From nobody Mon Sep 28 08:07:25 2026 Received: from mail-pg1-f179.google.com (mail-pg1-f179.google.com [209.85.215.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3D22A44AB62 for ; Mon, 24 Aug 2026 15:39:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.179 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787585957; cv=none; b=PSdyzglqMwzekHznDoh4GSiH1lgApqTKYK0FfiAwQDpUFB5Q75b0o10hri0UlvrOL6vr8v0JiXvVvfPOdwo0HtpdM7Mrr1gKJi4azwoHJq+IPvk+7/A8M79rfje5BehRDHlfX9iGOMPsjslJnbn+gOAK1NXjSjddoVfPL/oLE/g= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787585957; c=relaxed/simple; bh=suqqPZQ4y7T6U5ONdlfbDEhZPCpA2hZpC57daMlfS9o=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=NKlW2Xh67we2YsLa8pDW3Lt2lmpb3IaUOb8/e+/h7Ro6XRp3VK7f++2zHSDWf17ggCAB8MRREiH5+3/5oO6HRYlzQsLlYfc5M4RqOdm7o5VjNm5BuRDbA9eiJsnsZhQwkpEbEb8IR8ELzwPyqY3GMeEMwQvvd+dspjjfpemNIeg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=snu.ac.kr; spf=pass smtp.mailfrom=snu.ac.kr; dkim=pass (1024-bit key) header.d=snu.ac.kr header.i=@snu.ac.kr header.b=wp48ExiP; arc=none smtp.client-ip=209.85.215.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=snu.ac.kr Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=snu.ac.kr Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=snu.ac.kr header.i=@snu.ac.kr header.b="wp48ExiP" Received: by mail-pg1-f179.google.com with SMTP id 41be03b00d2f7-cbe827e3cb4so4156827a12.3 for ; Mon, 24 Aug 2026 08:39:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=snu.ac.kr; s=google; t=1787585953; x=1788190753; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=OENTk8cjPfC9H38uVIzpl4K9G/NOAUfmEmPfYCmr4HA=; b=wp48ExiPmY42AR4WY4c3fxVnKadk2GYDo0l5lEQft8SFdRnNrP/xXDNMJDf4NpC7Da mFJLxQdFGatuiLsNQ7TjMUEym+6K5metqsE4uHnEE190ZdB3XmmaHYPW1vYOuQ7acqvg HUbrcdv1Z1bTXJB6XsiDY3omT5Qig5Eo3rQ4g= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787585953; x=1788190753; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=OENTk8cjPfC9H38uVIzpl4K9G/NOAUfmEmPfYCmr4HA=; b=hni6+5DhPCeQqI2WYswXDOFGR2kR//WSyXyfURjJ+Z960HyCGR7zRQsVCIfQqgS1ze 2dvjv7EOc/KKd9XP2Zggd1x55cLHlrh2lVO+tI8KU79iXtLxtW0T++bgolx+p1K4qqTc YEhPneYGgpzpkFsORlDzSmL8wguA6CUSvHsprUwWMq6kJQ37tb47a0ma0GJse/WkwciM Azw0AccOY7RrM6IE4WFo7D+AGPYBtc0fTwnkeRvzopbc5jsrGGrbwAGSI/VAaZBScCC0 5GgaC25v812iMFRHJ8wG1P9hXQlWTTTadjvrfV1JYxQ5GoJVBMbJl+8mXtNBzzl0GY+T wI3w== X-Gm-Message-State: AFuF++lwB/5QrgpgXVdJvNmkv4MkwgTpP5qVmEqecSaRjjMWF420pwGQ h/hBJGhgn1tuqPMlOirRm/ZvDzS4CSjrHKeDUlJ7ZDN4kgXtGWER6pDmpP4O2RhV7+k= X-Gm-Gg: AR+sD12l7eHicnHT9zXITmDLo4oAQyFNhHHWIknyizgrHCxPkiHvEPzW3BAZm4jBK9o g4fID4yDGCCGWeP6Ky0k3gnk3pySVCKTWZ2wTPMD6E74IbqWok/e0OJDAFLX2cBwggRh1S6dON5 jhyE7NPhY4S/WZX6+J6TZOs2mjYMmoWhnD7uSCSpYC1+Xos2AoePBUKCD2HwlnwKXh/DtdqLqPD ckvvng3JB7vdnjR2e9yUsnd9Ax8im+VxfTk0tTlKDDmIHYopMwADDGIhRWp+8Py3E3olo+p6Zq7 D+WmCcukzE0JxO19mpt69epyB3cQQ4++mNMqmLHpXjVFVPoX4u2QKk/KYD4zBaBv4iOzuAjV7pL 