general protection fault in l2cap_chan_timeout (3)

Status: upstream: reported C repro on 2022/02/10 18:27
Subsystems: bluetooth
[Documentation on labels]
Reported-by: syzbot+f0908ddc8b64b86e81f2@syzkaller.appspotmail.com
First crash: 1639d, last: 55d
Cause bisection: the issue happens on the oldest tested release (bisect log)
Crash: KASAN: use-after-free Read in lock_sock_nested (log)
Repro: C syz .config
  
Fix bisection the fix commit could be any of (bisect log):
  f4bc5bbb5fef Merge tag 'nfsd-5.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux
  568035b01cfb Linux 6.0-rc1
   
▶ ▼ ✨ AI Patch Versions (1)
Version Stage Reported Report Link Job
1 moderation 2026/05/09 07:21 Discussion 36c34c1e-9031-4e9a-abb1-b1e594ef4819
▶ ▼ ✨ AI Jobs (8)
ID Workflow Result Correct Bug Created Started Finished Revision
b11e3cd0 assessment-security 💥 general protection fault in l2cap_chan_timeout (3) 2026/08/05 00:03 2026/08/05 00:03 2026/08/05 00:03 d4abbeac
c31eb994 assessment-security 💥 general protection fault in l2cap_chan_timeout (3) 2026/07/05 04:43 2026/07/05 04:43 2026/07/05 04:45 93f57954
2a3c588d assessment-security 💥 general protection fault in l2cap_chan_timeout (3) 2026/06/18 04:16 2026/06/18 04:16 2026/06/18 04:18 b62b3ded
db6048ee assessment-security 💥 general protection fault in l2cap_chan_timeout (3) 2026/06/10 00:15 2026/06/10 00:15 2026/06/10 00:17 c36c07f6
a80e9c71 assessment-security 💥 general protection fault in l2cap_chan_timeout (3) 2026/06/04 02:18 2026/06/04 02:18 2026/06/04 02:20 62fe1528
c4f1c24d assessment-security 💥 general protection fault in l2cap_chan_timeout (3) 2026/06/01 15:54 2026/06/01 15:54 2026/06/01 15:56 386cc6da
fd30def6 assessment-security 💥 general protection fault in l2cap_chan_timeout (3) 2026/05/16 08:20 2026/05/16 08:20 2026/05/16 08:21 a15a64a6
36c34c1e patching ❓ general protection fault in l2cap_chan_timeout (3) 2026/05/09 05:09 2026/05/09 05:09 2026/05/09 07:21 29233ece
▶ ▼ Discussions (3)
Title Replies (including bot) Last reply
[syzbot] general protection fault in l2cap_chan_timeout (3) 0 (3) 2026/06/16 15:35
[syzbot] Monthly bluetooth report (Feb 2024) 0 (1) 2024/02/04 13:30
[syzbot] Monthly bluetooth report (Jun 2023) 0 (1) 2023/07/01 10:15
▶ ▼ Similar bugs (6)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 general protection fault in l2cap_chan_timeout (2) 2 syz, C error 2 1779d 1871d 0/1 upstream: reported C repro on 2021/06/23 21:07
upstream general protection fault in l2cap_chan_timeout (2) bluetooth 2 1 1899d 1894d 0/29 auto-closed as invalid on 2021/09/23 19:42
upstream general protection fault in l2cap_chan_timeout bluetooth 2 1 2081d 2076d 0/29 auto-closed as invalid on 2021/03/25 23:40
linux-4.14 general protection fault in l2cap_chan_timeout 2 1 2197d 2197d 0/1 auto-closed as invalid on 2020/11/29 23:43
linux-4.19 general protection fault in l2cap_chan_timeout 2 1 2175d 2175d 0/1 auto-closed as invalid on 2020/12/21 18:33
linux-4.14 general protection fault in l2cap_chan_timeout (2) 2 syz, C 3 1265d 1631d 0/1 upstream: reported C repro on 2022/02/18 23:43
▶ ▼ Last patch testing requests (12)
Created Duration User Patch Repo Result
2026/08/01 22:42 33m retest repro upstream OK log
2026/08/01 18:37 25m retest repro upstream OK log
2026/06/16 15:35 3h29m dmantipov@yandex.ru patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git b1cbabe84ca1381a004fb91ee1791a1a53bce44e log
2026/05/23 18:08 41m retest repro upstream log
2026/05/23 17:57 23m retest repro upstream report log
2026/05/23 17:53 25m retest repro upstream log
2026/01/29 08:41 24m retest repro upstream report log
2026/01/29 08:42 12m retest repro upstream report log
2025/11/15 10:57 52m retest repro upstream report log
2025/11/15 10:58 13m retest repro upstream report log
2025/08/23 21:34 14m retest repro upstream report log
2023/11/06 13:01 26m yuran.pereira@hotmail.com https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master report log
