syzbot


WARNING: refcount bug in sco_sock_timeout (2)

Status: upstream: reported on 2023/06/28 07:45
Subsystems: bluetooth
[Documentation on labels]
Reported-by: syzbot+c689847e27e0fa3e7a5d@syzkaller.appspotmail.com
First crash: 540d, last: 54d
Discussions (2)
Title Replies (including bot) Last reply
Re: [syzbot] [bluetooth?] WARNING: refcount bug in sco_sock_timeout (2) 1 (1) 2023/12/11 14:15
[syzbot] [bluetooth?] WARNING: refcount bug in sco_sock_timeout (2) 0 (1) 2023/06/28 07:45
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING: refcount bug in sco_sock_timeout bluetooth 24 940d 1183d 0/28 auto-obsoleted due to no activity on 2022/09/15 13:12

Sample crash report:
------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 0 PID: 5179 at lib/refcount.c:25 refcount_warn_saturate+0x13a/0x1d0 lib/refcount.c:25
Modules linked in:
CPU: 0 PID: 5179 Comm: kworker/0:4 Not tainted 6.10.0-rc3-syzkaller-00044-g2ccbdf43d5e7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Workqueue: events sco_sock_timeout
RIP: 0010:refcount_warn_saturate+0x13a/0x1d0 lib/refcount.c:25
Code: c0 a5 1f 8c e8 c7 d9 a8 fc 90 0f 0b 90 90 eb b9 e8 2b ab e6 fc c6 05 89 50 e8 0a 01 90 48 c7 c7 20 a6 1f 8c e8 a7 d9 a8 fc 90 <0f> 0b 90 90 eb 99 e8 0b ab e6 fc c6 05 6a 50 e8 0a 01 90 48 c7 c7
RSP: 0018:ffffc90008cf7b70 EFLAGS: 00010246
RAX: 42c18cce13d44100 RBX: ffff888015b95080 RCX: ffff8880298c5a00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000002 R08: ffffffff81585822 R09: fffffbfff1c39994
R10: dffffc0000000000 R11: fffffbfff1c39994 R12: ffff888015b95000
R13: dffffc0000000000 R14: ffff888015b95080 R15: ffff88802c2b2a08
FS:  0000000000000000(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b33425000 CR3: 000000007e34a000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 __refcount_inc include/linux/refcount.h:241 [inline]
 refcount_inc include/linux/refcount.h:258 [inline]
 sock_hold include/net/sock.h:774 [inline]
 sco_sock_timeout+0x1e1/0x270 net/bluetooth/sco.c:92
 process_one_work kernel/workqueue.c:3231 [inline]
 process_scheduled_works+0xa2e/0x1830 kernel/workqueue.c:3312
 worker_thread+0x86d/0xd70 kernel/workqueue.c:3393
 kthread+0x2f2/0x390 kernel/kthread.c:389
 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>

Crashes (10):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/06/16 20:02 upstream 2ccbdf43d5e7 f429ab00 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root WARNING: refcount bug in sco_sock_timeout
2024/05/15 18:34 upstream 1b294a1f3561 0b3dad46 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root WARNING: refcount bug in sco_sock_timeout
2024/10/20 16:28 upstream 715ca9dd687f cd6fc0a3 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 WARNING: refcount bug in sco_sock_timeout
2023/08/15 14:15 upstream 91aa6c412d7f 39990d51 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root WARNING: refcount bug in sco_sock_timeout
2024/07/05 16:59 net 0005b2dc43f9 2a40360c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce WARNING: refcount bug in sco_sock_timeout
2023/11/12 10:33 net 2bd5b559a1f3 6d6dbf8a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce WARNING: refcount bug in sco_sock_timeout
2024/09/14 17:31 net-next 34c44eb31de9 ff60e2ca .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING: refcount bug in sco_sock_timeout
2024/02/10 06:54 net-next 4ec3b4aafc87 77b23aa1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING: refcount bug in sco_sock_timeout
2024/01/19 07:58 net-next 736b5545d39c 239abf84 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING: refcount bug in sco_sock_timeout
2023/06/23 00:04 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 42234a752679 09ffe269 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING: refcount bug in sco_sock_timeout
* Struck through repros no longer work on HEAD.