f24bb2/bzImage-788220ee.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c12e2f...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: slab-use-after-free in l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949

Read of size 8 at addr ffff8880241e9800 by task kworker/u9:0/54

CPU: 0 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.11.0-rc6-syzkaller-00268-g788220eee30d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: hci2 hci_rx_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119

print_address_description mm/kasan/report.c:377 [inline]
print_report+0xc3/0x620 mm/kasan/report.c:488
kasan_report+0xd9/0x110 mm/kasan/report.c:601
l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949
l2cap_connect_req net/bluetooth/l2cap_core.c:4080 [inline]
l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4772 [inline]
l2cap_sig_channel net/bluetooth/l2cap_core.c:5543 [inline]

l2cap_recv_frame+0xf0b/0x8eb0 net/bluetooth/l2cap_core.c:6825
l2cap_recv_acldata+0x9b4/0xb70 net/bluetooth/l2cap_core.c:7514
hci_acldata_packet net/bluetooth/hci_core.c:3791 [inline]
hci_rx_work+0xaab/0x1610 net/bluetooth/hci_core.c:4028
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389

kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>

Allocated by task 5253:

kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:387

kmalloc_noprof include/linux/slab.h:681 [inline]
kzalloc_noprof include/linux/slab.h:807 [inline]
l2cap_conn_add.part.0+0x60/0xa60 net/bluetooth/l2cap_core.c:6868
l2cap_conn_add net/bluetooth/l2cap_core.c:69 [inline]
l2cap_connect_cfm+0x428/0xf80 net/bluetooth/l2cap_core.c:7245
hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
hci_remote_features_evt+0x548/0x9e0 net/bluetooth/hci_event.c:3721
hci_event_func net/bluetooth/hci_event.c:7446 [inline]
hci_event_packet+0x9eb/0x1180 net/bluetooth/hci_event.c:7498
hci_rx_work+0x2c6/0x1610 net/bluetooth/hci_core.c:4023
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389

kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Freed by task 5245:

kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
poison_slab_object+0xf7/0x160 mm/kasan/common.c:240
__kasan_slab_free+0x32/0x50 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]

slab_free_hook mm/slub.c:2256 [inline]
slab_free mm/slub.c:4477 [inline]
kfree+0x12a/0x3b0 mm/slub.c:4598

l2cap_conn_free net/bluetooth/l2cap_core.c:1810 [inline]
kref_put include/linux/kref.h:65 [inline]
l2cap_conn_put net/bluetooth/l2cap_core.c:1822 [inline]

l2cap_conn_del+0x59d/0x730 net/bluetooth/l2cap_core.c:1802
l2cap_connect_cfm+0x9e6/0xf80 net/bluetooth/l2cap_core.c:7241
hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
hci_conn_failed+0x1c3/0x370 net/bluetooth/hci_conn.c:1265
hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583
abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2917
hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389

kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Last potentially related work creation:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
__kasan_record_aux_stack+0xba/0xd0 mm/kasan/generic.c:541

insert_work+0x36/0x230 kernel/workqueue.c:2185
__queue_work+0x97e/0x1070 kernel/workqueue.c:2341

call_timer_fn+0x1a0/0x610 kernel/time/timer.c:1792
expire_timers kernel/time/timer.c:1838 [inline]
__run_timers+0x567/0xaf0 kernel/time/timer.c:2417
__run_timer_base kernel/time/timer.c:2428 [inline]
__run_timer_base kernel/time/timer.c:2421 [inline]
run_timer_base+0x111/0x190 kernel/time/timer.c:2437
run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2447
handle_softirqs+0x216/0x8f0 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu kernel/softirq.c:637 [inline]
irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1043
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702

Second to last potentially related work creation:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
__kasan_record_aux_stack+0xba/0xd0 mm/kasan/generic.c:541

insert_work+0x36/0x230 kernel/workqueue.c:2185
__queue_work+0x3f8/0x1070 kernel/workqueue.c:2345
queue_work_on+0x11a/0x140 kernel/workqueue.c:2392

queue_work include/linux/workqueue.h:621 [inline]
l2cap_conn_ready net/bluetooth/l2cap_core.c:1640 [inline]

l2cap_connect_cfm+0x9c9/0xf80 net/bluetooth/l2cap_core.c:7286
hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
hci_remote_features_evt+0x548/0x9e0 net/bluetooth/hci_event.c:3721
hci_event_func net/bluetooth/hci_event.c:7446 [inline]
hci_event_packet+0x9eb/0x1180 net/bluetooth/hci_event.c:7498
hci_rx_work+0x2c6/0x1610 net/bluetooth/hci_core.c:4023
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389

kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

The buggy address belongs to the object at ffff8880241e9800

which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 0 bytes inside of

freed 1024-byte region [ffff8880241e9800, ffff8880241e9c00)

The buggy address belongs to the physical page:

page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x241e8

head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0

flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)

page_type: 0xfdffffff(slab)
raw: 00fff00000000040 ffff88801ac41dc0 ffffea00007cac00 dead000000000002
raw: 0000000000000000 0000000000100010 00000001fdffffff 0000000000000000
head: 00fff00000000040 ffff88801ac41dc0 ffffea00007cac00 dead000000000002
head: 0000000000000000 0000000000100010 00000001fdffffff 0000000000000000
head: 00fff00000000003 ffffea0000907a01 ffffffffffffffff 0000000000000000

head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4642, tgid 4642 (init), ts 27796307015, free_ts 0
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1500
prep_new_page mm/page_alloc.c:1508 [inline]
get_page_from_freelist+0x1351/0x2e50 mm/page_alloc.c:3446
__alloc_pages_noprof+0x22b/0x2460 mm/page_alloc.c:4702

__alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
alloc_pages_node_noprof include/linux/gfp.h:296 [inline]

alloc_slab_page+0x4e/0xf0 mm/slub.c:2325
allocate_slab mm/slub.c:2488 [inline]
new_slab+0x84/0x260 mm/slub.c:2541
___slab_alloc+0xdac/0x1870 mm/slub.c:3727
__slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3817
__slab_alloc_node mm/slub.c:3870 [inline]
slab_alloc_node mm/slub.c:4029 [inline]
__do_kmalloc_node mm/slub.c:4161 [inline]
__kmalloc_noprof+0x367/0x400 mm/slub.c:4174
kmalloc_noprof include/linux/slab.h:685 [inline]
kzalloc_noprof include/linux/slab.h:807 [inline]
tomoyo_init_log+0x13ca/0x2180 security/tomoyo/audit.c:275
tomoyo_supervisor+0x30c/0xea0 security/tomoyo/common.c:2089
tomoyo_audit_env_log security/tomoyo/environ.c:36 [inline]
tomoyo_env_perm+0x193/0x210 security/tomoyo/environ.c:63
tomoyo_environ security/tomoyo/domain.c:672 [inline]
tomoyo_find_next_domain+0xef9/0x2020 security/tomoyo/domain.c:878
tomoyo_bprm_check_security security/tomoyo/tomoyo.c:102 [inline]
tomoyo_bprm_check_security+0x12e/0x1d0 security/tomoyo/tomoyo.c:92
security_bprm_check+0x65/0xb0 security/security.c:1191
search_binary_handler fs/exec.c:1815 [inline]
exec_binprm fs/exec.c:1869 [inline]
bprm_execve fs/exec.c:1920 [inline]
bprm_execve+0x642/0x1960 fs/exec.c:1896
do_execveat_common.isra.0+0x4f1/0x630 fs/exec.c:2027
page_owner free stack trace missing

Memory state around the buggy address:

ffff8880241e9700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8880241e9780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8880241e9800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880241e9880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880241e9900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

Hillf Danton

unread,

Sep 7, 2024, 8:02:15 PMSep 7

to syzbot, linux-...@vger.kernel.org, syzkall...@googlegroups.com

On Sat, 07 Sep 2024 07:42:26 -0700

> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 788220eee30d Merge tag 'pm-6.11-rc7' of git://git.kernel.o..
> git tree: upstream

> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1304189f980000

#syz test

--- l/net/bluetooth/l2cap_core.c
+++ c/net/bluetooth/l2cap_core.c
@@ -1797,6 +1797,7 @@ static void l2cap_conn_del(struct hci_co
if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
cancel_delayed_work_sync(&conn->info_timer);

+ cancel_work_sync(&hcon->hdev->rx_work);
hcon->l2cap_data = NULL;
conn->hchan = NULL;
l2cap_conn_put(conn);
--

syzbot

unread,

Sep 7, 2024, 8:24:06 PMSep 7

to hda...@sina.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
possible deadlock in hci_conn_failed

======================================================
WARNING: possible circular locking dependency detected
6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0 Not tainted
------------------------------------------------------
kworker/u9:5/5970 is trying to acquire lock:
ffff888032308aa0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: touch_work_lockdep_map kernel/workqueue.c:3890 [inline]
ffff888032308aa0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: start_flush_work kernel/workqueue.c:4144 [inline]
ffff888032308aa0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: __flush_work+0x46d/0xc30 kernel/workqueue.c:4176

but task is already holding lock:
ffffffff8fc9caa8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1957 [inline]
ffffffff8fc9caa8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_failed+0x158/0x370 net/bluetooth/hci_conn.c:1265

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #2 (hci_cb_list_lock){+.+.}-{3:3}
:
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
hci_connect_cfm include/net/bluetooth/hci_core.h:1957 [inline]
hci_remote_features_evt+0x4dc/0x9e0 net/bluetooth/hci_event.c:3721

hci_event_func net/bluetooth/hci_event.c:7446 [inline]
hci_event_packet+0x9eb/0x1180 net/bluetooth/hci_event.c:7498
hci_rx_work+0x2c6/0x1610 net/bluetooth/hci_core.c:4023
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

-> #1 (&hdev->lock){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
hci_store_wake_reason net/bluetooth/hci_event.c:7191 [inline]
hci_event_packet+0x323/0x1180 net/bluetooth/hci_event.c:7494

hci_rx_work+0x2c6/0x1610 net/bluetooth/hci_core.c:4023
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

-> #0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3133 [inline]
check_prevs_add kernel/locking/lockdep.c:3252 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]
__lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142
lock_acquire kernel/locking/lockdep.c:5759 [inline]
lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
touch_work_lockdep_map kernel/workqueue.c:3890 [inline]
start_flush_work kernel/workqueue.c:4144 [inline]
__flush_work+0x477/0xc30 kernel/workqueue.c:4176
__cancel_work_sync+0x10c/0x130 kernel/workqueue.c:4332
l2cap_conn_del+0x4a6/0x760 net/bluetooth/l2cap_core.c:1800
l2cap_connect_cfm+0x9e6/0xf80 net/bluetooth/l2cap_core.c:7242

hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
hci_conn_failed+0x1c3/0x370 net/bluetooth/hci_conn.c:1265
hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583
abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2917
hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

other info that might help us debug this:

Chain exists of:
(work_completion)(&hdev->rx_work) --> &hdev->lock --> hci_cb_list_lock

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(hci_cb_list_lock);
lock(&hdev->lock);
lock(hci_cb_list_lock);
lock((work_completion)(&hdev->rx_work));

*** DEADLOCK ***

6 locks held by kworker/u9:5/5970:
#0: ffff8880280f7948 ((wq_completion)hci4){+.+.}-{0:0}, at: process_one_work+0x1277/0x1b40 kernel/workqueue.c:3206
#1: ffffc9000305fd80 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x921/0x1b40 kernel/workqueue.c:3207
#2: ffff888032308d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x170/0x410 net/bluetooth/hci_sync.c:327
#3: ffff888032308078 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x150/0xb50 net/bluetooth/hci_sync.c:5564
#4: ffffffff8fc9caa8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1957 [inline]
#4: ffffffff8fc9caa8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_failed+0x158/0x370 net/bluetooth/hci_conn.c:1265
#5: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:326 [inline]
#5: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#5: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: start_flush_work kernel/workqueue.c:4118 [inline]
#5: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: __flush_work+0x103/0xc30 kernel/workqueue.c:4176

stack backtrace:
CPU: 1 UID: 0 PID: 5970 Comm: kworker/u9:5 Not tainted 6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024

Workqueue: hci4 hci_cmd_sync_work

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119

check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2186
check_prev_add kernel/locking/lockdep.c:3133 [inline]
check_prevs_add kernel/locking/lockdep.c:3252 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]
__lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142
lock_acquire kernel/locking/lockdep.c:5759 [inline]
lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
touch_work_lockdep_map kernel/workqueue.c:3890 [inline]
start_flush_work kernel/workqueue.c:4144 [inline]
__flush_work+0x477/0xc30 kernel/workqueue.c:4176
__cancel_work_sync+0x10c/0x130 kernel/workqueue.c:4332
l2cap_conn_del+0x4a6/0x760 net/bluetooth/l2cap_core.c:1800
l2cap_connect_cfm+0x9e6/0xf80 net/bluetooth/l2cap_core.c:7242

hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
hci_conn_failed+0x1c3/0x370 net/bluetooth/hci_conn.c:1265
hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583
abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2917
hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

