[syzbot] [bluetooth?] KASAN: stack-out-of-bounds Read in l2cap_send_cmd
1 view
Skip to first unread message
syzbot
12:51 AM (10 hours ago) 12:51 AM
to johan....@gmail.com, linux-b...@vger.kernel.org, linux-...@vger.kernel.org, luiz....@gmail.com, mar...@holtmann.org, syzkall...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: af98e93c5c39 Add linux-next specific files for 20260212
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=170d815a580000
kernel config: https://syzkaller.appspot.com/x/.config?x=61690c38d1398936
dashboard link: https://syzkaller.appspot.com/bug?extid=b7f3e7d9a596bf6a63e3
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=167b7a52580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11549994580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d6acde52048b/disk-af98e93c.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ea8f872a1b5a/vmlinux-af98e93c.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c600c3134b27/bzImage-af98e93c.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b7f3e7...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: stack-out-of-bounds in skb_put_data include/linux/skbuff.h:2800 [inline]
BUG: KASAN: stack-out-of-bounds in l2cap_build_cmd net/bluetooth/l2cap_core.c:3003 [inline]
BUG: KASAN: stack-out-of-bounds in l2cap_send_cmd+0x2a3/0xb90 net/bluetooth/l2cap_core.c:954
Read of size 22 at addr ffffc90003357540 by task kworker/u9:2/5923
CPU: 1 UID: 0 PID: 5923 Comm: kworker/u9:2 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Workqueue: hci0 hci_rx_work
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xba/0x230 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
check_region_inline mm/kasan/generic.c:-1 [inline]
kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200
__asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105
skb_put_data include/linux/skbuff.h:2800 [inline]
l2cap_build_cmd net/bluetooth/l2cap_core.c:3003 [inline]
l2cap_send_cmd+0x2a3/0xb90 net/bluetooth/l2cap_core.c:954
l2cap_ecred_conn_req net/bluetooth/l2cap_core.c:5192 [inline]
l2cap_le_sig_cmd net/bluetooth/l2cap_core.c:5494 [inline]
l2cap_le_sig_channel net/bluetooth/l2cap_core.c:5552 [inline]
l2cap_recv_frame+0xd352/0x10110 net/bluetooth/l2cap_core.c:6897
l2cap_recv_acldata+0x7e9/0x13e0 net/bluetooth/l2cap_core.c:7621
hci_acldata_packet net/bluetooth/hci_core.c:3855 [inline]
hci_rx_work+0x4f9/0x1040 net/bluetooth/hci_core.c:4082
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
process_scheduled_works kernel/workqueue.c:3362 [inline]
worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
kthread+0x388/0x470 kernel/kthread.c:467
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
The buggy address belongs to stack of task kworker/u9:2/5923
and is located at offset 128 in frame:
l2cap_recv_frame+0x0/0x10110 include/linux/skbuff.h:-1
This frame has 26 objects:
[32, 34) 'rsp.i238.i.i'
[48, 88) 'chan.i.i.i'
[128, 146) 'pdu_u.i.i.i'
[192, 202) 'rsp.i94.i.i'
[224, 226) 'rsp.i.i.i111'
[240, 242) 'rej.i'
[256, 258) 'rej.i145.i'
[272, 274) 'rej.i143.i'
[288, 290) 'req.i229.i.i'
[304, 312) 'buf.i222.i.i'
[336, 348) 'buf29.i.i.i'
[368, 372) 'rsp49.i.i.i'
[384, 393) 'rfc.i.i118.i.i'
[416, 480) 'buf.i119.i.i'
[512, 576) 'req.i120.i.i'
[608, 617) 'rfc.i.i.i.i'
[640, 656) 'efs.i.i.i.i'
[672, 678) 'rej.i371.i.i.i'
[704, 710) 'rej.i.i.i.i'
[736, 800) 'rsp.i.i.i'
[832, 896) 'buf.i.i.i'