10+ixbyy0uXPqtHjt3QqAeGgZwXBrEii92vsTs1rdXO1LXTf++EpRabMF0ToOx/0orBrqgsOVnd 8cZ0fhXD9Ag55NxRMKPIB0n2MuEJiyYbaSg/HyacYdudSt52NzKfiB1wMUNkt1rohDU3VVtoPlk NG8xW8hf94bR1LY+dtPSJqEVpeuXe+v9wNlrE102EmmpVm0hqukaV5zSfAXQSqWhF50RNn8SoPW P8k8LPFmocagc67DTls6zOCSpCR3o7kj1n11flhzdGRzhe+kmOOpqA== X-Received: by 2002:a05:6a20:7292:b0:3b4:7e2d:a3c2 with SMTP id adf61e73a8af0-3cd301c72f7mr41618230637.18.1787585953431; Mon, 24 Aug 2026 08:39:13 -0700 (PDT) Received: from leesin ([147.46.121.37]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cc199daed9asm1197608a12.5.2026.08.24.08.39.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 24 Aug 2026 08:39:12 -0700 (PDT) From: Jaeyoung Chung To: linux-bluetooth@vger.kernel.org, luiz.dentz@gmail.com, marcel@holtmann.org Cc: linux-kernel@vger.kernel.org, eulgyukim@snu.ac.kr, jjy600901@snu.ac.kr Subject: [BUG] general protection fault in __l2cap_chan_add Date: Tue, 25 Aug 2026 00:39:07 +0900 Message-ID: <20260824153908.2327306-1-jjy600901@snu.ac.kr> X-Mailer: git-send-email 2.50.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Hello, We found a "general protection fault in __l2cap_chan_add" on Linux v7.2. The issue was found by our own race fuzzer. We have not analyzed the root c= ause, so we do not have a proposed fix to offer. To reproduce the race reliably, we applied the delay patch below to the kernel and ran the C reproducer as root inside an x86_64 QEMU guest. The crash log we observed, the delay patch and the reproducer are all included below. The following kernel config options are required to reproduce the issue: CONFIG_BT=3Dy CONFIG_BT_BREDR=3Dy CONFIG_BT_HCIVHCI=3Dy CONFIG_KASAN=3Dy We hope this report is useful. Please let us know if any further information would help. Reported-by: Eulgyu Kim Reported-by: Jaeyoung Chung Kernel delay patch: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 1156aba4e83c..1c16fec62f14 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -30,6 +30,7 @@ #include #include #include +#include =20 #include #include @@ -96,6 +97,8 @@ static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct= l2cap_conn *conn, return NULL; } =20 +unsigned long syz_l2cap_victim; + static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn, u16 cid) { @@ -104,6 +107,11 @@ static struct l2cap_chan *__l2cap_get_chan_by_scid(str= uct l2cap_conn *conn, list_for_each_entry(c, &conn->chan_l, list) { if (c->scid =3D=3D cid) return c; + if ((unsigned long)c =3D=3D syz_l2cap_victim && + strncmp(current->comm, "syzrepro", 8) =3D=3D 0) { + syz_l2cap_victim =3D 0; + mdelay(500); + } } return NULL; } diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c index 4058ff50cc27..8dffd01db9fe 100644 --- a/net/bluetooth/l2cap_sock.c +++ b/net/bluetooth/l2cap_sock.c @@ -29,6 +29,7 @@ #include #include #include +#include =20 #include #include @@ -36,6 +37,8 @@ =20 #include "smp.h" =20 +extern unsigned long syz_l2cap_victim; + static struct bt_sock_list l2cap_sk_list =3D { .lock =3D __RW_LOCK_UNLOCKED(l2cap_sk_list.lock) }; @@ -1430,6 +1433,11 @@ static int l2cap_sock_shutdown(struct socket *sock, = int how) conn =3D l2cap_conn_hold_unless_zero(chan->conn); l2cap_chan_unlock(chan); =20 + if (strncmp(current->comm, "syzrepro1", 9) =3D=3D 0) { + syz_l2cap_victim =3D conn ? 