</TASK>

Tested on:

commit: d1f2d51b Merge tag 'clk-fixes-for-linus' of git://git...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13100e00580000

kernel config: https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=163c989f980000

Edward Adam Davis

unread,

Sep 7, 2024, 9:28:41 PMSep 7

to syzbot+c12e2f...@syzkaller.appspotmail.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com

after release conn, we need to cancle rx_work

#syz test

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 9988ba382b68..afa02e0d7917 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1800,6 +1800,7 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)

hcon->l2cap_data = NULL;
conn->hchan = NULL;
l2cap_conn_put(conn);

+ cancel_work_sync(&hcon->hdev->rx_work);
}

static void l2cap_conn_free(struct kref *ref)

syzbot

unread,

Sep 7, 2024, 9:51:04 PMSep 7

to ead...@qq.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
possible deadlock in hci_conn_failed

======================================================
WARNING: possible circular locking dependency detected
6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0 Not tainted
------------------------------------------------------

kworker/u9:6/7098 is trying to acquire lock:
ffff888025470aa0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: touch_work_lockdep_map kernel/workqueue.c:3890 [inline]
ffff888025470aa0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: start_flush_work kernel/workqueue.c:4144 [inline]
ffff888025470aa0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: __flush_work+0x46d/0xc30 kernel/workqueue.c:4176

l2cap_conn_del+0x55c/0x780 net/bluetooth/l2cap_core.c:1803

l2cap_connect_cfm+0x9e6/0xf80 net/bluetooth/l2cap_core.c:7242
hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
hci_conn_failed+0x1c3/0x370 net/bluetooth/hci_conn.c:1265
hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583
abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2917
hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

other info that might help us debug this:

Chain exists of:
(work_completion)(&hdev->rx_work) --> &hdev->lock --> hci_cb_list_lock

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(hci_cb_list_lock);
lock(&hdev->lock);
lock(hci_cb_list_lock);
lock((work_completion)(&hdev->rx_work));

*** DEADLOCK ***

6 locks held by kworker/u9:6/7098:
#0:
ffff88803384c148 (
(wq_completion)hci2

){+.+.}-{0:0}, at: process_one_work+0x1277/0x1b40 kernel/workqueue.c:3206

#1: ffffc9000adcfd80 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x921/0x1b40 kernel/workqueue.c:3207
#2: ffff888025470d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x170/0x410 net/bluetooth/hci_sync.c:327
#3: ffff888025470078

(&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x150/0xb50 net/bluetooth/hci_sync.c:5564
#4: ffffffff8fc9caa8 (hci_cb_list_lock){+.+.}-{3:3}
, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1957 [inline]

, at: hci_conn_failed+0x158/0x370 net/bluetooth/hci_conn.c:1265
#5: ffffffff8ddb9fe0
(rcu_read_lock
){....}-{1:2}
, at: rcu_lock_acquire include/linux/rcupdate.h:326 [inline]

, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]

, at: start_flush_work kernel/workqueue.c:4118 [inline]

, at: __flush_work+0x103/0xc30 kernel/workqueue.c:4176

stack backtrace:

CPU: 1 UID: 0 PID: 7098 Comm: kworker/u9:6 Not tainted 6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024

Workqueue: hci2 hci_cmd_sync_work

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2186
check_prev_add kernel/locking/lockdep.c:3133 [inline]
check_prevs_add kernel/locking/lockdep.c:3252 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]
__lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142
lock_acquire kernel/locking/lockdep.c:5759 [inline]
lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
touch_work_lockdep_map kernel/workqueue.c:3890 [inline]
start_flush_work kernel/workqueue.c:4144 [inline]
__flush_work+0x477/0xc30 kernel/workqueue.c:4176
__cancel_work_sync+0x10c/0x130 kernel/workqueue.c:4332

l2cap_conn_del+0x55c/0x780 net/bluetooth/l2cap_core.c:1803

l2cap_connect_cfm+0x9e6/0xf80 net/bluetooth/l2cap_core.c:7242
hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
hci_conn_failed+0x1c3/0x370 net/bluetooth/hci_conn.c:1265
hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583
abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2917
hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>

Tested on:

commit: d1f2d51b Merge tag 'clk-fixes-for-linus' of git://git...
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=12acabc7980000

kernel config: https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=10640e00580000

Edward Adam Davis

unread,

Sep 7, 2024, 10:06:32 PMSep 7

to syzbot+c12e2f...@syzkaller.appspotmail.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com

after release conn, we need to cancle rx_work

#syz test

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 8e48ccd2af30..5050d20e9cd1 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -1264,6 +1264,7 @@ void hci_conn_failed(struct hci_conn *conn, u8 status)
conn->state = BT_CLOSED;
hci_connect_cfm(conn, status);
hci_conn_del(conn);
+ cancel_work_sync(&hdev->rx_work);
}

/* This function requires the caller holds hdev->lock */

syzbot

unread,

Sep 7, 2024, 10:29:04 PMSep 7

to ead...@qq.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

possible deadlock in hci_abort_conn_sync

======================================================
WARNING: possible circular locking dependency detected
6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0 Not tainted
------------------------------------------------------

kworker/u9:2/5285 is trying to acquire lock:
ffff888043094aa0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: touch_work_lockdep_map kernel/workqueue.c:3890 [inline]
ffff888043094aa0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: start_flush_work kernel/workqueue.c:4144 [inline]
ffff888043094aa0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: __flush_work+0x46d/0xc30 kernel/workqueue.c:4176

but task is already holding lock:

ffff888043094078 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x150/0xb50 net/bluetooth/hci_sync.c:5564

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #1 (&hdev->lock){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
hci_store_wake_reason net/bluetooth/hci_event.c:7191 [inline]
hci_event_packet+0x323/0x1180 net/bluetooth/hci_event.c:7494
hci_rx_work+0x2c6/0x1610 net/bluetooth/hci_core.c:4023
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

-> #0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3133 [inline]
check_prevs_add kernel/locking/lockdep.c:3252 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]
__lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142
lock_acquire kernel/locking/lockdep.c:5759 [inline]
lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
touch_work_lockdep_map kernel/workqueue.c:3890 [inline]
start_flush_work kernel/workqueue.c:4144 [inline]
__flush_work+0x477/0xc30 kernel/workqueue.c:4176
__cancel_work_sync+0x10c/0x130 kernel/workqueue.c:4332

hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583
abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2918

hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

other info that might help us debug this:

Possible unsafe locking scenario:

CPU0 CPU1
---- ----

lock(&hdev->lock);
lock((work_completion)(&hdev->rx_work));
lock(&hdev->lock);

lock((work_completion)(&hdev->rx_work));

*** DEADLOCK ***

5 locks held by kworker/u9:2/5285:
#0: ffff8880439ca148 ((wq_completion)hci0){+.+.}-{0:0}, at: process_one_work+0x1277/0x1b40 kernel/workqueue.c:3206
#1: ffffc9000392fd80 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x921/0x1b40 kernel/workqueue.c:3207
#2: ffff888043094d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x170/0x410 net/bluetooth/hci_sync.c:327
#3: ffff888043094078 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x150/0xb50 net/bluetooth/hci_sync.c:5564
#4: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:326 [inline]
#4: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#4: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: start_flush_work kernel/workqueue.c:4118 [inline]
#4: ffffffff8ddb9fe0 (rcu_read_lock){....}-{1:2}, at: __flush_work+0x103/0xc30 kernel/workqueue.c:4176

stack backtrace:
CPU: 0 UID: 0 PID: 5285 Comm: kworker/u9:2 Not tainted 6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024

Workqueue: hci0 hci_cmd_sync_work

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2186
check_prev_add kernel/locking/lockdep.c:3133 [inline]
check_prevs_add kernel/locking/lockdep.c:3252 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]
__lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142
lock_acquire kernel/locking/lockdep.c:5759 [inline]
lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
touch_work_lockdep_map kernel/workqueue.c:3890 [inline]
start_flush_work kernel/workqueue.c:4144 [inline]
__flush_work+0x477/0xc30 kernel/workqueue.c:4176
__cancel_work_sync+0x10c/0x130 kernel/workqueue.c:4332

hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583
abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2918

hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>

Tested on:

commit: d1f2d51b Merge tag 'clk-fixes-for-linus' of git://git...
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=146feffb980000

kernel config: https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=175c0e00580000

Edward Adam Davis

unread,

Sep 7, 2024, 10:41:16 PMSep 7

to syzbot+c12e2f...@syzkaller.appspotmail.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com

after release conn, we need to cancle rx_work

#syz test

diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index e79cd40bd079..6d95e07d9ddd 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -5499,7 +5499,7 @@ static int hci_reject_conn_sync(struct hci_dev *hdev, struct hci_conn *conn,

int hci_abort_conn_sync(struct hci_dev *hdev, struct hci_conn *conn, u8 reason)
{
- int err = 0;
+ int err = 0, failed = 0;
u16 handle = conn->handle;
bool disconnect = false;
struct hci_conn *c;
@@ -5543,10 +5543,13 @@ int hci_abort_conn_sync(struct hci_dev *hdev, struct hci_conn *conn, u8 reason)
hci_conn_del(conn);
} else {
hci_conn_failed(conn, reason);
+ failed = 1;
}

unlock:
hci_dev_unlock(hdev);
+ if (failed)
+ cancel_work_sync(&hdev->rx_work);
return err;
}

syzbot

unread,

Sep 7, 2024, 11:06:04 PMSep 7

to ead...@qq.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

KASAN: slab-use-after-free Read in l2cap_connect

Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

==================================================================
BUG: KASAN: slab-use-after-free in l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949

Read of size 8 at addr ffff88807a217000 by task kworker/u9:0/54

CPU: 0 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024

Workqueue: hci2 hci_rx_work

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119

print_address_description mm/kasan/report.c:377 [inline]
print_report+0xc3/0x620 mm/kasan/report.c:488
kasan_report+0xd9/0x110 mm/kasan/report.c:601
l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949
l2cap_connect_req net/bluetooth/l2cap_core.c:4080 [inline]
l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4772 [inline]
l2cap_sig_channel net/bluetooth/l2cap_core.c:5543 [inline]
l2cap_recv_frame+0xf0b/0x8eb0 net/bluetooth/l2cap_core.c:6825
l2cap_recv_acldata+0x9b4/0xb70 net/bluetooth/l2cap_core.c:7514
hci_acldata_packet net/bluetooth/hci_core.c:3791 [inline]
hci_rx_work+0xaab/0x1610 net/bluetooth/hci_core.c:4028

process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>

Allocated by task 6033:

kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:387
kmalloc_noprof include/linux/slab.h:681 [inline]
kzalloc_noprof include/linux/slab.h:807 [inline]
l2cap_conn_add.part.0+0x60/0xa60 net/bluetooth/l2cap_core.c:6868
l2cap_conn_add net/bluetooth/l2cap_core.c:69 [inline]
l2cap_connect_cfm+0x428/0xf80 net/bluetooth/l2cap_core.c:7245
hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]

hci_remote_features_evt+0x548/0x9e0 net/bluetooth/hci_event.c:3721

hci_event_func net/bluetooth/hci_event.c:7446 [inline]
hci_event_packet+0x9eb/0x1180 net/bluetooth/hci_event.c:7498

hci_rx_work+0x2c6/0x1610 net/bluetooth/hci_core.c:4023
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Freed by task 7242:

kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
poison_slab_object+0xf7/0x160 mm/kasan/common.c:240
__kasan_slab_free+0x32/0x50 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2256 [inline]
slab_free mm/slub.c:4477 [inline]
kfree+0x12a/0x3b0 mm/slub.c:4598
l2cap_conn_free net/bluetooth/l2cap_core.c:1810 [inline]
kref_put include/linux/kref.h:65 [inline]
l2cap_conn_put net/bluetooth/l2cap_core.c:1822 [inline]
l2cap_conn_del+0x59d/0x730 net/bluetooth/l2cap_core.c:1802
l2cap_connect_cfm+0x9e6/0xf80 net/bluetooth/l2cap_core.c:7241

hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
hci_conn_failed+0x1c3/0x370 net/bluetooth/hci_conn.c:1265

hci_abort_conn_sync+0x5df/0xb90 net/bluetooth/hci_sync.c:5583
abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2917

hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

hci_remote_features_evt+0x548/0x9e0 net/bluetooth/hci_event.c:3721

hci_event_func net/bluetooth/hci_event.c:7446 [inline]
hci_event_packet+0x9eb/0x1180 net/bluetooth/hci_event.c:7498

hci_rx_work+0x2c6/0x1610 net/bluetooth/hci_core.c:4023
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

The buggy address belongs to the object at ffff88807a217000

which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 0 bytes inside of

freed 1024-byte region [ffff88807a217000, ffff88807a217400)

