From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out162-62-58-211.mail.qq.com (out162-62-58-211.mail.qq.com [162.62.58.211]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6862F33BBA1 for ; Fri, 21 Nov 2025 09:08:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=162.62.58.211 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763716092; cv=none; b=Rokm2d0+xOfgQ9vRPqeCRdGTWM+C7J5TYsBdmSp+qWR2xshyTz721tHidt8Dt+jaRsYPXPbI35y3CcA/EcrMeyNVx+HdWUbUxwMkH9GfwitRiCro3bOXq0xVIjnxaFZldO6qpG7OB/GGDgBaACXDar/PIys/8eJCDShGp8Yd9CQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763716092; c=relaxed/simple; bh=XFjHfPxH0WRdyKvHqyKNparKB2VNx1FXlQtwFUCJ5XA=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=rlp/LWl+YlPtO1k4jQOLHMa+zIZx/AYMZcRc93f/y2L8yj6n3Pws0B9SvQx8u9xDdICUgweNj10WhUvxRtUdBroScv+a2g4RhrvKt3JVsngtS5XZsRTP/JEreHhAmk4qTbLTT1uWgskttH/2bP/HrqBwmUyOeJFKtQzq8tzF3BY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=DOMXvnnq; arc=none smtp.client-ip=162.62.58.211 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="DOMXvnnq" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1763716085; bh=hG196uxVGy8ilCiX9bM8lWSFWXhQrsY7TAIFec48pug=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=DOMXvnnqO2wMpYJdkQEZu3FdnoTbj56/0njr0HDnUNH98LPDSRGcJZFO2HcW5x6bx Kv85OxVEOCF3wCy8mWyMy5rRpFqGOJdxwLGT0Dg1VYp5omGwS+/7WU989sZEC3KU+X gyoPWGD2dArXtlOl0k4WkRlpn/GZnFYFT4Cb2gBg= Received: from lxu-ped-host.. ([111.201.7.117]) by newxmesmtplogicsvrszb43-0.qq.com (NewEsmtp) with SMTP id 1B724CA3; Fri, 21 Nov 2025 17:06:55 +0800 X-QQ-mid: xmsmtpt1763716015twoqjo3fs Message-ID: X-QQ-XMAILINFO: N20OWsEN8qUxHd68ZRtROUQKp1cNUwK2Y3mIpIeH1BVcNtYE1fQ7aZL3KgEx0j ie5bvlBYC2BdJmqWTopcPzT3zWpYNTnasUe59XUPYzPCyPaTJJMdPa4EpMhgA1ZQ+mVKZJgzxCBF RM0PVyV6ddRMYt6oRas1ds/e7J1cmMrsPtYuYOuH4eCIsAww+n8gf1F5gUfItPZuhlPn3jdUwRbY Eonp8RcKK9aJPO7mxGuAQ7tE/rcKgQmGV51+K4HFO2gVGWButqe+9D+S2rgX/khBraSgBUzDASRs pZfCxhPAu6PT2CuwAhKxmNUuwmdE/uSXdrxXxOtrP7y8apLzBK/+bWulgemdNzuNlbLJN7tHP713 mJWHKG9J4YtX04D7XFF5UaxxSQXFVBllt51Exddt4VoEMwyUwmjOW39gtVhJFiu+7czGkYV1OWQR 7xxc15AzXsF4kmzHPBr4+JpSYN0XQMurEY/DdXseBqgCpSYGM7oBOrKlaURdQD0FEK6E1KiJg2+q Iyhoc/o9UFVk4/VAD1c3AE7yJC66IPRQpR6n5W6PL21xprEY6BaVy9awx3BT/SuE0OR611iEgsbx JLy31fBAWaMUprfyLp1h1228vjH2o52zQOV1oKwffttcScAJnrvxCB9a0VOiYnnSF1EnfiM82AF5 g1uvIWeHc5Eage/Ji1yR7Iya9mIAxnExBQHaQIFwQsaqywOwyspTYUQD6MwA38PUq5LQo3Mfqb+/ iFB0Ywyjp858OEmdcQp3UyU/WfTfv7pIuBI4t39On3KqlR93KIhpZoxBKkArHGpfoWG40MR/qZiJ NmZnhyfw8dnuJHY3me6FTNHGYSbk0VMvDCyDrJmnUX/den+nTR6iJJ0kVd5vg4CNCPjKRRoy3IsY 7GvftYjZxIVe2LZ6n6FwWR6MtaEgxIkj/foim8AmYd8WnZw4Z8vtcbSh85g71fN5VFL+lsmDSD+Y 4sLF5BM4mhlYodQQRp5A6IX4iFn+f8zoKRrX1jHLHAFyu3878CVNcvVYUX2t2R/C4L8UfS278= X-QQ-XMRINFO: NI4Ajvh11aEj8Xl/2s1/T8w= From: Edward Adam Davis To: syzbot+f098d64cc684b8dbaf65@syzkaller.appspotmail.com Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [bluetooth?] [usb?] memory leak in __hci_cmd_sync_sk Date: Fri, 21 Nov 2025 17:06:55 +0800 X-OQ-MSGID: <20251121090654.3909396-2-eadavis@qq.