syzbot

 sign-in | mailing list | source | docs
🐞 Open [994] ≡ Subsystems 🐞 Fixed [5242] 🐞 Invalid [12515] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

BUG: unable to handle kernel paging request in h4_recv_buf

Status: fixed on 2019/03/28 12:00
Subsystems: bluetooth
[Documentation on labels]
Reported-by: syzbot+017a32f149406df32703@syzkaller.appspotmail.com
Fix commit: 1dc2d785156c Bluetooth: hci_uart: Check if socket buffer is ERR_PTR in h4_recv_buf()
First crash: 1941d, last: 1879d
▶ ▼ Discussions (8)
Title Replies (including bot) Last reply
[PATCH AUTOSEL 5.0 001/262] CIFS: fix POSIX lock leak and invalid ptr deref 284 (284) 2019/04/04 13:22
[PATCH AUTOSEL 4.19 001/192] CIFS: fix POSIX lock leak and invalid ptr deref 192 (192) 2019/03/27 18:10
[PATCH 5.0 00/52] 5.0.5-stable review 61 (61) 2019/03/27 05:06
[PATCH 4.19 00/45] 4.19.32-stable review 51 (51) 2019/03/27 04:04
[PATCH 4.14 00/41] 4.14.109-stable review 47 (47) 2019/03/26 23:15
[PATCH] Bluetooth: hci_uart: Check if socket buffer is ERR_PTR in h4_recv_buf() 2 (2) 2019/01/22 08:49
[PATCH] Bluetooth: hci_uart: Add a local variable to store the result of h4_recv_buf() 5 (5) 2019/01/21 14:48
BUG: unable to handle kernel paging request in h4_recv_buf 0 (1) 2019/01/02 09:01

Sample crash report:
Bluetooth: hci0: sending frame failed (-49)
Bluetooth: hci0: command 0x1001 tx timeout
Bluetooth: hci0: sending frame failed (-49)
Bluetooth: hci0: command 0x1009 tx timeout
Bluetooth: hci0: Frame reassembly failed (-84)
BUG: unable to handle kernel paging request at ffffffffffffffd6
#PF error: [normal kernel read fault]
PGD 8874067 P4D 8874067 PUD 8876067 PMD 0 
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 44 Comm: kworker/u4:2 Not tainted 5.0.0-rc5 #60
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events_unbound flush_to_ldisc
RIP: 0010:h4_recv_buf+0x1ea/0xda0 drivers/bluetooth/hci_h4.c:211
Code: b6 14 10 48 89 c8 83 e0 07 83 c0 01 38 d0 7c 08 84 d2 0f 85 d7 0a 00 00 48 ba 00 00 00 00 00 fc ff df 48 8b 45 d0 4c 8d 60 70 <0f> b7 58 2a 4c 89 e0 48 c1 e8 03 0f b6 04 10 84 c0 74 08 3c 03 0f
RSP: 0018:ffff8880a9ae7b10 EFLAGS: 00010246
RAX: ffffffffffffffac RBX: 0000000000000000 RCX: ffffffffffffffd6
RDX: dffffc0000000000 RSI: ffffffff84ecf372 RDI: 0000000000000005
RBP: ffff8880a9ae7b98 R08: ffff8880a9af4400 R09: 0000000000000003
R10: ffffed1015d05bcf R11: ffff8880ae82de7b R12: 000000000000001c
R13: ffff8880a9ad57c0 R14: ffff88808d4ba020 R15: 0000000000000006
FS:  0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 0000000087309000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 h4_recv+0xe4/0x200 drivers/bluetooth/hci_h4.c:131
 hci_uart_tty_receive+0x22b/0x530 drivers/bluetooth/hci_ldisc.c:607
 tty_ldisc_receive_buf+0x164/0x1c0 drivers/tty/tty_buffer.c:465
 tty_port_default_receive_buf+0x7d/0xb0 drivers/tty/tty_port.c:38
 receive_buf drivers/tty/tty_buffer.c:481 [inline]
 flush_to_ldisc+0x228/0x390 drivers/tty/tty_buffer.c:533
 process_one_work+0x98e/0x1790 kernel/workqueue.c:2173
 worker_thread+0x98/0xe40 kernel/workqueue.c:2319
 kthread+0x357/0x430 kernel/kthread.c:246
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
Modules linked in:
CR2: ffffffffffffffd6
---[ end trace 7052334c669bd77e ]---
RIP: 0010:h4_recv_buf+0x1ea/0xda0 drivers/bluetooth/hci_h4.c:211