0 : (unsigned long)chan; + mdelay(250); + } + if (conn) /* mutex lock must be taken before l2cap_chan_lock() */ mutex_lock(&conn->lock); =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D C reproducer: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #ifndef AF_BLUETOOTH #define AF_BLUETOOTH 31 #endif #define BTPROTO_L2CAP 0 #define BTPROTO_HCI 1 #define HCI_COMMAND_PKT 0x01 #define HCI_EVENT_PKT 0x04 #define HCI_VENDOR_PKT 0xff #define HCI_EV_CONN_COMPLETE 0x03 #define HCI_EV_CONN_REQUEST 0x04 #define HCI_EV_REMOTE_FEATURES 0x0b #define HCI_EV_CMD_COMPLETE 0x0e #define HCI_OP_RESET 0x0c03 #define HCI_OP_WRITE_SCAN_ENABLE 0x0c1a #define HCI_OP_READ_BUFFER_SIZE 0x1005 #define HCI_OP_READ_BD_ADDR 0x1009 #define ACL_LINK 0x01 #define SCAN_PAGE 0x02 #define HCI_PRIMARY 0 #define HCI_HANDLE_1 200 #define HCIDEVUP _IOW('H', 201, int) #define HCISETSCAN _IOW('H', 221, int) typedef struct { uint8_t b[6]; } __attribute__((packed)) my_bdaddr_t; struct sockaddr_l2 { uint16_t l2_family; uint16_t l2_psm; my_bdaddr_t l2_bdaddr; uint16_t l2_cid; uint8_t l2_bdaddr_type; } __attribute__((packed)); struct hci_command_hdr { uint16_t opcode; uint8_t plen; } __attribute__((packed)); struct hci_event_hdr { uint8_t evt; uint8_t plen; } __attribute__((packed)); struct hci_ev_cmd_complete { uint8_t ncmd; uint16_t opcode; } __attribute__((packed)); struct hci_ev_conn_request { my_bdaddr_t bdaddr; uint8_t dev_class[3]; uint8_t link_type; } __attribute__((packed)); struct hci_ev_conn_complete { uint8_t status; uint16_t handle; my_bdaddr_t bdaddr; uint8_t link_type; uint8_t encr_mode; } __attribute__((packed)); struct hci_ev_remote_features { uint8_t status; uint16_t handle; uint8_t features[8]; } __attribute__((packed)); struct hci_rp_read_bd_addr { uint8_t status; my_bdaddr_t bdaddr; } __attribute__((packed)); struct hci_rp_read_buffer_size { uint8_t status; uint16_t acl_mtu; uint8_t sco_mtu; uint16_t acl_max_pkt; uint16_t sco_max_pkt; } __attribute__((packed)); struct hci_dev_req { uint16_t dev_id; uint32_t dev_opt; }; struct vhci_vendor_pkt_request { uint8_t type; uint8_t opcode; } __attribute__((packed)); struct my_rfkill_event { uint32_t idx; uint8_t type; uint8_t op; uint8_t soft; uint8_t hard; } __attribute__((packed)); #define RFKILL_TYPE_ALL 0 #define RFKILL_OP_CHANGE_ALL 3 static int vhci_fd =3D -1; static int hci_sock =3D -1; static int hci_dev_id =3D -1; #define LOG(fmt, ...) = \ do { \ fflush(stdout); \ } while (0) #define