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <691b301e.a70a0220.f6df1.0011.GAE@google.com> References: <691b301e.a70a0220.f6df1.0011.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit #syz test diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index 3418d7b964a1..34887a154700 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -1466,7 +1466,7 @@ static void hci_cmd_timeout(struct work_struct *work) if (hdev->req_skb) { u16 opcode = hci_skb_opcode(hdev->req_skb); - bt_dev_err(hdev, "command 0x%4.4x tx timeout", opcode); + bt_dev_err(hdev, "command 0x%4.4x skb: %p tx timeout hdev: %p", opcode, hdev->req_skb, hdev); hci_cmd_sync_cancel_sync(hdev, ETIMEDOUT); } else { @@ -4162,7 +4162,11 @@ static void hci_cmd_work(struct work_struct *work) /* Send queued commands */ if (atomic_read(&hdev->cmd_cnt)) { + unsigned long flags; + + spin_lock_irqsave(&hdev->cmd_q.lock, flags); skb = skb_dequeue(&hdev->cmd_q); + spin_unlock_irqrestore(&hdev->cmd_q.lock, flags); if (!skb) return; diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c index 6e76798ec786..c16ab9089b5b 100644 --- a/net/bluetooth/hci_sync.c +++ b/net/bluetooth/hci_sync.c @@ -133,6 +133,8 @@ static int hci_req_sync_run(struct hci_request *req) return -ENODATA; skb = skb_peek_tail(&req->cmd_q); + printk("status: %u, result: %u, skb: %p, %s\n", + hdev->req_status, hdev->req_result, skb, __func__); bt_cb(skb)->hci.req_complete_skb = hci_cmd_sync_complete; bt_cb(skb)->hci.req_flags |= HCI_REQ_SKB; @@ -158,8 +160,9 @@ struct sk_buff *__hci_cmd_sync_sk(struct hci_dev *hdev, u16 opcode, u32 plen, struct sock *sk) { struct hci_request req; - struct sk_buff *skb; + struct sk_buff *skb, *skb_tail; int err = 0; + unsigned long flags; bt_dev_dbg(hdev, "Opcode 0x%4.4x", opcode); @@ -169,6 +172,7 @@ struct sk_buff *__hci_cmd_sync_sk(struct hci_dev *hdev, u16 opcode, u32 plen, hdev->req_status = HCI_REQ_PEND; + skb_tail = skb_peek_tail(&req.cmd_q); err = hci_req_sync_run(&req); if (err < 0) return ERR_PTR(err); @@ -201,18 +205,36 @@ struct sk_buff *__hci_cmd_sync_sk(struct hci_dev *hdev, u16 opcode, u32 plen, bt_dev_dbg(hdev, "end: err %d", err); + printk("err: %d, status: %u, result: %u, skb: %p, hdev: %p, %s\n", + err, hdev->req_status, hdev->req_result, skb, hdev, __func__); if (err < 0) { kfree_skb(skb); - return ERR_PTR(err); + goto out; } /* If command return a status event skb will be set to NULL as there are * no parameters. */ - if (!skb) - return ERR_PTR(-ENODATA); + if (!skb) { + err = -ENODATA; + goto out; + } return skb; + +out: + if (!skb_queue_empty(&hdev->cmd_q)) { + spin_lock_irqsave(&hdev->cmd_q.lock, flags); + skb = __skb_dequeue_tail(&hdev->cmd_q); + spin_unlock_irqrestore(&hdev->cmd_q.lock, flags); + skb_tail = NULL; + } else + skb = skb_tail; + + printk("remove skb: %p, tskb: %p, hdev: %p, %s\n", skb, skb_tail, hdev, __func__); + kfree_skb(skb); + + return ERR_PTR(err); } EXPORT_SYMBOL(__hci_cmd_sync_sk);