Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in set_powered_sync

[Hillf Danton <hdanton@sina.com>]

On Sun, 08 Sep 2024 02:07:21 -0700
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    f723224742fc Merge tag 'nf-next-24-09-06' of git://git.ker..
> git tree:       net-next
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=139b0e00580000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git  v6.12-rc7

--- x/net/bluetooth/hci_sync.c
+++ y/net/bluetooth/hci_sync.c
@@ -308,6 +308,7 @@ static void hci_cmd_sync_work(struct wor
 
 	bt_dev_dbg(hdev, "");
 
+	hci_req_sync_lock(hdev);
 	/* Dequeue all entries and run them */
 	while (1) {
 		struct hci_cmd_sync_work_entry *entry;
@@ -328,15 +329,14 @@ static void hci_cmd_sync_work(struct wor
 		if (entry->func) {
 			int err;
 
-			hci_req_sync_lock(hdev);
 			err = entry->func(hdev, entry->data);
 			if (entry->destroy)
 				entry->destroy(hdev, entry->data, err);
-			hci_req_sync_unlock(hdev);
 		}
 
 		kfree(entry);
 	}
+	hci_req_sync_unlock(hdev);
 }
 
 static void hci_cmd_sync_cancel_work(struct work_struct *work)
--