syzbot


KCSAN: data-race in hci_uart_open / hci_uart_tty_close

Status: moderation: reported on 2025/10/27 04:27
Subsystems: bluetooth
[Documentation on labels]
Reported-by: syzbot+072dd099702efe664172@syzkaller.appspotmail.com
First crash: 3d07h, last: 3d07h

Sample crash report:
==================================================================
BUG: KCSAN: data-race in hci_uart_open / hci_uart_tty_close

write to 0xffff88813ae41410 of 8 bytes by task 20904 on cpu 1:
 hci_uart_close drivers/bluetooth/hci_ldisc.c:269 [inline]
 hci_uart_tty_close+0x61/0x170 drivers/bluetooth/hci_ldisc.c:545
 tty_ldisc_close drivers/tty/tty_ldisc.c:455 [inline]
 tty_ldisc_kill+0x8d/0x140 drivers/tty/tty_ldisc.c:613
 tty_ldisc_hangup+0x2fa/0x370 drivers/tty/tty_ldisc.c:729
 __tty_hangup+0x3c2/0x540 drivers/tty/tty_io.c:621
 tty_vhangup drivers/tty/tty_io.c:691 [inline]
 tty_ioctl+0x601/0xb80 drivers/tty/tty_io.c:2732
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xce/0x140 fs/ioctl.c:583
 __x64_sys_ioctl+0x43/0x50 fs/ioctl.c:583
 x64_sys_call+0x1816/0x3000 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

write to 0xffff88813ae41410 of 8 bytes by task 3557 on cpu 0:
 hci_uart_open+0x19/0x30 drivers/bluetooth/hci_ldisc.c:258
 hci_dev_open_sync+0x186/0x2290 net/bluetooth/hci_sync.c:5122
 hci_dev_do_open net/bluetooth/hci_core.c:430 [inline]
 hci_power_on+0xef/0x390 net/bluetooth/hci_core.c:959
 process_one_work kernel/workqueue.c:3263 [inline]
 process_scheduled_works+0x4ce/0x9d0 kernel/workqueue.c:3346
 worker_thread+0x582/0x770 kernel/workqueue.c:3427
 kthread+0x489/0x510 kernel/kthread.c:463
 ret_from_fork+0x122/0x1b0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

value changed: 0xffffffff83e189e0 -> 0x0000000000000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 3557 Comm: kworker/u9:1 Tainted: G        W           syzkaller #0 PREEMPT(voluntary) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Workqueue: hci0 hci_power_on
==================================================================
Bluetooth: hci0: Opcode 0x1003 failed: -110

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/10/27 04:26 upstream dbfc6422a34d c0460fcd .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in hci_uart_open / hci_uart_tty_close
* Struck through repros no longer work on HEAD.