LOGE(fmt, ...) = \ do { \ fflush(stdout); \ } while (0) static void hci_send_event_packet(int fd, uint8_t evt, void *data, size_t data_len) { struct iovec iv[3]; struct hci_event_hdr hdr; uint8_t type =3D HCI_EVENT_PKT; hdr.evt =3D evt; hdr.plen =3D data_len; iv[0].iov_base =3D &type; iv[0].iov_len =3D sizeof(type); iv[1].iov_base =3D &hdr; iv[1].iov_len =3D sizeof(hdr); iv[2].iov_base =3D data; iv[2].iov_len =3D data_len; if (writev(fd, iv, 3) < 0) LOGE("writev(event) failed"); } static void hci_send_event_cmd_complete(int fd, uint16_t opcode, void *data, size_t data_len) { struct iovec iv[4]; struct hci_event_hdr hdr; struct hci_ev_cmd_complete evt_hdr; uint8_t type =3D HCI_EVENT_PKT; hdr.evt =3D HCI_EV_CMD_COMPLETE; hdr.plen =3D sizeof(struct hci_ev_cmd_complete) + data_len; evt_hdr.ncmd =3D 1; evt_hdr.opcode =3D opcode; iv[0].iov_base =3D &type; iv[0].iov_len =3D sizeof(type); iv[1].iov_base =3D &hdr; iv[1].iov_len =3D sizeof(hdr); iv[2].iov_base =3D &evt_hdr; iv[2].iov_len =3D sizeof(evt_hdr); iv[3].iov_base =3D data; iv[3].iov_len =3D data_len; if (writev(fd, iv, 4) < 0) LOGE("writev(cmd_complete) failed"); } static void process_command_pkt(int fd, char *buf, ssize_t buf_size) { struct hci_command_hdr *hdr =3D (struct hci_command_hdr *)buf; if (buf_size < (ssize_t)sizeof(struct hci_command_hdr)) return; switch (hdr->opcode) { case HCI_OP_READ_BD_ADDR: { struct hci_rp_read_bd_addr rp; memset(&rp, 0, sizeof(rp)); rp.status =3D 0; memset(&rp.bdaddr, 0xaa, 6); hci_send_event_cmd_complete(fd, hdr->opcode, &rp, sizeof(rp)); return; } case HCI_OP_READ_BUFFER_SIZE: { struct hci_rp_read_buffer_size rp; memset(&rp, 0, sizeof(rp)); rp.status =3D 0; rp.acl_mtu =3D 1021; rp.sco_mtu =3D 96; rp.acl_max_pkt =3D 4; rp.sco_max_pkt =3D 6; hci_send_event_cmd_complete(fd, hdr->opcode, &rp, sizeof(rp)); return; } case HCI_OP_WRITE_SCAN_ENABLE: { uint8_t status =3D 0; hci_send_event_cmd_complete(fd, hdr->opcode, &status, sizeof(status)); return; } } { char dummy[0xf9]; memset(dummy, 0, sizeof(dummy)); hci_send_event_cmd_complete(fd, hdr->opcode, dummy, sizeof(dummy)); } } static void *event_thread(void *arg) { (void)arg; prctl(PR_SET_NAME, "syzhci", 0, 0, 0); for (;;) { char buf[1024]; ssize_t n; memset(buf, 0, sizeof(buf)); n =3D read(vhci_fd, buf, sizeof(buf)); if (n < 0) { if (errno =3D=3D EINTR) continue; return NULL; } if (n > 0 && (uint8_t)buf[0] =3D=3D HCI_COMMAND_PKT) process_command_pkt(vhci_fd, buf + 1, n - 1); } return NULL; } static void rfkill_unblock_all(void) { struct my_rfkill_event ev; int fd =3D open("/dev/rfkill", O_WRONLY); if (fd < 0) { return; } memset(&ev, 0, sizeof(ev)); ev.idx =3D 0; ev.type =3D RFKILL_TYPE_ALL; ev.op =3D RFKILL_OP_CHANGE_ALL; if (write(fd, &ev, sizeof(ev)) < 0) LOGE("write rfkill failed"); close(fd); } static void inject_fake_acl_link(void) { struct hci_ev_conn_request request; struct