KASAN: use-after-free Read in hci_chan_del

Status: upstream: reported C repro on 2026/10/30 14:19
Reported-by: syzbot+75e5e6d6d6d94546fce5@syzkaller.appspotmail.com
First crash: 13d, last: 34m
▶ ▼ Similar bugs (6)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 KASAN: use-after-free Read in hci_chan_del 19 syz, C error 21 1557d 2292d 0/1 upstream: reported C repro on 2020/08/03 13:37
linux-4.19 KASAN: use-after-free Read in hci_chan_del 19 syz, C done 24 1947d 2293d 1/1 fixed on 2021/08/15 11:28
upstream KASAN: use-after-free Read in hci_chan_del bluetooth 19 syz, C done done 87 2014d 2293d 0/29 auto-obsoleted due to no activity on 2023/04/13 23:02
upstream BUG: corrupted list in hci_chan_del (2) bluetooth 19 syz, C done 502 641d 644d 28/29 fixed on 2025/06/10 16:19
upstream BUG: corrupted list in hci_chan_del bluetooth 8 2 2282d 2282d 0/29 auto-closed as invalid on 2020/12/12 09:03
linux-4.14 BUG: corrupted list in hci_chan_del 8 1 2292d 2292d 0/1 auto-closed as invalid on 2020/12/02 12:13

Sample crash report:
==================================================================
BUG: KASAN: use-after-free in hci_chan_del+0x36/0x1a0 net/bluetooth/hci_conn.c:2780
Read of size 8 at addr ffff8880299c4f18 by task krfcommd/3346

CPU: 1 PID: 3346 Comm: krfcommd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:316 [inline]
 print_report+0xa8/0x210 mm/kasan/report.c:420
 kasan_report+0x10b/0x140 mm/kasan/report.c:524
 hci_chan_del+0x36/0x1a0 net/bluetooth/hci_conn.c:2780
 l2cap_conn_free net/bluetooth/l2cap_core.c:1868 [inline]
 kref_put include/linux/kref.h:65 [inline]
 l2cap_conn_put net/bluetooth/l2cap_core.c:1882 [inline]
 l2cap_chan_destroy net/bluetooth/l2cap_core.c:502 [inline]
 kref_put include/linux/kref.h:65 [inline]
 l2cap_chan_put+0x1f5/0x300 net/bluetooth/l2cap_core.c:529
 l2cap_sock_release+0x179/0x1e0 net/bluetooth/l2cap_sock.c:1494
 __sock_release net/socket.c:654 [inline]
 sock_release+0x7b/0x140 net/socket.c:682
 rfcomm_session_del+0x141/0x200 net/bluetooth/rfcomm/core.c:781
 rfcomm_process_sessions net/bluetooth/rfcomm/core.c:-1 [inline]
 rfcomm_run+0x46e1/0x5f10 net/bluetooth/rfcomm/core.c:2254
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>

Allocated by task 4474:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
 ____kasan_kmalloc mm/kasan/common.c:375 [inline]
 __kasan_kmalloc+0x8e/0xa0 mm/kasan/common.c:384
 kmalloc include/linux/slab.h:563 [inline]
 kzalloc include/linux/slab.h:699 [inline]
 hci_chan_create+0xc5/0x300 net/bluetooth/hci_conn.c:2765
 l2cap_conn_add+0x5d/0x910 net/bluetooth/l2cap_core.c:7211
 l2cap_chan_connect+0x67b/0xeb0 net/bluetooth/l2cap_core.c:7408
 l2cap_sock_connect+0x576/0x750 net/bluetooth/l2cap_sock.c:259
 kernel_connect+0x13e/0x1c0 net/socket.c:3555
 rfcomm_session_connect net/bluetooth/rfcomm/core.c:863 [inline]
 rfcomm_dlc_open+0x648/0xb40 net/bluetooth/rfcomm/core.c:447
 rfcomm_sock_connect+0x2e9/0x600 net/bluetooth/rfcomm/sock.c:422
 __sys_connect_file net/socket.c:2011 [inline]
 __sys_connect+0x3cb/0x450 net/socket.c:2028
 __do_sys_connect net/socket.c:2038 [inline]
 __se_sys_connect net/socket.c:2035 [inline]
 __x64_sys_connect+0x76/0x80 net/socket.c:2035
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

