Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: general protection fault in l2cap_send_cmd Bluetooth: Wrong link type (-22) Oops: general protection fault, probably for non-canonical address 0xdffffc0000000064: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000320-0x0000000000000327] CPU: 0 UID: 0 PID: 8403 Comm: kworker/u9:10 Not tainted 6.13.0-rc7-syzkaller-g9bffa1ad25b8 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 Workqueue: hci4 hci_rx_work RIP: 0010:l2cap_send_cmd+0x563/0x8d0 net/bluetooth/l2cap_core.c:964 Code: fc ff df 80 3c 08 00 74 08 48 89 df e8 f6 54 42 f7 bd 22 03 00 00 48 03 2b 48 89 e8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 11 01 00 00 0f b6 5d 00 89 de 83 e6 40 31 RSP: 0018:ffffc9000557f378 EFLAGS: 00010202 RAX: 0000000000000064 RBX: ffff88801eb23c78 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff888034724000 RBP: 0000000000000322 R08: ffffffff8ac395c4 R09: 0000000000000000 R10: dffffc0000000000 R11: ffffed100f588363 R12: ffff888034724000 R13: ffff888034724010 R14: ffff88801eb22c80 R15: ffff888063932140 FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055558b7da5c8 CR3: 000000002974a000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline] l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline] l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817 hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline] hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317 worker_thread+0x870/0xd30 kernel/workqueue.c:3398 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:l2cap_send_cmd+0x563/0x8d0 net/bluetooth/l2cap_core.c:964 Code: fc ff df 80 3c 08 00 74 08 48 89 df e8 f6 54 42 f7 bd 22 03 00 00 48 03 2b 48 89 e8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 11 01 00 00 0f b6 5d 00 89 de 83 e6 40 31 RSP: 0018:ffffc9000557f378 EFLAGS: 00010202 RAX: 0000000000000064 RBX: ffff88801eb23c78 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff888034724000 ---------------- Code disassembly (best guess), 2 bytes skipped: 0: df 80 3c 08 00 74 filds 0x7400083c(%rax) 6: 08 48 89 or %cl,-0x77(%rax) 9: df e8 fucomip %st(0),%st b: f6 54 42 f7 notb -0x9(%rdx,%rax,2) f: bd 22 03 00 00 mov $0x322,%ebp 14: 48 03 2b add (%rbx),%rbp 17: 48 89 e8 mov %rbp,%rax 1a: 48 c1 e8 03 shr $0x3,%rax 1e: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx 25: fc ff df * 28: 0f b6 04 08 movzbl (%rax,%rcx,1),%eax <-- trapping instruction 2c: 84 c0 test %al,%al 2e: 0f 85 11 01 00 00 jne 0x145 34: 0f b6 5d 00 movzbl 0x0(%rbp),%ebx 38: 89 de mov %ebx,%esi 3a: 83 e6 40 and $0x40,%esi 3d: 31 .byte 0x31 Tested on: commit: 9bffa1ad Merge tag 'drm-fixes-2025-01-17' of https://g.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=16139fc4580000 kernel config: https://syzkaller.appspot.com/x/.config?x=aadf89e2f6db86cc dashboard link: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734 compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 Note: no patches were applied.
