linux-kernel-mentees.lists.linuxfoundation.org archive mirror
 help / color / mirror / Atom feed
* Re: [Linux-kernel-mentees] BUG: corrupted list in kobject_add_internal
       [not found] <000000000000c57f2d05ac4c5b8e@google.com>
@ 2020-08-20  6:07 ` Coiby Xu
  2020-08-20  6:13   ` Dmitry Vyukov via Linux-kernel-mentees
  2020-08-23  1:00 ` [Linux-kernel-mentees] [PATCH] Bluetooth: fix "list_add double add" in hci_conn_complete_evt Coiby Xu
  2020-11-08 22:55 ` [Linux-kernel-mentees] BUG: corrupted list in kobject_add_internal syzbot
  2 siblings, 1 reply; 8+ messages in thread
From: Coiby Xu @ 2020-08-20  6:07 UTC (permalink / raw)
  To: syzbot
  Cc: johan.hedberg, rafael, marcel, syzkaller-bugs, linux-kernel,
	linux-bluetooth, netdev, abhishekpandit, kuba,
	linux-kernel-mentees, davem

On Fri, Aug 07, 2020 at 09:47:20AM -0700, syzbot wrote:
>Hello,
>
>syzbot found the following issue on:
>
>HEAD commit:    5a30a789 Merge tag 'x86-urgent-2020-08-02' of git://git.ke..
>git tree:       upstream
>console output: https://syzkaller.appspot.com/x/log.txt?x=1660c858900000
>kernel config:  https://syzkaller.appspot.com/x/.config?x=c0cfcf935bcc94d2
>dashboard link: https://syzkaller.appspot.com/bug?extid=dd768a260f7358adbaf9
>compiler:       gcc (GCC) 10.1.0-syz 20200507
>syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=14b73afc900000
>C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=124893a4900000
>
>The issue was bisected to:
>
>commit 4f40afc6c76451daff7d0dcfc8a3d113ccf65bfc
>Author: Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
>Date:   Wed Mar 11 15:54:01 2020 +0000
>
>    Bluetooth: Handle BR/EDR devices during suspend
>
>bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=11cb1e0a900000
>final oops:     https://syzkaller.appspot.com/x/report.txt?x=13cb1e0a900000
>console output: https://syzkaller.appspot.com/x/log.txt?x=15cb1e0a900000
>
>IMPORTANT: if you fix the issue, please add the following tag to the commit:
>Reported-by: syzbot+dd768a260f7358adbaf9@syzkaller.appspotmail.com
>Fixes: 4f40afc6c764 ("Bluetooth: Handle BR/EDR devices during suspend")
>
>debugfs: Directory '200' with parent 'hci0' already present!
>list_add double add: new=ffff88808e9b6418, prev=ffff88808e9b6418, next=ffff8880a973ef00.
>------------[ cut here ]------------
>kernel BUG at lib/list_debug.c:29!
>invalid opcode: 0000 [#1] PREEMPT SMP KASAN
>CPU: 1 PID: 6882 Comm: kworker/u5:1 Not tainted 5.8.0-rc7-syzkaller #0
>Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
>Workqueue: hci0 hci_rx_work
>RIP: 0010:__list_add_valid.cold+0x26/0x3c lib/list_debug.c:29
>Code: 57 ff ff ff 4c 89 e1 48 c7 c7 20 92 93 88 e8 b1 f1 c1 fd 0f 0b 48 89 f2 4c 89 e1 48 89 ee 48 c7 c7 60 93 93 88 e8 9a f1 c1 fd <0f> 0b 48 89 f1 48 c7 c7 e0 92 93 88 4c 89 e6 e8 86 f1 c1 fd 0f 0b
>RSP: 0018:ffffc90001777830 EFLAGS: 00010282
>RAX: 0000000000000058 RBX: ffff8880a973ef00 RCX: 0000000000000000
>RDX: ffff888094f1c200 RSI: ffffffff815d4ef7 RDI: fffff520002eeef8
>RBP: ffff88808e9b6418 R08: 0000000000000058 R09: ffff8880ae7318e7
>R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880a973ef00
>R13: ffff888087315270 R14: ffff88808e9b6430 R15: ffff88808e9b6418
>FS:  0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
>CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>CR2: 00007ffdcd6db747 CR3: 000000009ba09000 CR4: 00000000001406e0
>DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
>DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
>Call Trace:
> __list_add include/linux/list.h:67 [inline]
> list_add_tail include/linux/list.h:100 [inline]
> kobj_kset_join lib/kobject.c:196 [inline]
> kobject_add_internal+0x18d/0x940 lib/kobject.c:246
> kobject_add_varg lib/kobject.c:390 [inline]
> kobject_add+0x150/0x1c0 lib/kobject.c:442
> device_add+0x35a/0x1be0 drivers/base/core.c:2633
> hci_conn_add_sysfs+0x84/0xe0 net/bluetooth/hci_sysfs.c:53
> hci_conn_complete_evt net/bluetooth/hci_event.c:2607 [inline]
> hci_event_packet+0xe0b/0x86f5 net/bluetooth/hci_event.c:6033
> hci_rx_work+0x22e/0xb10 net/bluetooth/hci_core.c:4705
> process_one_work+0x94c/0x1670 kernel/workqueue.c:2269
> worker_thread+0x64c/0x1120 kernel/workqueue.c:2415
> kthread+0x3b5/0x4a0 kernel/kthread.c:291
> ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293
>Modules linked in:
>---[ end trace b1bcc552c32d25e9 ]---
>RIP: 0010:__list_add_valid.cold+0x26/0x3c lib/list_debug.c:29
>Code: 57 ff ff ff 4c 89 e1 48 c7 c7 20 92 93 88 e8 b1 f1 c1 fd 0f 0b 48 89 f2 4c 89 e1 48 89 ee 48 c7 c7 60 93 93 88 e8 9a f1 c1 fd <0f> 0b 48 89 f1 48 c7 c7 e0 92 93 88 4c 89 e6 e8 86 f1 c1 fd 0f 0b
>RSP: 0018:ffffc90001777830 EFLAGS: 00010282
>RAX: 0000000000000058 RBX: ffff8880a973ef00 RCX: 0000000000000000
>RDX: ffff888094f1c200 RSI: ffffffff815d4ef7 RDI: fffff520002eeef8
>RBP: ffff88808e9b6418 R08: 0000000000000058 R09: ffff8880ae7318e7
>R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880a973ef00
>R13: ffff888087315270 R14: ffff88808e9b6430 R15: ffff88808e9b6418
>FS:  0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
>CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>CR2: 00007ffdcd6db747 CR3: 0000000009a79000 CR4: 00000000001406e0
>DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
>DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
>
>
>---
>This report is generated by a bot. It may contain errors.
>See https://goo.gl/tpsmEJ for more information about syzbot.
>syzbot engineers can be reached at syzkaller@googlegroups.com.
>
>syzbot will keep track of this issue. See:
>https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>For information about bisection process see: https://goo.gl/tpsmEJ#bisection
>syzbot can test patches for this issue, for details see:
>https://goo.gl/tpsmEJ#testing-patches
>
>--
>You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
>To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
>To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/000000000000c57f2d05ac4c5b8e%40google.com.

