* [PATCH v2] Bluetooth: fix memory leak in error path of hci_alloc_dev()
@ 2026-05-31 16:30 Bharath Reddy
2026-05-31 18:13 ` Markus Elfring
0 siblings, 1 reply; 3+ messages in thread
From: Bharath Reddy @ 2026-05-31 16:30 UTC (permalink / raw)
To: marcel, luiz.dentz
Cc: linux-bluetooth, linux-kernel, Bharath Reddy,
syzbot+535ecc844591e50588a5
Early failures in Bluetooth HCI UART configuration leak SRCU percpu
memory.
When device initialization fails before hci_register_dev() completes,
the HCI_UNREGISTER flag is never set. As a result, when the device
reference count reaches zero, bt_host_release() evaluates this flag as
false and falls back to a direct kfree(hdev).
Because hci_release_dev() is bypassed, the SRCU struct initialized
early in hci_alloc_dev() is never cleaned up, resulting in a leak of
percpu memory.
Fix the leak by explicitly calling cleanup_srcu_struct() in the
fallback (unregistered) branch of bt_host_release() before freeing
the device.
Reported-by: syzbot+535ecc844591e50588a5@syzkaller.appspotmail.com
Tested-by: syzbot+535ecc844591e50588a5@syzkaller.appspotmail.com
Signed-off-by: Bharath Reddy <kbreddy.rpbc@gmail.com>
---
net/bluetooth/hci_sysfs.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index 041ce9adc378..74131f2c3be6 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -85,8 +85,10 @@ static void bt_host_release(struct device *dev)
if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
hci_release_dev(hdev);
- else
+ else {
+ cleanup_srcu_struct(&hdev->srcu);
kfree(hdev);
+ }
module_put(THIS_MODULE);
}
--
2.34.1
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [syzbot] [bluetooth?] memory leak in init_srcu_struct_fields
@ 2026-05-31 1:19 syzbot
2026-05-31 15:27 ` [PATCH v2] Bluetooth: fix memory leak in error path of hci_alloc_dev() Bharath Reddy
0 siblings, 1 reply; 3+ messages in thread
From: syzbot @ 2026-05-31 1:19 UTC (permalink / raw)
To: kartikey406, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
memory leak in init_srcu_struct_fields
BUG: memory leak
unreferenced object 0xffff88810ace7000 (size 512):
comm "syz.0.17", pid 6583, jiffies 4294948651
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc 1a69216d):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4575 [inline]
slab_alloc_node mm/slub.c:4899 [inline]
__kmalloc_cache_noprof+0x371/0x480 mm/slub.c:5415
kmalloc_noprof include/linux/slab.h:950 [inline]
kzalloc_noprof include/linux/slab.h:1188 [inline]
init_srcu_struct_fields+0x2c0/0x350 kernel/rcu/srcutree.c:207
hci_alloc_dev_priv+0x37/0x680 net/bluetooth/hci_core.c:2416
hci_alloc_dev include/net/bluetooth/hci_core.h:1763 [inline]
hci_uart_register_dev drivers/bluetooth/hci_ldisc.c:672 [inline]
hci_uart_set_proto drivers/bluetooth/hci_ldisc.c:752 [inline]
hci_uart_tty_ioctl+0x173/0x460 drivers/bluetooth/hci_ldisc.c:806
tty_ioctl+0xaca/0xd60 drivers/tty/tty_io.c:2801
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xee/0x600 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object (percpu) 0x607e4d944640 (size 384):
comm "syz.0.17", pid 6583, jiffies 4294948651
hex dump (first 32 bytes on cpu 0):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc 593bdea7):
pcpu_alloc_noprof+0x7c7/0xed0 mm/percpu.c:1896
init_srcu_struct_fields+0x2eb/0x350 kernel/rcu/srcutree.c:224
hci_alloc_dev_priv+0x37/0x680 net/bluetooth/hci_core.c:2416
hci_alloc_dev include/net/bluetooth/hci_core.h:1763 [inline]
hci_uart_register_dev drivers/bluetooth/hci_ldisc.c:672 [inline]
hci_uart_set_proto drivers/bluetooth/hci_ldisc.c:752 [inline]
hci_uart_tty_ioctl+0x173/0x460 drivers/bluetooth/hci_ldisc.c:806
tty_ioctl+0xaca/0xd60 drivers/tty/tty_io.c:2801
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xee/0x600 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff88810b1d9200 (size 512):
comm "syz.0.18", pid 6587, jiffies 4294948653
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc 27fa06af):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4575 [inline]
slab_alloc_node mm/slub.c:4899 [inline]
__kmalloc_cache_noprof+0x371/0x480 mm/slub.c:5415
kmalloc_noprof include/linux/slab.h:950 [inline]
kzalloc_noprof include/linux/slab.h:1188 [inline]
init_srcu_struct_fields+0x2c0/0x350 kernel/rcu/srcutree.c:207
hci_alloc_dev_priv+0x37/0x680 net/bluetooth/hci_core.c:2416
hci_alloc_dev include/net/bluetooth/hci_core.h:1763 [inline]
hci_uart_register_dev drivers/bluetooth/hci_ldisc.c:672 [inline]
hci_uart_set_proto drivers/bluetooth/hci_ldisc.c:752 [inline]