The buggy address belongs to the physical page:

page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7a210

head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xfdffffff(slab)

raw: 00fff00000000040 ffff88801ac41dc0 ffffea0001813a00 dead000000000002

raw: 0000000000000000 0000000000100010 00000001fdffffff 0000000000000000

head: 00fff00000000040 ffff88801ac41dc0 ffffea0001813a00 dead000000000002

head: 0000000000000000 0000000000100010 00000001fdffffff 0000000000000000

head: 00fff00000000003 ffffea0001e88401 ffffffffffffffff 0000000000000000

head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1500
prep_new_page mm/page_alloc.c:1508 [inline]
get_page_from_freelist+0x1351/0x2e50 mm/page_alloc.c:3446
__alloc_pages_noprof+0x22b/0x2460 mm/page_alloc.c:4702
__alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
alloc_slab_page+0x4e/0xf0 mm/slub.c:2325
allocate_slab mm/slub.c:2488 [inline]
new_slab+0x84/0x260 mm/slub.c:2541
___slab_alloc+0xdac/0x1870 mm/slub.c:3727
__slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3817
__slab_alloc_node mm/slub.c:3870 [inline]
slab_alloc_node mm/slub.c:4029 [inline]
__do_kmalloc_node mm/slub.c:4161 [inline]

__kmalloc_node_track_caller_noprof+0x355/0x430 mm/slub.c:4181
kmemdup_noprof+0x29/0x60 mm/util.c:133
kmemdup_noprof include/linux/fortify-string.h:753 [inline]
setup_ipc_sysctls+0x5e/0x300 ipc/ipc_sysctl.c:251
create_ipc_ns ipc/namespace.c:81 [inline]
copy_ipcs+0x498/0x600 ipc/namespace.c:112
create_new_namespaces+0x20a/0xad0 kernel/nsproxy.c:90
unshare_nsproxy_namespaces+0xc0/0x1f0 kernel/nsproxy.c:228
ksys_unshare+0x419/0x970 kernel/fork.c:3309
__do_sys_unshare kernel/fork.c:3380 [inline]
__se_sys_unshare kernel/fork.c:3378 [inline]
__x64_sys_unshare+0x31/0x40 kernel/fork.c:3378

do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83

page last free pid 5878 tgid 5878 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1101 [inline]
free_unref_page+0x64a/0xe40 mm/page_alloc.c:2619
__put_partials+0x14c/0x170 mm/slub.c:3055

qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:322
kasan_slab_alloc include/linux/kasan.h:201 [inline]

slab_post_alloc_hook mm/slub.c:3992 [inline]
slab_alloc_node mm/slub.c:4041 [inline]
__do_kmalloc_node mm/slub.c:4161 [inline]
__kmalloc_node_noprof+0x1c3/0x430 mm/slub.c:4168
kmalloc_node_noprof include/linux/slab.h:708 [inline]
__vmalloc_area_node mm/vmalloc.c:3642 [inline]
__vmalloc_node_range_noprof+0x3de/0x14e0 mm/vmalloc.c:3837
alloc_thread_stack_node kernel/fork.c:313 [inline]
dup_task_struct kernel/fork.c:1113 [inline]
copy_process+0x2f3b/0x8de0 kernel/fork.c:2204
kernel_clone+0xfd/0x960 kernel/fork.c:2781
__do_sys_clone3+0x1f5/0x270 kernel/fork.c:3085

do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83

entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:

ffff88807a216f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88807a216f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88807a217000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88807a217080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88807a217100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Tested on:

commit: d1f2d51b Merge tag 'clk-fixes-for-linus' of git://git...
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=116def29980000

kernel config: https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=133feffb980000

Edward Adam Davis

unread,

Sep 7, 2024, 11:21:41 PMSep 7

to syzbot+c12e2f...@syzkaller.appspotmail.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com

after release conn, we need to cancle rx_work

#syz test

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index f25a21f532aa..4f7b45bb863f 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -3776,18 +3776,19 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)

hci_dev_lock(hdev);
conn = hci_conn_hash_lookup_handle(hdev, handle);
- hci_dev_unlock(hdev);

if (conn) {
hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);

/* Send to upper protocol */
l2cap_recv_acldata(conn, skb, flags);
+ hci_dev_unlock(hdev);
return;
} else {
bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
handle);
}
+ hci_dev_unlock(hdev);

kfree_skb(skb);
}

Hillf Danton

unread,

Sep 7, 2024, 11:25:58 PMSep 7

to syzbot, linux-...@vger.kernel.org, syzkall...@googlegroups.com

On Sat, 07 Sep 2024 07:42:26 -0700

> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 788220eee30d Merge tag 'pm-6.11-rc7' of git://git.kernel.o..
> git tree: upstream

> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1304189f980000

#syz test

--- l/net/bluetooth/l2cap_core.c
+++ c/net/bluetooth/l2cap_core.c

@@ -1747,6 +1747,8 @@ static void l2cap_unregister_all_users(s
}
}

+static DEFINE_MUTEX(l2cap_conn_del_mutex);
+

static void l2cap_conn_del(struct hci_conn *hcon, int err)

{
struct l2cap_conn *conn = hcon->l2cap_data;
@@ -1797,8 +1799,10 @@ static void l2cap_conn_del(struct hci_co

if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
cancel_delayed_work_sync(&conn->info_timer);

+ mutex_lock(&l2cap_conn_del_mutex);

hcon->l2cap_data = NULL;
conn->hchan = NULL;

+ mutex_unlock(&l2cap_conn_del_mutex);
l2cap_conn_put(conn);
}

@@ -7480,11 +7484,21 @@ void l2cap_recv_acldata(struct hci_conn
struct l2cap_conn *conn = hcon->l2cap_data;
int len;

- if (!conn)
+ if (!conn) {
conn = l2cap_conn_add(hcon);
-
- if (!conn)
- goto drop;
+ if (!conn)
+ goto drop;
+ l2cap_conn_get(conn);
+ } else {
+ mutex_lock(&l2cap_conn_del_mutex);
+ conn = hcon->l2cap_data;
+ if (conn)
+ if (!kref_get_unless_zero(&conn->ref))
+ conn = NULL;
+ mutex_unlock(&l2cap_conn_del_mutex);
+ if (!conn)
+ goto drop;
+ }

BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags);

@@ -7512,6 +7526,7 @@ void l2cap_recv_acldata(struct hci_conn
if (len == skb->len) {
/* Complete frame received */
l2cap_recv_frame(conn, skb);
+ l2cap_conn_put(conn);
return;
}

@@ -7576,6 +7591,8 @@ void l2cap_recv_acldata(struct hci_conn

drop:
kfree_skb(skb);
+ if (conn)
+ 2cap_conn_put(conn);
}

static struct hci_cb l2cap_cb = {
--

syzbot

unread,

Sep 7, 2024, 11:58:04 PMSep 7

to ead...@qq.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

possible deadlock in l2cap_recv_frame

Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)
============================================

WARNING: possible recursive locking detected

6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0 Not tainted
--------------------------------------------

kworker/u9:1/4615 is trying to acquire lock:
ffff888062afc078 (&hdev->lock){+.+.}-{3:3}, at: l2cap_connect_req net/bluetooth/l2cap_core.c:4075 [inline]
ffff888062afc078 (&hdev->lock){+.+.}-{3:3}, at: l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4772 [inline]
ffff888062afc078 (&hdev->lock){+.+.}-{3:3}, at: l2cap_sig_channel net/bluetooth/l2cap_core.c:5543 [inline]
ffff888062afc078 (&hdev->lock){+.+.}-{3:3}, at: l2cap_recv_frame+0xe9d/0x8eb0 net/bluetooth/l2cap_core.c:6825

but task is already holding lock:

ffff888062afc078 (&hdev->lock){+.+.}-{3:3}, at: hci_acldata_packet net/bluetooth/hci_core.c:3783 [inline]
ffff888062afc078 (&hdev->lock){+.+.}-{3:3}, at: hci_rx_work+0x96b/0x1610 net/bluetooth/hci_core.c:4029

other info that might help us debug this:
Possible unsafe locking scenario:

CPU0

----
lock(&hdev->lock);
lock(&hdev->lock);

*** DEADLOCK ***

May be due to missing lock nesting notation

3 locks held by kworker/u9:1/4615:
#0: ffff8880301df948 ((wq_completion)hci2#2){+.+.}-{0:0}, at: process_one_work+0x1277/0x1b40 kernel/workqueue.c:3206
#1: ffffc9000d83fd80 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x921/0x1b40 kernel/workqueue.c:3207
#2: ffff888062afc078 (&hdev->lock){+.+.}-{3:3}, at: hci_acldata_packet net/bluetooth/hci_core.c:3783 [inline]
#2: ffff888062afc078 (&hdev->lock){+.+.}-{3:3}, at: hci_rx_work+0x96b/0x1610 net/bluetooth/hci_core.c:4029

stack backtrace:
CPU: 0 UID: 0 PID: 4615 Comm: kworker/u9:1 Not tainted 6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: hci2 hci_rx_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119

check_deadlock kernel/locking/lockdep.c:3061 [inline]
validate_chain kernel/locking/lockdep.c:3855 [inline]
__lock_acquire+0x2167/0x3cb0 kernel/locking/lockdep.c:5142

lock_acquire kernel/locking/lockdep.c:5759 [inline]
lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724

__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752

l2cap_connect_req net/bluetooth/l2cap_core.c:4075 [inline]

l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4772 [inline]
l2cap_sig_channel net/bluetooth/l2cap_core.c:5543 [inline]

l2cap_recv_frame+0xe9d/0x8eb0 net/bluetooth/l2cap_core.c:6825
l2cap_recv_acldata+0x9b4/0xb70 net/bluetooth/l2cap_core.c:7514
hci_acldata_packet net/bluetooth/hci_core.c:3790 [inline]
hci_rx_work+0xaa1/0x1610 net/bluetooth/hci_core.c:4029

process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>

Tested on:

commit: d1f2d51b Merge tag 'clk-fixes-for-linus' of git://git...
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=1656abc7980000

kernel config: https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=165a0e00580000

syzbot

unread,

Sep 8, 2024, 12:07:04 AMSep 8

to hda...@sina.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

net/bluetooth/l2cap_core.c:7595:17: error: invalid suffix "cap_conn_put" on integer constant

Tested on:

commit: d1f2d51b Merge tag 'clk-fixes-for-linus' of git://git...
git tree: upstream

kernel config: https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=137def29980000

Edward Adam Davis

unread,

Sep 8, 2024, 12:07:32 AMSep 8

to syzbot+c12e2f...@syzkaller.appspotmail.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 9988ba382b68..b948b0a3b2f2 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -4072,10 +4072,8 @@ static int l2cap_connect_req(struct l2cap_conn *conn,
if (cmd_len < sizeof(struct l2cap_conn_req))
return -EPROTO;

- hci_dev_lock(hdev);
if (hci_dev_test_flag(hdev, HCI_MGMT))
mgmt_device_connected(hdev, hcon, NULL, 0);
- hci_dev_unlock(hdev);

l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP);
return 0;

syzbot

unread,

Sep 8, 2024, 12:37:04 AMSep 8

to ead...@qq.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+c12e2f...@syzkaller.appspotmail.com
Tested-by: syzbot+c12e2f...@syzkaller.appspotmail.com

Tested on:

commit: d1f2d51b Merge tag 'clk-fixes-for-linus' of git://git...
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=1187ef29980000

kernel config: https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=11ad989f980000

Note: testing is done by a robot and is best-effort only.

Edward Adam Davis

unread,

Sep 8, 2024, 3:22:44 AMSep 8

to syzbot+c12e2f...@syzkaller.appspotmail.com, johan....@gmail.com, linux-b...@vger.kernel.org, linux-...@vger.kernel.org, luiz....@gmail.com, mar...@holtmann.org, syzkall...@googlegroups.com

[Syzbot reported]

...

[Analysis]
There was a data race when accessing conn in hci_rx_work and hci_cmd_sync_work.
This is because the hci dev lock was prematurely exited when executing
hci_acldata_macket() in hci_rx_work, which resulted in it being released
by hci_cmd_sync_work when accessing conn outside the lock.

