* [PATCH v2] Bluetooth: fix memory leak in error path of hci_alloc_dev()
@ 2026-05-31 16:30 Bharath Reddy
2026-05-31 18:13 ` Markus Elfring
0 siblings, 1 reply; 3+ messages in thread
From: Bharath Reddy @ 2026-05-31 16:30 UTC (permalink / raw)
To: marcel, luiz.dentz
Cc: linux-bluetooth, linux-kernel, Bharath Reddy,
syzbot+535ecc844591e50588a5
Early failures in Bluetooth HCI UART configuration leak SRCU percpu
memory.
When device initialization fails before hci_register_dev() completes,
the HCI_UNREGISTER flag is never set. As a result, when the device
reference count reaches zero, bt_host_release() evaluates this flag as
false and falls back to a direct kfree(hdev).
Because hci_release_dev() is bypassed, the SRCU struct initialized
early in hci_alloc_dev() is never cleaned up, resulting in a leak of
percpu memory.
Fix the leak by explicitly calling cleanup_srcu_struct() in the
fallback (unregistered) branch of bt_host_release() before freeing
the device.
Reported-by: syzbot+535ecc844591e50588a5@syzkaller.appspotmail.com
Tested-by: syzbot+535ecc844591e50588a5@syzkaller.appspotmail.com
Signed-off-by: Bharath Reddy <kbreddy.rpbc@gmail.com>
---
net/bluetooth/hci_sysfs.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index 041ce9adc378..74131f2c3be6 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -85,8 +85,10 @@ static void bt_host_release(struct device *dev)
if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
hci_release_dev(hdev);
- else
+ else {
+ cleanup_srcu_struct(&hdev->srcu);
kfree(hdev);
+ }
module_put(THIS_MODULE);
}
--
2.34.1
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH v2] Bluetooth: fix memory leak in error path of hci_alloc_dev()
2026-05-31 16:30 [PATCH v2] Bluetooth: fix memory leak in error path of hci_alloc_dev() Bharath Reddy
@ 2026-05-31 18:13 ` Markus Elfring
0 siblings, 0 replies; 3+ messages in thread
From: Markus Elfring @ 2026-05-31 18:13 UTC (permalink / raw)
To: Bharath Reddy, linux-bluetooth, Luiz Von Dentz, Marcel Holtmann
Cc: syzbot+535ecc844591e50588a5, LKML
…
> Fix the leak by explicitly calling cleanup_srcu_struct() in the
> fallback (unregistered) branch of bt_host_release() before freeing
> the device.
…
> ---
> net/bluetooth/hci_sysfs.c | 4 +++-
Some contributors would appreciate patch version descriptions.
https://lore.kernel.org/all/?q=%22This+looks+like+a+new+version+of+a+previously+submitted+patch%22
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v7.1-rc5#n310
Regards,
Markus
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH v2] Bluetooth: fix memory leak in error path of hci_alloc_dev()
2026-05-31 1:19 [syzbot] [bluetooth?] memory leak in init_srcu_struct_fields syzbot
@ 2026-05-31 15:27 ` Bharath Reddy
0 siblings, 0 replies; 3+ messages in thread
From: Bharath Reddy @ 2026-05-31 15:27 UTC (permalink / raw)
To: syzbot+535ecc844591e50588a5
Cc: kartikey406, linux-kernel, syzkaller-bugs, Bharath Reddy
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git f377d0025eb0
Early failures in Bluetooth HCI UART configuration leak SRCU percpu
memory.
When device initialization fails before hci_register_dev() completes,
the HCI_UNREGISTER flag is never set. As a result, when the device
reference count reaches zero, bt_host_release() evaluates this flag as
false and falls back to a direct kfree(hdev).
Because hci_release_dev() is bypassed, the SRCU struct initialized
early in hci_alloc_dev() is never cleaned up, resulting in a leak of
percpu memory.
Fix the leak by explicitly calling cleanup_srcu_struct() in the
fallback (unregistered) branch of bt_host_release() before freeing
the device.
Reported-by: syzbot+535ecc844591e50588a5@syzkaller.appspotmail.com
Signed-off-by: Bharath Reddy <kbreddy.rpbc@gmail.com>
---
net/bluetooth/hci_sysfs.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index 041ce9adc378..74131f2c3be6 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -85,8 +85,10 @@ static void bt_host_release(struct device *dev)
if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
hci_release_dev(hdev);
- else
+ else {
+ cleanup_srcu_struct(&hdev->srcu);
kfree(hdev);
+ }
module_put(THIS_MODULE);
}
--
2.34.1
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-05-31 18:13 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-05-31 16:30 [PATCH v2] Bluetooth: fix memory leak in error path of hci_alloc_dev() Bharath Reddy
2026-05-31 18:13 ` Markus Elfring
-- strict thread matches above, loose matches on Subject: below --
2026-05-31 1:19 [syzbot] [bluetooth?] memory leak in init_srcu_struct_fields syzbot
2026-05-31 15:27 ` [PATCH v2] Bluetooth: fix memory leak in error path of hci_alloc_dev() Bharath Reddy
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®