hci_uart_tty_ioctl+0x173/0x460 drivers/bluetooth/hci_ldisc.c:806
tty_ioctl+0xaca/0xd60 drivers/tty/tty_io.c:2801
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xee/0x600 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object (percpu) 0x607e4d9447c0 (size 384):
comm "syz.0.18", pid 6587, jiffies 4294948653
hex dump (first 32 bytes on cpu 0):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc 593bdea7):
pcpu_alloc_noprof+0x7c7/0xed0 mm/percpu.c:1896
init_srcu_struct_fields+0x2eb/0x350 kernel/rcu/srcutree.c:224
hci_alloc_dev_priv+0x37/0x680 net/bluetooth/hci_core.c:2416
hci_alloc_dev include/net/bluetooth/hci_core.h:1763 [inline]
hci_uart_register_dev drivers/bluetooth/hci_ldisc.c:672 [inline]
hci_uart_set_proto drivers/bluetooth/hci_ldisc.c:752 [inline]
hci_uart_tty_ioctl+0x173/0x460 drivers/bluetooth/hci_ldisc.c:806
tty_ioctl+0xaca/0xd60 drivers/tty/tty_io.c:2801
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xee/0x600 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object (percpu) 0x607e4d944980 (size 384):
comm "syz.0.19", pid 6595, jiffies 4294948657
hex dump (first 32 bytes on cpu 0):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc 593bdea7):
pcpu_alloc_noprof+0x7c7/0xed0 mm/percpu.c:1896
init_srcu_struct_fields+0x2eb/0x350 kernel/rcu/srcutree.c:224
hci_alloc_dev_priv+0x37/0x680 net/bluetooth/hci_core.c:2416
hci_alloc_dev include/net/bluetooth/hci_core.h:1763 [inline]
hci_uart_register_dev drivers/bluetooth/hci_ldisc.c:672 [inline]
hci_uart_set_proto drivers/bluetooth/hci_ldisc.c:752 [inline]
hci_uart_tty_ioctl+0x173/0x460 drivers/bluetooth/hci_ldisc.c:806
tty_ioctl+0xaca/0xd60 drivers/tty/tty_io.c:2801
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xee/0x600 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF
Tested on:
commit: 174914ea Merge tag 'v7.1-rc6-smb3-client-fixes' of git..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17f2f57e580000
kernel config: https://syzkaller.appspot.com/x/.config?x=5733044df9370cfc
dashboard link: https://syzkaller.appspot.com/bug?extid=535ecc844591e50588a5
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
patch: https://syzkaller.appspot.com/x/patch.diff?x=17b2f57e580000
^ permalink raw reply [flat|nested] 3+ messages in thread* [PATCH v2] Bluetooth: fix memory leak in error path of hci_alloc_dev()
2026-05-31 1:19 [syzbot] [bluetooth?] memory leak in init_srcu_struct_fields syzbot
@ 2026-05-31 15:27 ` Bharath Reddy
0 siblings, 0 replies; 3+ messages in thread
From: Bharath Reddy @ 2026-05-31 15:27 UTC (permalink / raw)
To: syzbot+535ecc844591e50588a5
Cc: kartikey406, linux-kernel, syzkaller-bugs, Bharath Reddy
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git f377d0025eb0
Early failures in Bluetooth HCI UART configuration leak SRCU percpu
memory.
When device initialization fails before hci_register_dev() completes,
the HCI_UNREGISTER flag is never set. As a result, when the device
reference count reaches zero, bt_host_release() evaluates this flag as
false and falls back to a direct kfree(hdev).
Because hci_release_dev() is bypassed, the SRCU struct initialized
early in hci_alloc_dev() is never cleaned up, resulting in a leak of
percpu memory.
Fix the leak by explicitly calling cleanup_srcu_struct() in the
fallback (unregistered) branch of bt_host_release() before freeing
the device.
Reported-by: syzbot+535ecc844591e50588a5@syzkaller.appspotmail.com
Signed-off-by: Bharath Reddy <kbreddy.rpbc@gmail.com>
---
net/bluetooth/hci_sysfs.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index 041ce9adc378..74131f2c3be6 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -85,8 +85,10 @@ static void bt_host_release(struct device *dev)
if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
hci_release_dev(hdev);
- else
+ else {
+ cleanup_srcu_struct(&hdev->srcu);
kfree(hdev);
+ }
module_put(THIS_MODULE);
}
--
2.34.1
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-05-31 18:13 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-05-31 16:30 [PATCH v2] Bluetooth: fix memory leak in error path of hci_alloc_dev() Bharath Reddy
2026-05-31 18:13 ` Markus Elfring
-- strict thread matches above, loose matches on Subject: below --
2026-05-31 1:19 [syzbot] [bluetooth?] memory leak in init_srcu_struct_fields syzbot
2026-05-31 15:27 ` [PATCH v2] Bluetooth: fix memory leak in error path of hci_alloc_dev() Bharath Reddy
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®