hci_ev_conn_complete complete; struct hci_ev_remote_features features; memset(&request, 0, sizeof(request)); memset(&request.bdaddr, 0xaa, 6); request.bdaddr.b[5] =3D 0x10; request.link_type =3D ACL_LINK; hci_send_event_packet(vhci_fd, HCI_EV_CONN_REQUEST, &request, sizeof(request)); memset(&complete, 0, sizeof(complete)); complete.status =3D 0; complete.handle =3D HCI_HANDLE_1; memset(&complete.bdaddr, 0xaa, 6); complete.bdaddr.b[5] =3D 0x10; complete.link_type =3D ACL_LINK; complete.encr_mode =3D 0; hci_send_event_packet(vhci_fd, HCI_EV_CONN_COMPLETE, &complete, sizeof(complete)); memset(&features, 0, sizeof(features)); features.status =3D 0; features.handle =3D HCI_HANDLE_1; hci_send_event_packet(vhci_fd, HCI_EV_REMOTE_FEATURES, &features, sizeof(features)); } static int setup_vhci(void) { struct vhci_vendor_pkt_request vendor_pkt_req; struct hci_dev_req dr; pthread_t th; char buf[1024]; ssize_t n; int ret, tries; hci_sock =3D socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI); if (hci_sock < 0) { return -1; } vhci_fd =3D open("/dev/vhci", O_RDWR); if (vhci_fd < 0) { return -1; } vendor_pkt_req.type =3D HCI_VENDOR_PKT; vendor_pkt_req.opcode =3D HCI_PRIMARY; if (write(vhci_fd, &vendor_pkt_req, sizeof(vendor_pkt_req)) !=3D (ssize_t)sizeof(vendor_pkt_req)) { return -1; } for (tries =3D 0; tries < 64; tries++) { memset(buf, 0, sizeof(buf)); n =3D read(vhci_fd, buf, sizeof(buf)); if (n < 0) { return -1; } if (n >=3D 4 && (uint8_t)buf[0] =3D=3D HCI_VENDOR_PKT) { hci_dev_id =3D (uint8_t)buf[2] | ((uint8_t)buf[3] << 8); break; } if (n > 0 && (uint8_t)buf[0] =3D=3D HCI_COMMAND_PKT) process_command_pkt(vhci_fd, buf + 1, n - 1); } if (hci_dev_id < 0) { return -1; } if (pthread_create(&th, NULL, event_thread, NULL)) { return -1; } pthread_detach(th); ret =3D ioctl(hci_sock, HCIDEVUP, hci_dev_id); if (ret) { if (errno =3D=3D ERFKILL) { rfkill_unblock_all(); ret =3D ioctl(hci_sock, HCIDEVUP, hci_dev_id); } if (ret && errno !=3D EALREADY) { return -1; } } memset(&dr, 0, sizeof(dr)); dr.dev_id =3D hci_dev_id; dr.dev_opt =3D SCAN_PAGE; if (ioctl(hci_sock, HCISETSCAN, &dr)) { return -1; } inject_fake_acl_link(); usleep(200000); return 0; } static pthread_barrier_t barrier; static volatile int fd0 =3D -1; static volatile int fd1 =3D -1; static volatile int connect_err0; static volatile int connect_err2; static void fill_addr(struct sockaddr_l2 *sa) { memset(sa, 0, sizeof(*sa)); sa->l2_family =3D AF_BLUETOOTH; sa->l2_psm =3D 0x0021; memset(&sa->l2_bdaddr, 0xaa, 6); sa->l2_bdaddr.b[5] =3D 0x10; sa->l2_cid =3D 0; sa->l2_bdaddr_type =3D 0; } static void *thread0(void *arg) { struct sockaddr_l2 sa; (void)arg; prctl(PR_SET_NAME, "syzrepro0", 0, 0, 0); fill_addr(&sa); pthread_barrier_wait(&barrier); usleep(20000); errno =3D 0; if (connect(fd0, (struct sockaddr *)&sa, 14) < 0) connect_err0 =3D errno; else connect_err0 =3D 0; return NULL; } static