Reported-and-tested-by: syzbot+c12e2f...@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
Signed-off-by: Edward Adam Davis <ead...@qq.com>
---
net/bluetooth/hci_core.c | 3 ++-
net/bluetooth/l2cap_core.c | 2 --
2 files changed, 2 insertions(+), 3 deletions(-)

--
2.43.0

Hillf Danton

unread,

Sep 8, 2024, 4:33:03 AMSep 8

to syzbot, linux-...@vger.kernel.org, syzkall...@googlegroups.com

On Sat, 07 Sep 2024 07:42:26 -0700

> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 788220eee30d Merge tag 'pm-6.11-rc7' of git://git.kernel.o..
> git tree: upstream

+ l2cap_conn_put(conn);

syzbot

unread,

Sep 8, 2024, 4:52:03 AMSep 8

to hda...@sina.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

general protection fault in hci_send_acl

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
CPU: 1 UID: 0 PID: 7269 Comm: kworker/u9:8 Not tainted 6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: hci2 hci_rx_work

RIP: 0010:hci_send_acl+0x35/0xd30 net/bluetooth/hci_core.c:3230
Code: 41 55 41 54 55 49 8d 6f 18 53 48 89 f3 48 83 ec 70 89 14 24 e8 1c 18 83 f7 48 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 bc 0b 00 00 49 8b 47 18 48 8d b8 e0 0f 00 00 48
RSP: 0018:ffffc9000ae676e0 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: ffff888030adc500 RCX: ffffffff8a1303d4
RDX: 0000000000000003 RSI: ffffffff8a08b834 RDI: 0000000000000000
RBP: 0000000000000018 R08: 0000000000000001 R09: 0000000000000080
R10: 0000000000000001 R11: 0000000000000000 R12: ffff888011da0000
R13: 0000000000000002 R14: ffffc9000ae67880 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b8900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000080 CR3: 00000000781ba000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
l2cap_send_cmd+0x6e5/0x920 net/bluetooth/l2cap_core.c:973
l2cap_connect.constprop.0+0x6f7/0x1270 net/bluetooth/l2cap_core.c:4038
l2cap_connect_req net/bluetooth/l2cap_core.c:4084 [inline]
l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4776 [inline]
l2cap_sig_channel net/bluetooth/l2cap_core.c:5547 [inline]
l2cap_recv_frame+0xf0b/0x8eb0 net/bluetooth/l2cap_core.c:6829
l2cap_recv_acldata+0xd58/0xfd0 net/bluetooth/l2cap_core.c:7528

hci_acldata_packet net/bluetooth/hci_core.c:3791 [inline]
hci_rx_work+0xaab/0x1610 net/bluetooth/hci_core.c:4028
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:hci_send_acl+0x35/0xd30 net/bluetooth/hci_core.c:3230
Code: 41 55 41 54 55 49 8d 6f 18 53 48 89 f3 48 83 ec 70 89 14 24 e8 1c 18 83 f7 48 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 bc 0b 00 00 49 8b 47 18 48 8d b8 e0 0f 00 00 48
RSP: 0018:ffffc9000ae676e0 EFLAGS: 00010206

RAX: dffffc0000000000 RBX: ffff888030adc500 RCX: ffffffff8a1303d4
RDX: 0000000000000003 RSI: ffffffff8a08b834 RDI: 0000000000000000
RBP: 0000000000000018 R08: 0000000000000001 R09: 0000000000000080
R10: 0000000000000001 R11: 0000000000000000 R12: ffff888011da0000
R13: 0000000000000002 R14: ffffc9000ae67880 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b8800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000080 CR3: 00000000781ba000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 41 55 push %r13
2: 41 54 push %r12
4: 55 push %rbp
5: 49 8d 6f 18 lea 0x18(%r15),%rbp
9: 53 push %rbx
a: 48 89 f3 mov %rsi,%rbx
d: 48 83 ec 70 sub $0x70,%rsp
11: 89 14 24 mov %edx,(%rsp)
14: e8 1c 18 83 f7 call 0xf7831835
19: 48 89 ea mov %rbp,%rdx
1c: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
23: fc ff df
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
2e: 0f 85 bc 0b 00 00 jne 0xbf0
34: 49 8b 47 18 mov 0x18(%r15),%rax
38: 48 8d b8 e0 0f 00 00 lea 0xfe0(%rax),%rdi
3f: 48 rex.W

Tested on:

commit: d1f2d51b Merge tag 'clk-fixes-for-linus' of git://git...
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=13f51ffb980000

kernel config: https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=11651ffb980000

Hillf Danton

unread,

Sep 8, 2024, 7:15:33 AMSep 8

to syzbot, linux-...@vger.kernel.org, syzkall...@googlegroups.com

On Sat, 07 Sep 2024 07:42:26 -0700

> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 788220eee30d Merge tag 'pm-6.11-rc7' of git://git.kernel.o..
> git tree: upstream

> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1304189f980000

#syz test

--- l/net/bluetooth/l2cap_core.c
+++ c/net/bluetooth/l2cap_core.c
@@ -1747,6 +1747,8 @@ static void l2cap_unregister_all_users(s
}
}

+static DEFINE_MUTEX(l2cap_conn_del_mutex);
+
static void l2cap_conn_del(struct hci_conn *hcon, int err)
{
struct l2cap_conn *conn = hcon->l2cap_data;

@@ -1792,14 +1794,15 @@ static void l2cap_conn_del(struct hci_co

mutex_unlock(&conn->chan_lock);

- hci_chan_del(conn->hchan);
-

if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
cancel_delayed_work_sync(&conn->info_timer);

+ mutex_lock(&l2cap_conn_del_mutex);
hcon->l2cap_data = NULL;

+ hci_chan_del(conn->hchan);

conn->hchan = NULL;
l2cap_conn_put(conn);

+ mutex_unlock(&l2cap_conn_del_mutex);

}

static void l2cap_conn_free(struct kref *ref)

@@ -7480,6 +7483,7 @@ void l2cap_recv_acldata(struct hci_conn

struct l2cap_conn *conn = hcon->l2cap_data;
int len;

+ mutex_lock(&l2cap_conn_del_mutex);

if (!conn)
conn = l2cap_conn_add(hcon);

@@ -7512,6 +7516,7 @@ void l2cap_recv_acldata(struct hci_conn

if (len == skb->len) {
/* Complete frame received */
l2cap_recv_frame(conn, skb);

+ mutex_unlock(&l2cap_conn_del_mutex);
return;
}

@@ -7576,6 +7581,7 @@ void l2cap_recv_acldata(struct hci_conn

drop:
kfree_skb(skb);
+ mutex_unlock(&l2cap_conn_del_mutex);

syzbot

unread,

Sep 8, 2024, 7:33:04 AMSep 8

to hda...@sina.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

possible deadlock in l2cap_recv_frame

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

======================================================
WARNING: possible circular locking dependency detected
6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0 Not tainted
------------------------------------------------------
kworker/u9:2/5273 is trying to acquire lock:
ffff888031c20078 (&hdev->lock){+.+.}-{3:3}, at: l2cap_connect_req net/bluetooth/l2cap_core.c:4078 [inline]
ffff888031c20078 (&hdev->lock){+.+.}-{3:3}, at: l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4775 [inline]
ffff888031c20078 (&hdev->lock){+.+.}-{3:3}, at: l2cap_sig_channel net/bluetooth/l2cap_core.c:5546 [inline]
ffff888031c20078 (&hdev->lock){+.+.}-{3:3}, at: l2cap_recv_frame+0xe9d/0x8eb0 net/bluetooth/l2cap_core.c:6828

but task is already holding lock:

ffffffff8fcb1c28 (l2cap_conn_del_mutex){+.+.}-{3:3}, at: l2cap_recv_acldata+0x57/0xbd0 net/bluetooth/l2cap_core.c:7486

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #2 (l2cap_conn_del_mutex){+.+.}-{3:3}:

__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752

l2cap_conn_del+0x462/0x750 net/bluetooth/l2cap_core.c:1800
l2cap_disconn_cfm net/bluetooth/l2cap_core.c:7310 [inline]
l2cap_disconn_cfm+0x96/0xd0 net/bluetooth/l2cap_core.c:7303
hci_disconn_cfm include/net/bluetooth/hci_core.h:1975 [inline]
hci_conn_hash_flush+0x114/0x260 net/bluetooth/hci_conn.c:2592
hci_dev_close_sync+0x59e/0x1110 net/bluetooth/hci_sync.c:5195
hci_dev_do_close+0x2e/0x90 net/bluetooth/hci_core.c:483
hci_unregister_dev+0x213/0x620 net/bluetooth/hci_core.c:2698
vhci_release+0x7f/0x100 drivers/bluetooth/hci_vhci.c:664
__fput+0x408/0xbb0 fs/file_table.c:422
task_work_run+0x14e/0x250 kernel/task_work.c:228
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0xaa3/0x2bb0 kernel/exit.c:882
do_group_exit+0xd3/0x2a0 kernel/exit.c:1031
get_signal+0x25fb/0x2770 kernel/signal.c:2917
arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #1 (hci_cb_list_lock){+.+.}-{3:3}:

__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752

hci_connect_cfm include/net/bluetooth/hci_core.h:1957 [inline]
hci_remote_features_evt+0x4dc/0x9e0 net/bluetooth/hci_event.c:3721

hci_event_func net/bluetooth/hci_event.c:7446 [inline]
hci_event_packet+0x9eb/0x1180 net/bluetooth/hci_event.c:7498
hci_rx_work+0x2c6/0x1610 net/bluetooth/hci_core.c:4023

process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

-> #0 (&hdev->lock){+.+.}-{3:3}:

check_prev_add kernel/locking/lockdep.c:3133 [inline]
check_prevs_add kernel/locking/lockdep.c:3252 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]

__lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142

lock_acquire kernel/locking/lockdep.c:5759 [inline]
lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752

l2cap_connect_req net/bluetooth/l2cap_core.c:4078 [inline]
l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4775 [inline]
l2cap_sig_channel net/bluetooth/l2cap_core.c:5546 [inline]
l2cap_recv_frame+0xe9d/0x8eb0 net/bluetooth/l2cap_core.c:6828
l2cap_recv_acldata+0x9fe/0xbd0 net/bluetooth/l2cap_core.c:7518

hci_acldata_packet net/bluetooth/hci_core.c:3791 [inline]
hci_rx_work+0xaab/0x1610 net/bluetooth/hci_core.c:4028
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

other info that might help us debug this:

Chain exists of:
&hdev->lock --> hci_cb_list_lock --> l2cap_conn_del_mutex

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(l2cap_conn_del_mutex);
lock(hci_cb_list_lock);
lock(l2cap_conn_del_mutex);

lock(&hdev->lock);

*** DEADLOCK ***

3 locks held by kworker/u9:2/5273:
#0: ffff888062dda148 ((wq_completion)hci1#2){+.+.}-{0:0}, at: process_one_work+0x1277/0x1b40 kernel/workqueue.c:3206
#1: ffffc9000379fd80 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x921/0x1b40 kernel/workqueue.c:3207
#2: ffffffff8fcb1c28 (l2cap_conn_del_mutex){+.+.}-{3:3}, at: l2cap_recv_acldata+0x57/0xbd0 net/bluetooth/l2cap_core.c:7486

stack backtrace:
CPU: 1 UID: 0 PID: 5273 Comm: kworker/u9:2 Not tainted 6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024

Workqueue: hci1 hci_rx_work

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119

check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2186
check_prev_add kernel/locking/lockdep.c:3133 [inline]
check_prevs_add kernel/locking/lockdep.c:3252 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]

__lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142

lock_acquire kernel/locking/lockdep.c:5759 [inline]
lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752

l2cap_connect_req net/bluetooth/l2cap_core.c:4078 [inline]
l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4775 [inline]
l2cap_sig_channel net/bluetooth/l2cap_core.c:5546 [inline]
l2cap_recv_frame+0xe9d/0x8eb0 net/bluetooth/l2cap_core.c:6828
l2cap_recv_acldata+0x9fe/0xbd0 net/bluetooth/l2cap_core.c:7518

hci_acldata_packet net/bluetooth/hci_core.c:3791 [inline]
hci_rx_work+0xaab/0x1610 net/bluetooth/hci_core.c:4028
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0c

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0d

Bluetooth: Wrong link type (-22)

Bluetooth: Unknown BR/EDR signaling command 0x0f

Bluetooth: Wrong link type (-22)
Bluetooth: Unknown BR/EDR signaling command 0x11
Bluetooth: Wrong link type (-22)

Tested on:

commit: d1f2d51b Merge tag 'clk-fixes-for-linus' of git://git...
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=103f1ffb980000

kernel config: https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=15508e00580000

Hillf Danton

unread,

Sep 8, 2024, 8:50:34 AMSep 8

to syzbot, linux-...@vger.kernel.org, syzkall...@googlegroups.com

On Sat, 07 Sep 2024 07:42:26 -0700

> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 788220eee30d Merge tag 'pm-6.11-rc7' of git://git.kernel.o..
> git tree: upstream

> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1304189f980000

#syz test

--- x/net/bluetooth/hci_core.c
+++ y/net/bluetooth/hci_core.c
@@ -3787,8 +3787,10 @@ static void hci_acldata_packet(struct hc
if (conn) {
hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);

+ hci_req_sync_lock(hdev);

/* Send to upper protocol */
l2cap_recv_acldata(conn, skb, flags);

+ hci_req_sync_unlock(hdev);

return;
} else {
bt_dev_err(hdev, "ACL packet for unknown connection handle %d",

--

syzbot

unread,

Sep 8, 2024, 9:10:04 AMSep 8

to hda...@sina.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

KASAN: slab-use-after-free Read in l2cap_recv_acldata

==================================================================
BUG: KASAN: slab-use-after-free in l2cap_recv_acldata+0xa0b/0xb70 net/bluetooth/l2cap_core.c:7480
Read of size 8 at addr ffff888031b08fe8 by task kworker/u9:8/7223

