From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.167.198 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794613112; b=uXdOFA1z+0JUgjHxuOWcX0rJ27kWrQTX9C1jPF/QFPZC4YymuUBJDv0OlQV4PCx5h7tJ dYdfC3OR3qPKkF1hBCVVdD+qD0Eh+b8FNi7enbNqOusjjxj4edopQNTeaxA7K90U0VIBS UwXfbyMaPaELmvWrc/DjC/4y/QL8xYjnaGN7yqC4bUWELZhCHNGn9PVZaG/K5mltyekn8 EYHZzSOR31RWBkxv9kgphIViisYJ/kFddcHXPYtcqUG2GQT8zF5Kmnd9Rap3jXCr8kPL4 2TBl2Z0okXpcjC5PNwavBIANG5dyme3DHF4U4dH9adh+ehuYezMQF6GL9I556vX9x2w== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794613112; h=DMARC-Filter:Received:X-Google-DKIM-Signature:X-Forwarded-Encrypted: X-Gm-Message-State:MIME-Version:X-Received:Date: X-Google-Appengine-App-Id:X-Google-Appengine-App-Id-Alias:Message-ID: Subject:From:To:Content-Type; bh=IXMzMwEfsS4+/hshQyxBdyRvMuv05vJvUOLr/48g+rU=; b=VRJlBde5mIIVl2shTPT+wH5yn/u0P8S2KmPXswPJ/A0d5uJ5nziBT3545kpAk20fGxLl scZy+64iLhM6ledvkO5DSUFQ1c8wqsMVNokmfefc+gyG3avbJwFlod5uSMo5Zln06lO6M sDgALWj8Gm3G+W2F8Fo0PEkH9QboGOzutW50BVVEiokOxkjJ5aAkPzmtQwCpqsaB3w86x wrQz106xAVa80PJeRnx6dLrg1GNbGfkHYduiDGpxEV0DY492feauEfM2/kpu1xZQpIapx oWUcaeXw10EhGoBD7ZI/94hzG0tcU4QFNMR7d5IrsZkgVgiWZF/QdSTezLLVeMC9ZeQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=fail header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.remote-ip=209.85.167.198 Received: from mail-oi1-f198.google.com (mail-oi1-f198.google.com [209.85.167.198]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 22138606A32D for ; Fri, 13 Nov 2026 23:38:32 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 22138606A32D Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-oi1-f198.google.com with SMTP id 5614622812f47-4c734afb8deso1983417b6e.1 for ; Fri, 13 Nov 2026 15:38:31 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794613111; x=1795217911; h=content-type:to:from:subject:message-id:date:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=IXMzMwEfsS4+/hshQyxBdyRvMuv05vJvUOLr/48g+rU=; b=gsYHyHBZqtm9ujGtZNgtyyK+3r7Efda4eU2eGgJUYHaf5/2R1Y4n2UYWZZKk0SQrI7 bG6M1EWv/gZEmrzlG7q6etYtFdAMz7h5dXrgXmqq4cTkhU/qEYvHvxtKyNXTCTEmG7E7 JDkh04vTjx8/8YTyqOONG81+Q/FWVkYtUajpflrRbmwMerVP5HExuNq5fTDfjhT35vds zH7NaCqagowUdViSYWWc/bZyKwXMc5FJiIl9y0fGVMOlM0zSMnMpI96HeIvJe4RkRLdU zxSn2fAfFcEByyBcdKYwtxcpOn13gmzXqqKJfiyTi+4N+lvi83IbdCVeikc0nTl1Z2SJ p0Wg== X-Forwarded-Encrypted: i=1; AL+hErE64ubUHbpwR5T7jBSMT9VwJjYcb1WrJnwsKqIntLJdt9GpI71lqy5CPoWwDRXzzDRhLelSXYBlsWCfMsQ=@vger.kernel.org X-Gm-Message-State: APuU4Z81FmA34UQ3xA0D3VWQRZmlXYrjgxMGF8QfcdicadNhLd2wDx+b YRyUeRU9+MxmJs3rGMKYqqAMi+xw4TqQCbVdAlO59la9Y6Q4MNaKM7no3TR0QDYpELF8BEzSXHw 2qW6eaEg+m7k6Uzyyf6Oo6X59X4/AQ/TqFeBoBZZUciIFD7XxKL8hQybGqRk= X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 X-Received: by 2002:a05:6808:309d:b0:533:87ee:d131 with SMTP id 5614622812f47-56e64effd43mr3820536b6e.25.1794613111223; Fri, 13 Nov 2026 15:38:31 -0800 (PST) Date: Fri, 13 Nov 2026 15:38:31 -0800 X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <6af79f77.98e60839.1e023a.00d6.GAE@google.com> Subject: [syzbot] [bluetooth?] WARNING in l2cap_chan_le_send_credits From: syzbot To: linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, luiz.dentz@gmail.com, marcel@holtmann.org, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" Hello, syzbot found the following issue on: HEAD commit: 18f2d01bfce9 arm64: kexec_file: Do not use CMA for images .. git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci console output: https://syzkaller.appspot.com/x/log.txt?x=11e3a44d580000 kernel config: https://syzkaller.appspot.com/x/.config?x=4e8e6c1701ad8af2 dashboard link: https://syzkaller.appspot.com/bug?extid=9dc8780713b11155dd74 compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 userspace arch: arm64 Unfortunately, I don't have any reproducer for this issue yet. Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/8bc8f56b5c77/disk-18f2d01b.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/0964f39ade28/vmlinux-18f2d01b.xz kernel image: https://storage.googleapis.com/syzbot-assets/03ec4e4b937f/Image-18f2d01b.gz.xz AI-generated root cause summary: In net/bluetooth/l2cap_core.c, l2cap_chan_le_send_credits() allocates an L2CAP transaction identifier via l2cap_get_ident() and unconditionally calls ida_free(&conn->tx_ida, ident) after transmission under the assumption that L2CAP_LE_CREDITS never expects a response. However, if the remote peer rejects the packet with L2CAP_COMMAND_REJ or sends a signaling response bearing that identifier, the asynchronous RX signaling handler l2cap_put_ident() sees the ID as currently allocated and frees it first. When l2cap_chan_le_send_credits() then executes ida_free() on the already-released identifier, ida_free() detects that the ID is not allocated and triggers the warning in lib/idr.c. full analysis: https://syzkaller.appspot.com/x/ai_root_cause?x=9dc8780713b11155dd74 IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+9dc8780713b11155dd74@syzkaller.appspotmail.com ------------[ cut here ]------------ ida_free called for id=2 which is not allocated. WARNING: lib/idr.c:594 at ida_free+0x24c/0x2d4 lib/idr.c:594, CPU#0: syz.4.2428/12785 Modules linked in: CPU: 0 UID: 0 PID: 12785 Comm: syz.4.2428 Tainted: G L syzkaller #0 PREEMPT Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : ida_free+0x24c/0x2d4 lib/idr.c:594 lr : ida_free+0x24c/0x2d4 lib/idr.c:594 sp : ffff800094d27880 x29: ffff800094d27910 x28: 00000000000000cc x27: 1fffe0001fc18211 x26: 0000000000000002 x25: dfff800000000000 x24: ffff800094d27880 x23: ffff7000129a4f10 x22: 00000000000000ca x21: 0000000000000000 x20: 0000000000000002 x19: 0000000000000000 x18: 00000000ffffffff x17: 0000000000000000 x16: 0000000000000000 x15: ffff80008b586000 x14: 0000000000001f42 x13: 0000000000000001 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000080000 x9 : 8f9eb4c3589ac800 x8 : 8f9eb4c3589ac800 x7 : 756372735f656c6f x6 : 5f656c6f736e6f63 x5 : ffff0000e4be4ffc x4 : 0000000000000000 x3 : ffff80008030d4c8 x2 : 0000000100000000 x1 : ffff0000dc3b0000 x0 : 0000000000000001 Call trace: ida_free+0x24c/0x2d4 lib/idr.c:594 (P) l2cap_chan_le_send_credits+0x17c/0x29c net/bluetooth/l2cap_core.c:7113 l2cap_chan_rx_avail+0xb4/0x134 net/bluetooth/l2cap_core.c:7126 l2cap_publish_rx_avail+0x110/0x168 net/bluetooth/l2cap_sock.c:-1 l2cap_sock_recvmsg+0x280/0x7b8 net/bluetooth/l2cap_sock.c:1317 sock_recvmsg_nosec net/socket.c:1154 [inline] sock_recvmsg+0xd4/0x170 net/socket.c:1176 __sys_recvfrom+0x1ec/0x31c net/socket.c:2333 __do_sys_recvfrom net/socket.c:2348 [inline] __se_sys_recvfrom net/socket.c:2344 [inline] __arm64_sys_recvfrom+0xec/0x10c net/socket.c:2344 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606 irq event stamp: 584 hardirqs last enabled at (583): [] vprintk_store+0x924/0xb94 kernel/printk/printk.c:2385 hardirqs last disabled at (584): [] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:484 softirqs last enabled at (552): [] __do_softirq+0x14/0x20 kernel/softirq.c:703 softirqs last disabled at (547): [] __do_softirq+0x14/0x20 kernel/softirq.c:703 ---[ end trace 0000000000000000 ]--- --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the report is already addressed, let syzbot know by replying with: #syz fix: exact-commit-title If you want to overwrite report's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the report is a duplicate of another one, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup