syzbot


bluetooth subsystem


List(s): linux-bluetooth@vger.kernel.org
Maintainer(s): luiz.dentz@gmail.com, marcel@holtmann.org
Fixed bugs: 81
Parent subsystem(s): kernel (94)
open (59):
Title Repro Cause bisect Fix bisect Count Last Reported Discussions
KASAN: slab-use-after-free Read in force_suspend_read bluetooth 4 2d15h 2d12h
KASAN: slab-use-after-free Read in full_proxy_read bluetooth 10 now 3d06h
general protection fault in hci_devcd_register bluetooth 5 6d06h 10d
general protection fault in hci_abort_conn bluetooth 1 33d 10d
WARNING in hci_devcd_register bluetooth 2 7d01h 15d
KASAN: slab-use-after-free Read in mgmt_remove_adv_monitor_complete (2) bluetooth 1 22d 18d
WARNING in hci_conn_drop bluetooth 1 24d 20d
KASAN: slab-use-after-free Read in full_proxy_write bluetooth 9 11d 22d
KASAN: slab-use-after-free Read in msft_opcode_get bluetooth 6 8d07h 25d
KASAN: slab-use-after-free Read in force_devcd_write bluetooth syz 126 now 26d 💬 1 [3d12h]
KASAN: slab-use-after-free Read in hci_tx_work bluetooth 1 33d 28d
WARNING in sco_conn_put bluetooth 1 33d 29d
WARNING: held lock freed in bt_accept_dequeue bluetooth 2 16d 33d
KASAN: slab-use-after-free Read in l2cap_connect_cfm bluetooth syz inconclusive 27 6d05h 34d
WARNING in hci_conn_timeout (2) bluetooth C error 175 1h54m 34d
general protection fault in l2cap_conn_del bluetooth 2 24d 40d
BUG: unable to handle kernel paging request in hci_release_dev bluetooth 1 48d 44d
KASAN: slab-use-after-free Write in sco_conn_put bluetooth 35 1d07h 49d
KASAN: slab-use-after-free Read in __timer_delete bluetooth C done done 1 55d 54d 💬 1 [24d]
KASAN: slab-use-after-free Read in lookup_object_or_alloc (2) bluetooth syz error 1 59d 54d
KASAN: slab-use-after-free Read in l2cap_disconn_ind bluetooth 1 59d 59d
KMSAN: uninit-value in hci_cmd_complete_evt bluetooth 2 31d 65d
KASAN: slab-use-after-free Write in sk_skb_reason_drop net bluetooth 2 25d 68d
WARNING in emon bluetooth 1 73d 69d
INFO: task hung in hci_cmd_sync_clear (3) bluetooth syz done 4 53d 72d
KASAN: slab-use-after-free Read in l2cap_register_user bluetooth 4 2d14h 74d
KASAN: slab-use-after-free Read in l2cap_unregister_user bluetooth syz done 23156 11m 80d 💬 1 [3d12h]
KASAN: slab-use-after-free Read in hci_send_acl (2) bluetooth 1 87d 81d
BUG: corrupted list in hci_cmd_sync_dequeue_once bluetooth 6 11d 91d
KASAN: slab-use-after-free Read in bt_accept_unlink bluetooth 10 4d00h 91d
KASAN: slab-use-after-free Read in l2cap_sock_new_connection_cb bluetooth 22 2d04h 91d
KASAN: slab-use-after-free Read in cmd_complete_rsp bluetooth 17 17d 91d
possible deadlock in touch_wq_lockdep_map (2) bluetooth 5 91d 101d
KASAN: slab-use-after-free Read in l2cap_sock_ready_cb (2) bluetooth 19 17d 111d
BUG: corrupted list in _hci_cmd_sync_cancel_entry bluetooth 3 49d 115d
KASAN: slab-use-after-free Read in sco_chan_del (2) bluetooth 2 91d 119d
BUG: corrupted list in mgmt_pending_remove bluetooth C error 31 3d02h 141d 💬 1 [53d]
WARNING: ODEBUG bug in hci_release_dev (2) bluetooth C error 142 1h55m 180d
possible deadlock in sco_connect_cfm bluetooth 13 5d07h 196d
KASAN: slab-use-after-free Read in hci_sock_get_cookie (2) bluetooth 26 1d02h 215d
possible deadlock in mgmt_set_connectable_complete bluetooth syz 44 54d 246d
KASAN: slab-use-after-free Read in skb_queue_purge_reason (2) bluetooth 65 1d22h 248d
BUG: sleeping function called from invalid context in lock_sock_nested (3) bluetooth C inconclusive 105 5d06h 252d 💬 2 [3d12h]
WARNING in sco_chan_del bluetooth 10 72d 254d
possible deadlock in mgmt_remove_adv_monitor_complete bluetooth C unreliable 39 3d21h 262d
KASAN: slab-use-after-free Read in l2cap_recv_frame bluetooth C inconclusive inconclusive 130 54d 268d 💬 2 [97d]
WARNING in hci_recv_frame bluetooth syz 34 5d10h 269d 💬 1 [61d]
KASAN: slab-use-after-free Read in hci_disconnect bluetooth 21 34d 269d
WARNING in l2cap_chan_send bluetooth 39 5d14h 281d
KASAN: slab-use-after-free Read in __hci_req_sync bluetooth C error error 3383 160d 288d 💬 2 [193d]
WARNING in l2cap_chan_del bluetooth 107 19h15m 309d
KASAN: slab-use-after-free Read in l2cap_send_cmd bluetooth C done 33 3d05h 329d PATCH [4d00h]
WARNING in hci_send_cmd bluetooth 8 95d 343d
general protection fault in lock_sock_nested bluetooth C done done 732 30m 497d
WARNING: refcount bug in sco_sock_timeout (2) bluetooth 10 92d 572d 💬 1 [406d]
WARNING in call_timer_fn bluetooth C unreliable 5569 3h45m 796d 💬 8 [3d12h]
general protection fault in l2cap_chan_timeout (3) bluetooth C inconclusive inconclusive 9 42d 1075d
general protection fault in skb_release_data (2) bluetooth net C done error 699 1d08h 1594d
WARNING: ODEBUG bug in put_device bluetooth syz done error 61 47d 1627d