void *thread1(void *arg) { (void)arg; prctl(PR_SET_NAME, "syzrepro1", 0, 0, 0); pthread_barrier_wait(&barrier); shutdown(fd0, SHUT_RDWR); return NULL; } static void *thread2(void *arg) { struct sockaddr_l2 sa; (void)arg; prctl(PR_SET_NAME, "syzrepro2", 0, 0, 0); fill_addr(&sa); pthread_barrier_wait(&barrier); usleep(100000); errno =3D 0; if (connect(fd1, (struct sockaddr *)&sa, 14) < 0) connect_err2 =3D errno; else connect_err2 =3D 0; return NULL; } static int link_is_gone(int err) { return err =3D=3D EHOSTUNREACH || err =3D=3D ECONNREFUSED || err =3D=3D EOPNOTSUPP || err =3D=3D ETIMEDOUT || err =3D=3D ENOTCON= N || err =3D=3D EIO; } int main(void) { int iters =3D 40; int i; setvbuf(stdout, NULL, _IOLBF, 0); if (setup_vhci() < 0) { return 1; } for (i =3D 0; i < iters; i++) { pthread_t t0, t1, t2; fd0 =3D socket(AF_BLUETOOTH, SOCK_SEQPACKET | SOCK_NONBLOCK, BTPROTO_L2CAP); if (fd0 < 0) { return 1; } fd1 =3D socket(AF_BLUETOOTH, SOCK_SEQPACKET | SOCK_NONBLOCK, BTPROTO_L2CAP); if (fd1 < 0) { close(fd0); return 1; } connect_err0 =3D -1; connect_err2 =3D -1; if (pthread_barrier_init(&barrier, NULL, 3)) { return 1; } if (pthread_create(&t0, NULL, thread0, NULL) || pthread_create(&t1, NULL, thread1, NULL) || pthread_create(&t2, NULL, thread2, NULL)) { return 1; } pthread_join(t0, NULL); pthread_join(t1, NULL); pthread_join(t2, NULL); pthread_barrier_destroy(&barrier); close(fd0); close(fd1); if (i =3D=3D 0 || (i % 5) =3D=3D 0) LOG("iter %d: connect0=3D%d connect2=3D%d", i, connect_err0, connect_err2); if (link_is_gone(connect_err0) || link_is_gone(connect_err2)) { inject_fake_acl_link(); usleep(200000); } } return 0; } =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Crash log: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Oops: general protection fault, probably for non-canonical address 0xfbd59b= ffffffffcc: 0000 [#1] SMP KASAN PTI KASAN: maybe wild-memory-access in range [0xdeacfffffffffe60-0xdeacffffffff= fe67] CPU: 3 UID: 0 PID: 404 Comm: syzrepro2 Not tainted 7.2.0-dirty #2 PREEMPT=20 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1= .1 04/01/2014 RIP: 0010:__l2cap_get_chan_by_scid net/bluetooth/l2cap_core.c:112 [inline] RIP: 0010:l2cap_alloc_cid net/bluetooth/l2cap_core.c:261 [inline] RIP: 0010:__l2cap_chan_add+0x178/0x770 net/bluetooth/l2cap_core.c:644 Code: e9 64 04 00 00 4d 8b 6d 00 4d 39 e5 0f 84 e7 03 00 00 49 8d ad 66 fd = ff ff 48 89 e8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c= 0 0f 85 89 00 00 00 49 8d 85 40 fd ff ff 66 44 39 RSP: 0018:ffff8881094e7c78 EFLAGS: 00010a07 RAX: 1bd59fffffffffcc RBX: ffff888109aae000 RCX: dffffc0000000000 RDX: 0000000000248940 RSI: 000000070eb25f82 RDI: 0000000000248919 RBP: deacfffffffffe66 R08: 0000000000000003 R09: 0000000000000003 R10: dffffc0000000000 R11: ffffffff9baf4880 R12: ffff8881076f3940 R13: dead000000000100 R14: ffff8881076f3800 