syzbot


KASAN: slab-out-of-bounds Read in hci_le_meta_evt (2)
Status: upstream: reported C repro on 2021/10/31 17:40
Reported-by: syzbot+e3fcb9c4f3c2a931dc40@syzkaller.appspotmail.com
Fix commit: Bluetooth: stop proccessing malicious adv data
Patched on: [ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce], missing on: [ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-leak ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce ci-upstream-kmsan-gce-386 ci-upstream-net-this-kasan-gce ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 31d, last: 31d

Cause bisection: the issue happens on the oldest tested release (bisect log)
Crash: KASAN: slab-out-of-bounds Read in hci_le_meta_evt (log)
Repro: C syz .config
similar bugs (4):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 KASAN: slab-out-of-bounds Read in hci_le_meta_evt C done 15 366d 486d 1/1 fixed on 2020/12/30 13:33
linux-4.19 KASAN: slab-out-of-bounds Read in hci_le_meta_evt C done 12 347d 488d 1/1 fixed on 2021/01/18 14:01
linux-4.19 KASAN: slab-out-of-bounds Read in hci_le_meta_evt (2) C error 1 50d 200d 0/1 upstream: reported C repro on 2021/05/14 20:19
upstream KASAN: slab-out-of-bounds Read in hci_le_meta_evt C error error 45 364d 485d 21/22 fixed on 2021/03/10 01:49
Patch testing requests:
Created Duration User Patch Repo Result
2021/10/31 20:16 16m paskripkin@gmail.com patch upstream OK
2021/10/31 18:21 16m paskripkin@gmail.com patch upstream OK

Sample crash report:

Crashes (2):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-selinux-root 2021/10/31 08:29 upstream 119c85055d86 098b5d53 .config log report syz C KASAN: slab-out-of-bounds Read in hci_le_meta_evt
ci-upstream-kasan-gce-selinux-root 2021/10/31 08:05 upstream 119c85055d86 098b5d53 .config log report info KASAN: slab-out-of-bounds Read in hci_le_meta_evt