From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out162-62-57-252.mail.qq.com (out162-62-57-252.mail.qq.com [162.62.57.252]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B1B04EEC3 for ; Sun, 16 Nov 2025 08:32:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=162.62.57.252 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763281973; cv=none; b=X47exZemVN9TFZLRfdbreWuSRb+YsZ4qGwRrn1hJUDx2PES0aC6LblhrC4cC8+Dgh7XaSogGTp2qofblAQ9t+LbfAPVqEcG5RxFI041gd5YkDQOXEUo/jjQ6og1B2yDSuQSyq6+uqMT28iHGpAD+PIcUllcKjwmDQENUqXH+t3c= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763281973; c=relaxed/simple; bh=xSLTgnK6Zm3lr63D8GCNdpoqqrxXHRNPZAZFYyqBTrU=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=WWmJeQw8tqaBHQLHN3LDmUqtEuvJ34pvG1CBSS4B5Z87+aVTo6c7T/WNPe0KycwwEvYhmB5oiXOpVu5Pa7ajdNBWEEoEB6IAlBcJpP+V9yFN8v8e3tXINGQhfOEMQBzyaADM5OUe91s/HVUlu9j4JBBH5VHygDZbitRY0lLa94M= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=qCI+XdpL; arc=none smtp.client-ip=162.62.57.252 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="qCI+XdpL" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1763281960; bh=MSdfyfYEon/acuq9U4zSKbAOFdRPyx+6WXFnTcICLPQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=qCI+XdpLtPLXmkq0nboapQqomTMeyUh+IZ52lZ+fasKhXliK9spb65ar1VGKyMZGS hHweSMcbtPnZL1mAv4Ysh7udNR7SAxALIaJfypR6lRUD0UU5WiuQ3AP4+2hRHR4EUd v2667u3H7llPmwsG0iT/cSGn4Ebrv4pzlpD+bJvA= Received: from lxu-ped-host.. ([111.201.7.117]) by newxmesmtplogicsvrsza56-0.qq.com (NewEsmtp) with SMTP id 75789CE5; Sun, 16 Nov 2025 16:29:23 +0800 X-QQ-mid: xmsmtpt1763281763tmsk4z5yc Message-ID: X-QQ-XMAILINFO: Od8VqZhFMB3Ntd/1M3eq57cjh64tm25FyxjlOrD6TTdAtDiHrIaVMmyWImqf4s UApjDy8CHQJb1i8UpkJLaHqipAW9FadfCU+/yiMrbLHBcTOPoaZMwU+ZeFz1NY59h8aYnB0koxKg Xrj0UQVx8IYkWtpQLieafOGQOvd1egj2dCXtFL+Eox8iRPpgwRq1dfGcFUeutH/2fu3Cf2/CUnNW nxCeweaUcTD9xZrr3u1AMNfv6+gGdKiZaLumRNHfXETen1r9uKnNdbUae5dnVqzXIbzZXgePG8Hq 0s4pBShMl5aXX8iBdp+VVWFN0Mg95TvWyQlv2wYWg/WsKSHVnaU1yyt/u5ojKNVAkNhmGPr5uiiD ckvOovGag3I53htfnJAE01n9enN3Tt/Xt6TJ4p4j79YNxr5rHazm/bUwHcDyUCc8REnNjx5pWE23 caG50h85XzAmieEbsUocejOYRdVq/ke2fpcNiklYj0+uz+DV66Y/Q8XvZfu/QUOc3WcftVxoSzmO 3iQpDIHvxxyxNuH8uVXrV4rS3doV9nImMcyVTsnA71NWbR529nsXEkagbyorspOX0QfwLYqodyDc UT6zXdHj15/PLHqXDSDTHGC1TbrJRk45AhT0d05gHCnmZZ+g4tjkPXGCnClJSRylCh/DBXUegoFb TcPxCiCEmJ7d5cMVHRQcF0zEMozx80gD7r1XDosWbyXVd9fjYSiyRRLokp45SKgZYvDgW/T1HW0j iXMcm63ozrhYD55OcfCIMH6ASHx9SnQjIsFPRC1QXKcXY4n2KYMhdyCQrkboITQn7nXehMsGu8eR EI59VApmMozpxsl5QlG1eqpTvJQR/lyzhW4fe7cKGuT+SUW8KzzVx+/2m5YZyrNePJXYHu4gvVtj Th7x0wZoTccdnrNENQH86PDxKs49hzK6NxMztToVgdCpKGnYtisntLDc3qj3VmhDGs6Y5CEwuol4 MIDMziiTFVXnjdPdO7PubTzmAPB9OUrfZRCa4TZGfy0ycE6Tk+/w== X-QQ-XMRINFO: M/715EihBoGSf6IYSX1iLFg= From: Edward Adam Davis To: syzbot+9aa47cd4633a3cf92a80@syzkaller.appspotmail.com Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in mgmt_pending_remove Date: Sun, 16 Nov 2025 16:29:24 +0800 X-OQ-MSGID: <20251116082923.44938-2-eadavis@qq.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <69197079.a70a0220.3124cb.0070.GAE@google.com> References: <69197079.a70a0220.3124cb.0070.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit #syz test diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c index fc866759910d..ad19022ae127 100644 --- a/net/bluetooth/hci_sock.c +++ b/net/bluetooth/hci_sock.c @@ -1311,7 +1311,9 @@ static int hci_sock_bind(struct socket *sock, struct sockaddr *addr, goto done; } + hci_dev_lock(hdev); mgmt_index_removed(hdev); + hci_dev_unlock(hdev); err = hci_dev_open(hdev->id); if (err) {