syzbot


bluetooth subsystem


List(s): linux-bluetooth@vger.kernel.org
Maintainer(s): luiz.dentz@gmail.com, marcel@holtmann.org
Fixed bugs: 83
Parent subsystem(s): kernel (84)
open (58):
Title Repro Cause bisect Fix bisect Count Last Reported Discussions
BUG: soft lockup in hci_cmd_timeout (2) bluetooth usb syz 1 8d15h 4d15h
KASAN: wild-memory-access Read in l2cap_connect_cfm bluetooth 2 10d 7d08h
WARNING in hci_send_cmd (2) bluetooth 1 30d 26d
possible deadlock in l2cap_info_timeout bluetooth 4 13h26m 27d
WARNING: refcount bug in sco_conn_put bluetooth 1 35d 31d
general protection fault in h5_close bluetooth C done 5 29d 32d
general protection fault in bcsp_close bluetooth C done 3 34d 32d
general protection fault in bcsp_recv bluetooth syz error 3 36d 37d
general protection fault in h5_recv bluetooth C done 10 27d 43d 💬 1 [41d]
general protection fault in __timer_delete_sync bluetooth C done 3 41d 45d 💬 1 [44d]
general protection fault in qca_close bluetooth C done 94 27d 46d PATCH [45d]
KASAN: null-ptr-deref Write in l2cap_sock_resume_cb (3) bluetooth 8 10d 55d
KASAN: slab-use-after-free Read in sock_def_readable net bluetooth 3 39d 56d
KASAN: slab-use-after-free Read in force_suspend_read bluetooth 8 38d 65d
KASAN: slab-use-after-free Read in full_proxy_read bluetooth 11 60d 66d
general protection fault in hci_devcd_register bluetooth 20 1d22h 73d
general protection fault in hci_abort_conn bluetooth 1 96d 73d
WARNING in hci_devcd_register bluetooth 3 13h41m 78d
KASAN: slab-use-after-free Read in mgmt_remove_adv_monitor_complete (2) bluetooth 1 85d 81d
WARNING in hci_conn_drop bluetooth 1 87d 83d
KASAN: slab-use-after-free Read in full_proxy_write bluetooth C 36 17d 85d
KASAN: slab-use-after-free Read in msft_opcode_get bluetooth 14 14d 88d
KASAN: slab-use-after-free Read in force_devcd_write bluetooth syz 321 1h19m 89d 💬 1 [4d00h]
KASAN: slab-use-after-free Read in hci_tx_work bluetooth 1 96d 91d
WARNING in sco_conn_put bluetooth 2 33d 92d
WARNING: held lock freed in bt_accept_dequeue bluetooth 2 80d 96d
WARNING in hci_conn_timeout (2) bluetooth C error 320 13h33m 97d
general protection fault in l2cap_conn_del bluetooth 2 87d 103d
KASAN: slab-use-after-free Write in sco_conn_put bluetooth 92 1d05h 112d
KASAN: slab-use-after-free Read in l2cap_disconn_ind bluetooth 2 51d 122d
KMSAN: uninit-value in hci_cmd_complete_evt bluetooth C 15 5d12h 128d
KASAN: slab-use-after-free Write in sk_skb_reason_drop bluetooth net 2 88d 131d
INFO: task hung in hci_cmd_sync_clear (3) bluetooth syz done 4 7d09h 135d
KASAN: slab-use-after-free Read in l2cap_register_user bluetooth 8 2d07h 137d
KASAN: slab-use-after-free Read in l2cap_unregister_user bluetooth syz done 33297 7m 143d 💬 1 [4d00h]
BUG: corrupted list in hci_cmd_sync_dequeue_once bluetooth 10 4d15h 154d
KASAN: slab-use-after-free Read in bt_accept_unlink bluetooth 20 23d 154d
KASAN: slab-use-after-free Read in l2cap_sock_new_connection_cb bluetooth 33 4d04h 154d
KASAN: slab-use-after-free Read in cmd_complete_rsp bluetooth 18 11d 154d
KASAN: slab-use-after-free Read in l2cap_sock_ready_cb (2) bluetooth 37 3h10m 174d
BUG: corrupted list in _hci_cmd_sync_cancel_entry bluetooth 4 18d 178d
BUG: corrupted list in mgmt_pending_remove bluetooth C error 36 3d02h 204d 💬 1 [116d]
WARNING: ODEBUG bug in hci_release_dev (2) bluetooth C error 214 11h36m 243d
possible deadlock in sco_connect_cfm bluetooth 21 13d 259d
KASAN: slab-use-after-free Read in hci_sock_get_cookie (2) bluetooth 42 7d09h 278d
BUG: sleeping function called from invalid context in lock_sock_nested (3) bluetooth C inconclusive 139 27m 315d 💬 2 [4d00h]
possible deadlock in mgmt_remove_adv_monitor_complete bluetooth C unreliable 39 6d15h 325d
KASAN: slab-use-after-free Read in l2cap_recv_frame bluetooth C inconclusive inconclusive 137 34d 331d 💬 2 [35d]
WARNING in hci_recv_frame bluetooth syz error 47 4d08h 332d 💬 1 [124d]
KASAN: slab-use-after-free Read in hci_disconnect bluetooth 24 34d 332d
WARNING in l2cap_chan_send bluetooth 42 3d02h 345d
KASAN: slab-use-after-free Read in __hci_req_sync bluetooth C error error 3383 223d 351d 💬 2 [256d]
WARNING in l2cap_chan_del bluetooth 174 29m 372d
general protection fault in lock_sock_nested bluetooth C done done 1349 1h49m 560d
WARNING in call_timer_fn bluetooth C unreliable 6318 24m 859d 💬 8 [4d00h]
general protection fault in l2cap_chan_timeout (3) bluetooth C inconclusive inconclusive 24 1d18h 1138d
general protection fault in skb_release_data (2) net bluetooth C done error 702 37d 1657d
WARNING: ODEBUG bug in put_device bluetooth syz done error 61 110d 1690d
moderation (1):
Title Repro Cause bisect Fix bisect Count Last Reported Discussions
KASAN: slab-use-after-free Read in hidp_session_thread bluetooth 2 43d 39d