CPU: 0 UID: 0 PID: 7223 Comm: kworker/u9:8 Not tainted 6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024

Workqueue: hci0 hci_rx_work

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119

print_address_description mm/kasan/report.c:377 [inline]
print_report+0xc3/0x620 mm/kasan/report.c:488
kasan_report+0xd9/0x110 mm/kasan/report.c:601

l2cap_recv_acldata+0xa0b/0xb70 net/bluetooth/l2cap_core.c:7480
hci_acldata_packet net/bluetooth/hci_core.c:3792 [inline]
hci_rx_work+0xac0/0x1630 net/bluetooth/hci_core.c:4030

process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>

Allocated by task 6015:

kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68

poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:387
kmalloc_noprof include/linux/slab.h:681 [inline]
kzalloc_noprof include/linux/slab.h:807 [inline]

__hci_conn_add+0x131/0x1a50 net/bluetooth/hci_conn.c:934
hci_conn_add_unset+0x6d/0x100 net/bluetooth/hci_conn.c:1043
hci_conn_request_evt+0x8c4/0xb40 net/bluetooth/hci_event.c:3288

hci_event_func net/bluetooth/hci_event.c:7446 [inline]
hci_event_packet+0x9eb/0x1180 net/bluetooth/hci_event.c:7498

hci_rx_work+0x2c6/0x1630 net/bluetooth/hci_core.c:4025

process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Freed by task 6017:

kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
poison_slab_object+0xf7/0x160 mm/kasan/common.c:240
__kasan_slab_free+0x32/0x50 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2256 [inline]
slab_free mm/slub.c:4477 [inline]
kfree+0x12a/0x3b0 mm/slub.c:4598

device_release+0xa1/0x240 drivers/base/core.c:2582
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x1e4/0x5a0 lib/kobject.c:737
put_device drivers/base/core.c:3790 [inline]
device_unregister+0x2f/0xc0 drivers/base/core.c:3913
hci_conn_del_sysfs+0xb4/0x180 net/bluetooth/hci_sysfs.c:86
hci_conn_cleanup net/bluetooth/hci_conn.c:175 [inline]
hci_conn_del+0x54e/0xdb0 net/bluetooth/hci_conn.c:1162

hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583
abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2917
hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328

process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

The buggy address belongs to the object at ffff888031b08000
which belongs to the cache kmalloc-8k of size 8192
The buggy address is located 4072 bytes inside of
freed 8192-byte region [ffff888031b08000, ffff888031b0a000)

The buggy address belongs to the physical page:

page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888031b0c000 pfn:0x31b08

head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0

ksm flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xfdffffff(slab)
raw: 00fff00000000040 ffff88801ac42280 ffffea0001f09000 0000000000000003
raw: ffff888031b0c000 0000000000020001 00000001fdffffff 0000000000000000
head: 00fff00000000040 ffff88801ac42280 ffffea0001f09000 0000000000000003
head: ffff888031b0c000 0000000000020001 00000001fdffffff 0000000000000000
head: 00fff00000000003 ffffea0000c6c201 ffffffffffffffff 0000000000000000

head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1500
prep_new_page mm/page_alloc.c:1508 [inline]
get_page_from_freelist+0x1351/0x2e50 mm/page_alloc.c:3446
__alloc_pages_noprof+0x22b/0x2460 mm/page_alloc.c:4702
__alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
alloc_slab_page+0x4e/0xf0 mm/slub.c:2325
allocate_slab mm/slub.c:2488 [inline]
new_slab+0x84/0x260 mm/slub.c:2541
___slab_alloc+0xdac/0x1870 mm/slub.c:3727
__slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3817
__slab_alloc_node mm/slub.c:3870 [inline]
slab_alloc_node mm/slub.c:4029 [inline]

__kmalloc_cache_noprof+0x2b4/0x300 mm/slub.c:4188

kmalloc_noprof include/linux/slab.h:681 [inline]
kzalloc_noprof include/linux/slab.h:807 [inline]

__hci_conn_add+0x131/0x1a50 net/bluetooth/hci_conn.c:934
hci_conn_add_unset+0x6d/0x100 net/bluetooth/hci_conn.c:1043
hci_conn_request_evt+0x8c4/0xb40 net/bluetooth/hci_event.c:3288

hci_event_func net/bluetooth/hci_event.c:7446 [inline]
hci_event_packet+0x9eb/0x1180 net/bluetooth/hci_event.c:7498

hci_rx_work+0x2c6/0x1630 net/bluetooth/hci_core.c:4025

process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389

page last free pid 5957 tgid 5957 stack trace:

reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1101 [inline]
free_unref_page+0x64a/0xe40 mm/page_alloc.c:2619
__put_partials+0x14c/0x170 mm/slub.c:3055
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:322
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3992 [inline]
slab_alloc_node mm/slub.c:4041 [inline]

kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4048
ptlock_alloc mm/memory.c:6589 [inline]
ptlock_init include/linux/mm.h:2944 [inline]
pmd_ptlock_init include/linux/mm.h:3048 [inline]
pagetable_pmd_ctor include/linux/mm.h:3086 [inline]
pmd_alloc_one_noprof include/asm-generic/pgalloc.h:141 [inline]
__pmd_alloc+0xc3/0x820 mm/memory.c:6079
pmd_alloc include/linux/mm.h:2835 [inline]
alloc_new_pmd mm/mremap.c:96 [inline]
move_page_tables+0x2218/0x3780 mm/mremap.c:608
shift_arg_pages+0x1eb/0x410 fs/exec.c:758
setup_arg_pages+0x516/0xc70 fs/exec.c:880
load_elf_binary+0xa66/0x4d90 fs/binfmt_elf.c:1014
search_binary_handler fs/exec.c:1827 [inline]

exec_binprm fs/exec.c:1869 [inline]
bprm_execve fs/exec.c:1920 [inline]

bprm_execve+0x703/0x1960 fs/exec.c:1896
do_execveat_common.isra.0+0x4f1/0x630 fs/exec.c:2027
do_execve fs/exec.c:2101 [inline]
__do_sys_execve fs/exec.c:2177 [inline]
__se_sys_execve fs/exec.c:2172 [inline]
__x64_sys_execve+0x8c/0xb0 fs/exec.c:2172

do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:

ffff888031b08e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888031b08f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888031b08f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888031b09000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888031b09080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Tested on:

commit: d1f2d51b Merge tag 'clk-fixes-for-linus' of git://git...
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=14151f29980000

kernel config: https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=15449ffb980000

Hillf Danton

unread,

Sep 8, 2024, 9:38:05 AMSep 8

to syzbot, linux-...@vger.kernel.org, syzkall...@googlegroups.com

On Sat, 07 Sep 2024 07:42:26 -0700

> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 788220eee30d Merge tag 'pm-6.11-rc7' of git://git.kernel.o..
> git tree: upstream

> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1304189f980000

#syz test

--- x/net/bluetooth/hci_core.c
+++ y/net/bluetooth/hci_core.c

@@ -3782,13 +3782,18 @@ static void hci_acldata_packet(struct hc

hci_dev_lock(hdev);
conn = hci_conn_hash_lookup_handle(hdev, handle);

+ if (conn)
+ hci_conn_get(conn);
hci_dev_unlock(hdev);

if (conn) {
hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);

+ hci_req_sync_lock(hdev);
/* Send to upper protocol */
l2cap_recv_acldata(conn, skb, flags);
+ hci_req_sync_unlock(hdev);

+ hci_conn_put(conn);

syzbot

unread,

Sep 8, 2024, 9:58:04 AMSep 8

to hda...@sina.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

possible deadlock in hci_dev_do_close

======================================================
WARNING: possible circular locking dependency detected
6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0 Not tainted
------------------------------------------------------

syz-executor/5776 is trying to acquire lock:
ffff88807d6ca148 ((wq_completion)hci1#2){+.+.}-{0:0}, at: touch_wq_lockdep_map+0x6e/0x120 kernel/workqueue.c:3875

but task is already holding lock:

ffff888060a68d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close+0x26/0x90 net/bluetooth/hci_core.c:481

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #2 (&hdev->req_lock){+.+.}-{3:3}:

__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752

hci_acldata_packet net/bluetooth/hci_core.c:3792 [inline]
hci_rx_work+0xabf/0x1650 net/bluetooth/hci_core.c:4033

process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

-> #1 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}:
process_one_work+0x927/0x1b40 kernel/workqueue.c:3207

process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

-> #0 ((wq_completion)hci1#2){+.+.}-{0:0}:

check_prev_add kernel/locking/lockdep.c:3133 [inline]
check_prevs_add kernel/locking/lockdep.c:3252 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]
__lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142
lock_acquire kernel/locking/lockdep.c:5759 [inline]
lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724

touch_wq_lockdep_map+0x78/0x120 kernel/workqueue.c:3875
__flush_workqueue+0x129/0x1200 kernel/workqueue.c:3917
drain_workqueue+0x18f/0x3d0 kernel/workqueue.c:4081
hci_dev_close_sync+0x333/0x1110 net/bluetooth/hci_sync.c:5181

hci_dev_do_close+0x2e/0x90 net/bluetooth/hci_core.c:483
hci_unregister_dev+0x213/0x620 net/bluetooth/hci_core.c:2698
vhci_release+0x7f/0x100 drivers/bluetooth/hci_vhci.c:664
__fput+0x408/0xbb0 fs/file_table.c:422
task_work_run+0x14e/0x250 kernel/task_work.c:228
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0xaa3/0x2bb0 kernel/exit.c:882
do_group_exit+0xd3/0x2a0 kernel/exit.c:1031
get_signal+0x25fb/0x2770 kernel/signal.c:2917
arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f

other info that might help us debug this:

Chain exists of:

(wq_completion)hci1#2 --> (work_completion)(&hdev->rx_work) --> &hdev->req_lock

Possible unsafe locking scenario:

CPU0 CPU1
---- ----

lock(&hdev->req_lock);
lock((work_completion)(&hdev->rx_work));
lock(&hdev->req_lock);
lock((wq_completion)hci1#2);

*** DEADLOCK ***

1 lock held by syz-executor/5776:
#0: ffff888060a68d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close+0x26/0x90 net/bluetooth/hci_core.c:481

stack backtrace:
CPU: 0 UID: 0 PID: 5776 Comm: syz-executor Not tainted 6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119

check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2186
check_prev_add kernel/locking/lockdep.c:3133 [inline]
check_prevs_add kernel/locking/lockdep.c:3252 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]
__lock_acquire+0x24ed/0x3cb0 kernel/locking/lockdep.c:5142
lock_acquire kernel/locking/lockdep.c:5759 [inline]
lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5724

touch_wq_lockdep_map+0x78/0x120 kernel/workqueue.c:3875
__flush_workqueue+0x129/0x1200 kernel/workqueue.c:3917
drain_workqueue+0x18f/0x3d0 kernel/workqueue.c:4081
hci_dev_close_sync+0x333/0x1110 net/bluetooth/hci_sync.c:5181

hci_dev_do_close+0x2e/0x90 net/bluetooth/hci_core.c:483
hci_unregister_dev+0x213/0x620 net/bluetooth/hci_core.c:2698
vhci_release+0x7f/0x100 drivers/bluetooth/hci_vhci.c:664
__fput+0x408/0xbb0 fs/file_table.c:422
task_work_run+0x14e/0x250 kernel/task_work.c:228
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0xaa3/0x2bb0 kernel/exit.c:882
do_group_exit+0xd3/0x2a0 kernel/exit.c:1031
get_signal+0x25fb/0x2770 kernel/signal.c:2917
arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f

RIP: 0033:0x7fc96277bb8a
Code: Unable to access opcode bytes at 0x7fc96277bb60.
RSP: 002b:00007ffc87843a70 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 00007fc96277bb8a
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00007ffc87843abc R08: 00007ffc878433cc R09: 00007ffc878437d7
R10: 00007ffc87843450 R11: 0000000000000293 R12: 0000000000000032
R13: 0000000000045913 R14: 00000000000458e1 R15: 00007ffc87843b10
</TASK>

Tested on:

commit: d1f2d51b Merge tag 'clk-fixes-for-linus' of git://git...
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=14dd1f29980000

kernel config: https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=10014877980000

Hillf Danton

unread,

Sep 9, 2024, 7:07:00 AMSep 9

to syzbot, linux-...@vger.kernel.org, syzkall...@googlegroups.com

On Sat, 07 Sep 2024 07:42:26 -0700

> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 788220eee30d Merge tag 'pm-6.11-rc7' of git://git.kernel.o..
> git tree: upstream

> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1304189f980000

#syz test

--- x/net/bluetooth/l2cap_core.c
+++ y/net/bluetooth/l2cap_core.c
@@ -1792,13 +1792,10 @@ static void l2cap_conn_del(struct hci_co

mutex_unlock(&conn->chan_lock);

