syzbot


KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt

Status: upstream: reported C repro on 2024/04/05 06:55
Subsystems: bluetooth
[Documentation on labels]
Reported-by: syzbot+8a1d152fba6b41f760ae@syzkaller.appspotmail.com
First crash: 53d, last: 42d
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [bluetooth?] KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt 2 (5) 2024/04/06 13:17
Last patch testing requests (3)
Created Duration User Patch Repo Result
2024/04/30 05:04 26m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci OK log
2024/04/05 10:06 7h52m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git fe46a7dd189e OK log
2024/04/05 09:50 7h38m eadavis@qq.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git fe46a7dd189e OK log

Sample crash report:
==================================================================
BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]
BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline]
BUG: KASAN: slab-out-of-bounds in l2cap_sock_setsockopt+0x2070/0x2934 net/bluetooth/l2cap_sock.c:962
Read of size 4 at addr ffff0000cbfa73c3 by task syz-executor258/6168

CPU: 1 PID: 6168 Comm: syz-executor258 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call trace:
 dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:291
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:298
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd0/0x124 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0x178/0x518 mm/kasan/report.c:488
 kasan_report+0xd8/0x138 mm/kasan/report.c:601
 __asan_report_load_n_noabort+0x1c/0x28 mm/kasan/report_generic.c:391
 copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]
 copy_from_sockptr include/linux/sockptr.h:55 [inline]
 l2cap_sock_setsockopt+0x2070/0x2934 net/bluetooth/l2cap_sock.c:962
 do_sock_setsockopt+0x2a0/0x4e0 net/socket.c:2311
 __sys_setsockopt+0x128/0x1a8 net/socket.c:2334
 __do_sys_setsockopt net/socket.c:2343 [inline]
 __se_sys_setsockopt net/socket.c:2340 [inline]
 __arm64_sys_setsockopt+0xb8/0xd4 net/socket.c:2340
 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:48
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:133
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:152
 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712
 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730
 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598

Allocated by task 6168:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x40/0x78 mm/kasan/common.c:68
 kasan_save_alloc_info+0x40/0x50 mm/kasan/generic.c:575
 poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
 __kasan_kmalloc+0xac/0xc4 mm/kasan/common.c:387
 kasan_kmalloc include/linux/kasan.h:211 [inline]
 __do_kmalloc_node mm/slub.c:3981 [inline]
 __kmalloc+0x2bc/0x5d4 mm/slub.c:3994
 kmalloc include/linux/slab.h:594 [inline]
 __cgroup_bpf_run_filter_setsockopt+0xa94/0xd1c kernel/bpf/cgroup.c:1872
 do_sock_setsockopt+0x498/0x4e0 net/socket.c:2293
 __sys_setsockopt+0x128/0x1a8 net/socket.c:2334
 __do_sys_setsockopt net/socket.c:2343 [inline]
 __se_sys_setsockopt net/socket.c:2340 [inline]
 __arm64_sys_setsockopt+0xb8/0xd4 net/socket.c:2340
 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:48
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:133
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:152
 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712
 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730
 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598

The buggy address belongs to the object at ffff0000cbfa73c0
 which belongs to the cache kmalloc-8 of size 8
The buggy address is located 1 bytes to the right of
 allocated 2-byte region [ffff0000cbfa73c0, ffff0000cbfa73c2)

The buggy address belongs to the physical page:
page:00000000512b024c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10bfa7
anon flags: 0x5ffc00000000800(slab|node=0|zone=2|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 05ffc00000000800 ffff0000c0001280 0000000000000000 dead000000000001
raw: 0000000000000000 0000000080800080 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000cbfa7280: 05 fc fc fc 00 fc fc fc 00 fc fc fc 00 fc fc fc
 ffff0000cbfa7300: 05 fc fc fc 05 fc fc fc 05 fc fc fc fa fc fc fc
>ffff0000cbfa7380: fa fc fc fc 00 fc fc fc 02 fc fc fc 05 fc fc fc
                                           ^
 ffff0000cbfa7400: 00 fc fc fc 00 fc fc fc 00 fc fc fc 05 fc fc fc
 ffff0000cbfa7480: 05 fc fc fc 05 fc fc fc 05 fc fc fc fa fc fc fc
==================================================================

Crashes (36):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/04/04 19:06 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 707081b61156 0ee3535e .config console log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt
2024/04/15 18:08 upstream fe46a7dd189e c8349e48 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt
2024/04/14 07:27 upstream fe46a7dd189e c8349e48 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt
2024/04/13 08:59 upstream fe46a7dd189e c8349e48 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt
2024/04/13 08:59 upstream fe46a7dd189e c8349e48 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt
2024/04/10 13:28 upstream fe46a7dd189e 56086b24 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt
2024/04/10 13:24 upstream fe46a7dd189e 56086b24 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt
2024/04/09 02:24 upstream fe46a7dd189e 53df08b6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt
2024/04/09 01:33 upstream fe46a7dd189e 53df08b6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt
2024/04/08 12:30 upstream fe46a7dd189e ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt
2024/04/08 12:28 upstream fe46a7dd189e ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt
2024/04/07 21:40 upstream fe46a7dd189e ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt
2024/04/07 03:41 upstream fe46a7dd189e ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt
2024/04/07 03:34 upstream fe46a7dd189e ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt
2024/04/07 01:35 upstream fe46a7dd189e ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt
2024/04/07 01:05 upstream fe46a7dd189e ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt
2024/04/06 17:40 upstream fe46a7dd189e ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt
2024/04/06 12:33 upstream fe46a7dd189e ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt
2024/04/04 22:01 upstream fe46a7dd189e 0ee3535e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt
2024/04/09 01:23 linux-next 11cb68ad52ac 53df08b6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt
2024/04/08 19:58 linux-next 11cb68ad52ac 53df08b6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt
2024/04/08 12:26 linux-next 11cb68ad52ac ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt
2024/04/07 06:15 linux-next 8568bb2ccc27 ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt
2024/04/13 09:15 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci b5d2afe8745b c8349e48 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt
2024/04/13 09:09 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci b5d2afe8745b c8349e48 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt
2024/04/10 13:25 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci fec50db7033e 56086b24 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt
2024/04/10 13:25 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci fec50db7033e 56086b24 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt
2024/04/08 12:27 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 707081b61156 ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt
2024/04/08 12:27 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 707081b61156 ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt
2024/04/07 01:28 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 707081b61156 ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt
2024/04/04 18:39 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 707081b61156 0ee3535e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt
2024/04/04 18:39 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 707081b61156 0ee3535e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt
2024/04/04 18:36 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 707081b61156 0ee3535e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt
2024/04/04 18:36 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 707081b61156 0ee3535e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt
2024/04/04 18:36 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 707081b61156 0ee3535e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt
2024/04/10 13:28 upstream 2c71fdf02a95 56086b24 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in l2cap_sock_setsockopt
* Struck through repros no longer work on HEAD.