syzbot


KASAN: slab-use-after-free Read in l2cap_connect_cfm

Status: upstream: reported on 2024/12/17 17:58
Subsystems: bluetooth
[Documentation on labels]
Reported-by: syzbot+e9abaabc441d3dd18735@syzkaller.appspotmail.com
First crash: 117d, last: 1d00h
Cause bisection: the issue happens on the oldest tested release (bisect log)
Crash: KASAN: use-after-free Read in lock_sock_nested (log)
Repro: syz .config
  
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect_cfm 0 (1) 2024/12/17 17:58
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 KASAN: use-after-free Read in l2cap_connect_cfm 1 7d07h 7d07h 0/3 upstream: reported on 2025/02/05 20:58
linux-6.1 KASAN: use-after-free Read in l2cap_connect_cfm 4 13d 117d 0/3 upstream: reported on 2024/10/19 04:09
Last patch testing requests (1)
Created Duration User Patch Repo Result
2024/12/02 17:58 24m retest repro upstream OK log

Sample crash report:
Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3
Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
==================================================================
BUG: KASAN: slab-use-after-free in l2cap_conn_ready net/bluetooth/l2cap_core.c:1619 [inline]
BUG: KASAN: slab-use-after-free in l2cap_connect_cfm+0xd55/0xf10 net/bluetooth/l2cap_core.c:7280
Read of size 8 at addr ffff888025012480 by task kworker/u9:2/5818

CPU: 0 UID: 0 PID: 5818 Comm: kworker/u9:2 Not tainted 6.13.0-syzkaller-04788-g7004a2e46d16 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Workqueue: hci1 hci_rx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0xc3/0x620 mm/kasan/report.c:489
 kasan_report+0xd9/0x110 mm/kasan/report.c:602
 l2cap_conn_ready net/bluetooth/l2cap_core.c:1619 [inline]
 l2cap_connect_cfm+0xd55/0xf10 net/bluetooth/l2cap_core.c:7280
 hci_connect_cfm include/net/bluetooth/hci_core.h:2051 [inline]
 le_conn_complete_evt+0x168d/0x1da0 net/bluetooth/hci_event.c:5763
 hci_le_conn_complete_evt+0x23c/0x370 net/bluetooth/hci_event.c:5789
 hci_le_meta_evt+0x2e2/0x5d0 net/bluetooth/hci_event.c:7162
 hci_event_func net/bluetooth/hci_event.c:7470 [inline]
 hci_event_packet+0x666/0x1180 net/bluetooth/hci_event.c:7525
 hci_rx_work+0x2c5/0x16b0 net/bluetooth/hci_core.c:4015
 process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3236
 process_scheduled_works kernel/workqueue.c:3317 [inline]
 worker_thread+0x6c8/0xf00 kernel/workqueue.c:3398
 kthread+0x3af/0x750 kernel/kthread.c:464
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>

Allocated by task 5818:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394
 kmalloc_noprof include/linux/slab.h:901 [inline]
 kzalloc_noprof include/linux/slab.h:1037 [inline]
 l2cap_chan_create+0x44/0x920 net/bluetooth/l2cap_core.c:449
 l2cap_sock_alloc.constprop.0+0xf5/0x1d0 net/bluetooth/l2cap_sock.c:1888
 l2cap_sock_new_connection_cb+0x101/0x240 net/bluetooth/l2cap_sock.c:1470
 l2cap_connect_cfm+0x85f/0xf10 net/bluetooth/l2cap_core.c:7263
 hci_connect_cfm include/net/bluetooth/hci_core.h:2051 [inline]
 le_conn_complete_evt+0x168d/0x1da0 net/bluetooth/hci_event.c:5763
 hci_le_conn_complete_evt+0x23c/0x370 net/bluetooth/hci_event.c:5789
 hci_le_meta_evt+0x2e2/0x5d0 net/bluetooth/hci_event.c:7162
 hci_event_func net/bluetooth/hci_event.c:7470 [inline]
 hci_event_packet+0x666/0x1180 net/bluetooth/hci_event.c:7525
 hci_rx_work+0x2c5/0x16b0 net/bluetooth/hci_core.c:4015
 process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3236
 process_scheduled_works kernel/workqueue.c:3317 [inline]
 worker_thread+0x6c8/0xf00 kernel/workqueue.c:3398
 kthread+0x3af/0x750 kernel/kthread.c:464
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Freed by task 6587:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:582
 poison_slab_object mm/kasan/common.c:247 [inline]
 __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264
 kasan_slab_free include/linux/kasan.h:233 [inline]
 slab_free_hook mm/slub.c:2353 [inline]
 slab_free mm/slub.c:4613 [inline]
 kfree+0x14f/0x4b0 mm/slub.c:4761
 l2cap_chan_destroy net/bluetooth/l2cap_core.c:495 [inline]
 kref_put include/linux/kref.h:65 [inline]
 l2cap_chan_put+0x216/0x2c0 net/bluetooth/l2cap_core.c:519
 l2cap_sock_cleanup_listen+0x4d/0x2a0 net/bluetooth/l2cap_sock.c:1453
 l2cap_sock_release+0x5c/0x210 net/bluetooth/l2cap_sock.c:1413
 __sock_release+0xb0/0x270 net/socket.c:642
 sock_close+0x1c/0x30 net/socket.c:1393
 __fput+0x3f8/0xb60 fs/file_table.c:450
 task_work_run+0x14e/0x250 kernel/task_work.c:239
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x27b/0x2a0 kernel/entry/common.c:218
 do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888025012000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 1152 bytes inside of
 freed 2048-byte region [ffff888025012000, ffff888025012800)

