syzbot

 sign-in | mailing list | source | docs | 🏰
🐞 Open [1344]
≡ Subsystems
🐞 Fixed [7089]
🐞 Invalid [18666]
⬇ Missing Backports [221]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
✨ AI
💬 Send us feedback

WARNING in hci_recv_frame

Status: upstream: reported C repro on 2024/04/26 12:10
Subsystems: bluetooth
[Documentation on labels]
Reported-by: syzbot+3e07a461b836821ff70e@syzkaller.appspotmail.com
First crash: 743d, last: 19h38m
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision Error
763eaac4-21db-4f95-8d45-0036ff51e5be patching-summary 💥 WARNING in hci_recv_frame 2026/03/26 17:33 2026/03/26 18:24 2026/03/26 19:25 50cdcaa1adff11dc8afdfa7ec9e390b9c5b72c3f DoWhile loop is going in cycles for 10 iterations
2a36748f-a196-41c6-ac0a-1067bfc979d3 patching 💥 WARNING in hci_recv_frame 2026/03/26 17:33 2026/03/26 17:33 2026/03/27 05:05 50cdcaa1adff11dc8afdfa7ec9e390b9c5b72c3f Error 400, Message: The input token count exceeds the maximum number of tokens allowed 1048576., Status: INVALID_ARGUMENT, Details: []
Cause bisection: failed (error log, bisect log)
  
▶ ▼ Discussions (3)
Title Replies (including bot) Last reply
[syzbot] Monthly bluetooth report (May 2026) 0 (1) 2026/05/02 12:32
[syzbot] Monthly bluetooth report (Apr 2026) 0 (1) 2026/04/01 07:42
[syzbot] [bluetooth?] WARNING in hci_recv_frame 1 (5) 2025/05/19 17:27
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.1 WARNING in hci_recv_frame -1 1 583d 583d 0/3 auto-obsoleted due to no activity on 2025/01/11 11:35
linux-5.15 WARNING in hci_recv_frame origin:lts-only -1 syz error 1 314d 316d 0/3 upstream: reported syz repro on 2025/06/27 08:19
▶ ▼ Last patch testing requests (6)
Created Duration User Patch Repo Result
2025/08/07 16:15 21m retest repro upstream OK log
2025/05/20 10:50 21m hdanton@sina.com patch upstream OK log
2025/05/17 00:01 19m retest repro upstream OK log
2025/05/17 00:01 19m retest repro upstream OK log
2025/03/18 04:08 2h49m retest repro upstream OK log
2024/11/20 11:47 22m hdanton@sina.com patch upstream OK log