This problem occurs because the HCI_EV_CONN_COMPLETE event packet is sent
twice for the same HCI connection,

     struct hci_ev_conn_complete complete;
     memset(&complete, 0, sizeof(complete));
     complete.status = 0;
     complete.handle = HCI_HANDLE_1;
     memset(&complete.bdaddr, 0xaa, 6);
     *(uint8_t*)&complete.bdaddr.b[5] = 0x10;
     complete.link_type = ACL_LINK;
     complete.encr_mode = 0;
     hci_send_event_packet(vhci_fd, HCI_EV_CONN_COMPLETE, &complete,
                             sizeof(complete));

which leads to kobject_add being called twice. Thus duplicate
(struct hci_conn *conn)->dev.kobj.entry is inserted into
(struct hci_conn *conn)->dev.kobj.kset->list.

But if it's the HCI connection creator's responsibility to
not send the HCI_EV_CONN_COMPLETE event packet twice, then it's not a
valid bug. Or should we make the kernel more robust by defending against
this case?

--
Best regards,
Coiby
_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees

^ permalink raw reply	[flat|nested] 8+ messages in thread

* Re: [Linux-kernel-mentees] BUG: corrupted list in kobject_add_internal
  2020-08-20  6:07 ` [Linux-kernel-mentees] BUG: corrupted list in kobject_add_internal Coiby Xu
@ 2020-08-20  6:13   ` Dmitry Vyukov via Linux-kernel-mentees
  2020-08-22 16:16     ` Coiby Xu
  0 siblings, 1 reply; 8+ messages in thread
From: Dmitry Vyukov via Linux-kernel-mentees @ 2020-08-20  6:13 UTC (permalink / raw)
  To: Coiby Xu
  Cc: syzbot, Johan Hedberg, Rafael Wysocki, Marcel Holtmann,
	syzkaller-bugs, LKML, linux-bluetooth, netdev, abhishekpandit,
	Jakub Kicinski, linux-kernel-mentees, David Miller

On Thu, Aug 20, 2020 at 8:07 AM Coiby Xu <coiby.xu@gmail.com> wrote:
>
> On Fri, Aug 07, 2020 at 09:47:20AM -0700, syzbot wrote:
> >Hello,
> >
> >syzbot found the following issue on:
> >
> >HEAD commit:    5a30a789 Merge tag 'x86-urgent-2020-08-02' of git://git.ke..
> >git tree:       upstream
> >console output: https://syzkaller.appspot.com/x/log.txt?x=1660c858900000
> >kernel config:  https://syzkaller.appspot.com/x/.config?x=c0cfcf935bcc94d2
> >dashboard link: https://syzkaller.appspot.com/bug?extid=dd768a260f7358adbaf9
> >compiler:       gcc (GCC) 10.1.0-syz 20200507
> >syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=14b73afc900000
> >C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=124893a4900000
> >
> >The issue was bisected to:
> >
> >commit 4f40afc6c76451daff7d0dcfc8a3d113ccf65bfc
> >Author: Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
> >Date:   Wed Mar 11 15:54:01 2020 +0000
> >
> >    Bluetooth: Handle BR/EDR devices during suspend
> >
> >bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=11cb1e0a900000
> >final oops:     https://syzkaller.appspot.com/x/report.txt?x=13cb1e0a900000
> >console output: https://syzkaller.appspot.com/x/log.txt?x=15cb1e0a900000
> >
> >IMPORTANT: if you fix the issue, please add the following tag to the commit:
> >Reported-by: syzbot+dd768a260f7358adbaf9@syzkaller.appspotmail.com
> >Fixes: 4f40afc6c764 ("Bluetooth: Handle BR/EDR devices during suspend")
> >
> >debugfs: Directory '200' with parent 'hci0' already present!
> >list_add double add: new=ffff88808e9b6418, prev=ffff88808e9b6418, next=ffff8880a973ef00.
> >------------[ cut here ]------------
> >kernel BUG at lib/list_debug.c:29!
> >invalid opcode: 0000 [#1] PREEMPT SMP KASAN
> >CPU: 1 PID: 6882 Comm: kworker/u5:1 Not tainted 5.8.0-rc7-syzkaller #0
> >Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> >Workqueue: hci0 hci_rx_work
> >RIP: 0010:__list_add_valid.cold+0x26/0x3c lib/list_debug.c:29
> >Code: 57 ff ff ff 4c 89 e1 48 c7 c7 20 92 93 88 e8 b1 f1 c1 fd 0f 0b 48 89 f2 4c 89 e1 48 89 ee 48 c7 c7 60 93 93 88 e8 9a f1 c1 fd <0f> 0b 48 89 f1 48 c7 c7 e0 92 93 88 4c 89 e6 e8 86 f1 c1 fd 0f 0b
> >RSP: 0018:ffffc90001777830 EFLAGS: 00010282
> >RAX: 0000000000000058 RBX: ffff8880a973ef00 RCX: 0000000000000000
> >RDX: ffff888094f1c200 RSI: ffffffff815d4ef7 RDI: fffff520002eeef8
> >RBP: ffff88808e9b6418 R08: 0000000000000058 R09: ffff8880ae7318e7
> >R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880a973ef00
> >R13: ffff888087315270 R14: ffff88808e9b6430 R15: ffff88808e9b6418
> >FS:  0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
> >CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> >CR2: 00007ffdcd6db747 CR3: 000000009ba09000 CR4: 00000000001406e0
> >DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> >DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> >Call Trace:
> > __list_add include/linux/list.h:67 [inline]
> > list_add_tail include/linux/list.h:100 [inline]
> > kobj_kset_join lib/kobject.c:196 [inline]
> > kobject_add_internal+0x18d/0x940 lib/kobject.c:246
> > kobject_add_varg lib/kobject.c:390 [inline]
> > kobject_add+0x150/0x1c0 lib/kobject.c:442
> > device_add+0x35a/0x1be0 drivers/base/core.c:2633
> > hci_conn_add_sysfs+0x84/0xe0 net/bluetooth/hci_sysfs.c:53
> > hci_conn_complete_evt net/bluetooth/hci_event.c:2607 [inline]
> > hci_event_packet+0xe0b/0x86f5 net/bluetooth/hci_event.c:6033
> > hci_rx_work+0x22e/0xb10 net/bluetooth/hci_core.c:4705
> > process_one_work+0x94c/0x1670 kernel/workqueue.c:2269
> > worker_thread+0x64c/0x1120 kernel/workqueue.c:2415
> > kthread+0x3b5/0x4a0 kernel/kthread.c:291
> > ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293
> >Modules linked in:
> >---[ end trace b1bcc552c32d25e9 ]---
> >RIP: 0010:__list_add_valid.cold+0x26/0x3c lib/list_debug.c:29
> >Code: 57 ff ff ff 4c 89 e1 48 c7 c7 20 92 93 88 e8 b1 f1 c1 fd 0f 0b 48 89 f2 4c 89 e1 48 89 ee 48 c7 c7 60 93 93 88 e8 9a f1 c1 fd <0f> 0b 48 89 f1 48 c7 c7 e0 92 93 88 4c 89 e6 e8 86 f1 c1 fd 0f 0b
> >RSP: 0018:ffffc90001777830 EFLAGS: 00010282
> >RAX: 0000000000000058 RBX: ffff8880a973ef00 RCX: 0000000000000000
> >RDX: ffff888094f1c200 RSI: ffffffff815d4ef7 RDI: fffff520002eeef8
> >RBP: ffff88808e9b6418 R08: 0000000000000058 R09: ffff8880ae7318e7
> >R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880a973ef00
> >R13: ffff888087315270 R14: ffff88808e9b6430 R15: ffff88808e9b6418
> >FS:  0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
> >CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> >CR2: 00007ffdcd6db747 CR3: 0000000009a79000 CR4: 00000000001406e0
> >DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> >DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> >
> >
> >---
> >This report is generated by a bot. It may contain errors.
> >See https://goo.gl/tpsmEJ for more information about syzbot.
> >syzbot engineers can be reached at syzkaller@googlegroups.com.
> >
> >syzbot will keep track of this issue. See:
> >https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
> >For information about bisection process see: https://goo.gl/tpsmEJ#bisection
> >syzbot can test patches for this issue, for details see:
> >https://goo.gl/tpsmEJ#testing-patches
> >
> >--
> >You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> >To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> >To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/000000000000c57f2d05ac4c5b8e%40google.com.
>
> This problem occurs because the HCI_EV_CONN_COMPLETE event packet is sent
> twice for the same HCI connection,
>
>      struct hci_ev_conn_complete complete;
>      memset(&complete, 0, sizeof(complete));
>      complete.status = 0;
>      complete.handle = HCI_HANDLE_1;
>      memset(&complete.bdaddr, 0xaa, 6);
>      *(uint8_t*)&complete.bdaddr.b[5] = 0x10;
>      complete.link_type = ACL_LINK;
>      complete.encr_mode = 0;
>      hci_send_event_packet(vhci_fd, HCI_EV_CONN_COMPLETE, &complete,
>                              sizeof(complete));
>
> which leads to kobject_add being called twice. Thus duplicate
> (struct hci_conn *conn)->dev.kobj.entry is inserted into
> (struct hci_conn *conn)->dev.kobj.kset->list.
>
> But if it's the HCI connection creator's responsibility to
> not send the HCI_EV_CONN_COMPLETE event packet twice, then it's not a
> valid bug. Or should we make the kernel more robust by defending against
> this case?