- hci_chan_del(conn->hchan);
-
if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
cancel_delayed_work_sync(&conn->info_timer);

hcon->l2cap_data = NULL;
- conn->hchan = NULL;
l2cap_conn_put(conn);
}

@@ -1806,6 +1803,7 @@ static void l2cap_conn_free(struct kref
{
struct l2cap_conn *conn = container_of(ref, struct l2cap_conn, ref);

+ hci_chan_del(conn->hchan);
hci_conn_put(conn->hcon);
kfree(conn);
}
@@ -7486,6 +7484,14 @@ void l2cap_recv_acldata(struct hci_conn
if (!conn)
goto drop;

+ hci_dev_lock(hcon->hdev);
+ if (conn != hcon->l2cap_data)
+ conn = NULL;
+ else
+ l2cap_conn_get(conn);
+ hci_dev_unlock(hcon->hdev);

+ if (!conn)
+ goto drop;

BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags);

switch (flags) {
@@ -7512,6 +7518,7 @@ void l2cap_recv_acldata(struct hci_conn

if (len == skb->len) {
/* Complete frame received */
l2cap_recv_frame(conn, skb);

+ l2cap_conn_put(conn);
return;
}

@@ -7576,6 +7583,8 @@ void l2cap_recv_acldata(struct hci_conn

drop:
kfree_skb(skb);
+ if (conn)
+ l2cap_conn_put(conn);

}

static struct hci_cb l2cap_cb = {

--- x/net/bluetooth/hci_core.c
+++ y/net/bluetooth/hci_core.c
@@ -3782,6 +3782,8 @@ static void hci_acldata_packet(struct hc

hci_dev_lock(hdev);
conn = hci_conn_hash_lookup_handle(hdev, handle);
+ if (conn)
+ hci_conn_get(conn);
hci_dev_unlock(hdev);

if (conn) {

@@ -3789,6 +3791,7 @@ static void hci_acldata_packet(struct hc

/* Send to upper protocol */
l2cap_recv_acldata(conn, skb, flags);

syzbot

unread,

Sep 9, 2024, 7:31:04 AMSep 9

to hda...@sina.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

KASAN: slab-use-after-free Read in hci_send_acl

==================================================================
BUG: KASAN: slab-use-after-free in hci_send_acl+0xc03/0xd30 net/bluetooth/hci_core.c:3230
Read of size 8 at addr ffff8880291d1618 by task kworker/u9:8/7107

CPU: 1 UID: 0 PID: 7107 Comm: kworker/u9:8 Not tainted 6.11.0-rc7-syzkaller-gda3ea35007d0-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024

Workqueue: hci1 hci_rx_work

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119

print_address_description mm/kasan/report.c:377 [inline]
print_report+0xc3/0x620 mm/kasan/report.c:488
kasan_report+0xd9/0x110 mm/kasan/report.c:601

hci_send_acl+0xc03/0xd30 net/bluetooth/hci_core.c:3230
l2cap_send_cmd+0x6e5/0x920 net/bluetooth/l2cap_core.c:973
l2cap_connect.constprop.0+0x6f7/0x1270 net/bluetooth/l2cap_core.c:4032
l2cap_connect_req net/bluetooth/l2cap_core.c:4078 [inline]
l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4770 [inline]
l2cap_sig_channel net/bluetooth/l2cap_core.c:5541 [inline]
l2cap_recv_frame+0xf0b/0x8eb0 net/bluetooth/l2cap_core.c:6823
l2cap_recv_acldata+0xc03/0xf00 net/bluetooth/l2cap_core.c:7520
hci_acldata_packet net/bluetooth/hci_core.c:3793 [inline]
hci_rx_work+0xabe/0x1630 net/bluetooth/hci_core.c:4031

process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

</TASK>

Allocated by task 54:

kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:387
kmalloc_noprof include/linux/slab.h:681 [inline]
kzalloc_noprof include/linux/slab.h:807 [inline]

hci_chan_create+0xa6/0x3d0 net/bluetooth/hci_conn.c:2732
l2cap_conn_add.part.0+0x1a/0xa60 net/bluetooth/l2cap_core.c:6862
l2cap_conn_add net/bluetooth/l2cap_core.c:69 [inline]
l2cap_connect_cfm+0x428/0xf80 net/bluetooth/l2cap_core.c:7243

hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
hci_remote_features_evt+0x548/0x9e0 net/bluetooth/hci_event.c:3721

hci_event_func net/bluetooth/hci_event.c:7446 [inline]
hci_event_packet+0x9eb/0x1180 net/bluetooth/hci_event.c:7498

hci_rx_work+0x2c6/0x1630 net/bluetooth/hci_core.c:4026

process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Freed by task 5973:

kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
poison_slab_object+0xf7/0x160 mm/kasan/common.c:240
__kasan_slab_free+0x32/0x50 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2256 [inline]
slab_free mm/slub.c:4477 [inline]
kfree+0x12a/0x3b0 mm/slub.c:4598

hci_chan_list_flush+0x81/0xf0 net/bluetooth/hci_conn.c:2772
hci_conn_cleanup net/bluetooth/hci_conn.c:150 [inline]
hci_conn_del+0x1cc/0xdb0 net/bluetooth/hci_conn.c:1162

hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583
abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2917
hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328

process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

The buggy address belongs to the object at ffff8880291d1600
which belongs to the cache kmalloc-128 of size 128
The buggy address is located 24 bytes inside of
freed 128-byte region [ffff8880291d1600, ffff8880291d1680)

The buggy address belongs to the physical page:

page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880291d1900 pfn:0x291d1
flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xfdffffff(slab)
raw: 00fff00000000200 ffff88801ac41a00 ffffea0001fd5a90 ffffea00009ed310
raw: ffff8880291d1900 000000000010000d 00000001fdffffff 0000000000000000

page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 0, migratetype Unmovable, gfp_mask 0x352800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL|__GFP_THISNODE), pid 5909, tgid 5909 (syz-executor), ts 135353944743, free_ts 135353325117

set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1500
prep_new_page mm/page_alloc.c:1508 [inline]
get_page_from_freelist+0x1351/0x2e50 mm/page_alloc.c:3446
__alloc_pages_noprof+0x22b/0x2460 mm/page_alloc.c:4702
__alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
alloc_slab_page+0x4e/0xf0 mm/slub.c:2325
allocate_slab mm/slub.c:2488 [inline]
new_slab+0x84/0x260 mm/slub.c:2541
___slab_alloc+0xdac/0x1870 mm/slub.c:3727
__slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3817
__slab_alloc_node mm/slub.c:3870 [inline]
slab_alloc_node mm/slub.c:4029 [inline]

__do_kmalloc_node mm/slub.c:4161 [inline]
__kmalloc_node_noprof+0x357/0x430 mm/slub.c:4168
kmalloc_array_node_noprof include/linux/slab.h:788 [inline]
alloc_slab_obj_exts+0x41/0xa0 mm/slub.c:1976
__memcg_slab_post_alloc_hook+0x2bc/0x9c0 mm/memcontrol.c:3019
memcg_slab_post_alloc_hook mm/slub.c:2164 [inline]
slab_post_alloc_hook mm/slub.c:4002 [inline]
slab_alloc_node mm/slub.c:4041 [inline]
kmem_cache_alloc_noprof+0x2c6/0x2f0 mm/slub.c:4048
copy_sighand+0x43/0x2c0 kernel/fork.c:1794
copy_process+0x2771/0x8de0 kernel/fork.c:2368
kernel_clone+0xfd/0x960 kernel/fork.c:2781
__do_sys_clone+0xba/0x100 kernel/fork.c:2924

do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83

page last free pid 5909 tgid 5909 stack trace:

reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1101 [inline]
free_unref_page+0x64a/0xe40 mm/page_alloc.c:2619

vfree+0x181/0x7a0 mm/vmalloc.c:3367
copy_entries_to_user net/ipv6/netfilter/ip6_tables.c:882 [inline]
get_entries net/ipv6/netfilter/ip6_tables.c:1039 [inline]
do_ip6t_get_ctl+0x8ec/0xaf0 net/ipv6/netfilter/ip6_tables.c:1677
nf_getsockopt+0x79/0xe0 net/netfilter/nf_sockopt.c:116
ipv6_getsockopt+0x1fd/0x2c0 net/ipv6/ipv6_sockglue.c:1493
tcp_getsockopt+0x9e/0x100 net/ipv4/tcp.c:4409
do_sock_getsockopt+0x3fe/0x800 net/socket.c:2386
__sys_getsockopt+0x1a1/0x270 net/socket.c:2415
__do_sys_getsockopt net/socket.c:2425 [inline]
__se_sys_getsockopt net/socket.c:2422 [inline]
__x64_sys_getsockopt+0xbd/0x160 net/socket.c:2422

do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:

ffff8880291d1500: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc
ffff8880291d1580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8880291d1600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880291d1680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8880291d1700: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc
==================================================================

Tested on:

commit: da3ea350 Linux 6.11-rc7
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15a3389f980000
kernel config: https://syzkaller.appspot.com/x/.config?x=28869f34c32848cf

dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=131ace00580000

syzbot

unread,

Sep 10, 2024, 2:43:04 PMSep 10

to ead...@qq.com, hda...@sina.com, johan....@gmail.com, linux-b...@vger.kernel.org, linux-...@vger.kernel.org, luiz....@gmail.com, luiz.vo...@intel.com, mar...@holtmann.org, syzkall...@googlegroups.com

syzbot has bisected this issue to:

commit 5af1f84ed13a416297ab9ced7537f4d5ae7f329a
Author: Luiz Augusto von Dentz <luiz.vo...@intel.com>
Date: Thu Aug 3 18:04:51 2023 +0000

Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=12477bc7980000
start commit: 788220eee30d Merge tag 'pm-6.11-rc7' of git://git.kernel.o..
git tree: upstream
final oops: https://syzkaller.appspot.com/x/report.txt?x=11477bc7980000
console output: https://syzkaller.appspot.com/x/log.txt?x=16477bc7980000

kernel config: https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11da6f29980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1304189f980000

Reported-by: syzbot+c12e2f...@syzkaller.appspotmail.com
Fixes: 5af1f84ed13a ("Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

Luiz Augusto von Dentz

unread,

Sep 10, 2024, 4:57:01 PMSep 10

to Edward Adam Davis, syzbot+c12e2f...@syzkaller.appspotmail.com, johan....@gmail.com, linux-b...@vger.kernel.org, linux-...@vger.kernel.org, mar...@holtmann.org, syzkall...@googlegroups.com

Hi Edward,

This is sort of risky, we shouldn't be calling this deep into the
stack with hci_dev_lock held.

>
> kfree_skb(skb);
> }
> diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> index 9988ba382b68..b948b0a3b2f2 100644
> --- a/net/bluetooth/l2cap_core.c
> +++ b/net/bluetooth/l2cap_core.c
> @@ -4072,10 +4072,8 @@ static int l2cap_connect_req(struct l2cap_conn *conn,
> if (cmd_len < sizeof(struct l2cap_conn_req))
> return -EPROTO;
>
> - hci_dev_lock(hdev);
> if (hci_dev_test_flag(hdev, HCI_MGMT))
> mgmt_device_connected(hdev, hcon, NULL, 0);
> - hci_dev_unlock(hdev);

So this might explain why things gets freed while processing the
request, we are locking to call mgmt_device_connected which I suspect
is no longer needed ever since:

commit db11223571d489d1aab575a4ac4b7352d2d54e2f

Author: Luiz Augusto von Dentz <luiz.vo...@intel.com>

Date: Tue Oct 25 14:12:58 2022 -0700

Bluetooth: btusb: Default CONFIG_BT_HCIBTUSB_POLL_SYNC=y

poll_sync has been proven to fix races of USB data and event endpoints
so this enables it by default.

Signed-off-by: Luiz Augusto von Dentz <luiz.vo...@intel.com>
Tested-by: Tedd Ho-Jeong An <ted...@intel.com>

Anyway syzbot don't use btusb so I think this might be due some
command pending that the emulator is not responding and instead
sending data, and then there is the issue that 7b064edae38d
("Bluetooth: Fix authentication if acl data comes before remote
feature evt") attempted to fix which I think it actually made it worse
by moving the call to mgmt_device_connected into l2cap_core.c it sort
move the problem but didn't fix the actual problem.