[928, 1056) 'req.i.i.i'
[1088, 1096) 'rsp.i.i.i.i'
[1120, 1122) 'info.i.i.i.i'
[1136, 1264) 'buf.i.i.i.i'
[1296, 1298) 'rej.i.i'
The buggy address belongs to a 8-page vmalloc region starting at 0xffffc90003350000 allocated at copy_process+0x508/0x3cf0 kernel/fork.c:2050
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x36e0f
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 0000000000000000 ffffea0000db83c8 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x29c2(GFP_NOWAIT|__GFP_HIGHMEM|__GFP_IO|__GFP_FS|__GFP_ZERO), pid 174, tgid 174 (kworker/u8:6), ts 80851768066, free_ts 75368874415
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x231/0x280 mm/page_alloc.c:1889
prep_new_page mm/page_alloc.c:1897 [inline]
get_page_from_freelist+0x24dc/0x2580 mm/page_alloc.c:3962
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5250
alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2485
alloc_frozen_pages_noprof mm/mempolicy.c:2556 [inline]
alloc_pages_noprof+0xa8/0x190 mm/mempolicy.c:2576
vm_area_alloc_pages mm/vmalloc.c:3662 [inline]
__vmalloc_area_node mm/vmalloc.c:3876 [inline]
__vmalloc_node_range_noprof+0x79b/0x1730 mm/vmalloc.c:4064
__vmalloc_node_noprof+0xc2/0x100 mm/vmalloc.c:4124
alloc_thread_stack_node kernel/fork.c:355 [inline]
dup_task_struct+0x228/0x9a0 kernel/fork.c:924
copy_process+0x508/0x3cf0 kernel/fork.c:2050
kernel_clone+0x248/0x8e0 kernel/fork.c:2654
user_mode_thread+0x110/0x180 kernel/fork.c:2730
call_usermodehelper_exec_sync kernel/umh.c:132 [inline]
call_usermodehelper_exec_work+0x9c/0x230 kernel/umh.c:163
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
process_scheduled_works kernel/workqueue.c:3362 [inline]
worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
kthread+0x388/0x470 kernel/kthread.c:467
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
page last free pid 5825 tgid 5825 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1433 [inline]
__free_frozen_pages+0xc2b/0xdb0 mm/page_alloc.c:2978
__folio_put+0x414/0x4f0 mm/swap.c:112
put_netmem include/net/netmem.h:420 [inline]
skb_page_unref include/linux/skbuff_ref.h:43 [inline]
__skb_frag_unref include/linux/skbuff_ref.h:56 [inline]
skb_release_data+0x4cb/0x940 net/core/skbuff.c:1122
skb_release_all net/core/skbuff.c:1203 [inline]
napi_consume_skb+0x1d8/0x290 net/core/skbuff.c:1550
skb_defer_free_flush+0x191/0x260 net/core/dev.c:6807
net_rx_action+0x455/0xf70 net/core/dev.c:7875
handle_softirqs+0x22a/0x870 kernel/softirq.c:626
do_softirq+0x76/0xd0 kernel/softirq.c:523
__local_bh_enable_ip+0xf8/0x130 kernel/softirq.c:450
local_bh_enable include/linux/bottom_half.h:33 [inline]
rcu_read_unlock_bh include/linux/rcupdate.h:924 [inline]
__dev_queue_xmit+0x1e6c/0x38a0 net/core/dev.c:4857
dev_queue_xmit include/linux/netdevice.h:3390 [inline]
neigh_hh_output include/net/neighbour.h:540 [inline]
neigh_output include/net/neighbour.h:554 [inline]
ip_finish_output2+0xc68/0x1070 net/ipv4/ip_output.c:237
NF_HOOK_COND include/linux/netfilter.h:307 [inline]
ip_output+0x29f/0x450 net/ipv4/ip_output.c:438
ip_local_out net/ipv4/ip_output.c:131 [inline]
__ip_queue_xmit+0x1198/0x1be0 net/ipv4/ip_output.c:534
__tcp_transmit_skb+0x2b30/0x43e0 net/ipv4/tcp_output.c:1693
tcp_transmit_skb net/ipv4/tcp_output.c:1711 [inline]
tcp_write_xmit+0x16e8/0x6980 net/ipv4/tcp_output.c:3064
tcp_sendmsg_locked+0x2dc9/0x5490 net/ipv4/tcp.c:1407
