KASAN: null-ptr-deref Write in l2cap_sock_resume_cb (3)

Status: auto-obsoleted due to no activity on 2025/06/22 21:10
Subsystems: bluetooth
[Documentation on labels]
Reported-by: syzbot+fe280ff30bb95df1577c@syzkaller.appspotmail.com
First crash: 576d, last: 526d
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [bluetooth?] KASAN: null-ptr-deref Write in l2cap_sock_resume_cb (3) 0 (1) 2025/01/28 09:23
▶ ▼ Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: null-ptr-deref Write in l2cap_sock_resume_cb bluetooth 12 1 762d 759d 0/29 auto-obsoleted due to no activity on 2024/10/29 12:18
upstream KASAN: null-ptr-deref Write in l2cap_sock_resume_cb (4) bluetooth 12 syz, C 8 412d 411d 29/29 fixed on 2025/09/04 16:57
upstream KASAN: null-ptr-deref Write in l2cap_sock_resume_cb (2) bluetooth 12 1 644d 644d 0/29 closed as invalid on 2024/12/17 17:57

Sample crash report:
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_write include/linux/instrumented.h:82 [inline]
BUG: KASAN: null-ptr-deref in clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline]
BUG: KASAN: null-ptr-deref in l2cap_sock_resume_cb+0xd0/0x130 net/bluetooth/l2cap_sock.c:1699
Write of size 8 at addr 0000000000000568 by task kworker/u33:0/66

CPU: 2 UID: 0 PID: 66 Comm: kworker/u33:0 Not tainted 6.13.0-syzkaller-09760-g69e858e0b8b2 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: hci2 hci_rx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 kasan_report+0xd9/0x110 mm/kasan/report.c:602
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189
 instrument_atomic_write include/linux/instrumented.h:82 [inline]
 clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline]
 l2cap_sock_resume_cb+0xd0/0x130 net/bluetooth/l2cap_sock.c:1699
 l2cap_security_cfm+0x795/0x11d0 net/bluetooth/l2cap_core.c:7346
 hci_security_cfm include/net/bluetooth/hci_core.h:2088 [inline]
 hci_encrypt_cfm+0x1f2/0x7d0 include/net/bluetooth/hci_core.h:2136
 hci_encrypt_change_evt+0x3f3/0x1130 net/bluetooth/hci_event.c:3655
 hci_event_func net/bluetooth/hci_event.c:7473 [inline]
 hci_event_packet+0x9eb/0x1180 net/bluetooth/hci_event.c:7525
 hci_rx_work+0x2c5/0x16b0 net/bluetooth/hci_core.c:4015
 process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3236
 process_scheduled_works kernel/workqueue.c:3317 [inline]
 worker_thread+0x6c8/0xf00 kernel/workqueue.c:3398
 kthread+0x3af/0x750 kernel/kthread.c:464
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
==================================================================

Crashes (8):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/02/01 18:55 upstream 69e858e0b8b2 0dff8567 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: null-ptr-deref Write in l2cap_sock_resume_cb
2025/01/24 09:20 upstream 8883957b3c9d 521b0ce3 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: null-ptr-deref Write in l2cap_sock_resume_cb
2025/01/24 09:20 upstream 8883957b3c9d 521b0ce3 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: null-ptr-deref Write in l2cap_sock_resume_cb
2025/01/24 09:20 upstream 8883957b3c9d 521b0ce3 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: null-ptr-deref Write in l2cap_sock_resume_cb
2025/01/24 09:17 upstream 8883957b3c9d 521b0ce3 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: null-ptr-deref Write in l2cap_sock_resume_cb
2025/01/24 09:17 upstream 8883957b3c9d 521b0ce3 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: null-ptr-deref Write in l2cap_sock_resume_cb
2025/01/24 09:16 upstream 8883957b3c9d 521b0ce3 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: null-ptr-deref Write in l2cap_sock_resume_cb
2025/03/14 21:09 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 059f6cbcfa70 e2826670 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Write in l2cap_sock_resume_cb
* Struck through repros no longer work on HEAD.