Freed by task 4368:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
 kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:516
 ____kasan_slab_free+0x126/0x1f0 mm/kasan/common.c:237
 kasan_slab_free include/linux/kasan.h:177 [inline]
 slab_free_hook mm/slub.c:1735 [inline]
 slab_free_freelist_hook+0x133/0x1b0 mm/slub.c:1761
 slab_free mm/slub.c:3694 [inline]
 __kmem_cache_free+0xb6/0x200 mm/slub.c:3707
 hci_chan_list_flush net/bluetooth/hci_conn.c:2805 [inline]
 hci_conn_cleanup+0x171/0x750 net/bluetooth/hci_conn.c:149
 hci_conn_del+0x4df/0x6e0 net/bluetooth/hci_conn.c:1234
 hci_conn_hash_flush+0x203/0x290 net/bluetooth/hci_conn.c:2610
 hci_dev_close_sync+0x989/0x10a0 net/bluetooth/hci_sync.c:5328
 hci_dev_do_close net/bluetooth/hci_core.c:523 [inline]
 hci_error_reset+0x120/0x390 net/bluetooth/hci_core.c:1028
 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

The buggy address belongs to the object at ffff8880299c4f00
 which belongs to the cache kmalloc-128 of size 128
The buggy address is located 24 bytes inside of
 128-byte region [ffff8880299c4f00, ffff8880299c4f80)

The buggy address belongs to the physical page:
page:ffffea0000a67100 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x299c4
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 0000000000000000 dead000000000122 ffff8880184418c0
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL), pid 4428, tgid 4428 (syz-executor), ts 89215404326, free_ts 89208877841
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x173/0x1a0 mm/page_alloc.c:2560
 prep_new_page mm/page_alloc.c:2567 [inline]
 get_page_from_freelist+0x206b/0x2180 mm/page_alloc.c:4358
 __alloc_pages+0x1ec/0x4f0 mm/page_alloc.c:5658
 alloc_slab_page+0x5d/0x180 mm/slub.c:1805
 allocate_slab mm/slub.c:1950 [inline]
 new_slab+0x87/0x2d0 mm/slub.c:2003
 ___slab_alloc+0xbc5/0x1240 mm/slub.c:3161
 __slab_alloc mm/slub.c:3247 [inline]
 slab_alloc_node mm/slub.c:3332 [inline]
 __kmem_cache_alloc_node+0x126/0x270 mm/slub.c:3405
 kmalloc_trace+0x26/0xe0 mm/slab_common.c:1026
 kmalloc include/linux/slab.h:563 [inline]
 __hw_addr_create net/core/dev_addr_lists.c:60 [inline]
 __hw_addr_add_ex+0x1f4/0x700 net/core/dev_addr_lists.c:118
 __dev_mc_add net/core/dev_addr_lists.c:867 [inline]
 dev_mc_add+0x9d/0x110 net/core/dev_addr_lists.c:885
 ip_mc_filter_add net/ipv4/igmp.c:1169 [inline]
 igmp_group_added+0x1dc/0x910 net/ipv4/igmp.c:1358
 ____ip_mc_inc_group+0x882/0xac0 net/ipv4/igmp.c:1492
 __ip_mc_inc_group net/ipv4/igmp.c:1501 [inline]
 ip_mc_inc_group net/ipv4/igmp.c:1507 [inline]
 ip_mc_up+0x121/0x2f0 net/ipv4/igmp.c:1806
 inetdev_event+0xe5c/0x13f0 net/ipv4/devinet.c:1590
 notifier_call_chain kernel/notifier.c:87 [inline]
 raw_notifier_call_chain+0xcb/0x160 kernel/notifier.c:455
 call_netdevice_notifiers_extack net/core/dev.c:2052 [inline]
 call_netdevice_notifiers net/core/dev.c:2066 [inline]
 __dev_notify_flags+0x1a7/0x310 net/core/dev.c:8734
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1487 [inline]
 free_pcp_prepare mm/page_alloc.c:1537 [inline]
 free_unref_page_prepare+0x8e5/0x9e0 mm/page_alloc.c:3414
 free_unref_page+0x2e/0x3f0 mm/page_alloc.c:3509
 free_slab mm/slub.c:2042 [inline]
 discard_slab mm/slub.c:2048 [inline]
 __unfreeze_partials+0x188/0x1e0 mm/slub.c:2598
 put_cpu_partial+0x17c/0x250 mm/slub.c:2674
 qlink_free mm/kasan/quarantine.c:166 [inline]
 qlist_free_all+0x76/0xe0 mm/kasan/quarantine.c:185
 kasan_quarantine_reduce+0x144/0x160 mm/kasan/quarantine.c:292
 __kasan_slab_alloc+0x1e/0x80 mm/kasan/common.c:306
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook+0x4b/0x490 mm/slab.h:742
 slab_alloc_node mm/slub.c:3366 [inline]
 __kmem_cache_alloc_node+0x19d/0x270 mm/slub.c:3405
 kmalloc_trace+0x26/0xe0 mm/slab_common.c:1026
 kmalloc include/linux/slab.h:563 [inline]
 kzalloc include/linux/slab.h:699 [inline]
 mca_alloc net/ipv6/mcast.c:887 [inline]
 __ipv6_dev_mc_inc+0x47b/0xb20 net/ipv6/mcast.c:942
 addrconf_join_solict net/ipv6/addrconf.c:2205 [inline]
 addrconf_dad_begin net/ipv6/addrconf.c:4054 [inline]
 addrconf_dad_work+0x3b8/0x1500 net/ipv6/addrconf.c:4179
 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

