syzbot

 sign-in | mailing list | source | docs
🐞 Open [712] 🐞 Fixed [297] 🐞 Invalid [838] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

general protection fault in hci_phy_link_complete_evt

Status: fixed on 2021/01/22 19:25
Reported-by: syzbot+477d30719250034f2009@syzkaller.appspotmail.com
Fix commit: abae100355c0 Bluetooth: Fix null pointer dereference in hci_event_packet()
First crash: 1363d, last: 1220d
Fix bisection: fixed by (bisect log) :
commit abae100355c011d14c75cabbf9eb773c231187ee
Author: Anmol Karn <anmol.karan123@gmail.com>
Date: Wed Sep 30 14:18:13 2020 +0000

  Bluetooth: Fix null pointer dereference in hci_event_packet()

  
▶ ▼ Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 general protection fault in hci_phy_link_complete_evt C done 40 1216d 1363d 1/1 fixed on 2021/01/26 16:42
upstream general protection fault in hci_phy_link_complete_evt bluetooth C done unreliable 50 1235d 1362d 0/26 auto-obsoleted due to no activity on 2023/06/21 05:31
▶ ▼ Fix bisection attempts (4)
Created Duration User Patch Repo Result
2021/01/21 17:36 3h03m bisect fix linux-4.19.y job log (1)
2020/12/13 15:04 31m bisect fix linux-4.19.y job log (0) log
2020/10/27 00:55 24m bisect fix linux-4.19.y job log (0) log
2020/09/27 00:29 25m bisect fix linux-4.19.y job log (0) log

Sample crash report:
IPVS: ftp: loaded support on port[0] = 21
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 8132 Comm: kworker/u5:1 Not tainted 4.19.157-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: hci0 hci_rx_work
RIP: 0010:hci_phy_link_complete_evt.isra.0+0x252/0x930 net/bluetooth/hci_event.c:4681
Code: 48 c1 ea 03 80 3c 02 00 0f 85 28 06 00 00 48 8b 9d 28 08 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 10 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 0c 06 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b
RSP: 0000:ffff8880b129fa70 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff87592837
RDX: 0000000000000002 RSI: ffffffff87592844 RDI: 0000000000000010
RBP: ffff8880b01be040 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 00000000000000c9
R13: dffffc0000000000 R14: ffff8880a8849f00 R15: ffff8880aa135c8b
FS:  0000000000000000(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa5de480320 CR3: 00000000abea1000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 hci_event_packet+0x2a35/0x7e19 net/bluetooth/hci_event.c:5911
 hci_rx_work+0x4ad/0xc70 net/bluetooth/hci_core.c:4359
 process_one_work+0x864/0x1570 kernel/workqueue.c:2155
 worker_thread+0x64c/0x1130 kernel/workqueue.c:2298
 kthread+0x33f/0x460 kernel/kthread.c:259
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
Modules linked in:
---[ end trace 2dc842a1c73b1646 ]---
RIP: 0010:hci_phy_link_complete_evt.isra.0+0x252/0x930 net/bluetooth/hci_event.c:4681
Code: 48 c1 ea 03 80 3c 02 00 0f 85 28 06 00 00 48 8b 9d 28 08 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 10 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 0c 06 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b
RSP: 0000:ffff8880b129fa70 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff87592837
RDX: 0000000000000002 RSI: ffffffff87592844 RDI: 0000000000000010
RBP: ffff8880b01be040 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 00000000000000c9
R13: dffffc0000000000 R14: ffff8880a8849f00 R15: ffff8880aa135c8b
FS:  0000000000000000(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa3b3109000 CR3: 00000000abea1000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (28):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/11/13 15:04 linux-4.19.y 31acccdc8774 4a7fa9b4 .config console log report syz C ci2-linux-4-19
2020/08/27 10:42 linux-4.19.y f6d5cb9e2c06 816e0689 .config console log report syz C ci2-linux-4-19
2020/08/04 05:30 linux-4.19.y 13af6c74b14a 96dd3623 .config console log report syz C ci2-linux-4-19
2020/08/03 12:48 linux-4.19.y 13af6c74b14a 96dd3623 .config console log report syz C ci2-linux-4-19
2020/08/03 06:25 linux-4.19.y 13af6c74b14a 96dd3623 .config console log report syz C ci2-linux-4-19
2020/08/03 06:05 linux-4.19.y 13af6c74b14a 96dd3623 .config console log report syz C ci2-linux-4-19
2020/08/02 22:39 linux-4.19.y 13af6c74b14a 96dd3623 .config console log report syz C ci2-linux-4-19
2020/08/02 22:12 linux-4.19.y 13af6c74b14a 96dd3623 .config console log report syz C ci2-linux-4-19
2020/08/02 21:46 linux-4.19.y 13af6c74b14a 96dd3623 .config console log report syz C ci2-linux-4-19
2020/08/02 20:32 linux-4.19.y 13af6c74b14a 96dd3623 .config console log report syz C ci2-linux-4-19
2020/08/02 20:12 linux-4.19.y 13af6c74b14a 96dd3623 .config console log report syz C ci2-linux-4-19
2020/08/02 20:01 linux-4.19.y 13af6c74b14a 96dd3623 .config console log report syz C ci2-linux-4-19
2020/08/02 09:15 linux-4.19.y 13af6c74b14a 96dd3623 .config console log report syz C ci2-linux-4-19
2020/12/22 17:35 linux-4.19.y 13d2ce42de8c 04201c06 .config console log report info ci2-linux-4-19
2020/08/28 00:27 linux-4.19.y f6d5cb9e2c06 816e0689 .config console log report ci2-linux-4-19
2020/08/18 10:51 linux-4.19.y c14d30dc9987 5ce13532 .config console log report ci2-linux-4-19
2020/08/09 14:00 linux-4.19.y 961f830af065 70301872 .config console log report ci2-linux-4-19
2020/08/08 23:44 linux-4.19.y 961f830af065 f721e4a0 .config console log report ci2-linux-4-19
2020/08/02 12:37 linux-4.19.y 13af6c74b14a 96dd3623 .config console log report ci2-linux-4-19
2020/08/02 12:31 linux-4.19.y 13af6c74b14a 96dd3623 .config console log report ci2-linux-4-19
2020/08/02 11:18 linux-4.19.y 13af6c74b14a 96dd3623 .config console log report ci2-linux-4-19
2020/08/02 09:34 linux-4.19.y 13af6c74b14a 96dd3623 .config console log report ci2-linux-4-19
2020/08/02 09:34 linux-4.19.y 13af6c74b14a 96dd3623 .config console log report ci2-linux-4-19
2020/08/02 09:34 linux-4.19.y 13af6c74b14a 96dd3623 .config console log report ci2-linux-4-19
2020/08/02 09:34 linux-4.19.y 13af6c74b14a 96dd3623 .config console log report ci2-linux-4-19
2020/08/02 09:18 linux-4.19.y 13af6c74b14a 96dd3623 .config console log report ci2-linux-4-19
2020/08/02 09:18 linux-4.19.y 13af6c74b14a 96dd3623 .config console log report ci2-linux-4-19
2020/08/02 08:59 linux-4.19.y 13af6c74b14a 96dd3623 .config console log report ci2-linux-4-19
* Struck through repros no longer work on HEAD.