Maybe something like the following would be a better approach:

https://gist.github.com/Vudentz/121a15fa4391b2b1f6c7e8d420a6846e

>
> l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP);
> return 0;
> --
> 2.43.0
>

--
Luiz Augusto von Dentz

Hillf Danton

unread,

Sep 11, 2024, 7:30:13 AMSep 11

to syzbot, linux-...@vger.kernel.org, syzkall...@googlegroups.com

On Sat, 07 Sep 2024 07:42:26 -0700
> syzbot has found a reproducer for the following issue on:
>

> HEAD commit: 788220eee30d Merge tag 'pm-6.11-rc7' of git://git.kernel.o..
> git tree: upstream

> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1304189f980000

#syz test

--- x/net/bluetooth/hci_core.c
+++ y/net/bluetooth/hci_core.c
@@ -3782,6 +3782,8 @@ static void hci_acldata_packet(struct hc

hci_dev_lock(hdev);
conn = hci_conn_hash_lookup_handle(hdev, handle);

+ if (conn)
+ hci_conn_get(conn);
hci_dev_unlock(hdev);

if (conn) {
@@ -3789,6 +3791,7 @@ static void hci_acldata_packet(struct hc

/* Send to upper protocol */
l2cap_recv_acldata(conn, skb, flags);

+ hci_conn_put(conn);

return;
} else {
bt_dev_err(hdev, "ACL packet for unknown connection handle %d",

--- x/net/bluetooth/l2cap_core.c
+++ y/net/bluetooth/l2cap_core.c
@@ -1792,13 +1792,10 @@ static void l2cap_conn_del(struct hci_co

mutex_unlock(&conn->chan_lock);

- hci_chan_del(conn->hchan);
-
if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
cancel_delayed_work_sync(&conn->info_timer);

hcon->l2cap_data = NULL;
- conn->hchan = NULL;
l2cap_conn_put(conn);
}

@@ -1806,6 +1803,7 @@ static void l2cap_conn_free(struct kref
{
struct l2cap_conn *conn = container_of(ref, struct l2cap_conn, ref);

+ hci_chan_del(conn->hchan);
hci_conn_put(conn->hcon);
kfree(conn);
}

@@ -4073,11 +4071,15 @@ static int l2cap_connect_req(struct l2ca
return -EPROTO;

hci_dev_lock(hdev);
+ if (hcon->state == BT_CLOSED) {
+ hci_dev_unlock(hdev);
+ return -EPROTO;
+ }

if (hci_dev_test_flag(hdev, HCI_MGMT))
mgmt_device_connected(hdev, hcon, NULL, 0);
- hci_dev_unlock(hdev);

l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP);
+ hci_dev_unlock(hdev);
return 0;
}

@@ -7486,6 +7488,14 @@ void l2cap_recv_acldata(struct hci_conn

if (!conn)
goto drop;

+ hci_dev_lock(hcon->hdev);
+ if (conn != hcon->l2cap_data)
+ conn = NULL;
+ else
+ l2cap_conn_get(conn);
+ hci_dev_unlock(hcon->hdev);
+ if (!conn)
+ goto drop;
BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags);

switch (flags) {

@@ -7512,6 +7522,7 @@ void l2cap_recv_acldata(struct hci_conn

if (len == skb->len) {
/* Complete frame received */
l2cap_recv_frame(conn, skb);
+ l2cap_conn_put(conn);
return;
}

@@ -7576,6 +7587,8 @@ void l2cap_recv_acldata(struct hci_conn

syzbot

unread,

Sep 11, 2024, 7:59:04 AMSep 11

to hda...@sina.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in hci_send_acl

Bluetooth: Wrong link type (-22)

Bluetooth: Wrong link type (-71)

==================================================================
BUG: KASAN: slab-use-after-free in hci_send_acl+0xc03/0xd30 net/bluetooth/hci_core.c:3230

Read of size 8 at addr ffff8880252f2018 by task kworker/u9:5/6019

CPU: 0 UID: 0 PID: 6019 Comm: kworker/u9:5 Not tainted 6.11.0-rc7-syzkaller-00020-g8d8d276ba2fb-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: hci2 hci_rx_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
print_address_description mm/kasan/report.c:377 [inline]
print_report+0xc3/0x620 mm/kasan/report.c:488
kasan_report+0xd9/0x110 mm/kasan/report.c:601

hci_send_acl+0xc03/0xd30 net/bluetooth/hci_core.c:3230
l2cap_send_cmd+0x6e5/0x920 net/bluetooth/l2cap_core.c:973

l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5512 [inline]
l2cap_sig_channel net/bluetooth/l2cap_core.c:5548 [inline]
l2cap_recv_frame+0x21db/0x8f20 net/bluetooth/l2cap_core.c:6827
l2cap_recv_acldata+0xc03/0xf00 net/bluetooth/l2cap_core.c:7524

hci_acldata_packet net/bluetooth/hci_core.c:3793 [inline]
hci_rx_work+0xabe/0x1630 net/bluetooth/hci_core.c:4031

process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

</TASK>

Allocated by task 6020:

kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68

poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:387
kmalloc_noprof include/linux/slab.h:681 [inline]
kzalloc_noprof include/linux/slab.h:807 [inline]
hci_chan_create+0xa6/0x3d0 net/bluetooth/hci_conn.c:2732

l2cap_conn_add.part.0+0x1a/0xa60 net/bluetooth/l2cap_core.c:6866
l2cap_conn_add net/bluetooth/l2cap_core.c:69 [inline]
l2cap_connect_cfm+0x428/0xf80 net/bluetooth/l2cap_core.c:7247

hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
hci_remote_features_evt+0x548/0x9e0 net/bluetooth/hci_event.c:3721
hci_event_func net/bluetooth/hci_event.c:7446 [inline]
hci_event_packet+0x9eb/0x1180 net/bluetooth/hci_event.c:7498
hci_rx_work+0x2c6/0x1630 net/bluetooth/hci_core.c:4026

process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Freed by task 5281:

kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
poison_slab_object+0xf7/0x160 mm/kasan/common.c:240
__kasan_slab_free+0x32/0x50 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2256 [inline]
slab_free mm/slub.c:4477 [inline]
kfree+0x12a/0x3b0 mm/slub.c:4598

hci_chan_list_flush+0x81/0xf0 net/bluetooth/hci_conn.c:2772
hci_conn_cleanup net/bluetooth/hci_conn.c:150 [inline]
hci_conn_del+0x1cc/0xdb0 net/bluetooth/hci_conn.c:1162

hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583
abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2917
hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328
process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

The buggy address belongs to the object at ffff8880252f2000

which belongs to the cache kmalloc-128 of size 128
The buggy address is located 24 bytes inside of

freed 128-byte region [ffff8880252f2000, ffff8880252f2080)

The buggy address belongs to the physical page:

page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880252f2900 pfn:0x252f2

flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xfdffffff(slab)

raw: 00fff00000000200 ffff88801ac41a00 ffffea00007ba290 ffffea00008abdd0
raw: ffff8880252f2900 000000000010000c 00000001fdffffff 0000000000000000

page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 0, migratetype Unmovable, gfp_mask 0x152cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 6020, tgid 6020 (kworker/u9:6), ts 135162004436, free_ts 135147554210

set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1500
prep_new_page mm/page_alloc.c:1508 [inline]
get_page_from_freelist+0x1351/0x2e50 mm/page_alloc.c:3446
__alloc_pages_noprof+0x22b/0x2460 mm/page_alloc.c:4702
__alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
alloc_slab_page+0x4e/0xf0 mm/slub.c:2325
allocate_slab mm/slub.c:2488 [inline]
new_slab+0x84/0x260 mm/slub.c:2541
___slab_alloc+0xdac/0x1870 mm/slub.c:3727
__slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3817
__slab_alloc_node mm/slub.c:3870 [inline]
slab_alloc_node mm/slub.c:4029 [inline]

__kmalloc_cache_noprof+0x2b4/0x300 mm/slub.c:4188

kmalloc_noprof include/linux/slab.h:681 [inline]
kzalloc_noprof include/linux/slab.h:807 [inline]
hci_chan_create+0xa6/0x3d0 net/bluetooth/hci_conn.c:2732

l2cap_conn_add.part.0+0x1a/0xa60 net/bluetooth/l2cap_core.c:6866
l2cap_conn_add net/bluetooth/l2cap_core.c:69 [inline]
l2cap_connect_cfm+0x428/0xf80 net/bluetooth/l2cap_core.c:7247

hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]
hci_remote_features_evt+0x548/0x9e0 net/bluetooth/hci_event.c:3721
hci_event_func net/bluetooth/hci_event.c:7446 [inline]
hci_event_packet+0x9eb/0x1180 net/bluetooth/hci_event.c:7498
hci_rx_work+0x2c6/0x1630 net/bluetooth/hci_core.c:4026

process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389

page last free pid 5597 tgid 5597 stack trace:

reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1101 [inline]

free_unref_folios+0x9e9/0x1390 mm/page_alloc.c:2667
folios_put_refs+0x560/0x760 mm/swap.c:1039
free_pages_and_swap_cache+0x36d/0x510 mm/swap_state.c:332
__tlb_batch_free_encoded_pages+0xf9/0x290 mm/mmu_gather.c:136
tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:366 [inline]
tlb_flush_mmu mm/mmu_gather.c:373 [inline]
tlb_finish_mmu+0x168/0x7b0 mm/mmu_gather.c:465
exit_mmap+0x3d1/0xb20 mm/mmap.c:3425
__mmput+0x12a/0x480 kernel/fork.c:1345
mmput+0x62/0x70 kernel/fork.c:1367
exit_mm kernel/exit.c:571 [inline]
do_exit+0x9bf/0x2bb0 kernel/exit.c:869
do_group_exit+0xd3/0x2a0 kernel/exit.c:1031
__do_sys_exit_group kernel/exit.c:1042 [inline]
__se_sys_exit_group kernel/exit.c:1040 [inline]
__x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1040
x64_sys_call+0x14a9/0x16a0 arch/x86/include/generated/asm/syscalls_64.h:232

do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:

ffff8880252f1f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8880252f1f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8880252f2000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880252f2080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8880252f2100: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc
==================================================================

Tested on:

commit: 8d8d276b Merge tag 'trace-v6.11-rc6' of git://git.kern..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11556100580000

kernel config: https://syzkaller.appspot.com/x/.config?x=28869f34c32848cf
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=162a07c7980000

Hillf Danton

unread,

Sep 12, 2024, 7:49:26 AMSep 12

to syzbot, linux-...@vger.kernel.org, syzkall...@googlegroups.com

On Sat, 07 Sep 2024 07:42:26 -0700
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 788220eee30d Merge tag 'pm-6.11-rc7' of git://git.kernel.o..
> git tree: upstream
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1304189f980000

#syz test

--- x/include/net/bluetooth/hci_core.h
+++ y/include/net/bluetooth/hci_core.h
@@ -511,6 +511,7 @@ struct hci_dev {
struct sk_buff *recv_event;

struct mutex req_lock;
+ struct mutex rx_lock;
wait_queue_head_t req_wait_q;
__u32 req_status;
__u32 req_result;
--- x/net/bluetooth/hci_core.c
+++ y/net/bluetooth/hci_core.c
@@ -2507,6 +2507,7 @@ struct hci_dev *hci_alloc_dev_priv(int s

mutex_init(&hdev->lock);
mutex_init(&hdev->req_lock);
+ mutex_init(&hdev->rx_lock);

ida_init(&hdev->unset_handle_ida);

@@ -3977,6 +3978,7 @@ static void hci_rx_work(struct work_stru

BT_DBG("%s", hdev->name);

+ mutex_lock(&hdev->rx_lock);
/* The kcov_remote functions used for collecting packet parsing
* coverage information from this background thread and associate
* the coverage with the syscall's thread which originally injected
@@ -4043,6 +4045,7 @@ static void hci_rx_work(struct work_stru
break;
}
}
+ mutex_unlock(&hdev->rx_lock);
}

static void hci_send_cmd_sync(struct hci_dev *hdev, struct sk_buff *skb)
--- x/net/bluetooth/hci_sync.c
+++ y/net/bluetooth/hci_sync.c
@@ -325,9 +325,11 @@ static void hci_cmd_sync_work(struct wor
int err;

hci_req_sync_lock(hdev);
+ mutex_lock(&hdev->rx_lock);
err = entry->func(hdev, entry->data);
if (entry->destroy)
entry->destroy(hdev, entry->data, err);
+ mutex_unlock(&hdev->rx_lock);
hci_req_sync_unlock(hdev);
}

--

syzbot

unread,

Sep 12, 2024, 10:51:04 AMSep 12

to hda...@sina.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+c12e2f...@syzkaller.appspotmail.com
Tested-by: syzbot+c12e2f...@syzkaller.appspotmail.com

Tested on:

commit: 77f58789 Merge tag 'arm-fixes-6.11-3' of git://git.ker..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1190149f980000

kernel config: https://syzkaller.appspot.com/x/.config?x=28869f34c32848cf
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=14c2d807980000

Luiz Augusto von Dentz

unread,

Sep 20, 2024, 11:07:22 AMSep 20

to Edward Adam Davis, syzbot+c12e2f...@syzkaller.appspotmail.com, johan....@gmail.com, linux-b...@vger.kernel.org, linux-...@vger.kernel.org, mar...@holtmann.org, syzkall...@googlegroups.com

Hi Edward,

Any comments? Are you still planning to work on this?

