From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out203-205-221-240.mail.qq.com (out203-205-221-240.mail.qq.com [203.205.221.240]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5EC702356A4 for ; Sun, 23 Nov 2025 14:06:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=203.205.221.240 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763906771; cv=none; b=rwFGNiKGpfs572UdYKNQ4HyRXMbtUqpnF9wVHsDhuH+c41Z3Ozw0UYYdgW+o+3UOviJPQ2nE+RADMtfEz2aJeoSoc2/YvLPcX1SNWfu+MiXsUBvdRPNNgPbz1wtqa/pho4+SagZ9D+2CgXefA6rysW5uflErUzKZmZNBjqZNLgA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763906771; c=relaxed/simple; bh=B0iHLtgR//AkgaWgXFHGJXyeP3u0EnYcF+2oeUTg5ss=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=dg59ty8J50qO5mjReHWgI93kOfgYKyZ3qWT2dGZ8ZFwJjL9D1ZSSxQusBynj+GzAiVMWNlAFqk9of+8mFqAIkk4f00+Yd3zs3HWTSReerGTDl3mH/8e2nQDtx045zBUgDKXV30JObYTScyj96ZOgmh8RUWRpmo6kCpAyPAKbbVk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=jTP4lud5; arc=none smtp.client-ip=203.205.221.240 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="jTP4lud5" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1763906755; bh=g7ZUnJ+JBpgRRPwwE5Zp9kdQJwnAPBpecLcynPgaBjI=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=jTP4lud5ejNP4vSeSiu+UGAjhWuFfdNuX5r/7hWnk+qnSbSgqns1LagHq6OYU5jwG v5NGWd1OIKM+SzZ1w+FhELHp/vvlMtrE1zXazmuNkfzWCSGHrYbDaRok040NIRgowj 7gNvZ54KFebP4x7JVZnD5J6CA6nZbNxZiEnMYkzI= Received: from lxu-ped-host.. ([111.201.7.117]) by newxmesmtplogicsvrsza53-0.qq.com (NewEsmtp) with SMTP id 17518832; Sun, 23 Nov 2025 22:05:53 +0800 X-QQ-mid: xmsmtpt1763906753tpwn6jrxu Message-ID: X-QQ-XMAILINFO: MDbayGdXPuoebYUF6ZclScH3wPWvsJ4Mr7BNrknb8pbv3I0tRy7gJ9/cz2Incx Nofym9aQaSJGgtW8UsrI5he8cI4JEetUbO5yGLKyNkh7iDOrpx/6fVo5cQJq+7ChW/f5h2XHwDgx +tKCce9RaaZzIFMzijbfVcIO/TLfr6ZDqeD6tmujGiq0dq+rb+Qn6zPW53DYG4yCvQsJ2Qr3ywnh W7OBzkwicD7DbMtfyfYE+mpH3UcH+/riJencbamgIHLkWJvuRXie/tuSibKqGb9u1t/c6WyQD/uP mFM4t9sq4mza56Syu/PcsOhJwjVZZO60ioRGqWlxEQjhhTLeeLGgkhY90KkpvQoopebUCVSLkwmw 9Pj9A/U0wRn/g5/AGmb7MpwTlCARpSf+LSwuuh/u1OqtmCgxt/8TCy8uNk4SY3QlpfSzwvxTr6b3 wWEnt/fxMA6GN9ND+c2mC5RINuKQfu31JSQq31qd/GNIyEgHC7/i3YHSAINTCQhlXPR9YtR8j9jz U/nKS59GWvGdrs52vTxVikmK8xeRx2iPwXhosRThes4LJVuXU9JXSEpfZsv1AQ5dain4ZKeTJIB6 M/Cy8PAW1VZ2a9ZHQYYNyI7ATTENinsQTRjeoFvk8mnlNIPx6Lh+ep7XZgV6G3kK/nkl4Nk/VjpE m48III35xOlqTtoe0ZWafS/jvZ5vDcqDUpQt5eDkv1YBSqwbLH8uAe5Q9wh3hHKFcTsms7LA9oRo Pt4YEbJ5tGrMaNT45JT23XnsBIlP7SnmFD44KkRoHThWKZrzZ+Pg8aI9kkD1NEKRNHmiy4Eo+wkA x7rIHQJmSJLhWbyx2BfXKh67BxprEwz+rqtIKXntVEpOn0s02p7LhbzNAOasxJfwGyOdguG938K9 4/rh0UJKg8Vw7ejTfANJFrV3SLvGTt7p5nUnnjncw8iwQqDHLXahXYsus9NnqEBJYMAi6uzcxWu0 x9tVQvcsVqfzqFXY6leLqGUPQIF5yoU+i1fcOZ7FqkLNBNi8oRCQ== X-QQ-XMRINFO: MPJ6Tf5t3I/ycC2BItcBVIA= From: Edward Adam Davis To: syzbot+f098d64cc684b8dbaf65@syzkaller.appspotmail.com Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [bluetooth?] [usb?] memory leak in __hci_cmd_sync_sk Date: Sun, 23 Nov 2025 22:05:54 +0800 X-OQ-MSGID: <20251123140553.4029780-2-eadavis@qq.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <691b301e.a70a0220.f6df1.0011.GAE@google.com> References: <691b301e.a70a0220.f6df1.0011.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit #syz test diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c index 6e76798ec786..4db9360732c5 100644 --- a/net/bluetooth/hci_sync.c +++ b/net/bluetooth/hci_sync.c @@ -172,7 +172,9 @@ struct sk_buff *__hci_cmd_sync_sk(struct hci_dev *hdev, u16 opcode, u32 plen, err = hci_req_sync_run(&req); if (err < 0) return ERR_PTR(err); + skb = skb_peek_tail(&req.cmd_q); +retry: err = wait_event_interruptible_timeout(hdev->req_wait_q, hdev->req_status != HCI_REQ_PEND, timeout); @@ -186,6 +188,11 @@ struct sk_buff *__hci_cmd_sync_sk(struct hci_dev *hdev, u16 opcode, u32 plen, break; case HCI_REQ_CANCELED: + if (hdev->req_skb != skb) { + atomic_set(&hdev->cmd_cnt, 1); + queue_work(hdev->workqueue, &hdev->cmd_work); + goto retry; + } err = -hdev->req_result; break; diff --git a/drivers/bluetooth/hci_vhci.c b/drivers/bluetooth/hci_vhci.c index 2fef08254d78..2e12615f539e 100644 --- a/drivers/bluetooth/hci_vhci.c +++ b/drivers/bluetooth/hci_vhci.c @@ -75,6 +75,10 @@ static int vhci_send_frame(struct hci_dev *hdev, struct sk_buff *skb) { struct vhci_data *data = hci_get_drvdata(hdev); + printk("skb: %p refcnt: %u, data inited: %d, %s\n", + skb, refcount_read(&skb->users), + atomic_read(&data->initialized), + __func__); memcpy(skb_push(skb, 1), &hci_skb_pkt_type(skb), 1); skb_queue_tail(&data->readq, skb); @@ -587,6 +591,8 @@ static ssize_t vhci_read(struct file *file, skb = skb_dequeue(&data->readq); if (skb) { ret = vhci_put_user(data, skb, buf, count); + printk("skb: %p refcnt: %u len: %u, data: %p, ret: %ld, count: %lu, %s\n", + skb, refcount_read(&skb->users), skb->len, skb->data, ret, count, __func__); if (ret < 0) skb_queue_head(&data->readq, skb); else