Hi Coiby,

Whoever is sending HCI_EV_CONN_COMPLETE, this should not corrupt
kernel memory. Even if it's firmware, it's not necessary trusted, see:
https://www.blackhat.com/us-20/briefings/schedule/index.html#finding-new-bluetooth-low-energy-exploits-via-reverse-engineering-multiple-vendors-firmwares-19655
and:
https://www.armis.com/bleedingbit/
So if an attacker takes over firmware, they can then corrupt kernel memory.
_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees

^ permalink raw reply	[flat|nested] 8+ messages in thread

* Re: [Linux-kernel-mentees] BUG: corrupted list in kobject_add_internal
  2020-08-20  6:13   ` Dmitry Vyukov via Linux-kernel-mentees
@ 2020-08-22 16:16     ` Coiby Xu
  0 siblings, 0 replies; 8+ messages in thread
From: Coiby Xu @ 2020-08-22 16:16 UTC (permalink / raw)
  To: Dmitry Vyukov
  Cc: syzbot, Johan Hedberg, Rafael Wysocki, Marcel Holtmann,
	syzkaller-bugs, LKML, linux-bluetooth, netdev, abhishekpandit,
	Jakub Kicinski, linux-kernel-mentees, David Miller

On Thu, Aug 20, 2020 at 08:13:47AM +0200, Dmitry Vyukov wrote:
>On Thu, Aug 20, 2020 at 8:07 AM Coiby Xu <coiby.xu@gmail.com> wrote:
>>
>> On Fri, Aug 07, 2020 at 09:47:20AM -0700, syzbot wrote:
>> >Hello,
>> >
>> >syzbot found the following issue on:
>> >
>> >HEAD commit:    5a30a789 Merge tag 'x86-urgent-2020-08-02' of git://git.ke..
>> >git tree:       upstream
>> >console output: https://syzkaller.appspot.com/x/log.txt?x=1660c858900000
>> >kernel config:  https://syzkaller.appspot.com/x/.config?x=c0cfcf935bcc94d2
>> >dashboard link: https://syzkaller.appspot.com/bug?extid=dd768a260f7358adbaf9
>> >compiler:       gcc (GCC) 10.1.0-syz 20200507
>> >syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=14b73afc900000
>> >C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=124893a4900000
>> >
>> >The issue was bisected to:
>> >
>> >commit 4f40afc6c76451daff7d0dcfc8a3d113ccf65bfc
>> >Author: Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
>> >Date:   Wed Mar 11 15:54:01 2020 +0000
>> >
>> >    Bluetooth: Handle BR/EDR devices during suspend
>> >
>> >bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=11cb1e0a900000
>> >final oops:     https://syzkaller.appspot.com/x/report.txt?x=13cb1e0a900000
>> >console output: https://syzkaller.appspot.com/x/log.txt?x=15cb1e0a900000
>> >
>> >IMPORTANT: if you fix the issue, please add the following tag to the commit:
>> >Reported-by: syzbot+dd768a260f7358adbaf9@syzkaller.appspotmail.com
>> >Fixes: 4f40afc6c764 ("Bluetooth: Handle BR/EDR devices during suspend")
>> >
>> >debugfs: Directory '200' with parent 'hci0' already present!
>> >list_add double add: new=ffff88808e9b6418, prev=ffff88808e9b6418, next=ffff8880a973ef00.
>> >------------[ cut here ]------------
>> >kernel BUG at lib/list_debug.c:29!
>> >invalid opcode: 0000 [#1] PREEMPT SMP KASAN
>> >CPU: 1 PID: 6882 Comm: kworker/u5:1 Not tainted 5.8.0-rc7-syzkaller #0
>> >Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
>> >Workqueue: hci0 hci_rx_work
>> >RIP: 0010:__list_add_valid.cold+0x26/0x3c lib/list_debug.c:29
>> >Code: 57 ff ff ff 4c 89 e1 48 c7 c7 20 92 93 88 e8 b1 f1 c1 fd 0f 0b 48 89 f2 4c 89 e1 48 89 ee 48 c7 c7 60 93 93 88 e8 9a f1 c1 fd <0f> 0b 48 89 f1 48 c7 c7 e0 92 93 88 4c 89 e6 e8 86 f1 c1 fd 0f 0b
>> >RSP: 0018:ffffc90001777830 EFLAGS: 00010282
>> >RAX: 0000000000000058 RBX: ffff8880a973ef00 RCX: 0000000000000000
>> >RDX: ffff888094f1c200 RSI: ffffffff815d4ef7 RDI: fffff520002eeef8
>> >RBP: ffff88808e9b6418 R08: 0000000000000058 R09: ffff8880ae7318e7
>> >R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880a973ef00
>> >R13: ffff888087315270 R14: ffff88808e9b6430 R15: ffff88808e9b6418
>> >FS:  0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
>> >CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> >CR2: 00007ffdcd6db747 CR3: 000000009ba09000 CR4: 00000000001406e0
>> >DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
>> >DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
>> >Call Trace:
>> > __list_add include/linux/list.h:67 [inline]
>> > list_add_tail include/linux/list.h:100 [inline]
>> > kobj_kset_join lib/kobject.c:196 [inline]
>> > kobject_add_internal+0x18d/0x940 lib/kobject.c:246
>> > kobject_add_varg lib/kobject.c:390 [inline]
>> > kobject_add+0x150/0x1c0 lib/kobject.c:442
>> > device_add+0x35a/0x1be0 drivers/base/core.c:2633
>> > hci_conn_add_sysfs+0x84/0xe0 net/bluetooth/hci_sysfs.c:53
>> > hci_conn_complete_evt net/bluetooth/hci_event.c:2607 [inline]
>> > hci_event_packet+0xe0b/0x86f5 net/bluetooth/hci_event.c:6033
>> > hci_rx_work+0x22e/0xb10 net/bluetooth/hci_core.c:4705
>> > process_one_work+0x94c/0x1670 kernel/workqueue.c:2269
>> > worker_thread+0x64c/0x1120 kernel/workqueue.c:2415
>> > kthread+0x3b5/0x4a0 kernel/kthread.c:291
>> > ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293
>> >Modules linked in:
>> >---[ end trace b1bcc552c32d25e9 ]---
>> >RIP: 0010:__list_add_valid.cold+0x26/0x3c lib/list_debug.c:29
>> >Code: 57 ff ff ff 4c 89 e1 48 c7 c7 20 92 93 88 e8 b1 f1 c1 fd 0f 0b 48 89 f2 4c 89 e1 48 89 ee 48 c7 c7 60 93 93 88 e8 9a f1 c1 fd <0f> 0b 48 89 f1 48 c7 c7 e0 92 93 88 4c 89 e6 e8 86 f1 c1 fd 0f 0b
>> >RSP: 0018:ffffc90001777830 EFLAGS: 00010282
>> >RAX: 0000000000000058 RBX: ffff8880a973ef00 RCX: 0000000000000000
>> >RDX: ffff888094f1c200 RSI: ffffffff815d4ef7 RDI: fffff520002eeef8
>> >RBP: ffff88808e9b6418 R08: 0000000000000058 R09: ffff8880ae7318e7
>> >R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880a973ef00
>> >R13: ffff888087315270 R14: ffff88808e9b6430 R15: ffff88808e9b6418
>> >FS:  0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
>> >CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> >CR2: 00007ffdcd6db747 CR3: 0000000009a79000 CR4: 00000000001406e0
>> >DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
>> >DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
>> >
>> >
>> >---
>> >This report is generated by a bot. It may contain errors.
>> >See https://goo.gl/tpsmEJ for more information about syzbot.
>> >syzbot engineers can be reached at syzkaller@googlegroups.com.
>> >
>> >syzbot will keep track of this issue. See:
>> >https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>> >For information about bisection process see: https://goo.gl/tpsmEJ#bisection
>> >syzbot can test patches for this issue, for details see:
>> >https://goo.gl/tpsmEJ#testing-patches
>> >
>> >--
>> >You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
>> >To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
>> >To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/000000000000c57f2d05ac4c5b8e%40google.com.
>>
>> This problem occurs because the HCI_EV_CONN_COMPLETE event packet is sent
>> twice for the same HCI connection,
>>
>>      struct hci_ev_conn_complete complete;
>>      memset(&complete, 0, sizeof(complete));
>>      complete.status = 0;
>>      complete.handle = HCI_HANDLE_1;
>>      memset(&complete.bdaddr, 0xaa, 6);
>>      *(uint8_t*)&complete.bdaddr.b[5] = 0x10;
>>      complete.link_type = ACL_LINK;
>>      complete.encr_mode = 0;
>>      hci_send_event_packet(vhci_fd, HCI_EV_CONN_COMPLETE, &complete,
>>                              sizeof(complete));
>>
>> which leads to kobject_add being called twice. Thus duplicate
>> (struct hci_conn *conn)->dev.kobj.entry is inserted into
>> (struct hci_conn *conn)->dev.kobj.kset->list.
>>
>> But if it's the HCI connection creator's responsibility to
>> not send the HCI_EV_CONN_COMPLETE event packet twice, then it's not a
>> valid bug. Or should we make the kernel more robust by defending against
>> this case?
>
>Hi Coiby,

Hi Dmitry,

>
>Whoever is sending HCI_EV_CONN_COMPLETE, this should not corrupt
>kernel memory. Even if it's firmware, it's not necessary trusted, see:
>https://www.blackhat.com/us-20/briefings/schedule/index.html#finding-new-bluetooth-low-energy-exploits-via-reverse-engineering-multiple-vendors-firmwares-19655
>and:
>https://www.armis.com/bleedingbit/
>So if an attacker takes over firmware, they can then corrupt kernel memory.

Thank you for sharing the links. Although I haven't found out how exactly
this "list_add double add" corruption would be exploited by an attacker
in the two resources or on the Internet (the closest one I can find is
CVE-2019-2215 which exploits list_del with CONFIG_DEBUG_LIST disabled),
this should be an interesting bug and I'll learn more about Bluetooth to
fix it.

--
Best regards,
Coiby
_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees

^ permalink raw reply	[flat|nested] 8+ messages in thread

* [Linux-kernel-mentees] [PATCH] Bluetooth: fix "list_add double add" in hci_conn_complete_evt
       [not found] <000000000000c57f2d05ac4c5b8e@google.com>
  2020-08-20  6:07 ` [Linux-kernel-mentees] BUG: corrupted list in kobject_add_internal Coiby Xu
@ 2020-08-23  1:00 ` Coiby Xu
  2020-08-31 16:06   ` Marcel Holtmann
  2020-11-08 22:55 ` [Linux-kernel-mentees] BUG: corrupted list in kobject_add_internal syzbot
  2 siblings, 1 reply; 8+ messages in thread
From: Coiby Xu @ 2020-08-23  1:00 UTC (permalink / raw)
  To: linux-bluetooth
  Cc: syzbot+dd768a260f7358adbaf9, Johan Hedberg, Marcel Holtmann,
	syzkaller-bugs, open list, open list:NETWORKING [GENERAL],
	Jakub Kicinski, linux-kernel-mentees, David S. Miller

When two HCI_EV_CONN_COMPLETE event packets with status=0 of the same
HCI connection are received, device_add would be called twice which
leads to kobject_add being called twice. Thus duplicate
(struct hci_conn *conn)->dev.kobj.entry would be inserted into
(struct hci_conn *conn)->dev.kobj.kset->list.

