Title | Replies (including bot) | Last reply |
---|---|---|
[syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect_cfm | 0 (1) | 2024/12/17 17:58 |
syzbot |
sign-in | mailing list | source | docs |
Title | Replies (including bot) | Last reply |
---|---|---|
[syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect_cfm | 0 (1) | 2024/12/17 17:58 |
Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 ================================================================== BUG: KASAN: slab-use-after-free in l2cap_conn_ready net/bluetooth/l2cap_core.c:1619 [inline] BUG: KASAN: slab-use-after-free in l2cap_connect_cfm+0xd55/0xf10 net/bluetooth/l2cap_core.c:7280 Read of size 8 at addr ffff888025012480 by task kworker/u9:2/5818 CPU: 0 UID: 0 PID: 5818 Comm: kworker/u9:2 Not tainted 6.13.0-syzkaller-04788-g7004a2e46d16 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 Workqueue: hci1 hci_rx_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xc3/0x620 mm/kasan/report.c:489 kasan_report+0xd9/0x110 mm/kasan/report.c:602 l2cap_conn_ready net/bluetooth/l2cap_core.c:1619 [inline] l2cap_connect_cfm+0xd55/0xf10 net/bluetooth/l2cap_core.c:7280 hci_connect_cfm include/net/bluetooth/hci_core.h:2051 [inline] le_conn_complete_evt+0x168d/0x1da0 net/bluetooth/hci_event.c:5763 hci_le_conn_complete_evt+0x23c/0x370 net/bluetooth/hci_event.c:5789 hci_le_meta_evt+0x2e2/0x5d0 net/bluetooth/hci_event.c:7162 hci_event_func net/bluetooth/hci_event.c:7470 [inline] hci_event_packet+0x666/0x1180 net/bluetooth/hci_event.c:7525 hci_rx_work+0x2c5/0x16b0 net/bluetooth/hci_core.c:4015 process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3236 process_scheduled_works kernel/workqueue.c:3317 [inline] worker_thread+0x6c8/0xf00 kernel/workqueue.c:3398 kthread+0x3af/0x750 kernel/kthread.c:464 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Allocated by task 5818: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394 kmalloc_noprof include/linux/slab.h:901 [inline] kzalloc_noprof include/linux/slab.h:1037 [inline] l2cap_chan_create+0x44/0x920 net/bluetooth/l2cap_core.c:449 l2cap_sock_alloc.constprop.0+0xf5/0x1d0 net/bluetooth/l2cap_sock.c:1888 l2cap_sock_new_connection_cb+0x101/0x240 net/bluetooth/l2cap_sock.c:1470 l2cap_connect_cfm+0x85f/0xf10 net/bluetooth/l2cap_core.c:7263 hci_connect_cfm include/net/bluetooth/hci_core.h:2051 [inline] le_conn_complete_evt+0x168d/0x1da0 net/bluetooth/hci_event.c:5763 hci_le_conn_complete_evt+0x23c/0x370 net/bluetooth/hci_event.c:5789 hci_le_meta_evt+0x2e2/0x5d0 net/bluetooth/hci_event.c:7162 hci_event_func net/bluetooth/hci_event.c:7470 [inline] hci_event_packet+0x666/0x1180 net/bluetooth/hci_event.c:7525 hci_rx_work+0x2c5/0x16b0 net/bluetooth/hci_core.c:4015 process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3236 process_scheduled_works kernel/workqueue.c:3317 [inline] worker_thread+0x6c8/0xf00 kernel/workqueue.c:3398 kthread+0x3af/0x750 kernel/kthread.c:464 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Freed by task 6587: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:582 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2353 [inline] slab_free mm/slub.c:4613 [inline] kfree+0x14f/0x4b0 mm/slub.c:4761 l2cap_chan_destroy net/bluetooth/l2cap_core.c:495 [inline] kref_put include/linux/kref.h:65 [inline] l2cap_chan_put+0x216/0x2c0 net/bluetooth/l2cap_core.c:519 l2cap_sock_cleanup_listen+0x4d/0x2a0 net/bluetooth/l2cap_sock.c:1453 l2cap_sock_release+0x5c/0x210 net/bluetooth/l2cap_sock.c:1413 __sock_release+0xb0/0x270 net/socket.c:642 sock_close+0x1c/0x30 net/socket.c:1393 __fput+0x3f8/0xb60 fs/file_table.c:450 task_work_run+0x14e/0x250 kernel/task_work.c:239 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x27b/0x2a0 kernel/entry/common.c:218 do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff888025012000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 1152 bytes inside of freed 2048-byte region [ffff888025012000, ffff888025012800) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x25010 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801b042000 0000000000000000 0000000000000001 raw: 0000000000000000 0000000080080008 00000001f5000000 0000000000000000 head: 00fff00000000040 ffff88801b042000 0000000000000000 0000000000000001 head: 0000000000000000 0000000080080008 00000001f5000000 0000000000000000 head: 00fff00000000003 ffffea0000940401 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd28c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5824, tgid 