syzbot


KASAN: null-ptr-deref Write in l2cap_sock_resume_cb (3)

Status: upstream: reported on 2025/01/28 09:23
Subsystems: bluetooth
[Documentation on labels]
Reported-by: syzbot+fe280ff30bb95df1577c@syzkaller.appspotmail.com
First crash: 5d23h, last: 5d23h
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [bluetooth?] KASAN: null-ptr-deref Write in l2cap_sock_resume_cb (3) 0 (1) 2025/01/28 09:23
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: null-ptr-deref Write in l2cap_sock_resume_cb bluetooth 1 192d 189d 0/28 auto-obsoleted due to no activity on 2024/10/29 12:18
upstream KASAN: null-ptr-deref Write in l2cap_sock_resume_cb (2) bluetooth 1 74d 74d 0/28 closed as invalid on 2024/12/17 17:57

Sample crash report:
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_write include/linux/instrumented.h:82 [inline]
BUG: KASAN: null-ptr-deref in clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline]
BUG: KASAN: null-ptr-deref in l2cap_sock_resume_cb+0xd0/0x130 net/bluetooth/l2cap_sock.c:1699
Write of size 8 at addr 0000000000000568 by task kworker/u33:4/5957

CPU: 3 UID: 0 PID: 5957 Comm: kworker/u33:4 Not tainted 6.13.0-syzkaller-05154-g8883957b3c9d #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: hci3 hci_rx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 kasan_report+0xd9/0x110 mm/kasan/report.c:602
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189
 instrument_atomic_write include/linux/instrumented.h:82 [inline]
 clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline]
 l2cap_sock_resume_cb+0xd0/0x130 net/bluetooth/l2cap_sock.c:1699
 l2cap_security_cfm+0x795/0x11d0 net/bluetooth/l2cap_core.c:7346
 hci_security_cfm include/net/bluetooth/hci_core.h:2088 [inline]
 hci_encrypt_cfm+0x1f2/0x7d0 include/net/bluetooth/hci_core.h:2136
 hci_encrypt_change_evt+0x3f3/0x1130 net/bluetooth/hci_event.c:3655
 hci_event_func net/bluetooth/hci_event.c:7473 [inline]
 hci_event_packet+0x9eb/0x1190 net/bluetooth/hci_event.c:7525
 hci_rx_work+0x2c5/0x16b0 net/bluetooth/hci_core.c:4015
 process_one_work+0x958/0x1b30 kernel/workqueue.c:3236
 process_scheduled_works kernel/workqueue.c:3317 [inline]
 worker_thread+0x6c8/0xf00 kernel/workqueue.c:3398
 kthread+0x3af/0x750 kernel/kthread.c:464
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
==================================================================

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/01/24 09:20 upstream 8883957b3c9d 521b0ce3 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: null-ptr-deref Write in l2cap_sock_resume_cb
2025/01/24 09:20 upstream 8883957b3c9d 521b0ce3 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: null-ptr-deref Write in l2cap_sock_resume_cb
2025/01/24 09:20 upstream 8883957b3c9d 521b0ce3 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: null-ptr-deref Write in l2cap_sock_resume_cb
2025/01/24 09:17 upstream 8883957b3c9d 521b0ce3 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: null-ptr-deref Write in l2cap_sock_resume_cb
2025/01/24 09:17 upstream 8883957b3c9d 521b0ce3 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: null-ptr-deref Write in l2cap_sock_resume_cb
2025/01/24 09:16 upstream 8883957b3c9d 521b0ce3 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: null-ptr-deref Write in l2cap_sock_resume_cb
* Struck through repros no longer work on HEAD.