This issue can be fixed by checking (struct hci_conn *conn)->debugfs.
If it's not NULL, it means the HCI connection has been completed and we
won't duplicate the work as for processing the first
HCI_EV_CONN_COMPLETE event.

Reported-and-tested-by: syzbot+dd768a260f7358adbaf9@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=dd768a260f7358adbaf9
Signed-off-by: Coiby Xu <coiby.xu@gmail.com>
---
 net/bluetooth/hci_event.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 4b7fc430793c..1233739ce760 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -2605,6 +2605,11 @@ static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 	}

 	if (!ev->status) {
+		if (conn->debugfs) {
+			bt_dev_err(hdev, "The connection has been completed");
+			goto unlock;
+		}
+
 		conn->handle = __le16_to_cpu(ev->handle);

 		if (conn->type == ACL_LINK) {
--
2.28.0

_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees

^ permalink raw reply	[flat|nested] 8+ messages in thread

* Re: [Linux-kernel-mentees] [PATCH] Bluetooth: fix "list_add double add" in hci_conn_complete_evt
  2020-08-23  1:00 ` [Linux-kernel-mentees] [PATCH] Bluetooth: fix "list_add double add" in hci_conn_complete_evt Coiby Xu
@ 2020-08-31 16:06   ` Marcel Holtmann
  2020-09-02 12:31     ` Coiby Xu
  0 siblings, 1 reply; 8+ messages in thread
From: Marcel Holtmann @ 2020-08-31 16:06 UTC (permalink / raw)
  To: Coiby Xu
  Cc: syzbot+dd768a260f7358adbaf9, Johan Hedberg, syzkaller-bugs,
	open list, linux-bluetooth, open list:NETWORKING [GENERAL],
	Jakub Kicinski, linux-kernel-mentees, David S. Miller

Hi Coiby,

> When two HCI_EV_CONN_COMPLETE event packets with status=0 of the same
> HCI connection are received, device_add would be called twice which
> leads to kobject_add being called twice. Thus duplicate
> (struct hci_conn *conn)->dev.kobj.entry would be inserted into
> (struct hci_conn *conn)->dev.kobj.kset->list.
> 
> This issue can be fixed by checking (struct hci_conn *conn)->debugfs.
> If it's not NULL, it means the HCI connection has been completed and we
> won't duplicate the work as for processing the first
> HCI_EV_CONN_COMPLETE event.

do you have a btmon trace for this happening?

> Reported-and-tested-by: syzbot+dd768a260f7358adbaf9@syzkaller.appspotmail.com
> Link: https://syzkaller.appspot.com/bug?extid=dd768a260f7358adbaf9
> Signed-off-by: Coiby Xu <coiby.xu@gmail.com>
> ---
> net/bluetooth/hci_event.c | 5 +++++
> 1 file changed, 5 insertions(+)
> 
> diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
> index 4b7fc430793c..1233739ce760 100644
> --- a/net/bluetooth/hci_event.c
> +++ b/net/bluetooth/hci_event.c
> @@ -2605,6 +2605,11 @@ static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
> 	}
> 
> 	if (!ev->status) {
> +		if (conn->debugfs) {
> +			bt_dev_err(hdev, "The connection has been completed");
> +			goto unlock;
> +		}
> +

And instead of doing papering over a hole, I would rather detect that the HCI event is not valid since we already received one for this connection.

Regards

Marcel

_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees

^ permalink raw reply	[flat|nested] 8+ messages in thread

* Re: [Linux-kernel-mentees] [PATCH] Bluetooth: fix "list_add double add" in hci_conn_complete_evt
  2020-08-31 16:06   ` Marcel Holtmann
@ 2020-09-02 12:31     ` Coiby Xu
  0 siblings, 0 replies; 8+ messages in thread
From: Coiby Xu @ 2020-09-02 12:31 UTC (permalink / raw)
  To: Marcel Holtmann
  Cc: syzbot+dd768a260f7358adbaf9, Johan Hedberg, syzkaller-bugs,
	open list, linux-bluetooth, open list:NETWORKING [GENERAL],
	Jakub Kicinski, linux-kernel-mentees, David S. Miller

[-- Attachment #1: Type: text/plain, Size: 2190 bytes --]

On Mon, Aug 31, 2020 at 06:06:18PM +0200, Marcel Holtmann wrote:
>Hi Coiby,

Hi Marcel,

Thank you for reviewing this patch!

>
>> When two HCI_EV_CONN_COMPLETE event packets with status=0 of the same
>> HCI connection are received, device_add would be called twice which
>> leads to kobject_add being called twice. Thus duplicate
>> (struct hci_conn *conn)->dev.kobj.entry would be inserted into
>> (struct hci_conn *conn)->dev.kobj.kset->list.
>>
>> This issue can be fixed by checking (struct hci_conn *conn)->debugfs.
>> If it's not NULL, it means the HCI connection has been completed and we
>> won't duplicate the work as for processing the first
>> HCI_EV_CONN_COMPLETE event.
>
>do you have a btmon trace for this happening?

Please see the attachment "btmon_output" which is a plain text file.
I couldn't find a way to save traces in btsnoop format (the kernel would
panic immediately after running the re-producer before QEMU has a chance
to write the btsnoop file to the disk image).

I've also also attached a simplified re-producer rep9_min.c if it interests you.
>
>> Reported-and-tested-by: syzbot+dd768a260f7358adbaf9@syzkaller.appspotmail.com
>> Link: https://syzkaller.appspot.com/bug?extid=dd768a260f7358adbaf9
>> Signed-off-by: Coiby Xu <coiby.xu@gmail.com>
>> ---
>> net/bluetooth/hci_event.c | 5 +++++
>> 1 file changed, 5 insertions(+)
>>
>> diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
>> index 4b7fc430793c..1233739ce760 100644
>> --- a/net/bluetooth/hci_event.c
>> +++ b/net/bluetooth/hci_event.c
>> @@ -2605,6 +2605,11 @@ static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
>> 	}
>>
>> 	if (!ev->status) {
>> +		if (conn->debugfs) {
>> +			bt_dev_err(hdev, "The connection has been completed");
>> +			goto unlock;
>> +		}
>> +
>
>And instead of doing papering over a hole, I would rather detect that the HCI event is not valid since we already received one for this connection.

To check conn->debugfs is what I think could be used to detect this
duplicate HCI event. Or you are suggesting this is not sufficient
and implement something like a state machine instead?

