[syzbot] [bluetooth?] WARNING in l2cap_chan_le_send_credits

[syzbot] [bluetooth?] WARNING in l2cap_chan_le_send_credits

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    18f2d01bfce9 arm64: kexec_file: Do not use CMA for images ..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=11e3a44d580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=4e8e6c1701ad8af2
dashboard link: https://syzkaller.appspot.com/bug?extid=9dc8780713b11155dd74
compiler:       Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8bc8f56b5c77/disk-18f2d01b.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/0964f39ade28/vmlinux-18f2d01b.xz
kernel image: https://storage.googleapis.com/syzbot-assets/03ec4e4b937f/Image-18f2d01b.gz.xz

AI-generated root cause summary:
In net/bluetooth/l2cap_core.c, l2cap_chan_le_send_credits() allocates an L2CAP
transaction identifier via l2cap_get_ident() and unconditionally calls
ida_free(&conn->tx_ida, ident) after transmission under the assumption that
L2CAP_LE_CREDITS never expects a response. However, if the remote peer rejects
the packet with L2CAP_COMMAND_REJ or sends a signaling response bearing that
identifier, the asynchronous RX signaling handler l2cap_put_ident() sees the ID
as currently allocated and frees it first. When l2cap_chan_le_send_credits()
then executes ida_free() on the already-released identifier, ida_free() detects
that the ID is not allocated and triggers the warning in lib/idr.c.

full analysis:  https://syzkaller.appspot.com/x/ai_root_cause?x=9dc8780713b11155dd74

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9dc8780713b11155dd74@syzkaller.appspotmail.com

------------[ cut here ]------------
ida_free called for id=2 which is not allocated.
WARNING: lib/idr.c:594 at ida_free+0x24c/0x2d4 lib/idr.c:594, CPU#0: syz.4.2428/12785
Modules linked in:
CPU: 0 UID: 0 PID: 12785 Comm: syz.4.2428 Tainted: G             L      syzkaller #0 PREEMPT 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : ida_free+0x24c/0x2d4 lib/idr.c:594
lr : ida_free+0x24c/0x2d4 lib/idr.c:594
sp : ffff800094d27880
x29: ffff800094d27910 x28: 00000000000000cc x27: 1fffe0001fc18211
x26: 0000000000000002 x25: dfff800000000000 x24: ffff800094d27880
x23: ffff7000129a4f10 x22: 00000000000000ca x21: 0000000000000000
x20: 0000000000000002 x19: 0000000000000000 x18: 00000000ffffffff
x17: 0000000000000000 x16: 0000000000000000 x15: ffff80008b586000
x14: 0000000000001f42 x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000080000 x9 : 8f9eb4c3589ac800
x8 : 8f9eb4c3589ac800 x7 : 756372735f656c6f x6 : 5f656c6f736e6f63
x5 : ffff0000e4be4ffc x4 : 0000000000000000 x3 : ffff80008030d4c8
x2 : 0000000100000000 x1 : ffff0000dc3b0000 x0 : 0000000000000001
Call trace:
 ida_free+0x24c/0x2d4 lib/idr.c:594 (P)
 l2cap_chan_le_send_credits+0x17c/0x29c net/bluetooth/l2cap_core.c:7113
 l2cap_chan_rx_avail+0xb4/0x134 net/bluetooth/l2cap_core.c:7126
 l2cap_publish_rx_avail+0x110/0x168 net/bluetooth/l2cap_sock.c:-1
 l2cap_sock_recvmsg+0x280/0x7b8 net/bluetooth/l2cap_sock.c:1317
 sock_recvmsg_nosec net/socket.c:1154 [inline]
 sock_recvmsg+0xd4/0x170 net/socket.c:1176
 __sys_recvfrom+0x1ec/0x31c net/socket.c:2333
 __do_sys_recvfrom net/socket.c:2348 [inline]
 __se_sys_recvfrom net/socket.c:2344 [inline]
 __arm64_sys_recvfrom+0xec/0x10c net/socket.c:2344
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
 el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797
 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
irq event stamp: 584
hardirqs last  enabled at (583): [<ffff8000804a47b4>] vprintk_store+0x924/0xb94 kernel/printk/printk.c:2385
hardirqs last disabled at (584): [<ffff800086954058>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:484
softirqs last  enabled at (552): [<ffff8000800204f4>] __do_softirq+0x14/0x20 kernel/softirq.c:703
softirqs last disabled at (547): [<ffff8000800204f4>] __do_softirq+0x14/0x20 kernel/softirq.c:703
---[ end trace 0000000000000000 ]---


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup