bisecting fixing commit since 13af6c74b14a883366e7702c40c52ff548096e7f building syzkaller on 02034dac31a9c4dfecfa163f445ef1921c442268 testing commit 13af6c74b14a883366e7702c40c52ff548096e7f with gcc (GCC) 8.4.1 20210217 kernel signature: c8d7bf7325a88f2faca1fdd64ed0f25f936fd17e38729a35e287213807f567f0 all runs: crashed: KASAN: use-after-free Read in hci_send_acl testing current HEAD eb575cd5d7f60241d016fdd13a9e86d962093c9b testing commit eb575cd5d7f60241d016fdd13a9e86d962093c9b with gcc (GCC) 8.4.1 20210217 kernel signature: 1b76c53b48b88f0ba342c4a1cd21956508bfdf0104e1e8ac51e8973aefcc0367 all runs: OK # git bisect start eb575cd5d7f60241d016fdd13a9e86d962093c9b 13af6c74b14a883366e7702c40c52ff548096e7f Bisecting: 2210 revisions left to test after this (roughly 11 steps) [89d8af6bf6544270efdcd36045863615fdf0d31e] drivers: soc: ti: knav_qmss_queue: Fix error return code in knav_queue_probe testing commit 89d8af6bf6544270efdcd36045863615fdf0d31e with gcc (GCC) 8.4.1 20210217 kernel signature: 7b62f24e59eb8d2b26723481dda7a552515538c9044e8302102c51423e92f25b all runs: crashed: KASAN: use-after-free Read in hci_send_acl # git bisect good 89d8af6bf6544270efdcd36045863615fdf0d31e Bisecting: 1105 revisions left to test after this (roughly 10 steps) [2b7a58254b73503ad404e615c50de7c728219ca8] staging: rtl8192u: fix ->ssid overflow in r8192_wx_set_scan() testing commit 2b7a58254b73503ad404e615c50de7c728219ca8 with gcc (GCC) 8.4.1 20210217 kernel signature: 4a6c8ebce786434a67f714d958fbfcd661a4884116d70621c455dbabc1a6c5e4 all runs: crashed: KASAN: use-after-free Read in hci_send_acl # git bisect good 2b7a58254b73503ad404e615c50de7c728219ca8 Bisecting: 552 revisions left to test after this (roughly 9 steps) [648fafd886fa1680c6ba52a1d6e34fa5513a93f0] ARM: dts: exynos: correct MUIC interrupt trigger level on Midas family testing commit 648fafd886fa1680c6ba52a1d6e34fa5513a93f0 with gcc (GCC) 8.4.1 20210217 kernel signature: 37dd5718db32c9f53c47e0eee6a14815ad16b024f0ac4f1688253bc4ae6a93db all runs: OK # git bisect bad 648fafd886fa1680c6ba52a1d6e34fa5513a93f0 Bisecting: 276 revisions left to test after this (roughly 8 steps) [90e501b66b2ac99f7488965d41feb21b1c865a76] ASoC: sunxi: sun4i-codec: fill ASoC card owner testing commit 90e501b66b2ac99f7488965d41feb21b1c865a76 with gcc (GCC) 8.4.1 20210217 kernel signature: e16da3fb8aa6316e3a1973b37d7bb48d1f3b68bff6cd73cae09f89dba843745e all runs: crashed: KASAN: use-after-free Read in hci_send_acl # git bisect good 90e501b66b2ac99f7488965d41feb21b1c865a76 Bisecting: 138 revisions left to test after this (roughly 7 steps) [66dba3a2f16d643660de3a94bdf4360caee7cac8] usb: gadget: uvc: add bInterval checking for HS mode testing commit 66dba3a2f16d643660de3a94bdf4360caee7cac8 with gcc (GCC) 8.4.1 20210217 kernel signature: b756f9dc9687d845ce797ca928f63bfc328872ec73303c576709583a3eef5928 all runs: crashed: KASAN: use-after-free Read in hci_send_acl # git bisect good 66dba3a2f16d643660de3a94bdf4360caee7cac8 Bisecting: 69 revisions left to test after this (roughly 6 steps) [315eab77e030b3b9549021855e598e596c1b8992] tpm: vtpm_proxy: Avoid reading host log when using a virtual device testing commit 315eab77e030b3b9549021855e598e596c1b8992 with gcc (GCC) 8.4.1 20210217 kernel signature: 5792629d1bba3312734a94cc82e10f392218041eef260c65dbab3cf09556b99b all runs: crashed: KASAN: use-after-free Read in hci_send_acl # git bisect good 315eab77e030b3b9549021855e598e596c1b8992 Bisecting: 34 revisions left to test after this (roughly 5 steps) [35113c4c9fa7c970ff456982e381dc9e9594154a] bluetooth: eliminate the potential race condition when removing the HCI controller testing commit 35113c4c9fa7c970ff456982e381dc9e9594154a with gcc (GCC) 8.4.1 20210217 kernel signature: bb94cd2cb7b20226e1afbda223e82c4ce1462f3345458049ba023a7515acc43d all runs: OK # git bisect bad 35113c4c9fa7c970ff456982e381dc9e9594154a Bisecting: 17 revisions left to test after this (roughly 4 steps) [a32ccf93f257ca5c515ddb8a2fb8750f442ffca0] usb: dwc2: Fix session request interrupt handler testing commit a32ccf93f257ca5c515ddb8a2fb8750f442ffca0 with gcc (GCC) 8.4.1 20210217 kernel signature: dbf73532d5596c4c4b8ed10f5c0ed6d69e711de5f1870ad85f9f5871053c9be2 all runs: crashed: KASAN: use-after-free Read in hci_send_acl # git bisect good a32ccf93f257ca5c515ddb8a2fb8750f442ffca0 Bisecting: 8 revisions left to test after this (roughly 3 steps) [c3da81cefbb5bc729db273ce90a994477413fc9d] modules: mark find_symbol static testing commit c3da81cefbb5bc729db273ce90a994477413fc9d with gcc (GCC) 8.4.1 20210217 kernel signature: 814f7ed4152287383381b6803ca456048f5c136f946a9a007b0fd1107fccf38f all runs: crashed: KASAN: use-after-free Read in hci_send_acl # git bisect good c3da81cefbb5bc729db273ce90a994477413fc9d Bisecting: 4 revisions left to test after this (roughly 2 steps) [04c85f758849657691dde9fce66d18eee7a9ae8f] modules: rename the licence field in struct symsearch to license testing commit 04c85f758849657691dde9fce66d18eee7a9ae8f with gcc (GCC) 8.4.1 20210217 kernel signature: c06994361da50640e5d4a0b244027b11a826d44b0e48f4e3dd25a2f62599f91f all runs: crashed: KASAN: use-after-free Read in hci_send_acl # git bisect good 04c85f758849657691dde9fce66d18eee7a9ae8f Bisecting: 2 revisions left to test after this (roughly 1 step) [2ab98abf0d2a820efa726a5e143133fc5993ed56] modules: inherit TAINT_PROPRIETARY_MODULE testing commit 2ab98abf0d2a820efa726a5e143133fc5993ed56 with gcc (GCC) 8.4.1 20210217 kernel signature: d108cdbe95f0396eb4a657ec905569fdc7c60d7e57db8a7f9ae4a2b1d90f2402 all runs: crashed: KASAN: use-after-free Read in hci_send_acl # git bisect good 2ab98abf0d2a820efa726a5e143133fc5993ed56 Bisecting: 0 revisions left to test after this (roughly 1 step) [40fa36443db3ddb570e5e5f27c44d23d680f9d1b] hsr: use netdev_err() instead of WARN_ONCE() testing commit 40fa36443db3ddb570e5e5f27c44d23d680f9d1b with gcc (GCC) 8.4.1 20210217 kernel signature: 75776cf4a10b4bdf1a3d1317a7d17a90577801f9c336c003dac5c9d601d2a825 all runs: OK # git bisect bad 40fa36443db3ddb570e5e5f27c44d23d680f9d1b Bisecting: 0 revisions left to test after this (roughly 0 steps) [75e26178e26f910f7f26c79c2824b726eecf0dfb] Bluetooth: verify AMP hci_chan before amp_destroy testing commit 75e26178e26f910f7f26c79c2824b726eecf0dfb with gcc (GCC) 8.4.1 20210217 kernel signature: cf4d94c5b51c0a669d682f668d3fdad5ac3332ae998b9bcf99c8740194737be0 all runs: OK # git bisect bad 75e26178e26f910f7f26c79c2824b726eecf0dfb 75e26178e26f910f7f26c79c2824b726eecf0dfb is the first bad commit commit 75e26178e26f910f7f26c79c2824b726eecf0dfb Author: Archie Pusaka Date: Mon Mar 22 14:03:11 2021 +0800 Bluetooth: verify AMP hci_chan before amp_destroy commit 5c4c8c9544099bb9043a10a5318130a943e32fc3 upstream. hci_chan can be created in 2 places: hci_loglink_complete_evt() if it is an AMP hci_chan, or l2cap_conn_add() otherwise. In theory, Only AMP hci_chan should be removed by a call to hci_disconn_loglink_complete_evt(). However, the controller might mess up, call that function, and destroy an hci_chan which is not initiated by hci_loglink_complete_evt(). This patch adds a verification that the destroyed hci_chan must have been init'd by hci_loglink_complete_evt(). Example crash call trace: Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xe3/0x144 lib/dump_stack.c:118 print_address_description+0x67/0x22a mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report mm/kasan/report.c:412 [inline] kasan_report+0x251/0x28f mm/kasan/report.c:396 hci_send_acl+0x3b/0x56e net/bluetooth/hci_core.c:4072 l2cap_send_cmd+0x5af/0x5c2 net/bluetooth/l2cap_core.c:877 l2cap_send_move_chan_cfm_icid+0x8e/0xb1 net/bluetooth/l2cap_core.c:4661 l2cap_move_fail net/bluetooth/l2cap_core.c:5146 [inline] l2cap_move_channel_rsp net/bluetooth/l2cap_core.c:5185 [inline] l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:5464 [inline] l2cap_sig_channel net/bluetooth/l2cap_core.c:5799 [inline] l2cap_recv_frame+0x1d12/0x51aa net/bluetooth/l2cap_core.c:7023 l2cap_recv_acldata+0x2ea/0x693 net/bluetooth/l2cap_core.c:7596 hci_acldata_packet net/bluetooth/hci_core.c:4606 [inline] hci_rx_work+0x2bd/0x45e net/bluetooth/hci_core.c:4796 process_one_work+0x6f8/0xb50 kernel/workqueue.c:2175 worker_thread+0x4fc/0x670 kernel/workqueue.c:2321 kthread+0x2f0/0x304 kernel/kthread.c:253 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:415 Allocated by task 38: set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc+0x8d/0x9a mm/kasan/kasan.c:553 kmem_cache_alloc_trace+0x102/0x129 mm/slub.c:2787 kmalloc include/linux/slab.h:515 [inline] kzalloc include/linux/slab.h:709 [inline] hci_chan_create+0x86/0x26d net/bluetooth/hci_conn.c:1674 l2cap_conn_add.part.0+0x1c/0x814 net/bluetooth/l2cap_core.c:7062 l2cap_conn_add net/bluetooth/l2cap_core.c:7059 [inline] l2cap_connect_cfm+0x134/0x852 net/bluetooth/l2cap_core.c:7381 hci_connect_cfm+0x9d/0x122 include/net/bluetooth/hci_core.h:1404 hci_remote_ext_features_evt net/bluetooth/hci_event.c:4161 [inline] hci_event_packet+0x463f/0x72fa net/bluetooth/hci_event.c:5981 hci_rx_work+0x197/0x45e net/bluetooth/hci_core.c:4791 process_one_work+0x6f8/0xb50 kernel/workqueue.c:2175 worker_thread+0x4fc/0x670 kernel/workqueue.c:2321 kthread+0x2f0/0x304 kernel/kthread.c:253 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:415 Freed by task 1732: set_track mm/kasan/kasan.c:460 [inline] __kasan_slab_free mm/kasan/kasan.c:521 [inline] __kasan_slab_free+0x106/0x128 mm/kasan/kasan.c:493 slab_free_hook mm/slub.c:1409 [inline] slab_free_freelist_hook+0xaa/0xf6 mm/slub.c:1436 slab_free mm/slub.c:3009 [inline] kfree+0x182/0x21e mm/slub.c:3972 hci_disconn_loglink_complete_evt net/bluetooth/hci_event.c:4891 [inline] hci_event_packet+0x6a1c/0x72fa net/bluetooth/hci_event.c:6050 hci_rx_work+0x197/0x45e net/bluetooth/hci_core.c:4791 process_one_work+0x6f8/0xb50 kernel/workqueue.c:2175 worker_thread+0x4fc/0x670 kernel/workqueue.c:2321 kthread+0x2f0/0x304 kernel/kthread.c:253 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:415 The buggy address belongs to the object at ffff8881d7af9180 which belongs to the cache kmalloc-128 of size 128 The buggy address is located 24 bytes inside of 128-byte region [ffff8881d7af9180, ffff8881d7af9200) The buggy address belongs to the page: page:ffffea00075ebe40 count:1 mapcount:0 mapping:ffff8881da403200 index:0x0 flags: 0x8000000000000200(slab) raw: 8000000000000200 dead000000000100 dead000000000200 ffff8881da403200 raw: 0000000000000000 0000000080150015 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8881d7af9080: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb ffff8881d7af9100: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc >ffff8881d7af9180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8881d7af9200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8881d7af9280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc Signed-off-by: Archie Pusaka Reported-by: syzbot+98228e7407314d2d4ba2@syzkaller.appspotmail.com Reviewed-by: Alain Michaud Reviewed-by: Abhishek Pandit-Subedi Signed-off-by: Marcel Holtmann Cc: George Kennedy Signed-off-by: Greg Kroah-Hartman include/net/bluetooth/hci_core.h | 1 + net/bluetooth/hci_event.c | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) culprit signature: cf4d94c5b51c0a669d682f668d3fdad5ac3332ae998b9bcf99c8740194737be0 parent signature: d108cdbe95f0396eb4a657ec905569fdc7c60d7e57db8a7f9ae4a2b1d90f2402 revisions tested: 15, total time: 4h1m43.686425957s (build: 2h34m38.579450589s, test: 1h25m33.234275503s) first good commit: 75e26178e26f910f7f26c79c2824b726eecf0dfb Bluetooth: verify AMP hci_chan before amp_destroy recipients (to): ["abhishekpandit@chromium.org" "alainm@chromium.org" "apusaka@chromium.org" "gregkh@linuxfoundation.org" "marcel@holtmann.org"] recipients (cc): []