Memory state around the buggy address:
ffffc90003357400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffffc90003357480: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 f8 f2 f8 f8
>ffffc90003357500: f8 f8 f8 f2 f2 f2 f2 f2 00 00 02 f2 f2 f2 f2 f2
^
ffffc90003357580: f8 f8 f2 f2 f8 f2 f8 f2 f8 f2 f8 f2 f8 f2 f8 f2
ffffc90003357600: f2 f2 f8 f8 f2 f2 f8 f2 f8 f8 f2 f2 f8 f8 f8 f8
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: af98e93c5c39 Add linux-next specific files for 20260212
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=170d815a580000
kernel config: https://syzkaller.appspot.com/x/.config?x=61690c38d1398936
dashboard link: https://syzkaller.appspot.com/bug?extid=b7f3e7d9a596bf6a63e3
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=167b7a52580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11549994580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d6acde52048b/disk-af98e93c.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ea8f872a1b5a/vmlinux-af98e93c.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c600c3134b27/bzImage-af98e93c.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b7f3e7...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: stack-out-of-bounds in skb_put_data include/linux/skbuff.h:2800 [inline]
BUG: KASAN: stack-out-of-bounds in l2cap_build_cmd net/bluetooth/l2cap_core.c:3003 [inline]
BUG: KASAN: stack-out-of-bounds in l2cap_send_cmd+0x2a3/0xb90 net/bluetooth/l2cap_core.c:954
Read of size 22 at addr ffffc90003357540 by task kworker/u9:2/5923
CPU: 1 UID: 0 PID: 5923 Comm: kworker/u9:2 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Workqueue: hci0 hci_rx_work
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xba/0x230 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
check_region_inline mm/kasan/generic.c:-1 [inline]
kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200
__asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105
skb_put_data include/linux/skbuff.h:2800 [inline]
l2cap_build_cmd net/bluetooth/l2cap_core.c:3003 [inline]
l2cap_send_cmd+0x2a3/0xb90 net/bluetooth/l2cap_core.c:954
l2cap_ecred_conn_req net/bluetooth/l2cap_core.c:5192 [inline]
l2cap_le_sig_cmd net/bluetooth/l2cap_core.c:5494 [inline]
l2cap_le_sig_channel net/bluetooth/l2cap_core.c:5552 [inline]
l2cap_recv_frame+0xd352/0x10110 net/bluetooth/l2cap_core.c:6897
l2cap_recv_acldata+0x7e9/0x13e0 net/bluetooth/l2cap_core.c:7621
hci_acldata_packet net/bluetooth/hci_core.c:3855 [inline]
hci_rx_work+0x4f9/0x1040 net/bluetooth/hci_core.c:4082
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
process_scheduled_works kernel/workqueue.c:3362 [inline]
worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
kthread+0x388/0x470 kernel/kthread.c:467
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
The buggy address belongs to stack of task kworker/u9:2/5923
and is located at offset 128 in frame:
l2cap_recv_frame+0x0/0x10110 include/linux/skbuff.h:-1
This frame has 26 objects:
[32, 34) 'rsp.i238.i.i'
[48, 88) 'chan.i.i.i'
[128, 146) 'pdu_u.i.i.i'
[192, 202) 'rsp.i94.i.i'
[224, 226) 'rsp.i.i.i111'
[240, 242) 'rej.i'
[256, 258) 'rej.i145.i'
[272, 274) 'rej.i143.i'
[288, 290) 'req.i229.i.i'
[304, 312) 'buf.i222.i.i'
[336, 348) 'buf29.i.i.i'
[368, 372) 'rsp49.i.i.i'
[384, 393) 'rfc.i.i118.i.i'
[416, 480) 'buf.i119.i.i'
[512, 576) 'req.i120.i.i'
[608, 617) 'rfc.i.i.i.i'
[640, 656) 'efs.i.i.i.i'
