syzbot

 sign-in | mailing list | source | docs
🐞 Open [977] ≡ Subsystems 🐞 Fixed [5235] 🐞 Invalid [12492] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

BUG: unable to handle kernel NULL pointer dereference in hci_uart_set_flow_control

Status: fixed on 2019/08/14 02:14
Subsystems: bluetooth
[Documentation on labels]
Reported-by: syzbot+79337b501d6aa974d0f6@syzkaller.appspotmail.com
Fix commit: b36a1552d731 Bluetooth: hci_uart: check for missing tty operations
First crash: 1859d, last: 1859d
Cause bisection: introduced by (bisect log) :
commit 162f812f23bab583f5d514ca0e4df67797ac9cdf
Author: Loic Poulain <loic.poulain@intel.com>
Date: Mon Sep 19 14:29:27 2016 +0000

  Bluetooth: hci_uart: Add Marvell support

Crash: BUG: unable to handle kernel NULL pointer dereference in corrupted (log)
Repro: C syz .config
  
▶ ▼ Discussions (14)
Title Replies (including bot) Last reply
[PATCH 4.9 000/223] 4.9.187-stable review 231 (231) 2019/08/28 03:02
[PATCH 3.16 000/157] 3.16.72-rc1 review 162 (162) 2019/08/11 15:25
[PATCH 5.2 00/20] 5.2.6-stable review 32 (32) 2019/08/07 02:38
[PATCH 4.19 00/32] 4.19.64-stable review 43 (43) 2019/08/06 23:16
[PATCH 4.14 00/25] 4.14.136-stable review 32 (32) 2019/08/03 15:59
[PATCH 4.4 000/158] 4.4.187-stable review 166 (166) 2019/08/03 15:57
[PATCH v5.3-rc2] Bluetooth: hci_uart: check for missing tty operations 9 (9) 2019/08/01 17:48
[PATCH v2] Bluetooth: hci_ldisc: check for missing tty operations 4 (4) 2019/07/30 09:34
[PATCH] Bluetooth: hci_uart: check for missing tty operations in protocol handlers 4 (4) 2019/07/25 14:31
Reminder: 29 open syzbot bugs in bluetooth subsystem 1 (1) 2019/07/24 01:41
Reminder: 29 open syzbot bugs in bluetooth subsystem 1 (1) 2019/07/09 19:07
[PATCH] Bluetooth: hci_ldisc: check for missing tty operations 3 (3) 2019/07/06 15:19
Reminder: 27 open syzbot bugs in bluetooth subsystem 1 (1) 2019/06/24 05:14
BUG: unable to handle kernel NULL pointer dereference in hci_uart_set_flow_control 0 (2) 2019/03/21 18:22

Sample crash report:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
#PF error: [INSTR]
PGD 8c208067 P4D 8c208067 PUD 8e5f2067 PMD 0 
Oops: 0010 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 1174 Comm: kworker/u5:0 Not tainted 5.1.0-rc1+ #31
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: hci0 hci_power_on
RIP: 0010:          (null)
Code: Bad RIP value.
RSP: 0018:ffff8880a7fefa28 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffffffff87ac4d20 RCX: 0000000000000000
RDX: 1ffffffff0f589bd RSI: 1ffff11014ff4d97 RDI: ffff888095ec4480
RBP: ffff8880a7fefb00 R08: ffff8880a7fa63c0 R09: 0000000000000004
R10: ffffed1012bd8895 R11: ffff888095ec44af R12: ffff888095ec4480
R13: 1ffff11014ffdf47 R14: ffff888095ec4490 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 0000000089bd6000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 hci_uart_set_flow_control+0x41e/0x600 drivers/bluetooth/hci_ldisc.c:327
 mrvl_setup+0x22/0x110 drivers/bluetooth/hci_mrvl.c:348
 hci_uart_setup+0x1c4/0x490 drivers/bluetooth/hci_ldisc.c:418
 hci_dev_do_open+0x78c/0x1780 net/bluetooth/hci_core.c:1450
 hci_power_on+0x10d/0x580 net/bluetooth/hci_core.c:2173
 process_one_work+0x98e/0x1790 kernel/workqueue.c:2269
 worker_thread+0x98/0xe40 kernel/workqueue.c:2415
 kthread+0x357/0x430 kernel/kthread.c:253
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
Modules linked in:
CR2: 0000000000000000
---[ end trace 15c24599b1b13b8f ]---
RIP: 0010:          (null)
Code: Bad RIP value.
RSP: 0018:ffff8880a7fefa28 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffffffff87ac4d20 RCX: 0000000000000000
RDX: 1ffffffff0f589bd RSI: 1ffff11014ff4d97 RDI: ffff888095ec4480
RBP: ffff8880a7fefb00 R08: ffff8880a7fa63c0 R09: 0000000000000004
R10: ffffed1012bd8895 R11: ffff888095ec44af R12: ffff888095ec4480
R13: 1ffff11014ffdf47 R14: ffff888095ec4490 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 0000000089bd6000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (7):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/03/21 17:23 upstream 54c490164523 dce6e62f .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/03/21 13:59 upstream 54c490164523 427ea487 .config console log report syz C ci-upstream-kasan-gce-smack-root
2019/03/21 12:01 upstream 54c490164523 427ea487 .config console log report syz C ci-upstream-kasan-gce
2019/03/21 11:59 upstream 54c490164523 427ea487 .config console log report syz C ci-upstream-kasan-gce-root
2019/03/21 12:02 upstream 54c490164523 427ea487 .config console log report syz C ci-upstream-kasan-gce-386
2019/03/21 11:42 linux-next 32a217bae32c 427ea487 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/03/21 11:23 linux-next 32a217bae32c 427ea487 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.