syzbot


bluetooth subsystem


List(s): linux-bluetooth@vger.kernel.org
Maintainer(s): luiz.dentz@gmail.com, marcel@holtmann.org
Fixed bugs: 74
Parent subsystem(s): kernel (78)
open (51):
Title Repro Cause bisect Fix bisect Count Last Reported Discussions
KASAN: slab-use-after-free Read in l2cap_sock_ready_cb (2) bluetooth 2 7h54m 3d18h
INFO: rcu detected stall in vhci_release mm bluetooth syz 4 3d23h 6d16h
KASAN: slab-use-after-free Write in mgmt_device_connected bluetooth 1 29d 7d13h
BUG: corrupted list in _hci_cmd_sync_cancel_entry bluetooth 1 15d 7d13h
KASAN: slab-use-after-free Read in sco_chan_del (2) bluetooth 1 16d 11d
BUG: corrupted list in mgmt_pending_remove bluetooth 10 16h35m 33d
KASAN: slab-use-after-free Read in l2cap_conn_unreliable bluetooth 1 66d 42d
KASAN: slab-use-after-free Read in hci_cmd_work bluetooth 1 80d 42d
WARNING in hci_conn_del (2) bluetooth 17 52d 48d
WARNING: ODEBUG bug in hci_release_dev (2) bluetooth 28 1d01h 72d
KASAN: null-ptr-deref Write in l2cap_sock_resume_cb bluetooth 1 75d 72d
WARNING in l2cap_send_cmd bluetooth 1 74d 72d
KASAN: slab-use-after-free Read in mgmt_remove_adv_monitor_sync bluetooth 17 21h49m 72d
KMSAN: uninit-value in hci_rx_work bluetooth 16 43d 73d
WARNING in hci_send_acl (3) bluetooth 1 80d 76d
KASAN: slab-use-after-free Read in set_powered_sync bluetooth C done 79 21h49m 81d 💬 6 [7h57m]
BUG: workqueue leaked atomic, lock or RCU: kworker/u9:NUM[NUM] bluetooth C 28 61d 88d 💬 1 [85d]
possible deadlock in sco_connect_cfm bluetooth 8 40d 88d
WARNING: locking bug in sco_conn_del (2) bluetooth 1 96d 92d
KASAN: slab-use-after-free Read in l2cap_recv_acldata bluetooth 1 97d 93d
KASAN: slab-use-after-free Read in __sock_queue_rcv_skb bluetooth 7 95d 102d
KASAN: slab-use-after-free Read in sk_skb_reason_drop bluetooth syz error error 412 50d 102d 💬 2 [85d]
KASAN: slab-use-after-free Read in hci_sock_get_cookie (2) bluetooth 4 28d 107d
KASAN: slab-use-after-free Read in __lock_sock (2) bluetooth C 5 96d 110d 💬 1 [109d]
KASAN: slab-use-after-free Read in hci_req_sync_complete bluetooth 8 94d 119d
possible deadlock in mgmt_set_connectable_complete bluetooth 3 7d19h 139d
KASAN: slab-use-after-free Read in skb_queue_purge_reason (2) bluetooth 43 3d22h 140d
BUG: sleeping function called from invalid context in lock_sock_nested (3) bluetooth C inconclusive 50 21h21m 144d 💬 2 [20d]
WARNING in sco_chan_del bluetooth 7 22d 147d
possible deadlock in mgmt_remove_adv_monitor_complete bluetooth 3 74d 155d
KASAN: slab-use-after-free Read in l2cap_recv_frame bluetooth C inconclusive 118 14h38m 160d 💬 2 [33d]
WARNING in hci_recv_frame bluetooth 7 2d09h 161d
KASAN: slab-use-after-free Read in hci_disconnect bluetooth 17 11d 162d
KASAN: slab-use-after-free Read in skb_release_head_state bluetooth syz error 135 24d 165d 💬 1 [20d]
WARNING in l2cap_chan_send bluetooth 36 2d02h 174d
KASAN: slab-use-after-free Read in __hci_req_sync bluetooth C error error 3383 52d 180d 💬 2 [85d]
BUG: sleeping function called from invalid context in hci_le_create_big_complete_evt bluetooth C done 141 5h43m 180d 💬 2 [20d]
WARNING in l2cap_chan_del bluetooth 22 6d00h 201d
KASAN: slab-use-after-free Read in hci_cmd_timeout bluetooth 28 55d 202d
KASAN: slab-use-after-free Read in l2cap_send_cmd bluetooth 28 6d15h 221d
WARNING in hci_send_cmd bluetooth 7 21d 235d
WARNING in l2cap_do_send (2) bluetooth syz 1 269d 283d 💬 2 [281d]
KASAN: slab-use-after-free Write in sco_sock_timeout bluetooth C done 273 2d09h 323d PATCH [11h26m]
general protection fault in lock_sock_nested bluetooth C done done 316 8h22m 389d
WARNING: refcount bug in sco_sock_timeout (2) bluetooth 9 20d 464d 💬 1 [298d]
KASAN: slab-use-after-free Write in sco_conn_del bluetooth C done 81 6h25m 493d 💬 2 [52d]
possible deadlock in rfcomm_dlc_exists bluetooth C error 13526 7h32m 623d PATCH [150d]
WARNING in call_timer_fn bluetooth syz unreliable 4115 3h09m 688d 💬 8 [20d]
general protection fault in l2cap_chan_timeout (3) bluetooth C inconclusive inconclusive 6 12d 967d
general protection fault in skb_release_data (2) net bluetooth C done error 683 74d 1486d
WARNING: ODEBUG bug in put_device bluetooth syz done error 45 51d 1519d
moderation (3):
Title Repro Cause bisect Fix bisect Count Last Reported Discussions
KASAN: slab-use-after-free Read in mgmt_remove_adv_monitor_complete bluetooth 1 9d16h 5d16h
KASAN: slab-use-after-free Read in bt_accept_dequeue bluetooth 2 27d 80d
BUG: corrupted list in hci_cmd_sync_dequeue_once bluetooth 3 7d09h 102d