[672, 678) 'rej.i371.i.i.i'
[704, 710) 'rej.i.i.i.i'
[736, 800) 'rsp.i.i.i'
[832, 896) 'buf.i.i.i'
[928, 1056) 'req.i.i.i'
[1088, 1096) 'rsp.i.i.i.i'
[1120, 1122) 'info.i.i.i.i'
[1136, 1264) 'buf.i.i.i.i'
[1296, 1298) 'rej.i.i'
The buggy address belongs to a 8-page vmalloc region starting at 0xffffc90003350000 allocated at copy_process+0x508/0x3cf0 kernel/fork.c:2050
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x36e0f
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 0000000000000000 ffffea0000db83c8 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x29c2(GFP_NOWAIT|__GFP_HIGHMEM|__GFP_IO|__GFP_FS|__GFP_ZERO), pid 174, tgid 174 (kworker/u8:6), ts 80851768066, free_ts 75368874415
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x231/0x280 mm/page_alloc.c:1889
prep_new_page mm/page_alloc.c:1897 [inline]
get_page_from_freelist+0x24dc/0x2580 mm/page_alloc.c:3962
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5250
alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2485
alloc_frozen_pages_noprof mm/mempolicy.c:2556 [inline]
alloc_pages_noprof+0xa8/0x190 mm/mempolicy.c:2576
vm_area_alloc_pages mm/vmalloc.c:3662 [inline]
__vmalloc_area_node mm/vmalloc.c:3876 [inline]
__vmalloc_node_range_noprof+0x79b/0x1730 mm/vmalloc.c:4064
__vmalloc_node_noprof+0xc2/0x100 mm/vmalloc.c:4124
alloc_thread_stack_node kernel/fork.c:355 [inline]
dup_task_struct+0x228/0x9a0 kernel/fork.c:924
copy_process+0x508/0x3cf0 kernel/fork.c:2050
kernel_clone+0x248/0x8e0 kernel/fork.c:2654
user_mode_thread+0x110/0x180 kernel/fork.c:2730
call_usermodehelper_exec_sync kernel/umh.c:132 [inline]
call_usermodehelper_exec_work+0x9c/0x230 kernel/umh.c:163
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
process_scheduled_works kernel/workqueue.c:3362 [inline]
worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
kthread+0x388/0x470 kernel/kthread.c:467
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
page last free pid 5825 tgid 5825 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1433 [inline]
__free_frozen_pages+0xc2b/0xdb0 mm/page_alloc.c:2978
__folio_put+0x414/0x4f0 mm/swap.c:112
put_netmem include/net/netmem.h:420 [inline]
skb_page_unref include/linux/skbuff_ref.h:43 [inline]
__skb_frag_unref include/linux/skbuff_ref.h:56 [inline]
skb_release_data+0x4cb/0x940 net/core/skbuff.c:1122
skb_release_all net/core/skbuff.c:1203 [inline]
napi_consume_skb+0x1d8/0x290 net/core/skbuff.c:1550
skb_defer_free_flush+0x191/0x260 net/core/dev.c:6807
net_rx_action+0x455/0xf70 net/core/dev.c:7875
handle_softirqs+0x22a/0x870 kernel/softirq.c:626
do_softirq+0x76/0xd0 kernel/softirq.c:523
__local_bh_enable_ip+0xf8/0x130 kernel/softirq.c:450
local_bh_enable include/linux/bottom_half.h:33 [inline]
rcu_read_unlock_bh include/linux/rcupdate.h:924 [inline]
__dev_queue_xmit+0x1e6c/0x38a0 net/core/dev.c:4857
dev_queue_xmit include/linux/netdevice.h:3390 [inline]
neigh_hh_output include/net/neighbour.h:540 [inline]
neigh_output include/net/neighbour.h:554 [inline]
ip_finish_output2+0xc68/0x1070 net/ipv4/ip_output.c:237
NF_HOOK_COND include/linux/netfilter.h:307 [inline]
ip_output+0x29f/0x450 net/ipv4/ip_output.c:438
ip_local_out net/ipv4/ip_output.c:131 [inline]
__ip_queue_xmit+0x1198/0x1be0 net/ipv4/ip_output.c:534
__tcp_transmit_skb+0x2b30/0x43e0 net/ipv4/tcp_output.c:1693
tcp_transmit_skb net/ipv4/tcp_output.c:1711 [inline]
tcp_write_xmit+0x16e8/0x6980 net/ipv4/tcp_output.c:3064