Memory state around the buggy address:
 ffff8880299c4e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8880299c4e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8880299c4f00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                            ^
 ffff8880299c4f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8880299c5000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Crashes (517):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/11/02 00:30 linux-6.1.y 08889840163e 25a0ae84 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in hci_chan_del
2026/11/09 13:51 linux-6.1.y c75b0cf0982c 5cecaf1f .config console log report syz / log [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: corrupted list in hci_chan_del
2026/10/31 07:10 linux-6.1.y 08889840163e 0ec395f8 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: corrupted list in hci_chan_del
2026/11/13 10:24 linux-6.1.y c75b0cf0982c 26b2fee0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in hci_chan_del
2026/11/13 01:20 linux-6.1.y c75b0cf0982c c0087d7f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in hci_chan_del
2026/11/12 22:52 linux-6.1.y c75b0cf0982c c0087d7f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in hci_chan_del
2026/11/12 17:16 linux-6.1.y c75b0cf0982c c0087d7f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in hci_chan_del
2026/11/12 14:09 linux-6.1.y c75b0cf0982c 8d68b303 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in hci_chan_del
2026/11/12 07:22 linux-6.1.y c75b0cf0982c 8d68b303 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in hci_chan_del
2026/11/12 06:02 linux-6.1.y c75b0cf0982c 8d68b303 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in hci_chan_del
2026/11/11 18:41 linux-6.1.y c75b0cf0982c e56a968c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in hci_chan_del
2026/11/11 13:59 linux-6.1.y c75b0cf0982c e56a968c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in hci_chan_del
2026/11/10 17:38 linux-6.1.y c75b0cf0982c d3056657 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in hci_chan_del
2026/11/10 12:13 linux-6.1.y c75b0cf0982c 70ec0380 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in hci_chan_del
2026/10/30 14:19 linux-6.1.y 08889840163e b498adee .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in hci_chan_del
2026/11/13 12:35 linux-6.1.y c75b0cf0982c be5d1971 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hci_chan_del
2026/11/13 09:13 linux-6.1.y c75b0cf0982c 26b2fee0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hci_chan_del
2026/11/12 21:13 linux-6.1.y c75b0cf0982c c0087d7f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hci_chan_del
2026/11/12 20:09 linux-6.1.y c75b0cf0982c c0087d7f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hci_chan_del
2026/11/12 18:31 linux-6.1.y c75b0cf0982c c0087d7f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hci_chan_del
2026/11/12 15:22 linux-6.1.y c75b0cf0982c 8d68b303 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hci_chan_del
2026/11/12 12:23 linux-6.1.y c75b0cf0982c 8d68b303 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hci_chan_del
2026/11/12 08:53 linux-6.1.y c75b0cf0982c 8d68b303 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hci_chan_del
2026/11/12 04:56 linux-6.1.y c75b0cf0982c 8d68b303 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hci_chan_del
