Title | Replies (including bot) | Last reply |
---|---|---|
[syzbot] [bluetooth?] KASAN: invalid-free in hci_req_sync_complete | 0 (1) | 2024/04/22 06:47 |
syzbot |
sign-in | mailing list | source | docs |
🐞 Open [1020] ≡ Subsystems 🐞 Fixed [5251] 🐞 Invalid [12565] ⬇ Missing Backports [85] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes | 💬 Send us feedback |
Title | Replies (including bot) | Last reply |
---|---|---|
[syzbot] [bluetooth?] KASAN: invalid-free in hci_req_sync_complete | 0 (1) | 2024/04/22 06:47 |
Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 ================================================================== BUG: KASAN: double-free in kfree_skb include/linux/skbuff.h:1262 [inline] BUG: KASAN: double-free in hci_req_sync_complete+0xe7/0x290 net/bluetooth/hci_request.c:109 Free of addr ffff88807ca01640 by task kworker/u9:2/5091 CPU: 1 PID: 5091 Comm: kworker/u9:2 Not tainted 6.9.0-rc6-syzkaller-00005-gb947cc5bf6d7 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Workqueue: hci2 hci_rx_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report_invalid_free+0x11a/0x140 mm/kasan/report.c:563 poison_slab_object+0xba/0xe0 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2106 [inline] slab_free mm/slub.c:4280 [inline] kmem_cache_free+0x10b/0x2c0 mm/slub.c:4344 kfree_skb include/linux/skbuff.h:1262 [inline] hci_req_sync_complete+0xe7/0x290 net/bluetooth/hci_request.c:109 hci_event_packet+0xc71/0x1540 net/bluetooth/hci_event.c:7607 hci_rx_work+0x3e8/0xca0 net/bluetooth/hci_core.c:4171 process_one_work kernel/workqueue.c:3254 [inline] process_scheduled_works+0xa10/0x17c0 kernel/workqueue.c:3335 worker_thread+0x86d/0xd70 kernel/workqueue.c:3416 kthread+0x2f0/0x390 kernel/kthread.c:388 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Allocated by task 5091: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:312 [inline] __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:338 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slub.c:3798 [inline] slab_alloc_node mm/slub.c:3845 [inline] kmem_cache_alloc+0x174/0x340 mm/slub.c:3852 skb_clone+0x20c/0x390 net/core/skbuff.c:2063 hci_send_cmd_sync net/bluetooth/hci_core.c:4220 [inline] hci_cmd_work+0x29e/0x670 net/bluetooth/hci_core.c:4240 process_one_work kernel/workqueue.c:3254 [inline] process_scheduled_works+0xa10/0x17c0 kernel/workqueue.c:3335 worker_thread+0x86d/0xd70 kernel/workqueue.c:3416 kthread+0x2f0/0x390 kernel/kthread.c:388 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Freed by task 7776: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object+0xa6/0xe0 mm/kasan/common.c:240 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2106 [inline] slab_free mm/slub.c:4280 [inline] kmem_cache_free+0x10b/0x2c0 mm/slub.c:4344 kfree_skb include/linux/skbuff.h:1262 [inline] __hci_req_sync+0x62f/0x950 net/bluetooth/hci_request.c:184 hci_req_sync+0xa9/0xd0 net/bluetooth/hci_request.c:206 hci_dev_cmd+0x518/0xa90 net/bluetooth/hci_core.c:790 sock_do_ioctl+0x158/0x460 net/socket.c:1222 sock_ioctl+0x629/0x8e0 net/socket.c:1341 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:904 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:890 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff88807ca01640 which belongs to the cache skbuff_head_cache of size 240 The buggy address is located 0 bytes inside of 240-byte region [ffff88807ca01640, ffff88807ca01730) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7ca01 flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000000800 ffff888018aa7780 dead000000000122 0000000000000000 raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 52, tgid 224528093 (kworker/u9:0), ts 52, free_ts 197753639127 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1534 prep_new_page mm/page_alloc.c:1541 [inline] get_page_from_freelist+0x3410/0x35b0 mm/page_alloc.c:3317 __alloc_pages+0x256/0x6c0 mm/page_alloc.c:4575 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] alloc_slab_page+0x5f/0x160 mm/slub.c:2175 allocate_slab mm/slub.c:2338 [inline] new_slab+0x84/0x2f0 mm/slub.c:2391 ___slab_alloc+0xc73/0x1260 mm/slub.c:3525 __slab_alloc mm/slub.c:3610 [inline] __slab_alloc_node mm/slub.c:3663 [inline] slab_alloc_node mm/slub.c:3835 [inline] kmem_cache_alloc_node+0x24a/0x380 mm/slub.c:3888 __alloc_skb+0x1c3/0x440 net/core/skbuff.c:658 alloc_skb include/linux/skbuff.h:1313 [inline] mgmt_alloc_skb net/bluetooth/mgmt_util.c:64 [inline] mgmt_send_event+0x46/0x1a0 net/bluetooth/mgmt_util.c:116 mgmt_index_event net/bluetooth/mgmt.c:326 [inline] mgmt_index_added+0x192/0x370 net/bluetooth/mgmt.c:9341 hci_power_on+0x48c/0x700 process_one_work kernel/workqueue.c:3254 [inline] process_scheduled_works+0xa10/0x17c0 kernel/workqueue.c:3335 worker_thread+0x86d/0xd70 kernel/workqueue.c:3416 kthread+0x2f0/0x390 kernel/kthread.c:388 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 page last free pid 7771 tgid 7771 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1141 [inline] free_unref_page_prepare+0x986/0xab0 mm/page_alloc.c:2347 free_unref_page+0x37/0x3f0 mm/page_alloc.c:2487 discard_slab mm/slub.c:2437 [inline] __put_partials+0xeb/0x130 mm/slub.c:2906 put_cpu_partial+0x17c/0x250 mm/slub.c:2981 __slab_free+0x2ea/0x3d0 