Code: b6 14 10 48 89 c8 83 e0 07 83 c0 01 38 d0 7c 08 84 d2 0f 85 d7 0a 00 00 48 ba 00 00 00 00 00 fc ff df 48 8b 45 d0 4c 8d 60 70 <0f> b7 58 2a 4c 89 e0 48 c1 e8 03 0f b6 04 10 84 c0 74 08 3c 03 0f
RSP: 0018:ffff8880a9ae7b10 EFLAGS: 00010246
RAX: ffffffffffffffac RBX: 0000000000000000 RCX: ffffffffffffffd6
RDX: dffffc0000000000 RSI: ffffffff84ecf372 RDI: 0000000000000005
RBP: ffff8880a9ae7b98 R08: ffff8880a9af4400 R09: 0000000000000003
R10: ffffed1015d05bcf R11: ffff8880ae82de7b R12: 000000000000001c
R13: ffff8880a9ad57c0 R14: ffff88808d4ba020 R15: 0000000000000006
FS:  0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 0000000087309000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (203):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/02/07 06:54 upstream 8834f5600cf3 d25487bc .config console log report syz C ci-upstream-kasan-gce-smack-root
2019/02/07 06:44 upstream 8834f5600cf3 d25487bc .config console log report syz C ci-upstream-kasan-gce-root
2019/02/07 06:25 upstream 8834f5600cf3 d25487bc .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/01/31 04:09 upstream 1c0490ce9022 aa432daf .config console log report syz C ci-upstream-kasan-gce-root
2019/01/30 21:47 upstream 1c0490ce9022 aa432daf .config console log report syz C ci-upstream-kasan-gce-smack-root
2019/01/30 20:39 upstream 1c0490ce9022 aa432daf .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/01/03 06:51 upstream 85f78456f286 06a2b89f .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/01/02 06:34 upstream 28e8c4bc8eb4 3d85f48c .config console log report syz C ci-upstream-kasan-gce-smack-root
2019/01/02 03:15 upstream 28e8c4bc8eb4 3d85f48c .config console log report syz C ci-upstream-kasan-gce-root
2019/01/02 13:59 linux-next 4cd1b60def51 f0491811 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/03/05 02:22 upstream 736706bee329 7c693b52 .config console log report ci-upstream-kasan-gce-smack-root
2019/03/04 16:18 upstream 1c163f4c7b3f 7c693b52 .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/04 13:01 upstream 1c163f4c7b3f 7c693b52 .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/04 12:51 upstream 1c163f4c7b3f 7c693b52 .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/04 05:53 upstream 1c163f4c7b3f 1c0e457a .config console log report ci-upstream-kasan-gce-smack-root
2019/03/03 05:28 upstream c93d9218ea56 1c0e457a .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/03 03:30 upstream c93d9218ea56 1c0e457a .config console log report ci-upstream-kasan-gce-root
2019/03/01 14:59 upstream 7d762d69145a 8a4b3a6b .config console log report ci-upstream-kasan-gce-root
2019/03/01 10:25 upstream 7d762d69145a 8a4b3a6b .config console log report ci-upstream-kasan-gce-smack-root
2019/02/28 22:05 upstream 7d762d69145a 09aeeba4 .config console log report ci-upstream-kasan-gce-smack-root
2019/02/28 18:11 upstream 7d762d69145a 09aeeba4 .config console log report ci-upstream-kasan-gce-smack-root
2019/02/26 16:11 upstream 7d762d69145a a36ecd98 .config console log report ci-upstream-kasan-gce-smack-root
2019/02/25 02:19 upstream c3619a482e15 7a06e792 .config console log report ci-upstream-kasan-gce-smack-root
2019/02/24 21:24 upstream c3619a482e15 7a06e792 .config console log report ci-upstream-kasan-gce-smack-root
2019/02/24 21:24 upstream c3619a482e15 7a06e792 .config console log report ci-upstream-kasan-gce-root