5824 (syz-executor), ts 53977591361, free_ts 53938335810 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1558 prep_new_page mm/page_alloc.c:1566 [inline] get_page_from_freelist+0xfce/0x2f80 mm/page_alloc.c:3476 __alloc_pages_noprof+0x221/0x2470 mm/page_alloc.c:4753 alloc_pages_mpol_noprof+0x2c8/0x620 mm/mempolicy.c:2269 alloc_slab_page mm/slub.c:2423 [inline] allocate_slab mm/slub.c:2589 [inline] new_slab+0x2c9/0x410 mm/slub.c:2642 ___slab_alloc+0xc5d/0x1720 mm/slub.c:3830 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3920 __slab_alloc_node mm/slub.c:3995 [inline] slab_alloc_node mm/slub.c:4156 [inline] __do_kmalloc_node mm/slub.c:4297 [inline] __kmalloc_node_track_caller_noprof+0x2f1/0x510 mm/slub.c:4317 kmalloc_reserve+0xef/0x2c0 net/core/skbuff.c:609 pskb_expand_head+0x243/0x1240 net/core/skbuff.c:2275 netlink_trim+0x22d/0x310 net/netlink/af_netlink.c:1304 netlink_unicast+0xc6/0x7f0 net/netlink/af_netlink.c:1338 nlmsg_unicast include/net/netlink.h:1161 [inline] rtnl_unicast net/core/rtnetlink.c:943 [inline] rtnl_getlink+0x8f0/0xb30 net/core/rtnetlink.c:4148 rtnetlink_rcv_msg+0x3c7/0xea0 net/core/rtnetlink.c:6920 netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2543 netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline] netlink_unicast+0x53c/0x7f0 net/netlink/af_netlink.c:1348 page last free pid 5192 tgid 5192 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1127 [inline] free_unref_page+0x661/0x1080 mm/page_alloc.c:2659 __put_partials+0x14c/0x170 mm/slub.c:3157 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x195/0x1e0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:250 [inline] slab_post_alloc_hook mm/slub.c:4119 [inline] slab_alloc_node mm/slub.c:4168 [inline] kmem_cache_alloc_noprof+0x226/0x3d0 mm/slub.c:4175 getname_flags.part.0+0x4c/0x550 fs/namei.c:139 getname_flags include/linux/audit.h:322 [inline] getname fs/namei.c:223 [inline] __do_sys_unlink fs/namei.c:4635 [inline] __se_sys_unlink fs/namei.c:4633 [inline] __x64_sys_unlink+0xb0/0x110 fs/namei.c:4633 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff888025012380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888025012400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888025012480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888025012500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888025012580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================
Time | Kernel | Commit | Syzkaller | Config | Log | Report | Syz repro | C repro | VM info | Assets (help?) | Manager | Title |
---|---|---|---|---|---|---|---|---|---|---|---|---|
2025/01/23 18:55 | upstream | 7004a2e46d16 | f6a35ef3 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-kasan-gce-selinux-root | KASAN: slab-use-after-free Read in l2cap_connect_cfm | ||
2025/01/02 01:58 | upstream | 56e6a3499e14 | d3ccff63 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-kasan-badwrites-root | KASAN: slab-use-after-free Read in l2cap_connect_cfm | ||
2024/12/28 21:43 | upstream | fd0584d220fe | d3ccff63 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-kasan-gce-selinux-root | KASAN: slab-use-after-free Read in l2cap_connect_cfm | ||
2024/12/22 22:34 | upstream | bcde95ce32b6 | b4fbdbd4 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-kasan-gce-selinux-root | KASAN: slab-use-after-free Read in l2cap_connect_cfm | ||
2024/12/15 21:48 | upstream | 2d8308bf5b67 | 7cbfbb3a | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-kasan-gce-smack-root | KASAN: slab-use-after-free Read in l2cap_connect_cfm | ||
2024/12/15 01:30 | upstream | a0e3919a2df2 | 7cbfbb3a | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-kasan-gce-smack-root | KASAN: slab-use-after-free Read in l2cap_connect_cfm | ||
2024/11/18 06:10 | upstream | f66d6acccbc0 | cfe3a04a | .config | console log | report | syz / log | [disk image] [vmlinux] [kernel image] | ci-upstream-kasan-badwrites-root | KASAN: slab-use-after-free Read in l2cap_connect_cfm | ||
2024/11/17 22:00 | upstream | f66d6acccbc0 | cfe3a04a | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-kasan-badwrites-root | KASAN: slab-use-after-free Read in l2cap_connect_cfm | ||
2024/11/17 21:58 | upstream | f66d6acccbc0 | cfe3a04a | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-kasan-badwrites-root | KASAN: slab-use-after-free Read in l2cap_connect_cfm | ||
2024/11/15 13:17 | upstream | cfaaa7d010d1 | f6ede3a3 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-kasan-gce-selinux-root | KASAN: slab-use-after-free Read in l2cap_connect_cfm | ||
2024/11/14 14:41 | upstream | 0a9b9d17f3a7 | 77f3eeb7 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-kasan-badwrites-root | KASAN: slab-use-after-free Read in l2cap_connect_cfm | ||
2024/11/09 00:17 | upstream | 50643bbc9eb6 | 6b856513 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-kasan-gce-root | KASAN: slab-use-after-free Read in l2cap_connect_cfm | ||
2024/11/08 06:40 | upstream | 906bd684e4b1 | 179b040e | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-kasan-gce-selinux-root | KASAN: slab-use-after-free Read in l2cap_connect_cfm | ||
2024/11/05 13:29 | upstream | 2e1b3cc9d7f7 | 509da429 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-kasan-badwrites-root | KASAN: slab-use-after-free Read in l2cap_connect_cfm | ||
2024/11/03 20:41 | upstream | b9021de3ec2f | f00eed24 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-kasan-gce-root | KASAN: slab-use-after-free Read in l2cap_connect_cfm | ||
2024/11/03 08:16 | upstream | 3e5e6c9900c3 | f00eed24 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-kasan-badwrites-root | KASAN: slab-use-after-free Read in l2cap_connect_cfm | ||
2024/10/31 21:37 | upstream | 0fc810ae3ae1 | 96eb609f | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-kasan-gce-smack-root | KASAN: slab-use-after-free Read in l2cap_connect_cfm | ||
2024/10/31 11:41 | upstream | 0fc810ae3ae1 | fb888278 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-kasan-gce-selinux-root | KASAN: slab-use-after-free Read in l2cap_connect_cfm | ||
2024/12/22 05:07 | upstream | 48f506ad0b68 | d7f584ee | .config | console log | report | info | [disk image (non-bootable)] [vmlinux] [kernel image] | ci-qemu-upstream-386 | KASAN: slab-use-after-free Read in l2cap_connect_cfm | ||
2024/12/11 06:45 | linux-next | af2ea8ab7a54 | cfc402b4 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-linux-next-kasan-gce-root | KASAN: slab-use-after-free Read in l2cap_connect_cfm | ||
2024/10/18 22:57 | linux-next | 15e7d45e786a | cd6fc0a3 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-linux-next-kasan-gce-root | KASAN: slab-use-after-free Read in l2cap_connect_cfm | ||
2025/02/07 00:25 | git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci | 2014c95afece | 53657d1b | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-gce-arm64 | KASAN: slab-use-after-free Read in l2cap_connect_cfm | ||
2025/01/29 05:49 | git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci | 1950a0af2d55 | f5427d7c | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-gce-arm64 | KASAN: slab-use-after-free Read in l2cap_connect_cfm | ||
2025/01/14 17:46 | git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci | 6251d1776bc5 | 7315a7cf | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-gce-arm64 | KASAN: slab-use-after-free Read in l2cap_connect_cfm | ||
2024/12/23 06:38 | git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci | 573067a5a685 | b4fbdbd4 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-gce-arm64 | KASAN: slab-use-after-free Read in l2cap_connect_cfm | ||
2024/11/11 17:55 | git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci | 563047e691f2 | 97fe5517 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-gce-arm64 | KASAN: slab-use-after-free Read in l2cap_connect_cfm | ||
2024/10/29 11:44 | git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci | 1bf329c696cf | 66aeb999 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-gce-arm64 | KASAN: slab-use-after-free Read in l2cap_connect_cfm | ||
2024/12/23 06:14 | upstream | bcde95ce32b6 | b4fbdbd4 | .config | console log | report | info | [disk image (non-bootable)] [vmlinux] [kernel image] | ci-qemu-upstream-386 | KASAN: wild-memory-access Read in l2cap_connect_cfm | ||
2025/02/12 04:20 | git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci | 2014c95afece | f2baddf5 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-gce-arm64 | KASAN: wild-memory-access Read in l2cap_connect_cfm | ||
2024/12/26 16:12 | git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci | 573067a5a685 | d3ccff63 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-gce-arm64 | KASAN: wild-memory-access Read in l2cap_connect_cfm | ||
2024/11/15 13:16 | git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci | 887407160d72 | f6ede3a3 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci-upstream-gce-arm64 | KASAN: wild-memory-access Read in l2cap_connect_cfm |