Edward Adam Davis

unread,

Sep 20, 2024, 9:41:10 PMSep 20

to luiz....@gmail.com, ead...@qq.com, johan....@gmail.com, linux-b...@vger.kernel.org, linux-...@vger.kernel.org, mar...@holtmann.org, syzbot+c12e2f...@syzkaller.appspotmail.com, syzkall...@googlegroups.com

I haven't thought of any better way yet. I understand what you mean, holding
hci_dev_lock for a long time.
At present, it is not impossible to try some strong drugs.

I think 7B064edae38d is used to solve another issue.

> >
> > Maybe something like the following would be a better approach:
> >
> > https://gist.github.com/Vudentz/121a15fa4391b2b1f6c7e8d420a6846e
>
> Any comments? Are you still planning to work on this?

Sorry for late.

>
> > >
> > > l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP);
> > > return 0;
> > > --
> > > 2.43.0
> > >
> >
> >
> > --
> > Luiz Augusto von Dentz

BR,
Edward

Hillf Danton

unread,

Sep 21, 2024, 6:56:33 AMSep 21

to Luiz Augusto von Dentz, Edward Adam Davis, syzbot+c12e2f...@syzkaller.appspotmail.com, linux-b...@vger.kernel.org, linux-...@vger.kernel.org, syzkall...@googlegroups.com

On Tue, Sep 10, 2024 at 4:56 PM Luiz Augusto von Dentz <luiz....@gmail.com> wrote:
>

> Maybe something like the following would be a better approach:
>
> https://gist.github.com/Vudentz/121a15fa4391b2b1f6c7e8d420a6846e

If your idea is not bad, boy, feel free to win Tested-by from syzbot with it.

Luiz Augusto von Dentz

unread,

Sep 23, 2024, 10:33:11 AMSep 23

to Hillf Danton, Edward Adam Davis, syzbot+c12e2f...@syzkaller.appspotmail.com, linux-b...@vger.kernel.org, linux-...@vger.kernel.org, syzkall...@googlegroups.com

Hi Hillf,

Is there a way to quickly check a patch with syzbot?

Aleksandr Nogikh

unread,

Sep 23, 2024, 10:37:45 AMSep 23

to Luiz Augusto von Dentz, Hillf Danton, Edward Adam Davis, syzbot+c12e2f...@syzkaller.appspotmail.com, linux-b...@vger.kernel.org, linux-...@vger.kernel.org, syzkall...@googlegroups.com

On Mon, Sep 23, 2024 at 4:33 PM Luiz Augusto von Dentz

<luiz....@gmail.com> wrote:
>
> Hi Hillf,
>
> On Sat, Sep 21, 2024 at 6:56 AM Hillf Danton <hda...@sina.com> wrote:
> >
> > On Tue, Sep 10, 2024 at 4:56 PM Luiz Augusto von Dentz <luiz....@gmail.com> wrote:
> > >
> > > Maybe something like the following would be a better approach:
> > >
> > > https://gist.github.com/Vudentz/121a15fa4391b2b1f6c7e8d420a6846e
> >
> > If your idea is not bad, boy, feel free to win Tested-by from syzbot with it.
>
> Is there a way to quickly check a patch with syzbot?

You can send a `#syz test` command in a reply to syzbot and attach the
patch-to-test to the email message.

See https://github.com/google/syzkaller/blob/master/docs/syzbot.md#testing-patches

--
Aleksandr

Luiz Augusto von Dentz

unread,

Sep 23, 2024, 11:20:58 AMSep 23

to Aleksandr Nogikh, Hillf Danton, Edward Adam Davis, syzbot+c12e2f...@syzkaller.appspotmail.com, linux-b...@vger.kernel.org, linux-...@vger.kernel.org, syzkall...@googlegroups.com

Hi Aleksandr,

Thanks, lets see if this works:

#syz test

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index d6976db02c06..b2f8f9c5b610 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -3782,6 +3782,8 @@ static void hci_acldata_packet(struct hci_dev

*hdev, struct sk_buff *skb)

hci_dev_lock(hdev);
conn = hci_conn_hash_lookup_handle(hdev, handle);

+ if (conn && hci_dev_test_flag(hdev, HCI_MGMT))
+ mgmt_device_connected(hdev, conn, NULL, 0);
hci_dev_unlock(hdev);

if (conn) {
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 1c82dcdf6e8f..b87c0f1dab9e 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -3706,7 +3706,7 @@ static void hci_remote_features_evt(struct
hci_dev *hdev, void *data,
goto unlock;
}

- if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
+ if (!ev->status) {
struct hci_cp_remote_name_req cp;
memset(&cp, 0, sizeof(cp));
bacpy(&cp.bdaddr, &conn->dst);
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 9988ba382b68..6544c1ed7143 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -4066,17 +4066,9 @@ static void l2cap_connect(struct l2cap_conn
*conn, struct l2cap_cmd_hdr *cmd,

static int l2cap_connect_req(struct l2cap_conn *conn,

struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
{
- struct hci_dev *hdev = conn->hcon->hdev;
- struct hci_conn *hcon = conn->hcon;
-

if (cmd_len < sizeof(struct l2cap_conn_req))
return -EPROTO;

- hci_dev_lock(hdev);

- if (hci_dev_test_flag(hdev, HCI_MGMT))
- mgmt_device_connected(hdev, hcon, NULL, 0);
- hci_dev_unlock(hdev);
-

syzbot

unread,

Sep 23, 2024, 11:28:04 AMSep 23

to ead...@qq.com, hda...@sina.com, linux-b...@vger.kernel.org, linux-...@vger.kernel.org, luiz....@gmail.com, nog...@google.com, syzkall...@googlegroups.com

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to apply patch:
checking file net/bluetooth/hci_core.c
patch: **** malformed patch at line 6: diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c

Tested on:

commit: de5cb0dc Merge branch 'address-masking'
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=57042fe37c7ee7c2

dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
compiler:

patch: https://syzkaller.appspot.com/x/patch.diff?x=127c12a9980000

Aleksandr Nogikh

unread,

Sep 23, 2024, 11:38:19 AMSep 23

to Luiz Augusto von Dentz, Hillf Danton, Edward Adam Davis, syzbot+c12e2f...@syzkaller.appspotmail.com, linux-b...@vger.kernel.org, linux-...@vger.kernel.org, syzkall...@googlegroups.com

Hi Luiz,

On Mon, Sep 23, 2024 at 5:20 PM Luiz Augusto von Dentz

^^ Patch parsing will fail here because it expects to see the git diff
output as is -- i.e. if some line only consisted of a single
whitespace (= it was an empty line and it did not change), it must
remain so. Sometimes these whitespaces get lost during copy-pasting
and it confuses syzbot.

--
Aleksandr

Luiz Augusto von Dentz

unread,

Sep 23, 2024, 11:48:20 AMSep 23

to Aleksandr Nogikh, Hillf Danton, Edward Adam Davis, syzbot+c12e2f...@syzkaller.appspotmail.com, linux-b...@vger.kernel.org, linux-...@vger.kernel.org, syzkall...@googlegroups.com

Hi,

On Mon, Sep 23, 2024 at 11:20 AM Luiz Augusto von Dentz

<luiz....@gmail.com> wrote:
>
> Hi Aleksandr,
>
> On Mon, Sep 23, 2024 at 10:37 AM Aleksandr Nogikh <nog...@google.com> wrote:
> >
> > On Mon, Sep 23, 2024 at 4:33 PM Luiz Augusto von Dentz
> > <luiz....@gmail.com> wrote:
> > >
> > > Hi Hillf,
> > >
> > > On Sat, Sep 21, 2024 at 6:56 AM Hillf Danton <hda...@sina.com> wrote:
> > > >
> > > > On Tue, Sep 10, 2024 at 4:56 PM Luiz Augusto von Dentz <luiz....@gmail.com> wrote:
> > > > >
> > > > > Maybe something like the following would be a better approach:
> > > > >
> > > > > https://gist.github.com/Vudentz/121a15fa4391b2b1f6c7e8d420a6846e
> > > >
> > > > If your idea is not bad, boy, feel free to win Tested-by from syzbot with it.
> > >
> > > Is there a way to quickly check a patch with syzbot?
> >
> > You can send a `#syz test` command in a reply to syzbot and attach the
> > patch-to-test to the email message.
> >
> > See https://github.com/google/syzkaller/blob/master/docs/syzbot.md#testing-patches
>

Lets try again with git diff output:

Aleksandr Nogikh

unread,

Sep 23, 2024, 11:52:01 AMSep 23

to Luiz Augusto von Dentz, syzbot+c12e2f...@syzkaller.appspotmail.com, syzkall...@googlegroups.com

(removed public mailing lists from Cc)

On Mon, Sep 23, 2024 at 5:48 PM Luiz Augusto von Dentz

Looks like the whitespaces still got lost while copy-pasting :(
As an option, you can also just attach the patch as a file.

Luiz Augusto von Dentz

unread,

Sep 23, 2024, 12:13:22 PMSep 23

to Aleksandr Nogikh, syzbot+c12e2f...@syzkaller.appspotmail.com, syzkall...@googlegroups.com

Hi Aleksandr,

On Mon, Sep 23, 2024 at 11:52 AM Aleksandr Nogikh <nog...@google.com> wrote:
>
> (removed public mailing lists from Cc)
>
> On Mon, Sep 23, 2024 at 5:48 PM Luiz Augusto von Dentz
> <luiz....@gmail.com> wrote:
> >
> > Hi,
> >
> > On Mon, Sep 23, 2024 at 11:20 AM Luiz Augusto von Dentz
> > <luiz....@gmail.com> wrote:
> > >
> > > Hi Aleksandr,
> > >
> > > On Mon, Sep 23, 2024 at 10:37 AM Aleksandr Nogikh <nog...@google.com> wrote:
> > > >
> > > > On Mon, Sep 23, 2024 at 4:33 PM Luiz Augusto von Dentz
> > > > <luiz....@gmail.com> wrote:
> > > > >
> > > > > Hi Hillf,
> > > > >
> > > > > On Sat, Sep 21, 2024 at 6:56 AM Hillf Danton <hda...@sina.com> wrote:
> > > > > >
> > > > > > On Tue, Sep 10, 2024 at 4:56 PM Luiz Augusto von Dentz <luiz....@gmail.com> wrote:
> > > > > > >
> > > > > > > Maybe something like the following would be a better approach:
> > > > > > >
> > > > > > > https://gist.github.com/Vudentz/121a15fa4391b2b1f6c7e8d420a6846e
> > > > > >
> > > > > > If your idea is not bad, boy, feel free to win Tested-by from syzbot with it.
> > > > >
> > > > > Is there a way to quickly check a patch with syzbot?
> > > >
> > > > You can send a `#syz test` command in a reply to syzbot and attach the
> > > > patch-to-test to the email message.
> > > >
> > > > See https://github.com/google/syzkaller/blob/master/docs/syzbot.md#testing-patches
> > >

> Looks like the whitespaces still got lost while copy-pasting :(
> As an option, you can also just attach the patch as a file.

Yeah, looks like gmail web client screwing things up, anyway lets try
attaching the patch:

#syz test

patch.diff

syzbot

unread,

Sep 23, 2024, 12:21:04 PMSep 23

to ead...@qq.com, hda...@sina.com, linux-b...@vger.kernel.org, linux-...@vger.kernel.org, luiz....@gmail.com, nog...@google.com, syzkall...@googlegroups.com

patch: https://syzkaller.appspot.com/x/patch.diff?x=11f72107980000

syzbot

unread,

Sep 23, 2024, 12:45:05 PMSep 23

to linux-...@vger.kernel.org, luiz....@gmail.com, nog...@google.com, syzkall...@googlegroups.com

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+c12e2f...@syzkaller.appspotmail.com
Tested-by: syzbot+c12e2f...@syzkaller.appspotmail.com

Tested on:

commit: de5cb0dc Merge branch 'address-masking'
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=13874a27980000
kernel config: https://syzkaller.appspot.com/x/.config?x=40f2e89a3d19f42c
dashboard link: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c

compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=11bff480580000

Reply all

Reply to author

Forward

[syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)

syzbot

syzbot

Hillf Danton

syzbot

Edward Adam Davis

syzbot

Edward Adam Davis

syzbot

Edward Adam Davis

syzbot

Edward Adam Davis

Hillf Danton

syzbot

syzbot

Edward Adam Davis

syzbot

Edward Adam Davis

Hillf Danton

syzbot

Hillf Danton

syzbot

Hillf Danton

syzbot

Hillf Danton

syzbot

Hillf Danton

syzbot

syzbot

Luiz Augusto von Dentz

Hillf Danton

syzbot

Hillf Danton

syzbot

Luiz Augusto von Dentz

Edward Adam Davis

Hillf Danton

Luiz Augusto von Dentz

Aleksandr Nogikh

Luiz Augusto von Dentz

syzbot

Aleksandr Nogikh

Luiz Augusto von Dentz

Aleksandr Nogikh

Luiz Augusto von Dentz

syzbot

syzbot