Sample crash report:
------------[ cut here ]------------
workqueue: cannot queue hci_rx_work on wq hci0
WARNING: kernel/workqueue.c:2270 at __queue_work+0xd08/0x1150 kernel/workqueue.c:2269, CPU#1: syz.0.63/6219
Modules linked in:
CPU: 1 UID: 0 PID: 6219 Comm: syz.0.63 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:__queue_work+0xd0c/0x1150 kernel/workqueue.c:2269
Code: 00 00 00 fc ff df 49 8d 94 24 78 01 00 00 48 89 f9 48 c1 e9 03 80 3c 01 00 0f 85 04 04 00 00 48 8d 3d 88 a8 0c 0f 48 8b 75 18 <67> 48 0f b9 3a e9 2a f7 ff ff e8 55 cc 38 00 90 0f 0b 90 e9 b2 f5
RSP: 0018:ffffc900056a7be0 EFLAGS: 00010046
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 1ffff110026d417b
RDX: ffff888022f5b978 RSI: ffffffff8a836730 RDI: ffffffff90dc7ae0
RBP: ffff8880136a0bc0 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff888022f5b800
R13: ffff88802d6ec900 R14: ffff88803f5b9ed8 R15: ffff88802fbc4000
FS:  00007f4eaa1906c0(0000) GS:ffff8880d6447000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000000288d7000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 queue_work_on+0x180/0x1e0 kernel/workqueue.c:2405
 queue_work include/linux/workqueue.h:669 [inline]
 hci_recv_frame+0x503/0x880 net/bluetooth/hci_core.c:2969
 vhci_get_user drivers/bluetooth/hci_vhci.c:520 [inline]
 vhci_write+0x384/0x490 drivers/bluetooth/hci_vhci.c:616
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x6ac/0x1070 fs/read_write.c:688
 ksys_write+0x12a/0x250 fs/read_write.c:740
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4ea935cfce
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007f4eaa18ffb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f4eaa1906c0 RCX: 00007f4ea935cfce
RDX: 0000000000000007 RSI: 0000200000000040 RDI: 00000000000000ca
RBP: 00007f4ea9432bd9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f4ea9616128 R14: 00007f4ea9616090 R15: 00007ffc8afe52a8
 </TASK>
----------------
Code disassembly (best guess):
   0:	00 00                	add    %al,(%rax)
   2:	00 fc                	add    %bh,%ah
   4:	ff                   	lcall  (bad)
   5:	df 49 8d             	fisttps -0x73(%rcx)
   8:	94                   	xchg   %eax,%esp
   9:	24 78                	and    $0x78,%al
   b:	01 00                	add    %eax,(%rax)
   d:	00 48 89             	add    %cl,-0x77(%rax)
  10:	f9                   	stc
  11:	48 c1 e9 03          	shr    $0x3,%rcx
  15:	80 3c 01 00          	cmpb   $0x0,(%rcx,%rax,1)
  19:	0f 85 04 04 00 00    	jne    0x423
  1f:	48 8d 3d 88 a8 0c 0f 	lea    0xf0ca888(%rip),%rdi        # 0xf0ca8ae
  26:	48 8b 75 18          	mov    0x18(%rbp),%rsi
* 2a:	67 48 0f b9 3a       	ud1    (%edx),%rdi <-- trapping instruction
  2f:	e9 2a f7 ff ff       	jmp    0xfffff75e
  34:	e8 55 cc 38 00       	call   0x38cc8e
  39:	90                   	nop
  3a:	0f 0b                	ud2
  3c:	90                   	nop
  3d:	e9                   	.byte 0xe9
  3e:	b2 f5                	mov    $0xf5,%dl