>
>Regards
>
>Marcel
>

--
Best regards,
Coiby

[-- Attachment #2: btmon_output --]
[-- Type: text/plain, Size: 14656 bytes --]

Bluetooth monitor ver 5.54
= Note: Linux version 5.8.0+ (x86_64)                                  0.447880
= Note: Bluetooth subsystem version 2.22                               0.447950
@ MGMT Open: btmon (privileged) version 1.18                  {0x0001} 0.449370
= New Index: 00:00:00:00:00:00 (Primary,Virtual,hci0)           [hci0] 5.834012
@ RAW Open: rep9_ (privileged) version 2.22                   {0x0002} 5.840840
= Open Index: 00:00:00:00:00:00                                 [hci0] 5.843719
< HCI Command: Reset (0x03|0x0003) plen 0                    #1 [hci0] 5.844689
> HCI Event: Command Complete (0x0e) plen 252                #2 [hci0] 5.844982
      Reset (0x03|0x0003) ncmd 1
        invalid packet size
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00                       .........
< HCI Command: Read Local Supported... (0x04|0x0003) plen 0  #3 [hci0] 5.845194
> HCI Event: Command Complete (0x0e) plen 252                #4 [hci0] 5.845356
      Read Local Supported Features (0x04|0x0003) ncmd 1
        invalid packet size
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00                       .........
< HCI Command: Read Local Version In.. (0x04|0x0001) plen 0  #5 [hci0] 5.845522
> HCI Event: Command Complete (0x0e) plen 252                #6 [hci0] 5.845593
      Read Local Version Information (0x04|0x0001) ncmd 1
        invalid packet size
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00                       .........
< HCI Command: Read BD ADDR (0x04|0x0009) plen 0             #7 [hci0] 5.845849
> HCI Event: Command Complete (0x0e) plen 10                 #8 [hci0] 5.845914
      Read BD ADDR (0x04|0x0009) ncmd 1
        Status: Success (0x00)
[   50.133219][ T8087] kobject_add_internal failed for hci0:200 with -EEXIST, don't try to register things with the same name in the same directory.
[   50.135031][ T8087] Bluetooth: hci0: failed to register connection device
        Address: AA:AA:AA:AA:AA:AA (OUI AA-AA-AA)
< HCI Command: Read Buffer Size (0x04|0x0005) plen 0         #9 [hci0] 5.846623
> HCI Event: Command Complete (0x0e) plen 11                #10 [hci0] 5.846710
      Read Buffer Size (0x04|0x0005) ncmd 1
        Status: Success (0x00)
        ACL MTU: 1021 ACL max packet: 4
        SCO MTU: 96   SCO max packet: 6
< HCI Command: Read Class of Device (0x03|0x0023) plen 0    #11 [hci0] 5.846806
> HCI Event: Command Complete (0x0e) plen 252               #12 [hci0] 5.846862
      Read Class of Device (0x03|0x0023) ncmd 1
        invalid packet size
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00                       .........
< HCI Command: Read Local Name (0x03|0x0014) plen 0         #13 [hci0] 5.893252
> HCI Event: Command Complete (0x0e) plen 252               #14 [hci0] 5.893318
      Read Local Name (0x03|0x0014) ncmd 1
        Status: Success (0x00)
        Name:
< HCI Command: Read Voice Setting (0x03|0x0025) plen 0      #15 [hci0] 5.893439
> HCI Event: Command Complete (0x0e) plen 252               #16 [hci0] 5.893490
      Read Voice Setting (0x03|0x0025) ncmd 1
        invalid packet size
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00                       .........
< HCI Command: Read Number of Suppo.. (0x03|0x0038) plen 0  #17 [hci0] 5.893559
> HCI Event: Command Complete (0x0e) plen 252               #18 [hci0] 5.893600
      Read Number of Supported IAC (0x03|0x0038) ncmd 1
        invalid packet size
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00                       .........
< HCI Command: Read Current IAC LAP (0x03|0x0039) plen 0    #19 [hci0] 5.893666
> HCI Event: Command Complete (0x0e) plen 252               #20 [hci0] 5.893710
      Read Current IAC LAP (0x03|0x0039) ncmd 1
        Status: Success (0x00)
        Number of IAC: 0
< HCI Command: Set Event Filter (0x03|0x0005) plen 1        #21 [hci0] 5.893777
        Type: Clear All Filters (0x00)
> HCI Event: Command Complete (0x0e) plen 252               #22 [hci0] 5.893818
      Set Event Filter (0x03|0x0005) ncmd 1
        invalid packet size
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00                       .........
< HCI Command: Write Connection Acc.. (0x03|0x0016) plen 2  #23 [hci0] 5.893884
        Timeout: 20000.000 msec (0x7d00)
> HCI Event: Command Complete (0x0e) plen 252               #24 [hci0] 5.893925
      Write Connection Accept Timeout (0x03|0x0016) ncmd 1
        invalid packet size
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00                       .........
= Index Info: AA:AA:AA:AA:AA.. (Ericsson Technology Licensing)  [hci0] 5.894458
@ MGMT Event: Index Added (0x0004) plen 0              {0x0001} [hci0] 5.894531
< HCI Command: Write Scan Enable (0x03|0x001a) plen 1       #25 [hci0] 5.895481
        Scan enable: Page Scan (0x02)
> HCI Event: Command Complete (0x0e) plen 4                 #26 [hci0] 5.895547
      Write Scan Enable (0x03|0x001a) ncmd 1
        Status: Success (0x00)
> HCI Event: Connect Request (0x04) plen 10                 #27 [hci0] 5.895786
        Address: 10:AA:AA:AA:AA:AA (OUI 10-AA-AA)
        Class: 0x000000
          Major class: Miscellaneous
          Minor class: 0x00
        Link type: ACL (0x01)
> HCI Event: Connect Complete (0x03) plen 11                #28 [hci0] 5.895828
        Status: Success (0x00)
        Handle: 200
        Address: 10:AA:AA:AA:AA:AA (OUI 10-AA-AA)
        Link type: ACL (0x01)
        Encryption: Disabled (0x00)
> HCI Event: Connect Complete (0x03) plen 11                #29 [hci0] 5.895842
        Status: Success (0x00)
        Handle: 200
        Address: 10:AA:AA:AA:AA:AA (OUI 10-AA-AA)
        Link type: ACL (0x01)
        Encryption: Disabled (0x00)
@ RAW Close: rep9_                                            {0x0002} 5.951790
< HCI Command: Accept Connection Re.. (0x01|0x0009) plen 7  #30 [hci0] 6.130913
        Address: 10:AA:AA:AA:AA:AA (OUI 10-AA-AA)
        Role: Slave (0x01)

[-- Attachment #3: rep9_min.c --]
[-- Type: text/plain, Size: 7470 bytes --]

// based on the reproducer
// https://syzkaller.appspot.com/bug?id=f0ec9a394925aafbdf13d0a7e6af4cff860f0ed6
// wich is autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <pthread.h>
#include <sched.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/epoll.h>
#include <sys/ioctl.h>
#include <sys/mount.h>
#include <sys/prctl.h>
#include <sys/resource.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/uio.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

#include <linux/capability.h>

const int kInitNetNsFd = 239;

#define MAX_FDS 30

static long syz_init_net_socket(volatile long domain, volatile long type,
                                volatile long proto)
{
  int netns = open("/proc/self/ns/net", O_RDONLY);

  if (netns == -1)
    return netns;

  int sock = syscall(__NR_socket, domain, type, proto);
  int err = errno;