R15: 0000000009aa0041 FS: 00007c16caf7a6c0(0000) GS:ffff88817b87f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007c16cc8b1ed0 CR3: 0000000106c78000 CR4: 00000000000006f0 Call Trace: l2cap_chan_connect+0x630/0xb90 net/bluetooth/l2cap_core.c:7404 l2cap_sock_connect+0x324/0x4c0 net/bluetooth/l2cap_sock.c:259 __sys_connect_file net/socket.c:2135 [inline] __sys_connect+0x20e/0x2d0 net/socket.c:2154 __do_sys_connect net/socket.c:2160 [inline] __se_sys_connect net/socket.c:2157 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:2157 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf7/0x370 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7c16cc88b7fb Code: 83 ec 18 89 54 24 0c 48 89 34 24 89 7c 24 08 e8 3b b0 f7 ff 8b 54 24 = 0c 48 8b 34 24 41 89 c0 8b 7c 24 08 b8 2a 00 00 00 0f 05 <48> 3d 00 f0 ff f= f 77 35 44 89 c7 89 44 24 08 e8 91 b0 f7 ff 8b 44 RSP: 002b:00007c16caf79e80 EFLAGS: 00000293 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 00007c16caf7a640 RCX: 00007c16cc88b7fb RDX: 000000000000000e RSI: 00007c16caf79eab RDI: 0000000000000006 RBP: 00007c16caf79eab R08: 0000000000000000 R09: 0000000000000003 R10: 0000000000000000 R11: 0000000000000293 R12: ffffffffffffff80 R13: 0000000000000072 R14: 00007ffc0dfae990 R15: 00007c16ca77a000 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:__l2cap_get_chan_by_scid net/bluetooth/l2cap_core.c:112 [inline] RIP: 0010:l2cap_alloc_cid net/bluetooth/l2cap_core.c:261 [inline] RIP: 0010:__l2cap_chan_add+0x178/0x770 net/bluetooth/l2cap_core.c:644 Code: e9 64 04 00 00 4d 8b 6d 00 4d 39 e5 0f 84 e7 03 00 00 49 8d ad 66 fd = ff ff 48 89 e8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c= 0 0f 85 89 00 00 00 49 8d 85 40 fd ff ff 66 44 39 RSP: 0018:ffff8881094e7c78 EFLAGS: 00010a07 RAX: 1bd59fffffffffcc RBX: ffff888109aae000 RCX: dffffc0000000000 RDX: 0000000000248940 RSI: 000000070eb25f82 RDI: 0000000000248919 RBP: deacfffffffffe66 R08: 0000000000000003 R09: 0000000000000003 R10: dffffc0000000000 R11: ffffffff9baf4880 R12: ffff8881076f3940 R13: dead000000000100 R14: ffff8881076f3800 R15: 0000000009aa0041 FS: 00007c16caf7a6c0(0000) GS:ffff88817b87f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007c16cc8b1ed0 CR3: 0000000106c78000 CR4: 00000000000006f0 ---------------- Code disassembly (best guess): 0: e9 64 04 00 00 jmpq 0x469 5: 4d 8b 6d 00 mov 0x0(%r13),%r13 9: 4d 39 e5 cmp %r12,%r13 c: 0f 84 e7 03 00 00 je 0x3f9 12: 49 8d ad 66 fd ff ff lea -0x29a(%r13),%rbp 19: 48 89 e8 mov %rbp,%rax 1c: 48 c1 e8 03 shr $0x3,%rax 20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx 27: fc ff df * 2a: 0f b6 04 08 movzbl (%rax,%rcx,1),%eax <-- trapping instruct= ion 2e: 84 c0 test %al,%al 30: 0f 85 89 00 00 00 jne 0xbf 36: 49 8d 85 40 fd ff ff lea -0x2c0(%r13),%rax 3d: 66 data16 3e: 44 rex.R 3f: 39 .byte 0x39 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D