Message-ID: <682791fe.a00a0220.398d88.0222.GAE@google.com>
Date: Fri, 16 May 2025 12:29:02 -0700
From: syzbot <syzbot+feb0dc579bbe30a13190@...kaller.appspotmail.com>
To: hdanton@...a.com, linux-kernel@...r.kernel.org, 
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in
 mgmt_remove_adv_monitor_complete (3)

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

ly 0 port 6081 - 0
[  100.848943][ T5354] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
2025/05/16 19:28:23 executed programs: 0
[  101.013794][ T5369] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[  101.017148][ T5369] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[  101.020411][ T5369] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[  101.035450][ T5369] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[  101.038675][ T5369] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[  101.209300][ T5423] chnl_net:caif_netlink_parms(): no params data found
[  101.264598][ T5423] bridge0: port 1(bridge_slave_0) entered blocking state
[  101.267830][ T5423] bridge0: port 1(bridge_slave_0) entered disabled state
[  101.270938][ T5423] bridge_slave_0: entered allmulticast mode
[  101.284275][ T5423] bridge_slave_0: entered promiscuous mode
[  101.288654][ T5423] bridge0: port 2(bridge_slave_1) entered blocking state
[  101.291850][ T5423] bridge0: port 2(bridge_slave_1) entered disabled state
[  101.304908][ T5423] bridge_slave_1: entered allmulticast mode
[  101.308917][ T5423] bridge_slave_1: entered promiscuous mode
[  101.344729][ T5423] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  101.350123][ T5423] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  101.404166][ T5423] team0: Port device team_slave_0 added
[  101.414160][ T5423] team0: Port device team_slave_1 added
[  101.464236][ T5423] batman_adv: batadv0: Adding interface: batadv_slave_0
[  101.467427][ T5423] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  101.524876][ T5423] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  101.533942][ T5423] batman_adv: batadv0: Adding interface: batadv_slave_1
[  101.536944][ T5423] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  101.556644][ T5423] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  101.577493][ T5423] hsr_slave_0: entered promiscuous mode
[  101.580492][ T5423] hsr_slave_1: entered promiscuous mode
[  101.583557][ T5423] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  101.586820][ T5423] Cannot create hsr debugfs directory
[  101.671639][ T5423] netdevsim netdevsim0 netdevsim0: renamed from eth0
[  101.684967][ T5423] netdevsim netdevsim0 netdevsim1: renamed from eth1
[  101.689759][ T5423] netdevsim netdevsim0 netdevsim2: renamed from eth2
[  101.695328][ T5423] netdevsim netdevsim0 netdevsim3: renamed from eth3
[  101.738872][ T5423] 8021q: adding VLAN 0 to HW filter on device bond0
[  101.750284][ T5423] 8021q: adding VLAN 0 to HW filter on device team0
[  101.759250][ T3014] bridge0: port 1(bridge_slave_0) entered blocking state
[  101.762476][ T3014] bridge0: port 1(bridge_slave_0) entered forwarding state
[  101.776899][ T3014] bridge0: port 2(bridge_slave_1) entered blocking state
[  101.780075][ T3014] bridge0: port 2(bridge_slave_1) entered forwarding state
[  101.794837][ T5423] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[  101.799531][ T5423] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  101.893807][ T5423] 8021q: adding VLAN 0 to HW filter on device batadv0
[  101.921315][ T5423] veth0_vlan: entered promiscuous mode
[  101.927787][ T5423] veth1_vlan: entered promiscuous mode
[  101.944392][ T5423] veth0_macvtap: entered promiscuous mode
[  101.948942][ T5423] veth1_macvtap: entered promiscuous mode
[  101.959001][ T5423] batman_adv: batadv0: Interface activated: batadv_slave_0
[  101.967366][ T5423] batman_adv: batadv0: Interface activated: batadv_slave_1
[  101.974334][ T5423] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  101.978242][ T5423] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  101.982099][ T5423] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  101.987697][ T5423] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  102.017256][ T5423] ieee80211 phy5: Selected rate control algorithm 'minstrel_ht'
[  102.031112][ T1034] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  102.036826][ T5423] ieee80211 phy6: Selected rate control algorithm 'minstrel_ht'
[  102.042499][ T1034] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  102.060001][ T3014] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  102.065051][ T3014] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  102.407753][ T2998] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  103.526458][ T2998] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  104.285604][ T2998] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  104.317214][ T2998] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  104.398084][ T2998] bridge_slave_1: left allmulticast mode
[  104.400556][ T2998] bridge_slave_1: left promiscuous mode
[  104.406727][ T2998] bridge0: port 2(bridge_slave_1) entered disabled state
[  104.410896][ T2998] bridge_slave_0: left allmulticast mode
[  104.414563][ T2998] bridge_slave_0: left promiscuous mode
[  104.417073][ T2998] bridge0: port 1(bridge_slave_0) entered disabled state
[  104.526855][ T2998] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  104.532481][ T2998] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  104.537559][ T2998] bond0 (unregistering): Released all slaves
[  104.601253][ T2998] hsr_slave_0: left promiscuous mode
[  104.606654][ T2998] hsr_slave_1: left promiscuous mode
[  104.614144][ T2998] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  104.617425][ T2998] batman_adv: batadv0: Removing interface: batadv_slave_0
[  104.633234][ T2998] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  104.636971][ T2998] batman_adv: batadv0: Removing interface: batadv_slave_1
[  104.663323][ T2998] veth1_macvtap: left promiscuous mode
[  104.665793][ T2998] veth0_macvtap: left promiscuous mode
[  104.668265][ T2998] veth1_vlan: left promiscuous mode
[  104.670638][ T2998] veth0_vlan: left promiscuous mode
[  104.837769][ T2998] team0 (unregistering): Port device team_slave_1 removed
[  104.847365][ T2998] team0 (unregistering): Port device team_slave_0 removed