2019/02/24 12:00 upstream e60b5f79bd75 7a06e792 .config console log report ci-upstream-kasan-gce-smack-root
2019/02/24 08:13 upstream e60b5f79bd75 7a06e792 .config console log report ci-upstream-kasan-gce-smack-root
2019/02/23 19:10 upstream cb268d806972 18107ce0 .config console log report ci-upstream-kasan-gce-selinux-root
2019/02/22 11:03 upstream 8a61716ff2ab 7ff74a98 .config console log report ci-upstream-kasan-gce-smack-root
2019/02/22 10:00 upstream 8a61716ff2ab 7ff74a98 .config console log report ci-upstream-kasan-gce-root
2019/02/20 04:34 upstream 40e196a906d9 4df543c9 .config console log report ci-upstream-kasan-gce-selinux-root
2019/02/18 22:31 upstream a3b22b9f11d9 59f36113 .config console log report ci-upstream-kasan-gce-selinux-root
2019/02/18 22:20 upstream a3b22b9f11d9 59f36113 .config console log report ci-upstream-kasan-gce-smack-root
2019/02/12 20:51 upstream aa0c38cf39de 6ecc6d0f .config console log report ci-upstream-kasan-gce-selinux-root
2019/02/12 11:32 upstream aa0c38cf39de 65a0d619 .config console log report ci-upstream-kasan-gce-selinux-root
2019/02/09 12:34 upstream 46c291e277f9 fa6c7b70 .config console log report ci-upstream-kasan-gce-smack-root
2019/02/08 22:04 upstream 74e96711e337 fa6c7b70 .config console log report ci-upstream-kasan-gce-smack-root
2019/02/08 09:29 upstream d47e3da17592 aa4feb03 .config console log report ci-upstream-kasan-gce-smack-root
2019/02/08 07:39 upstream d47e3da17592 aa4feb03 .config console log report ci-upstream-kasan-gce-root
2019/02/08 06:26 upstream d47e3da17592 aa4feb03 .config console log report ci-upstream-kasan-gce-root
2019/02/08 05:01 upstream d47e3da17592 aa4feb03 .config console log report ci-upstream-kasan-gce-smack-root
2019/02/07 11:13 upstream b0314565da2b aa4feb03 .config console log report ci-upstream-kasan-gce-selinux-root
2019/02/07 09:43 upstream b0314565da2b d25487bc .config console log report ci-upstream-kasan-gce-selinux-root
2019/02/06 19:36 upstream 8834f5600cf3 d25487bc .config console log report ci-upstream-kasan-gce-root
2019/02/06 18:22 upstream 8834f5600cf3 d25487bc .config console log report ci-upstream-kasan-gce-selinux-root
2019/02/06 16:44 upstream 8834f5600cf3 d25487bc .config console log report ci-upstream-kasan-gce-selinux-root
2019/02/06 13:31 upstream 8834f5600cf3 d25487bc .config console log report ci-upstream-kasan-gce-selinux-root
2019/02/06 11:58 upstream 8834f5600cf3 d672172c .config console log report ci-upstream-kasan-gce-selinux-root
2019/02/06 10:57 upstream 8834f5600cf3 d672172c .config console log report ci-upstream-kasan-gce-selinux-root
2019/02/06 09:21 upstream 8834f5600cf3 d672172c .config console log report ci-upstream-kasan-gce-selinux-root
2019/02/06 08:11 upstream 8834f5600cf3 d672172c .config console log report ci-upstream-kasan-gce-selinux-root
2019/02/06 07:08 upstream 8834f5600cf3 d672172c .config console log report ci-upstream-kasan-gce-selinux-root
2019/02/06 01:49 upstream 8834f5600cf3 d672172c .config console log report ci-upstream-kasan-gce-selinux-root
2019/02/05 19:05 upstream 8834f5600cf3 d672172c .config console log report ci-upstream-kasan-gce-selinux-root
2019/02/05 17:02 upstream 8834f5600cf3 d672172c .config console log report ci-upstream-kasan-gce-root
2019/01/20 21:49 linux-next 9673b4aa71ca fd37a550 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.