  /** if (setns(netns, 0)) */
  /**   exit(1); */

  close(netns);
  errno = err;
  return sock;
}

#define BTPROTO_HCI 1
#define ACL_LINK 1
#define SCAN_PAGE 2

typedef struct {
  uint8_t b[6];
} __attribute__((packed)) bdaddr_t;

#define HCI_COMMAND_PKT 1
#define HCI_EVENT_PKT 4
#define HCI_VENDOR_PKT 0xff

struct hci_command_hdr {
  uint16_t opcode;
  uint8_t plen;
} __attribute__((packed));

struct hci_event_hdr {
  uint8_t evt;
  uint8_t plen;
} __attribute__((packed));

#define HCI_EV_CONN_COMPLETE 0x03
struct hci_ev_conn_complete {
  uint8_t status;
  uint16_t handle;
  bdaddr_t bdaddr;
  uint8_t link_type;
  uint8_t encr_mode;
} __attribute__((packed));

#define HCI_EV_CONN_REQUEST 0x04
struct hci_ev_conn_request {
  bdaddr_t bdaddr;
  uint8_t dev_class[3];
  uint8_t link_type;
} __attribute__((packed));

#define HCI_EV_REMOTE_FEATURES 0x0b
struct hci_ev_remote_features {
  uint8_t status;
  uint16_t handle;
  uint8_t features[8];
} __attribute__((packed));

#define HCI_EV_CMD_COMPLETE 0x0e
struct hci_ev_cmd_complete {
  uint8_t ncmd;
  uint16_t opcode;
} __attribute__((packed));

#define HCI_OP_WRITE_SCAN_ENABLE 0x0c1a

#define HCI_OP_READ_BUFFER_SIZE 0x1005
struct hci_rp_read_buffer_size {
  uint8_t status;
  uint16_t acl_mtu;
  uint8_t sco_mtu;
  uint16_t acl_max_pkt;
  uint16_t sco_max_pkt;
} __attribute__((packed));

#define HCI_OP_READ_BD_ADDR 0x1009
struct hci_rp_read_bd_addr {
  uint8_t status;
  bdaddr_t bdaddr;
} __attribute__((packed));

#define HCI_EV_LE_META 0x3e
struct hci_ev_le_meta {
  uint8_t subevent;
} __attribute__((packed));

#define HCI_EV_LE_CONN_COMPLETE 0x01
struct hci_ev_le_conn_complete {
  uint8_t status;
  uint16_t handle;
  uint8_t role;
  uint8_t bdaddr_type;
  bdaddr_t bdaddr;
  uint16_t interval;
  uint16_t latency;
  uint16_t supervision_timeout;
  uint8_t clk_accurancy;
} __attribute__((packed));

struct hci_dev_req {
  uint16_t dev_id;
  uint32_t dev_opt;
};

struct vhci_vendor_pkt {
  uint8_t type;
  uint8_t opcode;
  uint16_t id;
};

#define HCIDEVUP _IOW('H', 201, int)
#define HCISETSCAN _IOW('H', 221, int)

static int vhci_fd = -1;

static void hci_send_event_packet(int fd, uint8_t evt, void* data,
                                  size_t data_len)
{
  struct iovec iv[3];
  struct hci_event_hdr hdr;
  hdr.evt = evt;
  hdr.plen = data_len;
  uint8_t type = HCI_EVENT_PKT;
  iv[0].iov_base = &type;
  iv[0].iov_len = sizeof(type);
  iv[1].iov_base = &hdr;
  iv[1].iov_len = sizeof(hdr);
  iv[2].iov_base = data;
  iv[2].iov_len = data_len;
  if (writev(fd, iv, sizeof(iv) / sizeof(struct iovec)) < 0)
    exit(1);
}

static void hci_send_event_cmd_complete(int fd, uint16_t opcode, void* data,
                                        size_t data_len)
{
  struct iovec iv[4];
  struct hci_event_hdr hdr;
  hdr.evt = HCI_EV_CMD_COMPLETE;
  hdr.plen = sizeof(struct hci_ev_cmd_complete) + data_len;
  struct hci_ev_cmd_complete evt_hdr;
  evt_hdr.ncmd = 1;
  evt_hdr.opcode = opcode;
  uint8_t type = HCI_EVENT_PKT;
  iv[0].iov_base = &type;
  iv[0].iov_len = sizeof(type);
  iv[1].iov_base = &hdr;
  iv[1].iov_len = sizeof(hdr);
  iv[2].iov_base = &evt_hdr;
  iv[2].iov_len = sizeof(evt_hdr);
  iv[3].iov_base = data;
  iv[3].iov_len = data_len;
  if (writev(fd, iv, sizeof(iv) / sizeof(struct iovec)) < 0)
    exit(1);
}

#define HCI_HANDLE_1 200
#define HCI_HANDLE_2 201

static void send_complte_ev()
{
  struct hci_ev_conn_complete complete;
  memset(&complete, 0, sizeof(complete));
  complete.status = 0;
  complete.handle = HCI_HANDLE_1;
  memset(&complete.bdaddr, 0xaa, 6);
  *(uint8_t*)&complete.bdaddr.b[5] = 0x10;
  complete.link_type = ACL_LINK;
  complete.encr_mode = 0;
  hci_send_event_packet(vhci_fd, HCI_EV_CONN_COMPLETE, &complete,
                        sizeof(complete));
}

static bool process_command_pkt(int fd, char* buf, ssize_t buf_size)
{
  struct hci_command_hdr* hdr = (struct hci_command_hdr*)buf;
  if (buf_size < (ssize_t)sizeof(struct hci_command_hdr) ||
      hdr->plen != buf_size - sizeof(struct hci_command_hdr)) {
    exit(1);
  }
  switch (hdr->opcode) {
  case HCI_OP_WRITE_SCAN_ENABLE: {
    uint8_t status = 0;
    hci_send_event_cmd_complete(fd, hdr->opcode, &status, sizeof(status));
    return true;
  }
  case HCI_OP_READ_BD_ADDR: {
    struct hci_rp_read_bd_addr rp = {0};
    rp.status = 0;
    memset(&rp.bdaddr, 0xaa, 6);
    hci_send_event_cmd_complete(fd, hdr->opcode, &rp, sizeof(rp));
    return false;
  }
  case HCI_OP_READ_BUFFER_SIZE: {
    struct hci_rp_read_buffer_size rp = {0};
    rp.status = 0;
    rp.acl_mtu = 1021;
    rp.sco_mtu = 96;
    rp.acl_max_pkt = 4;
    rp.sco_max_pkt = 6;
    hci_send_event_cmd_complete(fd, hdr->opcode, &rp, sizeof(rp));
    return false;
  }
  }
  char dummy[0xf9] = {0};
  hci_send_event_cmd_complete(fd, hdr->opcode, dummy, sizeof(dummy));
  return false;
}

