syzbot


general protection fault in lock_sock_nested

Status: upstream: reported on 2025/06/19 04:51
Reported-by: syzbot+aeda1232b2d36276f64e@syzkaller.appspotmail.com
First crash: 36d, last: 1d23h
Similar bugs (17)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-49 general protection fault in lock_sock_nested 2 1 2722d 2722d 0/3 auto-closed as invalid on 2019/02/22 12:39
linux-4.14 general protection fault in lock_sock_nested 2 4 1540d 1758d 0/1 auto-closed as invalid on 2021/09/04 19:35
upstream general protection fault in lock_sock_nested bluetooth 19 C done done 3030 23h53m 683d 0/29 upstream: reported C repro on 2023/09/11 07:52
linux-5.15 general protection fault in lock_sock_nested missing-backport origin:upstream 8 C error 134 9h39m 477d 0/3 upstream: reported C repro on 2024/04/04 13:25
linux-6.1 general protection fault in lock_sock_nested origin:upstream 19 syz 144 3d13h 467d 0/3 upstream: reported syz repro on 2024/04/14 08:46
upstream BUG: unable to handle kernel paging request in lock_sock_nested bluetooth 17 43 1375d 1815d 0/29 auto-closed as invalid on 2022/02/16 22:16
linux-4.19 KASAN: wild-memory-access Write in lock_sock_nested 23 2 1639d 1708d 0/1 auto-closed as invalid on 2021/05/28 14:35
linux-6.1 BUG: sleeping function called from invalid context in lock_sock_nested (2) origin:upstream missing-backport 5 C error 5 91d 152d 0/3 upstream: reported C repro on 2025/02/23 00:56
linux-4.19 KASAN: use-after-free Read in lock_sock_nested 23 C 471 877d 2191d 0/1 upstream: reported C repro on 2019/07/26 21:27
linux-4.14 KASAN: use-after-free Read in lock_sock_nested 19 C inconclusive 331 918d 2284d 0/1 upstream: reported C repro on 2019/04/24 06:28
upstream KASAN: use-after-free Read in lock_sock_nested hams 19 C inconclusive done 1856 787d 2396d 0/29 auto-obsoleted due to no activity on 2023/08/23 09:06
linux-6.1 BUG: sleeping function called from invalid context in lock_sock_nested 5 7 370d 391d 0/3 auto-obsoleted due to no activity on 2024/10/28 05:57
linux-4.14 BUG: unable to handle kernel paging request in lock_sock_nested 8 4 1533d 1652d 0/1 auto-closed as invalid on 2021/09/11 11:51
upstream KASAN: slab-out-of-bounds Read in lock_sock_nested bluetooth 17 syz unreliable done 23 1369d 1809d 0/29 auto-obsoleted due to no activity on 2022/09/29 10:19
linux-4.19 KASAN: slab-out-of-bounds Read in lock_sock_nested 23 14 1052d 1716d 0/1 auto-obsoleted due to no activity on 2023/01/05 15:59
upstream BUG: sleeping function called from invalid context in lock_sock_nested (3) bluetooth 19 C inconclusive error 150 4d00h 438d 0/29 upstream: reported C repro on 2024/05/13 12:58
linux-5.15 BUG: sleeping function called from invalid context in lock_sock_nested missing-backport origin:upstream 19 C error 22 64d 391d 0/3 upstream: reported C repro on 2024/06/29 07:50

Sample crash report:
general protection fault, probably for non-canonical address 0xdffffc0000000026: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000130-0x0000000000000137]
CPU: 1 PID: 27 Comm: kworker/1:1 Not tainted 6.6.99-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: events l2cap_info_timeout

