syzbot


KASAN: null-ptr-deref Write in l2cap_sock_suspend_cb (2)

Status: closed as invalid on 2025/08/19 19:15
Subsystems: bluetooth
[Documentation on labels]
First crash: 43d, last: 40d
Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.6 KASAN: null-ptr-deref Write in l2cap_sock_suspend_cb 12 1 54d 54d 0/2 upstream: reported on 2025/07/05 20:35
upstream KASAN: null-ptr-deref Write in l2cap_sock_suspend_cb bluetooth 12 1 715d 708d 0/29 auto-obsoleted due to no activity on 2023/12/23 09:03

Sample crash report:
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_write include/linux/instrumented.h:82 [inline]
BUG: KASAN: null-ptr-deref in set_bit include/asm-generic/bitops/instrumented-atomic.h:28 [inline]
BUG: KASAN: null-ptr-deref in l2cap_sock_suspend_cb+0x43/0x90 net/bluetooth/l2cap_sock.c:1745
Write of size 8 at addr 0000000000000570 by task kworker/u33:4/5958

CPU: 3 UID: 0 PID: 5958 Comm: kworker/u33:4 Not tainted 6.16.0-rc6-syzkaller-00237-gc7de79e662b8 #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: hci1 hci_rx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 kasan_report+0xe0/0x110 mm/kasan/report.c:593
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0x100/0x1b0 mm/kasan/generic.c:189
 instrument_atomic_write include/linux/instrumented.h:82 [inline]
 set_bit include/asm-generic/bitops/instrumented-atomic.h:28 [inline]
 l2cap_sock_suspend_cb+0x43/0x90 net/bluetooth/l2cap_sock.c:1745
 l2cap_chan_ready.part.0+0x1c6/0x240 net/bluetooth/l2cap_core.c:1257
 l2cap_chan_ready net/bluetooth/l2cap_core.c:1246 [inline]
 l2cap_le_start+0x1ea/0xe40 net/bluetooth/l2cap_core.c:1375
 l2cap_conn_ready net/bluetooth/l2cap_core.c:1628 [inline]
 l2cap_connect_cfm+0x8f4/0xf80 net/bluetooth/l2cap_core.c:7304
 hci_connect_cfm include/net/bluetooth/hci_core.h:2059 [inline]
 le_conn_complete_evt+0x1662/0x1d70 net/bluetooth/hci_event.c:5754
 hci_le_conn_complete_evt+0x23c/0x370 net/bluetooth/hci_event.c:5780
 hci_le_meta_evt+0x354/0x5e0 net/bluetooth/hci_event.c:7166
 hci_event_func net/bluetooth/hci_event.c:7474 [inline]
 hci_event_packet+0x685/0x11c0 net/bluetooth/hci_event.c:7531
 hci_rx_work+0x2c5/0x16b0 net/bluetooth/hci_core.c:4070
 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3321 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3402
 kthread+0x3c5/0x780 kernel/kthread.c:464
 ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/07/19 10:21 upstream c7de79e662b8 7117feec .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: null-ptr-deref Write in l2cap_sock_suspend_cb
2025/07/16 20:41 upstream 155a3c003e55 44f8051e .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: null-ptr-deref Write in l2cap_sock_suspend_cb
* Struck through repros no longer work on HEAD.