syzbot


bluetooth subsystem


List(s): linux-bluetooth@vger.kernel.org
Maintainer(s): luiz.dentz@gmail.com, marcel@holtmann.org
Fixed bugs: 83
Parent subsystem(s): kernel (89)
open (55):
Title Repro Cause bisect Fix bisect Count Last Reported Discussions
KASAN: slab-out-of-bounds Read in hci_cmd_sync_alloc bluetooth C 4 4d07h 9h31m
KASAN: slab-use-after-free Read in bt_accept_dequeue (2) bluetooth 1 10d 6d07h
possible deadlock in l2cap_conn_del bluetooth syz error 112 now 33d
KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump bluetooth C 498 16m 34d 💬 1 [11d]
BUG: soft lockup in hci_cmd_timeout (2) bluetooth usb syz 1 49d 45d
KASAN: wild-memory-access Read in l2cap_connect_cfm bluetooth 5 24d 47d
WARNING in hci_send_cmd (2) bluetooth 2 6d06h 67d
possible deadlock in l2cap_info_timeout bluetooth 11 1d21h 67d
WARNING: refcount bug in sco_conn_put bluetooth 1 76d 72d
general protection fault in h5_close bluetooth C done 5 70d 72d
general protection fault in bcsp_close bluetooth C done 3 74d 72d
general protection fault in bcsp_recv bluetooth C error 190 4h51m 77d
general protection fault in h5_recv bluetooth C done 285 6h18m 83d 💬 1 [12d]
general protection fault in __timer_delete_sync bluetooth C done 3 82d 85d 💬 1 [85d]
general protection fault in qca_close bluetooth C done 94 68d 87d PATCH [86d]
KASAN: null-ptr-deref Write in l2cap_sock_resume_cb (3) bluetooth 8 50d 96d
KASAN: slab-use-after-free Read in sock_def_readable bluetooth net 3 80d 97d
KASAN: slab-use-after-free Read in force_suspend_read bluetooth 8 78d 106d
general protection fault in hci_devcd_register bluetooth 24 2d05h 114d
WARNING in hci_devcd_register bluetooth 3 41d 119d
KASAN: slab-use-after-free Read in full_proxy_write bluetooth C 36 58d 126d
KASAN: slab-use-after-free Read in msft_opcode_get bluetooth 15 10d 128d
KASAN: slab-use-after-free Read in force_devcd_write bluetooth syz 341 6h17m 130d 💬 1 [12d]
WARNING in sco_conn_put bluetooth 2 73d 133d
WARNING: held lock freed in bt_accept_dequeue bluetooth 4 2d21h 137d
WARNING in hci_conn_timeout (2) bluetooth C error 400 7h55m 137d
KASAN: slab-use-after-free Write in sco_conn_put bluetooth 95 39d 153d
KASAN: slab-use-after-free Read in l2cap_disconn_ind bluetooth 2 92d 162d
KMSAN: uninit-value in hci_cmd_complete_evt bluetooth C 17 31d 169d
INFO: task hung in hci_cmd_sync_clear (3) bluetooth syz done 5 8d00h 176d
KASAN: slab-use-after-free Read in l2cap_register_user bluetooth 11 6d03h 178d
KASAN: slab-use-after-free Read in l2cap_unregister_user bluetooth syz done 36671 16m 183d 💬 1 [12d]
BUG: corrupted list in hci_cmd_sync_dequeue_once bluetooth 30 1d07h 195d
KASAN: slab-use-after-free Read in bt_accept_unlink bluetooth 28 11d 195d
KASAN: slab-use-after-free Read in l2cap_sock_new_connection_cb bluetooth 34 18d 195d
KASAN: slab-use-after-free Read in cmd_complete_rsp bluetooth 18 51d 195d
KASAN: slab-use-after-free Read in l2cap_sock_ready_cb (2) bluetooth 45 7d19h 215d
BUG: corrupted list in _hci_cmd_sync_cancel_entry bluetooth 13 1d00h 219d
BUG: corrupted list in mgmt_pending_remove bluetooth C error 42 3d11h 245d 💬 1 [157d]
WARNING: ODEBUG bug in hci_release_dev (2) bluetooth C error 242 2d06h 284d
possible deadlock in sco_connect_cfm bluetooth 21 54d 299d
KASAN: slab-use-after-free Read in hci_sock_get_cookie (2) bluetooth 46 2d07h 318d
BUG: sleeping function called from invalid context in lock_sock_nested (3) bluetooth C inconclusive 141 38d 356d 💬 2 [44d]
possible deadlock in mgmt_remove_adv_monitor_complete bluetooth C unreliable 39 16d 366d
KASAN: slab-use-after-free Read in l2cap_recv_frame bluetooth C inconclusive inconclusive 137 4d05h 372d 💬 2 [76d]
WARNING in hci_recv_frame bluetooth syz error 59 2d13h 373d 💬 1 [165d]
KASAN: slab-use-after-free Read in hci_disconnect bluetooth 27 2d07h 373d
WARNING in l2cap_chan_send bluetooth 43 13d 385d
KASAN: slab-use-after-free Read in __hci_req_sync bluetooth C error error 3383 263d 392d 💬 2 [297d]
WARNING in l2cap_chan_del bluetooth 203 8h18m 413d
general protection fault in lock_sock_nested bluetooth C done done 2099 1h39m 601d
WARNING in call_timer_fn bluetooth C unreliable 6596 28m 900d 💬 8 [12d]
general protection fault in l2cap_chan_timeout (3) bluetooth C inconclusive inconclusive 33 12d 1178d
general protection fault in skb_release_data (2) net bluetooth C done error 703 33d 1698d
WARNING: ODEBUG bug in put_device bluetooth syz done error 61 150d 1731d
moderation (1):
Title Repro Cause bisect Fix bisect Count Last Reported Discussions
KASAN: slab-use-after-free Read in hidp_session_thread bluetooth 3 29d 79d