▶ ▼ Fix bisection attempts (6)
Created Duration User Patch Repo Result
2022/08/16 14:36 36m bisect fix upstream OK (2) job log
2022/07/12 17:57 36m bisect fix upstream OK (0) job log log
2022/06/10 12:21 39m bisect fix upstream OK (0) job log log
2022/05/11 09:49 34m bisect fix upstream OK (0) job log log
2022/04/11 09:27 22m bisect fix upstream OK (0) job log log
2022/03/12 09:04 22m bisect fix upstream OK (0) job log log

Sample crash report:
general protection fault, probably for non-canonical address 0xdffffc0000000066: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000330-0x0000000000000337]
CPU: 0 PID: 8 Comm: kworker/0:1 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
Workqueue: events l2cap_chan_timeout
RIP: 0010:__mutex_lock_common kernel/locking/mutex.c:587 [inline]
RIP: 0010:__mutex_lock+0xf2/0xd70 kernel/locking/mutex.c:752
Code: c0 60 66 4a 94 48 c1 e8 03 42 0f b6 04 20 84 c0 0f 85 79 0b 00 00 83 3d db 39 d5 08 00 75 21 49 8d 7d 60 48 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 05 e8 b2 c8 7f f6 4d 39 6d 60 0f 85 f3 0a 00 00
RSP: 0000:ffffc900000d7a20 EFLAGS: 00010206
RAX: 0000000000000066 RBX: 0000000000000000 RCX: ffffffff944a6603
RDX: dffffc0000000000 RSI: ffff888017295a00 RDI: 0000000000000330
RBP: ffffc900000d7b78 R08: ffffc900000d7ae7 R09: 0000000000000000
R10: ffffc900000d7ac0 R11: fffff5200001af5d R12: dffffc0000000000
R13: 00000000000002d0 R14: 0000000000000000 R15: ffff888022445000
FS:  0000000000000000(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055da728a07e5 CR3: 0000000061c20000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 l2cap_chan_timeout+0x5a/0x340 net/bluetooth/l2cap_core.c:418
 process_one_work kernel/workqueue.c:3254 [inline]
 process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335
 worker_thread+0x86d/0xd70 kernel/workqueue.c:3416
 kthread+0x2f0/0x390 kernel/kthread.c:388
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__mutex_lock_common kernel/locking/mutex.c:587 [inline]
RIP: 0010:__mutex_lock+0xf2/0xd70 kernel/locking/mutex.c:752
Code: c0 60 66 4a 94 48 c1 e8 03 42 0f b6 04 20 84 c0 0f 85 79 0b 00 00 83 3d db 39 d5 08 00 75 21 49 8d 7d 60 48 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 05 e8 b2 c8 7f f6 4d 39 6d 60 0f 85 f3 0a 00 00
RSP: 0000:ffffc900000d7a20 EFLAGS: 00010206
RAX: 0000000000000066 RBX: 0000000000000000 RCX: ffffffff944a6603
RDX: dffffc0000000000 RSI: ffff888017295a00 RDI: 0000000000000330
RBP: ffffc900000d7b78 R08: ffffc900000d7ae7 R09: 0000000000000000
R10: ffffc900000d7ac0 R11: fffff5200001af5d R12: dffffc0000000000
R13: 00000000000002d0 R14: 0000000000000000 R15: ffff888022445000
FS:  0000000000000000(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055dab119f0c0 CR3: 000000007b4ac000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	c0 60 66 4a          	shlb   $0x4a,0x66(%rax)
   4:	94                   	xchg   %eax,%esp
   5:	48 c1 e8 03          	shr    $0x3,%rax
   9:	42 0f b6 04 20       	movzbl (%rax,%r12,1),%eax
   e:	84 c0                	test   %al,%al
  10:	0f 85 79 0b 00 00    	jne    0xb8f
  16:	83 3d db 39 d5 08 00 	cmpl   $0x0,0x8d539db(%rip)        # 0x8d539f8
  1d:	75 21                	jne    0x40
  1f:	49 8d 7d 60          	lea    0x60(%r13),%rdi
  23:	48 89 f8             	mov    %rdi,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 80 3c 20 00       	cmpb   $0x0,(%rax,%r12,1) <-- trapping instruction
  2f:	74 05                	je     0x36
  31:	e8 b2 c8 7f f6       	call   0xf67fc8e8
  36:	4d 39 6d 60          	cmp    %r13,0x60(%r13)
  3a:	0f 85 f3 0a 00 00    	jne    0xb33

Crashes (92):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/03/28 06:11 upstream fe46a7dd189e 120789fd .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs general protection fault in l2cap_chan_timeout