VM DIAGNOSIS:
19:28:21  Registers:
info registers vcpu 0

CPU#0
RAX=0000000000000079 RBX=0000000000000079 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc9000d52edf0
R8 =ffff888000b60237 R9 =1ffff1100016c046 R10=dffffc0000000000 R11=ffffffff853e04f0
R12=dffffc0000000000 R13=ffffffff9984bc64 R14=ffffffff99b50c00 R15=0000000000000000
RIP=ffffffff853e056c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff88808d6c7000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007fff08f02e48 CR3=000000001f723000 CR4=00352ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
Opmask00=00000000fcfeffd0 Opmask01=0000000000000003 Opmask02=00000000ffff7fdf Opmask03=0000000000000000
Opmask04=00000000ffffffff Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000
ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 44455a494c414954 494e495f43455355
ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00005597abcaeb30
ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00005597abcbcbf0
ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00ff000000000000
ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f0c36552c80
ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 3030323a30696368 2f306963682f6874 6f6f7465756c622f 6c6175747269762f
ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 005600051f40494c 43055c5155484005 424b4c55554c4e53 004057005b1a0f00
ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 7377685f31313230 3863616d2f6c6175 747269762f736563 697665642f737973
ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 003a756b733a322e 392d3533712d6370 7276633a3174633a 554d45516e76633a
ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 322e392d3533712d 63707276703a2939 3030322c39484349 2b35335128435064
ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 7261646e6174536e 703a554d45516e76 733a302e3072623a 343130322f31302f
ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 343064623a312b32 316f70627e322d33 2e36312e312d6e61 696265642d332e36
ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 313731302c453631 302c353631302c34 3631302c33343130 2c323431302c3134
ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000


syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/syzkaller/jobs/linux/gopath/pkg/mod/golang.org/toolchain@...0.1-go1.23.7.linux-amd64'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/syzkaller/jobs/linux/gopath/pkg/mod/golang.org/toolchain@...0.1-go1.23.7.linux-amd64/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.23.7'
GODEBUG=''
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build2323670350=/tmp/go-build -gno-record-gcc-switches'

git status (err=<nil>)
HEAD detached at 77908e5f2
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=77908e5f2ae80bee6d434bca762a25a0a5fc6a83 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20250509-090543'" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
	-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include   -DGOOS_linux=1 -DGOARCH_amd64=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"77908e5f2ae80bee6d434bca762a25a0a5fc6a83\"
/usr/bin/ld: /tmp/ccKazgFn.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=15c40ef4580000


Tested on:

commit:         83a89654 Merge tag 'scsi-fixes' of git://git.kernel.or..
git tree:       upstream
kernel config:  https://syzkaller.appspot.com/x/.config?x=c3f0e807ec5d1268
dashboard link: https://syzkaller.appspot.com/bug?extid=feb0dc579bbe30a13190
compiler:       Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2
patch:          https://syzkaller.appspot.com/x/patch.diff?x=10569cd4580000

Powered by blists - more mailing lists