2026/11/12 04:32 linux-6.1.y c75b0cf0982c 8d68b303 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hci_chan_del
2026/11/12 01:28 linux-6.1.y c75b0cf0982c 8d68b303 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hci_chan_del
2026/11/11 22:23 linux-6.1.y c75b0cf0982c e56a968c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hci_chan_del
2026/11/11 19:17 linux-6.1.y c75b0cf0982c e56a968c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hci_chan_del
2026/11/11 15:53 linux-6.1.y c75b0cf0982c e56a968c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hci_chan_del
2026/11/11 09:16 linux-6.1.y c75b0cf0982c d3056657 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hci_chan_del
2026/11/11 05:14 linux-6.1.y c75b0cf0982c d3056657 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hci_chan_del
2026/11/11 04:50 linux-6.1.y c75b0cf0982c d3056657 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hci_chan_del
2026/11/11 02:04 linux-6.1.y c75b0cf0982c d3056657 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in hci_chan_del
2026/11/13 07:56 linux-6.1.y c75b0cf0982c 26b2fee0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan BUG: corrupted list in hci_chan_del
2026/11/13 06:27 linux-6.1.y c75b0cf0982c 26b2fee0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan BUG: corrupted list in hci_chan_del
2026/11/13 03:47 linux-6.1.y c75b0cf0982c c0087d7f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan BUG: corrupted list in hci_chan_del
2026/11/13 02:26 linux-6.1.y c75b0cf0982c c0087d7f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan BUG: corrupted list in hci_chan_del
2026/11/12 18:25 linux-6.1.y c75b0cf0982c c0087d7f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan BUG: corrupted list in hci_chan_del
2026/11/12 00:20 linux-6.1.y c75b0cf0982c 8d68b303 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan BUG: corrupted list in hci_chan_del
2026/11/10 23:57 linux-6.1.y c75b0cf0982c d3056657 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan BUG: corrupted list in hci_chan_del
2026/11/13 00:19 linux-6.1.y c75b0cf0982c c0087d7f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: corrupted list in hci_chan_del
2026/11/12 10:24 linux-6.1.y c75b0cf0982c 8d68b303 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: corrupted list in hci_chan_del
2026/11/11 21:21 linux-6.1.y c75b0cf0982c e56a968c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: corrupted list in hci_chan_del
2026/11/11 20:17 linux-6.1.y c75b0cf0982c e56a968c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: corrupted list in hci_chan_del
2026/11/11 10:40 linux-6.1.y c75b0cf0982c d3056657 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: corrupted list in hci_chan_del
2026/11/10 22:30 linux-6.1.y c75b0cf0982c d3056657 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: corrupted list in hci_chan_del
2026/11/10 20:32 linux-6.1.y c75b0cf0982c d3056657 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: corrupted list in hci_chan_del
2026/11/10 18:57 linux-6.1.y c75b0cf0982c d3056657 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: corrupted list in hci_chan_del
2026/11/10 15:45 linux-6.1.y c75b0cf0982c d3056657 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: corrupted list in hci_chan_del
2026/11/05 09:07 linux-6.1.y 08889840163e 2ee8459f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KFENCE: use-after-free read in hci_chan_del
* Struck through repros no longer work on HEAD.