2022/02/10 09:02 upstream f4bc5bbb5fef 0b33604d .config console log report syz C ci-upstream-kasan-gce-smack-root general protection fault in l2cap_chan_timeout
2022/02/10 04:48 upstream f4bc5bbb5fef 0b33604d .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in l2cap_chan_timeout
2022/02/10 04:48 upstream f4bc5bbb5fef 0b33604d .config console log report info ci-upstream-kasan-gce-smack-root general protection fault in l2cap_chan_timeout
2026/06/13 16:49 upstream 062871f1371b 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: slab-use-after-free Read in l2cap_chan_timeout
2026/05/01 14:08 upstream 26fd6bff2c05 753c55b9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: slab-use-after-free Read in l2cap_chan_timeout
2025/10/12 20:40 upstream 67029a49db6c ff1712fe .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: slab-use-after-free Read in l2cap_chan_timeout
2025/03/13 14:40 upstream b7f94fcf5546 44be8b44 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: slab-use-after-free Read in l2cap_chan_timeout
2025/03/10 15:50 upstream 80e54e84911a 16256247 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: slab-use-after-free Read in l2cap_chan_timeout
2025/02/16 21:03 upstream ad1b832bf1cf 40a34ec9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-use-after-free Read in l2cap_chan_timeout
2026/05/31 23:07 upstream 174914ea5513 6b4a8443 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Read in l2cap_chan_timeout
2026/05/29 13:02 upstream 8fde5d1d47f6 6b4a8443 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Read in l2cap_chan_timeout
2026/05/09 17:33 upstream 70390501d194 29233ece .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Read in l2cap_chan_timeout
2026/04/19 07:25 upstream eb5249b12507 303e2802 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Read in l2cap_chan_timeout
2026/04/11 18:23 upstream e774d5f1bc27 38c8e246 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Read in l2cap_chan_timeout
2026/03/25 23:18 upstream bbeb83d3182a 4367a094 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Read in l2cap_chan_timeout
2026/03/22 08:17 upstream 113ae7b4decc 5b92003d .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Read in l2cap_chan_timeout
2026/03/22 03:03 upstream a0c83177734a 5b92003d .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Read in l2cap_chan_timeout
2026/03/13 10:49 upstream 0257f64bdac7 2f7f359d .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Read in l2cap_chan_timeout
2026/02/12 08:20 upstream 1e83ccd5921a 76a109e2 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Read in l2cap_chan_timeout
2026/01/15 08:34 upstream 944aacb68baf d1b870e1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Read in l2cap_chan_timeout
2025/12/19 10:02 upstream 516471569089 d1b870e1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Read in l2cap_chan_timeout
2025/11/27 07:34 upstream 4941a17751c9 e8331348 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Read in l2cap_chan_timeout
2025/11/24 23:50 upstream ac3fd01e4c1e 64219f15 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Read in l2cap_chan_timeout
2025/11/22 02:14 upstream 2eba5e05d9bc 4fb8ef37 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Read in l2cap_chan_timeout
2025/11/01 10:56 upstream ba36dd5ee6fd 2c50b6a9 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Read in l2cap_chan_timeout
2025/10/28 18:28 upstream fd57572253bc fd2207e7 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Read in l2cap_chan_timeout
2025/10/07 09:03 upstream c746c3b51698 8ef35d49 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Read in l2cap_chan_timeout
2025/10/02 15:35 upstream 7f7072574127 49379ee0 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Read in l2cap_chan_timeout
2025/09/21 08:52 upstream 3b08f56fbbb9 67c37560 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Read in l2cap_chan_timeout