static void* event_thread(void* arg)
{
  while (1) {
    char buf[1024] = {0};
    ssize_t buf_size = read(vhci_fd, buf, sizeof(buf));
    if (buf_size < 0)
      exit(1);
    if (buf_size > 0 && buf[0] == HCI_COMMAND_PKT) {
      if (process_command_pkt(vhci_fd, buf + 1, buf_size - 1))
        break;
    }
  }
  return NULL;
}
static void initialize_vhci()
{
  int hci_sock = syz_init_net_socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI);
  if (hci_sock < 0)
    exit(1);

  vhci_fd = open("/dev/vhci", O_RDWR);
  if (vhci_fd == -1)
    exit(1);

  struct vhci_vendor_pkt vendor_pkt;
  if (read(vhci_fd, &vendor_pkt, sizeof(vendor_pkt)) != sizeof(vendor_pkt))
    exit(1);

  if (vendor_pkt.type != HCI_VENDOR_PKT)
    exit(1);

  pthread_t th;
  if (pthread_create(&th, NULL, event_thread, NULL))
    exit(1);

  if (ioctl(hci_sock, HCIDEVUP, vendor_pkt.id) && errno != EALREADY)
    exit(1);

  struct hci_dev_req dr = {0};
  dr.dev_id = vendor_pkt.id;
  dr.dev_opt = SCAN_PAGE;
  if (ioctl(hci_sock, HCISETSCAN, &dr))
    exit(1);
  struct hci_ev_conn_request request;
  memset(&request, 0, sizeof(request));
  memset(&request.bdaddr, 0xaa, 6);
  *(uint8_t*)&request.bdaddr.b[5] = 0x10;
  request.link_type = ACL_LINK;
  hci_send_event_packet(vhci_fd, HCI_EV_CONN_REQUEST, &request,
                        sizeof(request));

  send_complte_ev();
  send_complte_ev();
  pthread_join(th, NULL);
  close(hci_sock);
}

int main(void)
{
  initialize_vhci();
  return 0;
}

[-- Attachment #4: Type: text/plain, Size: 201 bytes --]

_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees

^ permalink raw reply	[flat|nested] 8+ messages in thread

* Re: [Linux-kernel-mentees] BUG: corrupted list in kobject_add_internal
       [not found] <000000000000c57f2d05ac4c5b8e@google.com>
  2020-08-20  6:07 ` [Linux-kernel-mentees] BUG: corrupted list in kobject_add_internal Coiby Xu
  2020-08-23  1:00 ` [Linux-kernel-mentees] [PATCH] Bluetooth: fix "list_add double add" in hci_conn_complete_evt Coiby Xu
@ 2020-11-08 22:55 ` syzbot
  2020-11-11 11:22   ` Dmitry Vyukov via Linux-kernel-mentees
  2 siblings, 1 reply; 8+ messages in thread
From: syzbot @ 2020-11-08 22:55 UTC (permalink / raw)
  To: abhishekpandit, coiby.xu, davem, dvyukov, gregkh, johan.hedberg,
	kuba, linux-bluetooth, linux-kernel-mentees, linux-kernel,
	marcel, netdev, rafael, sonnysasaka, syzkaller-bugs

syzbot suspects this issue was fixed by commit:

commit a46b7ed4d52d09bd6c7ab53b2217d04fc2f02c65
Author: Sonny Sasaka <sonnysasaka@chromium.org>
Date:   Fri Aug 14 19:09:09 2020 +0000

    Bluetooth: Fix auto-creation of hci_conn at Conn Complete event

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=13d75792500000
start commit:   d6efb3ac Merge tag 'tty-5.9-rc1' of git://git.kernel.org/p..
git tree:       upstream
kernel config:  https://syzkaller.appspot.com/x/.config?x=ff87594cecb7e666
dashboard link: https://syzkaller.appspot.com/bug?extid=dd768a260f7358adbaf9
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=105054aa900000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16ab6976900000

If the result looks correct, please mark the issue as fixed by replying with:

#syz fix: Bluetooth: Fix auto-creation of hci_conn at Conn Complete event

For information about bisection process see: https://goo.gl/tpsmEJ#bisection
_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees

^ permalink raw reply	[flat|nested] 8+ messages in thread

* Re: [Linux-kernel-mentees] BUG: corrupted list in kobject_add_internal
  2020-11-08 22:55 ` [Linux-kernel-mentees] BUG: corrupted list in kobject_add_internal syzbot
@ 2020-11-11 11:22   ` Dmitry Vyukov via Linux-kernel-mentees
  0 siblings, 0 replies; 8+ messages in thread
From: Dmitry Vyukov via Linux-kernel-mentees @ 2020-11-11 11:22 UTC (permalink / raw)
  To: syzbot
  Cc: sonnysasaka, Johan Hedberg, Rafael Wysocki, Marcel Holtmann,
	syzkaller-bugs, LKML, Coiby Xu, linux-bluetooth, netdev,
	abhishekpandit, Jakub Kicinski, linux-kernel-mentees,
	David Miller

On Sun, Nov 8, 2020 at 11:55 PM syzbot
<syzbot+dd768a260f7358adbaf9@syzkaller.appspotmail.com> wrote:
>
> syzbot suspects this issue was fixed by commit:
>
> commit a46b7ed4d52d09bd6c7ab53b2217d04fc2f02c65
> Author: Sonny Sasaka <sonnysasaka@chromium.org>
> Date:   Fri Aug 14 19:09:09 2020 +0000
>
>     Bluetooth: Fix auto-creation of hci_conn at Conn Complete event
>
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=13d75792500000
> start commit:   d6efb3ac Merge tag 'tty-5.9-rc1' of git://git.kernel.org/p..
> git tree:       upstream
> kernel config:  https://syzkaller.appspot.com/x/.config?x=ff87594cecb7e666
> dashboard link: https://syzkaller.appspot.com/bug?extid=dd768a260f7358adbaf9
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=105054aa900000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16ab6976900000
>
> If the result looks correct, please mark the issue as fixed by replying with:
>
> #syz fix: Bluetooth: Fix auto-creation of hci_conn at Conn Complete event
>
> For information about bisection process see: https://goo.gl/tpsmEJ#bisection

#syz fix: Bluetooth: Fix auto-creation of hci_conn at Conn Complete event
_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees

^ permalink raw reply	[flat|nested] 8+ messages in thread

end of thread, other threads:[~2020-11-11 11:23 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
     [not found] <000000000000c57f2d05ac4c5b8e@google.com>
2020-08-20  6:07 ` [Linux-kernel-mentees] BUG: corrupted list in kobject_add_internal Coiby Xu
2020-08-20  6:13   ` Dmitry Vyukov via Linux-kernel-mentees
2020-08-22 16:16     ` Coiby Xu
2020-08-23  1:00 ` [Linux-kernel-mentees] [PATCH] Bluetooth: fix "list_add double add" in hci_conn_complete_evt Coiby Xu
2020-08-31 16:06   ` Marcel Holtmann
2020-09-02 12:31     ` Coiby Xu
2020-11-08 22:55 ` [Linux-kernel-mentees] BUG: corrupted list in kobject_add_internal syzbot
2020-11-11 11:22   ` Dmitry Vyukov via Linux-kernel-mentees

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).