mm/slub.c:4151 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x5e/0xc0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x23/0x80 mm/kasan/common.c:322 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slub.c:3798 [inline] slab_alloc_node mm/slub.c:3845 [inline] kmalloc_trace+0x16f/0x360 mm/slub.c:3992 kmalloc include/linux/slab.h:628 [inline] kzalloc include/linux/slab.h:749 [inline] ref_tracker_alloc+0x14b/0x490 lib/ref_tracker.c:203 __netdev_tracker_alloc include/linux/netdevice.h:4064 [inline] netdev_hold include/linux/netdevice.h:4093 [inline] rx_queue_add_kobject net/core/net-sysfs.c:1102 [inline] net_rx_queue_update_kobjects+0x16b/0x5b0 net/core/net-sysfs.c:1160 register_queue_kobjects net/core/net-sysfs.c:1895 [inline] netdev_register_kobject+0x224/0x320 net/core/net-sysfs.c:2140 register_netdevice+0x1208/0x1a20 net/core/dev.c:10283 bond_newlink+0x3b/0x90 drivers/net/bonding/bond_netlink.c:576 rtnl_newlink_create net/core/rtnetlink.c:3494 [inline] __rtnl_newlink net/core/rtnetlink.c:3714 [inline] rtnl_newlink+0x158f/0x20a0 net/core/rtnetlink.c:3727 rtnetlink_rcv_msg+0x89b/0x10d0 net/core/rtnetlink.c:6595 Memory state around the buggy address: ffff88807ca01500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88807ca01580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc >ffff88807ca01600: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb ^ ffff88807ca01680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88807ca01700: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc ==================================================================
Time | Kernel | Commit | Syzkaller | Config | Log | Report | Syz repro | C repro | VM info | Assets (help?) | Manager | Title |
---|---|---|---|---|---|---|---|---|---|---|---|---|
2024/04/30 02:17 | upstream | b947cc5bf6d7 | 27e33c58 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-kasan-gce | KASAN: invalid-free in hci_req_sync_complete | ||
2024/04/29 12:15 | upstream | e67572cd2204 | 27e33c58 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-kasan-gce | KASAN: invalid-free in hci_req_sync_complete | ||
2024/04/25 02:24 | upstream | e88c4cfcb7b8 | 8bdc0f22 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-kasan-gce-selinux-root | KASAN: invalid-free in hci_req_sync_complete | ||
2024/04/22 11:12 | upstream | ed30a4a51bb1 | af24b050 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-kasan-gce-smack-root | KASAN: invalid-free in hci_req_sync_complete | ||
2024/04/19 22:33 | upstream | dbe0a7be2838 | af24b050 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-kasan-badwrites-root | KASAN: invalid-free in hci_req_sync_complete | ||
2024/04/26 04:04 | upstream | e33c4963bf53 | 8bdc0f22 | .config | console log | report | info | [disk image (non-bootable)] [vmlinux] [kernel image] | ci-qemu-upstream | KASAN: invalid-free in hci_req_sync_complete | ||
2024/04/22 02:55 | upstream | 48cf398f15fc | af24b050 | .config | console log | report | info | [disk image (non-bootable)] [vmlinux] [kernel image] | ci-qemu-upstream | KASAN: invalid-free in hci_req_sync_complete | ||
2024/05/01 03:49 | upstream | 18daea77cca6 | 3ba885bc | .config | console log | report | info | [disk image (non-bootable)] [vmlinux] [kernel image] | ci-qemu-upstream-386 | KASAN: invalid-free in hci_req_sync_complete | ||
2024/04/23 00:18 | upstream | a2c63a3f3d68 | 21339d7b | .config | console log | report | info | [disk image (non-bootable)] [vmlinux] [kernel image] | ci-qemu-upstream-386 | KASAN: invalid-free in hci_req_sync_complete | ||
2024/05/03 13:35 | net-next | a17ef9e6c2c1 | dd26401e | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-upstream-net-next-test-gce | KASAN: invalid-free in hci_req_sync_complete | ||
2024/05/03 13:32 | net-next | a17ef9e6c2c1 | dd26401e | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-upstream-net-next-test-gce | KASAN: invalid-free in hci_req_sync_complete | ||
2024/05/03 06:21 | net-next | dcc61472534e | ddfc15a1 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-upstream-net-next-test-gce | KASAN: invalid-free in hci_req_sync_complete | ||
2024/05/01 06:33 | net-next | b45176703647 | 3ba885bc | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-upstream-net-next-test-gce | KASAN: invalid-free in hci_req_sync_complete | ||
2024/05/01 03:47 | net-next | b45176703647 | 3ba885bc | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-upstream-net-next-test-gce | KASAN: invalid-free in hci_req_sync_complete | ||
2024/05/01 01:31 | net-next | b45176703647 | 3ba885bc | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-upstream-net-next-test-gce | KASAN: invalid-free in hci_req_sync_complete | ||
2024/04/30 20:44 | net-next | dd1941f801bc | 3ce4924c | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-upstream-net-next-test-gce | KASAN: invalid-free in hci_req_sync_complete | ||
2024/04/30 20:21 | net-next | dd1941f801bc | 3ce4924c | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-upstream-net-next-test-gce | KASAN: invalid-free in hci_req_sync_complete | ||
2024/04/26 07:59 | net-next | 2bd87951de65 | 8bdc0f22 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-upstream-net-next-test-gce | KASAN: invalid-free in hci_req_sync_complete |