Crashes (230):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/02/28 10:14 upstream 4d349ee5c778 43249bac .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in hci_recv_frame
2026/01/09 03:07 upstream 79b95d74470d d1b870e1 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in hci_recv_frame
2025/09/23 21:29 upstream cec1e6e5d1ab e667a34f .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING in hci_recv_frame
2025/10/29 08:04 linux-next f9ba12abc528 fd2207e7 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce WARNING in hci_recv_frame
2026/05/01 16:16 upstream 26fd6bff2c05 753c55b9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root WARNING in hci_recv_frame
2026/04/15 08:40 upstream 508fed679541 e2e976a8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root WARNING in hci_recv_frame
2024/11/20 09:17 upstream a5c93bfec0be 7d02db5a .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root WARNING in hci_recv_frame
2026/05/08 13:59 upstream 917719c412c4 5633175a .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/05/07 23:26 upstream fcee7d82f27d e358bca5 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/05/07 05:59 upstream adc1e5c6203c f250db59 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/05/07 01:06 upstream adc1e5c6203c f250db59 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/05/06 23:38 upstream adc1e5c6203c f250db59 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/05/06 22:24 upstream adc1e5c6203c f250db59 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/05/03 03:33 upstream 66edb901bf87 a0d91488 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/05/02 08:54 upstream f1a5e78a55eb a0d91488 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/05/02 05:48 upstream 6fe0be6dc7fa 753c55b9 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/05/01 09:21 upstream 26fd6bff2c05 753c55b9 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/04/30 00:05 upstream 57b8e2d666a3 005438fc .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/04/29 22:01 upstream 57b8e2d666a3 005438fc .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/04/29 18:48 upstream 57b8e2d666a3 7ca9e4d8 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/04/29 07:52 upstream dca922e019dd 95008c03 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/04/28 23:23 upstream dca922e019dd 95008c03 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/04/28 03:43 upstream 3b3bea6d4b9c ce741359 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/04/27 23:51 upstream 254f49634ee1 ce741359 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/04/27 10:38 upstream 254f49634ee1 0f700595 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/04/26 19:49 upstream 897d54018cc9 9c2d0995 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/04/25 13:30 upstream 27d128c1cff6 9c2d0995 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/04/25 09:41 upstream 27d128c1cff6 9c2d0995 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/04/25 02:50 upstream 892c894b4ba4 9c2d0995 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/04/24 17:31 upstream dd6c438c3e64 9c2d0995 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/04/24 06:47 upstream dd6c438c3e64 9cfb3ca7 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/04/22 12:21 upstream 6596a02b2078 0b6ab7ec .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/04/22 11:11 upstream 6596a02b2078 0b6ab7ec .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/04/21 20:53 upstream b4e07588e743 9765efe0 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/04/21 08:37 upstream c1f49dea2b8f 3f2e655b .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/04/21 06:52 upstream c1f49dea2b8f 3f2e655b .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/04/21 04:52 upstream c1f49dea2b8f 3f2e655b .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/04/21 01:06 upstream c1f49dea2b8f e65da4ee .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/04/20 21:59 upstream c1f49dea2b8f e65da4ee .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/04/20 11:11 upstream bea8d77e45a8 303e2802 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/04/20 01:59 upstream bea8d77e45a8 303e2802 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/04/19 23:47 upstream bea8d77e45a8 303e2802 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/04/19 16:40 upstream faeab166167f 303e2802 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/04/19 05:01 upstream eb5249b12507 303e2802 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/04/18 13:12 upstream 8541d8f725c6 5be7a9de .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/04/17 18:56 upstream 43cfbdda5af6 24ecfc1e .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/04/17 00:47 upstream 3cd8b194bf34 de0a551d .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/04/16 14:21 upstream 1d51b370a0f8 4743f87d .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/04/15 06:48 upstream 508fed679541 362d1323 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/04/15 04:13 upstream 508fed679541 362d1323 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/04/15 02:24 upstream 508fed679541 362d1323 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/04/06 17:24 upstream 591cd656a1bf 4440e7c2 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2025/05/19 17:27 upstream a5806cd506af 27f68995 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2025/04/23 07:48 upstream bc3372351d0c 53a8b9bd .config console log report syz / log [disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro (clean fs)] ci-snapshot-upstream-root WARNING in hci_recv_frame
2025/03/20 16:17 upstream a7f2e10ecd8f 62330552 .config console log report syz / log [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in hci_recv_frame
2026/04/27 22:51 upstream 254f49634ee1 ce741359 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 WARNING in hci_recv_frame
2024/12/02 11:50 bpf 537a2525eaf7 68914665 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce WARNING in hci_recv_frame
2024/07/31 05:46 net 84383b5ef4cd 6fde257d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce WARNING in hci_recv_frame
2024/07/20 02:23 net-next 58f9416d413a 890ce4f3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-net-next-test-gce WARNING in hci_recv_frame
2024/04/26 10:28 net-next 2bd87951de65 8bdc0f22 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-net-next-test-gce WARNING in hci_recv_frame
2026/05/08 16:57 linux-next e98d21c170b0 5633175a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root WARNING in hci_recv_frame
2026/05/06 18:21 linux-next 735d2f48cada cbcd9ea0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root WARNING in hci_recv_frame
2026/05/05 22:59 linux-next 4cd074ae20bb 06e69a27 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce WARNING in hci_recv_frame
2026/05/05 06:55 linux-next 9d0d467c3572 a898ba9c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce WARNING in hci_recv_frame
2026/05/03 11:53 linux-next b9303e6bff70 a0d91488 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root WARNING in hci_recv_frame
2026/04/29 14:44 linux-next 0787c45ea08a 804ea88f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root WARNING in hci_recv_frame
2026/04/20 08:49 linux-next c7275b05bc42 303e2802 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce WARNING in hci_recv_frame
2026/04/20 05:12 linux-next c7275b05bc42 303e2802 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce WARNING in hci_recv_frame
2026/02/01 00:14 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 59e4d31a0470 35764559 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in hci_recv_frame
* Struck through repros no longer work on HEAD.