From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out203-205-221-164.mail.qq.com (out203-205-221-164.mail.qq.com [203.205.221.164]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 611F6337BBA for ; Thu, 20 Nov 2025 14:11:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=203.205.221.164 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763647915; cv=none; b=F9GgF3MGecgIPImw7fxoWgZMae6+u6Seto4ueAZY1ksRdc+7Otqbh/xqfhxgBWTij7xnf5JpN1UIFElz2hY8esYXhlPLpKSW3gSlubuFwx6fo584tb3kymsr/fULmtgj6ttXwRaNrD3nsnzNjzX4kfmlzji+N+Ffc2rqIOdm2XQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763647915; c=relaxed/simple; bh=2xUKUITJU9n4w3J9nuCC5lxVSbd/HRyz104ErGkf25A=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=XPrlxEzAiaxgMxSIg5E9jIXmvPDRJEdrcWb13IeiMUKZfYPgvJyLoCn6U6Kk4kLjT/6TpUimkumzVLG2kxpzBCxYoQQFarZHNbKLr5l9uOgfmwm5YBwHA9aagaiWa+WxrsFCd9Uswol1zGZnz64f73DPjNJcpYGOb7mpsoYyqcI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=uWxOSeMT; arc=none smtp.client-ip=203.205.221.164 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="uWxOSeMT" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1763647903; bh=JgV9dGjyGAYMQX/inK/qgTLcWWBtEulqmKDVsE08PV8=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=uWxOSeMTMfwFVwOY58gvrKXUzqy3KJFnQLCay/TM2YTOwhb+JVzhMSyf11Ly+lgwc 4HsuMpjZzFLOk9FiN5s0T3ZXbK5tjlLUY9Te72SF3jiKcpE0nrf9auA+tv/910Lsq0 vhewFb1dVXqw777GpEiAB5SQfgFJ5+A7VDDOHijk= Received: from lxu-ped-host.. ([111.201.7.117]) by newxmesmtplogicsvrszb43-0.qq.com (NewEsmtp) with SMTP id 2E99408F; Thu, 20 Nov 2025 22:11:41 +0800 X-QQ-mid: xmsmtpt1763647901t3y3icesq Message-ID: X-QQ-XMAILINFO: OJYupdf7O4WtGzmVr3LGokx1hRrCimI0c1cPCXCCg7YHGJL+w/sa18gz9Rs++8 LC0WmzKNaHfWMaTrZhl234P8s20M2LaQOWff7C2QBWRatHGfaXeHIu2vtY8YCeRsOBk7ApeGNqyR Yzv+sEeIrJDOnBljNLZcB7PkkfwTDnb65DiCBgWmIzOiGDDkKUX/9pq6Z+EHbdrv7BcJ3ChbygUT LTHC0RhZtmZoTt35SM2Q6ADKR3sd9P/S21wjl/I7mIAtPWvYx6EE6lrL6nN66oeUjYMVGltv/efK dgP8g5e0wdV3BKfkRCCFqqw8sENSnC2GATpHaWtnI+oxzxaNo3KVKh2gR4orBBb5Ij4DWqs1R60U 9Mp3DIjA+ptYAVC/ittVvYQVDZKDLQJ25+UFIbS/dvb0wpGq//GqHv/Nb0mHD9IB4ogVg2JJectq dIb7+oF2H3Hb+pNg/+KVGlrzMo+z2qpIvlvHsZNV4Siij5tK0pilR/Nb/RkwNR/PKTRPvP/ClUn2 8k1zbksEdCrPRP5vAIvsBzV41Vlcglw/9E0Ldpxp078TzOfWmK2luTKVQ6YDoi0P9prBWavNVI3m Pdpw2D+4fcrtcPJwmLE9LRRvWOEMCAOdD5wEcv6YE6CVxbHsJzm4JIPpTtuqgSNW+yZ+/y+6yvbN ZISh8c+gzctd/0+o5swUorvrFrKX8zbhTQOwbKFeDrKynSv1N9ufxxDGFXoJ+rAoJhp9ZAYYwNg+ 5FUZguA3kc05Bt+5cksAk4ZUfrP7Jdrmex2PtCJmnOWJ+sCGrZVwBp0UgQqCTfzTItZycLzm6Sow 3USOQH3iOv3tEKjM0kkEkpsFJhzL6n/pHHntwigsk40gohWrvVK3NaBkNSLFLgnrMByXratGL0dH FLDDgUG2OB2HrGJLEWSbHM1BJnBfm5o5H8NsZukI3oPCDxBo6Oqs5a9XOQPADgHkgX6vd/WdTzBR TPOvCLRgl534JpoMJP2FQgPKQgUeJppID6FteGq3iQaumqN626kjZmgLcRX7qvWc7G1C2GsSozC4 y6P+xjgelmWITJcswufxah6Nhoe78= X-QQ-XMRINFO: M/715EihBoGSf6IYSX1iLFg= From: Edward Adam Davis To: syzbot+f098d64cc684b8dbaf65@syzkaller.appspotmail.com Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [bluetooth?] [usb?] memory leak in __hci_cmd_sync_sk Date: Thu, 20 Nov 2025 22:11:42 +0800 X-OQ-MSGID: <20251120141141.3861604-2-eadavis@qq.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <691b301e.a70a0220.f6df1.0011.GAE@google.com> References: <691b301e.a70a0220.f6df1.0011.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit #syz test diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index 3418d7b964a1..62469dba9e63 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -1466,7 +1466,7 @@ static void hci_cmd_timeout(struct work_struct *work) if (hdev->req_skb) { u16 opcode = hci_skb_opcode(hdev->req_skb); - bt_dev_err(hdev, "command 0x%4.4x tx timeout", opcode); + bt_dev_err(hdev, "command 0x%4.4x skb: %p tx timeout", opcode, hdev->req_skb); hci_cmd_sync_cancel_sync(hdev, ETIMEDOUT); } else { diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c index 6e76798ec786..0a0ce2a9b822 100644 --- a/net/bluetooth/hci_sync.c +++ b/net/bluetooth/hci_sync.c @@ -133,6 +133,8 @@ static int hci_req_sync_run(struct hci_request *req) return -ENODATA; skb = skb_peek_tail(&req->cmd_q); + printk("status: %u, result: %u, skb: %p, %s\n", + hdev->req_status, hdev->req_result, skb, __func__); bt_cb(skb)->hci.req_complete_skb = hci_cmd_sync_complete; bt_cb(skb)->hci.req_flags |= HCI_REQ_SKB; @@ -201,6 +203,8 @@ struct sk_buff *__hci_cmd_sync_sk(struct hci_dev *hdev, u16 opcode, u32 plen, bt_dev_dbg(hdev, "end: err %d", err); + printk("err: %d, status: %u, result: %u, skb: %p, %s\n", + err, hdev->req_status, hdev->req_result, skb, __func__); if (err < 0) { kfree_skb(skb); return ERR_PTR(err); @@ -209,8 +213,12 @@ struct sk_buff *__hci_cmd_sync_sk(struct hci_dev *hdev, u16 opcode, u32 plen, /* If command return a status event skb will be set to NULL as there are * no parameters. */ - if (!skb) + if (!skb) { + flush_work(&hdev->cmd_work); + skb_queue_purge(&hdev->cmd_q); + return ERR_PTR(-ENODATA); + } return skb; }