syzbot


bluetooth subsystem


List(s): linux-bluetooth@vger.kernel.org
Maintainer(s): luiz.dentz@gmail.com, marcel@holtmann.org
Fixed bugs: 63
Parent subsystem(s): kernel (79)
open (49):
Title Repro Cause bisect Fix bisect Count Last Reported Discussions
possible deadlock in mgmt_set_connectable_complete bluetooth 1 14d 10d
KASAN: slab-use-after-free Read in skb_queue_purge_reason (2) bluetooth 3 6d14h 12d
BUG: sleeping function called from invalid context in lock_sock_nested (3) bluetooth 2 8d14h 16d 💬 1 [15d]
WARNING in sco_chan_del bluetooth 3 14d 18d
KFENCE: invalid free in __hci_req_sync bluetooth 13 2d05h 25d
possible deadlock in mgmt_remove_adv_monitor_complete bluetooth 1 30d 26d
possible deadlock in hci_dev_close bluetooth 2 28d 28d
KASAN: slab-use-after-free Read in l2cap_recv_frame bluetooth syz 1 36d 32d
possible deadlock in hci_unregister_dev (2) bluetooth 6 29d 33d
possible deadlock in hci_dev_do_close (2) bluetooth C done 10 28d 33d 💬 1 [30d]
WARNING in hci_recv_frame bluetooth 1 33d 33d
KASAN: slab-use-after-free Read in hci_disconnect bluetooth 7 2d21h 33d
KASAN: invalid-free in hci_req_sync_complete bluetooth 97 18h59m 37d
KASAN: slab-use-after-free Read in skb_release_head_state bluetooth syz 65 23h22m 37d 💬 1 [28d]
WARNING in hci_conn_set_handle bluetooth C error 7 7d23h 45d 💬 1 [44d]
WARNING in l2cap_chan_send bluetooth 8 9d21h 45d
KASAN: global-out-of-bounds Read in __timer_delete bluetooth 1 57d 51d
KASAN: slab-use-after-free Read in __hci_req_sync bluetooth C error 1907 2h07m 52d 💬 2 [19d]
BUG: sleeping function called from invalid context in hci_le_create_big_complete_evt bluetooth C done 7 8d20h 52d 💬 2 [51d]
KASAN: slab-out-of-bounds Read in hci_sock_setsockopt bluetooth C done 5 49d 54d PATCH [50d]
KASAN: slab-out-of-bounds Read in rfcomm_sock_setsockopt bluetooth C 8 40d 54d PATCH [50d]
KASAN: slab-out-of-bounds Read in l2cap_sock_setsockopt bluetooth C 36 44d 54d 💬 2 [53d]
KASAN: slab-out-of-bounds Read in sco_sock_setsockopt bluetooth C unreliable 28 41d 54d PATCH [50d]
WARNING in msft_do_close bluetooth 1 61d 57d
KASAN: slab-use-after-free Read in mgmt_pending_foreach bluetooth 1 66d 62d
WARNING in l2cap_chan_del bluetooth 2 48d 73d
possible deadlock in touch_wq_lockdep_map bluetooth 574 28m 74d
KASAN: slab-use-after-free Read in hci_cmd_timeout bluetooth 8 1d12h 74d
WARNING in hci_conn_del bluetooth C done 4805 5m 91d
KASAN: slab-use-after-free Read in l2cap_send_cmd bluetooth 4 43d 93d
WARNING in ida_free (2) bluetooth C 14 105d 106d 💬 2 [105d]
WARNING in hci_send_cmd bluetooth 4 18d 107d
INFO: task hung in hci_conn_failed bluetooth C done 1 79d 122d 💬 12 [119d]
possible deadlock in __flush_workqueue bluetooth 846 6m 133d
WARNING in l2cap_do_send (2) bluetooth syz 1 141d 154d 💬 2 [153d]
KASAN: slab-use-after-free Write in sco_sock_timeout bluetooth C done 240 3d04h 195d PATCH [193d]
INFO: trying to register non-static key in sco_sock_timeout (2) bluetooth 5 32d 198d
KASAN: slab-use-after-free Write in hci_conn_drop (2) bluetooth C done 7 77d 208d 💬 2 [101d]
general protection fault in lock_sock_nested bluetooth C done done 153 3d01h 261d
WARNING: refcount bug in sco_sock_timeout (2) bluetooth 6 14d 336d 💬 1 [170d]
KASAN: slab-use-after-free Write in sco_conn_del bluetooth C done 67 4h02m 365d 💬 2 [19d]
possible deadlock in rfcomm_dlc_exists bluetooth C error 12954 27d 495d PATCH [22d]
WARNING in call_timer_fn bluetooth syz unreliable 2863 4h13m 560d 💬 8 [19d]
general protection fault in l2cap_chan_timeout (3) bluetooth C inconclusive inconclusive 5 32d 839d
possible deadlock in rfcomm_sk_state_change bluetooth C done 21745 12d 989d PATCH [22d]
KASAN: use-after-free Read in __queue_work (3) bluetooth syz done done 83 561d 1389d 💬 1 [1111d]
WARNING: ODEBUG bug in put_device bluetooth syz done error 44 70d 1391d
KASAN: use-after-free Read in __sco_sock_close bluetooth syz error error 1 1394d 1394d
WARNING in hci_conn_timeout bluetooth C done 5093 9h52m 1397d PATCH [286d]
moderation (2):
Title Repro Cause bisect Fix bisect Count Last Reported Discussions
KASAN: slab-use-after-free Read in hci_req_sync_complete bluetooth 3 13d 25d
WARNING: refcount bug in sco_conn_del (3) bluetooth 1 59d 55d