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x25010
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801b042000 0000000000000000 0000000000000001
raw: 0000000000000000 0000000080080008 00000001f5000000 0000000000000000
head: 00fff00000000040 ffff88801b042000 0000000000000000 0000000000000001
head: 0000000000000000 0000000080080008 00000001f5000000 0000000000000000
head: 00fff00000000003 ffffea0000940401 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd28c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5824, tgid 5824 (syz-executor), ts 53977591361, free_ts 53938335810
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1558
 prep_new_page mm/page_alloc.c:1566 [inline]
 get_page_from_freelist+0xfce/0x2f80 mm/page_alloc.c:3476
 __alloc_pages_noprof+0x221/0x2470 mm/page_alloc.c:4753
 alloc_pages_mpol_noprof+0x2c8/0x620 mm/mempolicy.c:2269
 alloc_slab_page mm/slub.c:2423 [inline]
 allocate_slab mm/slub.c:2589 [inline]
 new_slab+0x2c9/0x410 mm/slub.c:2642
 ___slab_alloc+0xc5d/0x1720 mm/slub.c:3830
 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3920
 __slab_alloc_node mm/slub.c:3995 [inline]
 slab_alloc_node mm/slub.c:4156 [inline]
 __do_kmalloc_node mm/slub.c:4297 [inline]
 __kmalloc_node_track_caller_noprof+0x2f1/0x510 mm/slub.c:4317
 kmalloc_reserve+0xef/0x2c0 net/core/skbuff.c:609
 pskb_expand_head+0x243/0x1240 net/core/skbuff.c:2275
 netlink_trim+0x22d/0x310 net/netlink/af_netlink.c:1304
 netlink_unicast+0xc6/0x7f0 net/netlink/af_netlink.c:1338
 nlmsg_unicast include/net/netlink.h:1161 [inline]
 rtnl_unicast net/core/rtnetlink.c:943 [inline]
 rtnl_getlink+0x8f0/0xb30 net/core/rtnetlink.c:4148
 rtnetlink_rcv_msg+0x3c7/0xea0 net/core/rtnetlink.c:6920
 netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2543
 netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline]
 netlink_unicast+0x53c/0x7f0 net/netlink/af_netlink.c:1348
page last free pid 5192 tgid 5192 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1127 [inline]
 free_unref_page+0x661/0x1080 mm/page_alloc.c:2659
 __put_partials+0x14c/0x170 mm/slub.c:3157
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x195/0x1e0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329
 kasan_slab_alloc include/linux/kasan.h:250 [inline]
 slab_post_alloc_hook mm/slub.c:4119 [inline]
 slab_alloc_node mm/slub.c:4168 [inline]
 kmem_cache_alloc_noprof+0x226/0x3d0 mm/slub.c:4175
 getname_flags.part.0+0x4c/0x550 fs/namei.c:139
 getname_flags include/linux/audit.h:322 [inline]
 getname fs/namei.c:223 [inline]
 __do_sys_unlink fs/namei.c:4635 [inline]
 __se_sys_unlink fs/namei.c:4633 [inline]
 __x64_sys_unlink+0xb0/0x110 fs/namei.c:4633
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff888025012380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888025012400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888025012480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff888025012500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888025012580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Crashes (31):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/01/23 18:55 upstream 7004a2e46d16 f6a35ef3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: slab-use-after-free Read in l2cap_connect_cfm
2025/01/02 01:58 upstream 56e6a3499e14 d3ccff63 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root KASAN: slab-use-after-free Read in l2cap_connect_cfm
2024/12/28 21:43 upstream fd0584d220fe d3ccff63 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: slab-use-after-free Read in l2cap_connect_cfm
2024/12/22 22:34 upstream bcde95ce32b6 b4fbdbd4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: slab-use-after-free Read in l2cap_connect_cfm
2024/12/15 21:48 upstream 2d8308bf5b67 7cbfbb3a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: slab-use-after-free Read in l2cap_connect_cfm
2024/12/15 01:30 upstream a0e3919a2df2 7cbfbb3a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: slab-use-after-free Read in l2cap_connect_cfm
2024/11/18 06:10 upstream f66d6acccbc0 cfe3a04a .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root KASAN: slab-use-after-free Read in l2cap_connect_cfm
