[syzbot-moderation] Monthly bluetooth report (Sep 2025)

[syzbot]

Hello bluetooth maintainers/developers,

This is a 31-day syzbot report for the bluetooth subsystem.
All related reports/information can be found at:
https://syzkaller.appspot.com/upstream/s/bluetooth

During the period, 2 new issues were detected and 1 were fixed.
In total, 38 issues are still open and 91 have already been fixed.

Some of the still happening issues:

Ref Crashes Repro Title
<1> 43283 Yes KASAN: slab-use-after-free Read in l2cap_unregister_user
https://syzkaller.appspot.com/bug?extid=14b6d57fb728e27ce23c
<2> 7364 Yes WARNING in call_timer_fn
https://syzkaller.appspot.com/bug?extid=6fb78d577e89e69602f9
<3> 3411 Yes general protection fault in lock_sock_nested
https://syzkaller.appspot.com/bug?extid=d3ccfb78a0dc16ffebe3
<4> 1710 Yes general protection fault in h5_recv
https://syzkaller.appspot.com/bug?extid=b5691bb559396b262064
<5> 719 Yes WARNING in hci_conn_timeout (2)
https://syzkaller.appspot.com/bug?extid=fc4b5b2477d4ca272907
<6> 360 Yes WARNING: ODEBUG bug in hci_release_dev (2)
https://syzkaller.appspot.com/bug?extid=b170dbf55520ebf5969a
<7> 304 No WARNING in l2cap_chan_del
https://syzkaller.appspot.com/bug?extid=3272785b7a1fc9b510f6
<8> 274 Yes possible deadlock in l2cap_conn_del
https://syzkaller.appspot.com/bug?extid=b71bb48c13bf3fed3692
<9> 139 Yes KASAN: slab-use-after-free Read in l2cap_recv_frame
https://syzkaller.appspot.com/bug?extid=5c915dc5dd417b83b348
<10> 113 No BUG: corrupted list in hci_cmd_sync_dequeue_once
https://syzkaller.appspot.com/bug?extid=5250d87dea2afdb718a5

The report will be sent to: [linux-b...@vger.kernel.org luiz....@gmail.com mar...@holtmann.org linux-...@vger.kernel.org].

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

To disable reminders for individual bugs, reply with the following command:
#syz set <Ref> no-reminders

To change bug's subsystems, reply with:
#syz set <Ref> subsystems: new-subsystem

If the report looks fine to you, reply with:
#syz upstream

To regenerate the report, reply with:
#syz regenerate

You may send multiple commands in a single email message.

[Aleksandr Nogikh]

#syz upstream

> --
> You received this message because you are subscribed to the Google Groups "syzkaller-upstream-moderation" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-upstream-m...@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/syzkaller-upstream-moderation/68d3e4dd.a70a0220.4f78.001f.GAE%40google.com.