tcp_sendmsg_locked+0x2dc9/0x5490 net/ipv4/tcp.c:1407
Memory state around the buggy address:
ffffc90003357400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffffc90003357480: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 f8 f2 f8 f8
>ffffc90003357500: f8 f8 f8 f2 f2 f2 f2 f2 00 00 02 f2 f2 f2 f2 f2
^
ffffc90003357580: f8 f8 f2 f2 f8 f2 f8 f2 f8 f2 f8 f2 f8 f2 f8 f2
ffffc90003357600: f2 f2 f8 f8 f2 f2 f8 f2 f8 f8 f2 f2 f8 f8 f8 f8
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
9:59 AM (1 hour ago) 9:59 AM
to linux-...@vger.kernel.org, syzkall...@googlegroups.com
For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.
***
Subject: [PATCH] Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req
Author: jacob.p...@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git af98e93c5c39
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -5075,14 +5075,14 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
cmd_len -= sizeof(*req);
num_scid = cmd_len / sizeof(u16);
- /* Always respond with the same number of scids as in the request */
- rsp_len = cmd_len;
-
if (num_scid > L2CAP_ECRED_MAX_CID) {
result = L2CAP_CR_LE_INVALID_PARAMS;
goto response;
}
+ /* Always respond with the same number of scids as in the request */
+ rsp_len = cmd_len;
+
mtu = __le16_to_cpu(req->mtu);
mps = __le16_to_cpu(req->mps);
--
2.43.0
linux-...@vger.kernel.org, syzkall...@googlegroups.com.
***
Subject: [PATCH] Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req
Author: jacob.p...@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git af98e93c5c39
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -5075,14 +5075,14 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
cmd_len -= sizeof(*req);
num_scid = cmd_len / sizeof(u16);
- /* Always respond with the same number of scids as in the request */
- rsp_len = cmd_len;
-
if (num_scid > L2CAP_ECRED_MAX_CID) {
result = L2CAP_CR_LE_INVALID_PARAMS;
goto response;
}
+ /* Always respond with the same number of scids as in the request */
+ rsp_len = cmd_len;
+
mtu = __le16_to_cpu(req->mtu);
mps = __le16_to_cpu(req->mps);
--
2.43.0
syzbot
10:30 AM (14 minutes ago) 10:30 AM
to jacob.p...@gmail.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+b7f3e7...@syzkaller.appspotmail.com
Tested-by: syzbot+b7f3e7...@syzkaller.appspotmail.com
Tested on:
commit: af98e93c Add linux-next specific files for 20260212
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
console output: https://syzkaller.appspot.com/x/log.txt?x=141ac8da580000
Note: testing is done by a robot and is best-effort only.
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+b7f3e7...@syzkaller.appspotmail.com
Tested-by: syzbot+b7f3e7...@syzkaller.appspotmail.com
Tested on:
commit: af98e93c Add linux-next specific files for 20260212
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
console output: https://syzkaller.appspot.com/x/log.txt?x=141ac8da580000
kernel config: https://syzkaller.appspot.com/x/.config?x=61690c38d1398936
dashboard link: https://syzkaller.appspot.com/bug?extid=b7f3e7d9a596bf6a63e3
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=13aac8da580000
dashboard link: https://syzkaller.appspot.com/bug?extid=b7f3e7d9a596bf6a63e3
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
Note: testing is done by a robot and is best-effort only.
Reply all
Reply to author
Forward
0 new messages