2024/11/17 22:00 upstream f66d6acccbc0 cfe3a04a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root KASAN: slab-use-after-free Read in l2cap_connect_cfm
2024/11/17 21:58 upstream f66d6acccbc0 cfe3a04a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root KASAN: slab-use-after-free Read in l2cap_connect_cfm
2024/11/15 13:17 upstream cfaaa7d010d1 f6ede3a3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: slab-use-after-free Read in l2cap_connect_cfm
2024/11/14 14:41 upstream 0a9b9d17f3a7 77f3eeb7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root KASAN: slab-use-after-free Read in l2cap_connect_cfm
2024/11/09 00:17 upstream 50643bbc9eb6 6b856513 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-use-after-free Read in l2cap_connect_cfm
2024/11/08 06:40 upstream 906bd684e4b1 179b040e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: slab-use-after-free Read in l2cap_connect_cfm
2024/11/05 13:29 upstream 2e1b3cc9d7f7 509da429 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root KASAN: slab-use-after-free Read in l2cap_connect_cfm
2024/11/03 20:41 upstream b9021de3ec2f f00eed24 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-use-after-free Read in l2cap_connect_cfm
2024/11/03 08:16 upstream 3e5e6c9900c3 f00eed24 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root KASAN: slab-use-after-free Read in l2cap_connect_cfm
2024/10/31 21:37 upstream 0fc810ae3ae1 96eb609f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: slab-use-after-free Read in l2cap_connect_cfm
2024/10/31 11:41 upstream 0fc810ae3ae1 fb888278 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: slab-use-after-free Read in l2cap_connect_cfm
2024/12/22 05:07 upstream 48f506ad0b68 d7f584ee .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: slab-use-after-free Read in l2cap_connect_cfm
2024/12/11 06:45 linux-next af2ea8ab7a54 cfc402b4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: slab-use-after-free Read in l2cap_connect_cfm
2024/10/18 22:57 linux-next 15e7d45e786a cd6fc0a3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: slab-use-after-free Read in l2cap_connect_cfm
2025/02/07 00:25 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 2014c95afece 53657d1b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: slab-use-after-free Read in l2cap_connect_cfm
2025/01/29 05:49 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 1950a0af2d55 f5427d7c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: slab-use-after-free Read in l2cap_connect_cfm
2025/01/14 17:46 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 6251d1776bc5 7315a7cf .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: slab-use-after-free Read in l2cap_connect_cfm
2024/12/23 06:38 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 573067a5a685 b4fbdbd4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: slab-use-after-free Read in l2cap_connect_cfm
2024/11/11 17:55 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 563047e691f2 97fe5517 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: slab-use-after-free Read in l2cap_connect_cfm
2024/10/29 11:44 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 1bf329c696cf 66aeb999 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: slab-use-after-free Read in l2cap_connect_cfm
2024/12/23 06:14 upstream bcde95ce32b6 b4fbdbd4 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: wild-memory-access Read in l2cap_connect_cfm
2025/02/12 04:20 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 2014c95afece f2baddf5 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: wild-memory-access Read in l2cap_connect_cfm
2024/12/26 16:12 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 573067a5a685 d3ccff63 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: wild-memory-access Read in l2cap_connect_cfm
2024/11/15 13:16 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 887407160d72 f6ede3a3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: wild-memory-access Read in l2cap_connect_cfm
* Struck through repros no longer work on HEAD.