RIP: 0010:__lock_acquire+0xeb/0x7c80 kernel/locking/lockdep.c:5005
Code: 85 dc 66 00 00 83 3d cf a2 e3 0c 00 48 89 9c 24 f0 00 00 00 0f 84 11 10 00 00 83 3d fe bd 58 0b 00 74 36 48 89 f8 48 c1 e8 03 <42> 80 3c 00 00 74 1f 48 8b bc 24 88 00 00 00 e8 c1 cc 75 00 48 8b
RSP: 0018:ffffc90000a2f600 EFLAGS: 00010002
RAX: 0000000000000026 RBX: 1ffff92000145ee4 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000130
RBP: ffffc90000a2f848 R08: dffffc0000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff1c94f9e R12: 0000000000000001
R13: 0000000000000000 R14: ffff88801be73c00 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f37c52a1000 CR3: 0000000078c4c000 CR4: 00000000003506e0
Call Trace:
 <TASK>
 lock_acquire+0x197/0x410 kernel/locking/lockdep.c:5754
 lock_sock_nested+0x48/0x100 net/core/sock.c:3510
 lock_sock include/net/sock.h:1731 [inline]
 l2cap_sock_ready_cb+0x45/0x130 net/bluetooth/l2cap_sock.c:1658
 l2cap_chan_ready net/bluetooth/l2cap_core.c:1263 [inline]
 l2cap_conn_start+0x753/0xe40 net/bluetooth/l2cap_core.c:1512
 l2cap_info_timeout+0x68/0xa0 net/bluetooth/l2cap_core.c:1669
 process_one_work kernel/workqueue.c:2634 [inline]
 process_scheduled_works+0xa45/0x15b0 kernel/workqueue.c:2711
 worker_thread+0xa55/0xfc0 kernel/workqueue.c:2792
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__lock_acquire+0xeb/0x7c80 kernel/locking/lockdep.c:5005
Code: 85 dc 66 00 00 83 3d cf a2 e3 0c 00 48 89 9c 24 f0 00 00 00 0f 84 11 10 00 00 83 3d fe bd 58 0b 00 74 36 48 89 f8 48 c1 e8 03 <42> 80 3c 00 00 74 1f 48 8b bc 24 88 00 00 00 e8 c1 cc 75 00 48 8b
RSP: 0018:ffffc90000a2f600 EFLAGS: 00010002
RAX: 0000000000000026 RBX: 1ffff92000145ee4 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000130
RBP: ffffc90000a2f848 R08: dffffc0000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff1c94f9e R12: 0000000000000001
R13: 0000000000000000 R14: ffff88801be73c00 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f37c52a1000 CR3: 0000000078c4c000 CR4: 00000000003506e0
----------------
Code disassembly (best guess):
   0:	85 dc                	test   %ebx,%esp
   2:	66 00 00             	data16 add %al,(%rax)
   5:	83 3d cf a2 e3 0c 00 	cmpl   $0x0,0xce3a2cf(%rip)        # 0xce3a2db
   c:	48 89 9c 24 f0 00 00 	mov    %rbx,0xf0(%rsp)
  13:	00
  14:	0f 84 11 10 00 00    	je     0x102b
  1a:	83 3d fe bd 58 0b 00 	cmpl   $0x0,0xb58bdfe(%rip)        # 0xb58be1f
  21:	74 36                	je     0x59
  23:	48 89 f8             	mov    %rdi,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 80 3c 00 00       	cmpb   $0x0,(%rax,%r8,1) <-- trapping instruction
  2f:	74 1f                	je     0x50
  31:	48 8b bc 24 88 00 00 	mov    0x88(%rsp),%rdi
  38:	00
  39:	e8 c1 cc 75 00       	call   0x75ccff
  3e:	48                   	rex.W
  3f:	8b                   	.byte 0x8b

Crashes (7):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/07/24 00:53 linux-6.6.y d96eb99e2f0e 0c1d6ded .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan general protection fault in lock_sock_nested
2025/07/23 15:26 linux-6.6.y d96eb99e2f0e e1dd4f22 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan general protection fault in lock_sock_nested
2025/07/09 12:18 linux-6.6.y a5df3a702b2c f4e5e155 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan general protection fault in lock_sock_nested
2025/06/30 15:17 linux-6.6.y 3f5b4c104b7d fc9d8ee5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan general protection fault in lock_sock_nested
2025/06/19 11:03 linux-6.6.y c2603c511feb ed3e87f7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan general protection fault in lock_sock_nested
2025/06/19 04:51 linux-6.6.y c2603c511feb ed3e87f7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan general protection fault in lock_sock_nested
2025/06/19 04:50 linux-6.6.y c2603c511feb ed3e87f7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan general protection fault in lock_sock_nested
* Struck through repros no longer work on HEAD.