KASAN: null-ptr-deref Write in l2cap_sock_suspend

Kernel	Title	Rank 🛈	Count	Last	Reported	Patched	Status
linux-6.6	KASAN: null-ptr-deref Write in l2cap_sock_suspend_cb	12	1	393d	393d	0/2	auto-obsoleted due to no activity on 2025/10/13 20:35
upstream	KASAN: null-ptr-deref Write in l2cap_sock_suspend_cb (4) prio:high bluetooth	12	4	76d	80d	0/29	moderation: reported on 2026/05/14 19:02
upstream	KASAN: null-ptr-deref Write in l2cap_sock_suspend_cb bluetooth	12	1	1053d	1047d	0/29	auto-obsoleted due to no activity on 2023/12/23 09:03
upstream	KASAN: null-ptr-deref Write in l2cap_sock_suspend_cb (3) bluetooth	12	3	227d	236d	0/29	auto-obsoleted due to no activity on 2026/03/29 02:38

==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_write include/linux/instrumented.h:82 [inline]
BUG: KASAN: null-ptr-deref in set_bit include/asm-generic/bitops/instrumented-atomic.h:28 [inline]
BUG: KASAN: null-ptr-deref in l2cap_sock_suspend_cb+0x43/0x90 net/bluetooth/l2cap_sock.c:1745
Write of size 8 at addr 0000000000000570 by task kworker/u33:4/5958

CPU: 3 UID: 0 PID: 5958 Comm: kworker/u33:4 Not tainted 6.16.0-rc6-syzkaller-00237-gc7de79e662b8 #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: hci1 hci_rx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 kasan_report+0xe0/0x110 mm/kasan/report.c:593
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0x100/0x1b0 mm/kasan/generic.c:189
 instrument_atomic_write include/linux/instrumented.h:82 [inline]
 set_bit include/asm-generic/bitops/instrumented-atomic.h:28 [inline]
 l2cap_sock_suspend_cb+0x43/0x90 net/bluetooth/l2cap_sock.c:1745
 l2cap_chan_ready.part.0+0x1c6/0x240 net/bluetooth/l2cap_core.c:1257
 l2cap_chan_ready net/bluetooth/l2cap_core.c:1246 [inline]
 l2cap_le_start+0x1ea/0xe40 net/bluetooth/l2cap_core.c:1375
 l2cap_conn_ready net/bluetooth/l2cap_core.c:1628 [inline]
 l2cap_connect_cfm+0x8f4/0xf80 net/bluetooth/l2cap_core.c:7304
 hci_connect_cfm include/net/bluetooth/hci_core.h:2059 [inline]
 le_conn_complete_evt+0x1662/0x1d70 net/bluetooth/hci_event.c:5754
 hci_le_conn_complete_evt+0x23c/0x370 net/bluetooth/hci_event.c:5780
 hci_le_meta_evt+0x354/0x5e0 net/bluetooth/hci_event.c:7166
 hci_event_func net/bluetooth/hci_event.c:7474 [inline]
 hci_event_packet+0x685/0x11c0 net/bluetooth/hci_event.c:7531
 hci_rx_work+0x2c5/0x16b0 net/bluetooth/hci_core.c:4070
 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3321 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3402
 kthread+0x3c5/0x780 kernel/kthread.c:464
 ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
==================================================================

Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2025/07/19 10:21	upstream	c7de79e662b8	7117feec	.config	console log	report			info	[disk image (non-bootable)] [vmlinux] [kernel image]	ci-qemu-upstream	KASAN: null-ptr-deref Write in l2cap_sock_suspend_cb
2025/07/16 20:41	upstream	155a3c003e55	44f8051e	.config	console log	report			info	[disk image (non-bootable)] [vmlinux] [kernel image]	ci-qemu-upstream	KASAN: null-ptr-deref Write in l2cap_sock_suspend_cb