2025/09/15 17:32 upstream f83ec76bf285 e2beed91 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Read in l2cap_chan_timeout
2025/09/14 17:58 upstream f83a4f2a4d8c e2beed91 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Read in l2cap_chan_timeout
2025/09/10 21:17 upstream 7aac71907bde fdeaa69b .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Read in l2cap_chan_timeout
2025/09/10 01:37 upstream 9dd1835ecda5 fdeaa69b .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Read in l2cap_chan_timeout
2025/09/09 03:36 upstream f777d1112ee5 d291dd2d .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Read in l2cap_chan_timeout
2025/09/04 11:31 upstream b9a10f876409 d291dd2d .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Read in l2cap_chan_timeout
2025/09/01 09:55 upstream b320789d6883 807a3b61 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Read in l2cap_chan_timeout
2025/08/30 04:02 upstream fb679c832b64 807a3b61 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Read in l2cap_chan_timeout
2025/07/16 18:18 upstream 155a3c003e55 124ec9cc .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Read in l2cap_chan_timeout
2025/07/09 13:17 upstream 733923397fd9 f4e5e155 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Read in l2cap_chan_timeout
2025/07/08 10:13 upstream d7b8f8e20813 4f67c4ae .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Read in l2cap_chan_timeout
2023/11/08 07:09 upstream 13d88ac54ddd 83211397 .config console log report syz C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Read in l2cap_chan_timeout
2026/03/08 07:02 upstream 03dcad79eec3 5cb44a80 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: slab-use-after-free Read in l2cap_chan_timeout
2025/12/16 05:44 upstream 8f0b4cce4481 d1b870e1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: slab-use-after-free Read in l2cap_chan_timeout
2025/10/18 16:02 upstream f406055cb18c 1c8c8cd8 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: slab-use-after-free Read in l2cap_chan_timeout
2025/10/05 04:51 upstream cbf33b8e0b36 49379ee0 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: slab-use-after-free Read in l2cap_chan_timeout
2025/07/10 17:44 upstream bc9ff192a6c9 d7384b6d .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 KASAN: slab-use-after-free Read in l2cap_chan_timeout
2025/10/20 02:23 net ffff5c8fc2af 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce KASAN: slab-use-after-free Read in l2cap_chan_timeout
2025/09/08 03:18 net e2a10daba849 d291dd2d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce KASAN: slab-use-after-free Read in l2cap_chan_timeout
2025/08/09 21:25 net 33caa208dba6 32a0e5ed .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce KASAN: slab-use-after-free Read in l2cap_chan_timeout
2025/08/05 03:16 net 4eabe4cc0958 abdcb213 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce KASAN: slab-use-after-free Read in l2cap_chan_timeout
2025/08/01 06:49 net 010510128873 0c075d67 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce KASAN: slab-use-after-free Read in l2cap_chan_timeout
2025/07/29 03:07 net afd8c2c9e2e2 c4a95487 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce KASAN: slab-use-after-free Read in l2cap_chan_timeout
2025/07/19 23:36 net-next 4701ee5044fb 7117feec .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce KASAN: slab-use-after-free Read in l2cap_chan_timeout
2026/04/24 13:08 linux-next 4c406406070d 1c2b9291 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: slab-use-after-free Read in l2cap_chan_timeout
2026/03/30 13:35 linux-next 3b058d1aeeef 458630d8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: slab-use-after-free Read in l2cap_chan_timeout
2025/07/14 04:43 linux-next a62b7a37e6fc 3cda49cf .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce KASAN: slab-use-after-free Read in l2cap_chan_timeout
* Struck through repros no longer work on HEAD.