Re: [syzbot] [bluetooth?] [bcachefs?] KASAN: slab-use-after-free Read in hci_uart_write_work

[Hillf Danton <hdanton@sina.com>]

> Date: Mon, 14 Jul 2025 10:09:31 -0700	[thread overview]
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    3f31a806a62e Merge tag 'mm-hotfixes-stable-2025-07-11-16-1..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=174b07d4580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=b309c907eaab29da
> dashboard link: https://syzkaller.appspot.com/bug?extid=fde6bd779f78e6e0992e
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=127ece8c580000

#syz test

--- x/drivers/bluetooth/hci_uart.h
+++ y/drivers/bluetooth/hci_uart.h
@@ -69,6 +69,7 @@ struct hci_uart {
 	unsigned long		hdev_flags;
 
 	struct work_struct	init_ready;
+	struct mutex 		write_mutex;
 	struct work_struct	write_work;
 
 	const struct hci_uart_proto *proto;
--- x/drivers/bluetooth/hci_ldisc.c
+++ y/drivers/bluetooth/hci_ldisc.c
@@ -154,6 +154,7 @@ static void hci_uart_write_work(struct w
 	/* REVISIT: should we cope with bad skbs or ->write() returning
 	 * and error value ?
 	 */
+	mutex_lock(&hu->write_mutex);
 
 restart:
 	clear_bit(HCI_UART_TX_WAKEUP, &hu->tx_state);
@@ -180,6 +181,7 @@ restart:
 		goto restart;
 
 	wake_up_bit(&hu->tx_state, HCI_UART_SENDING);
+	mutex_unlock(&hu->write_mutex);
 }
 
 void hci_uart_init_work(struct work_struct *work)
@@ -515,6 +517,7 @@ static int hci_uart_tty_open(struct tty_
 
 	INIT_WORK(&hu->init_ready, hci_uart_init_work);
 	INIT_WORK(&hu->write_work, hci_uart_write_work);
+	mutex_init(&hu->write_mutex);
 
 	/* Flush any pending characters in the driver */
 	tty_driver_flush_buffer(tty);
--