From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out162-62-57-49.mail.qq.com (out162-62-57-49.mail.qq.com [162.62.57.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 90DE327055F for ; Fri, 21 Nov 2025 00:55:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=162.62.57.49 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763686515; cv=none; b=TTf7ArLiFC+MDSi0vmTYTuVJYpczpzOle01pawt1Jb7sobgZ/uXKb4wXGk5GM2Id4Or0AuFkpbO1iYDT3Jv+r7iMctHi7BTbaeNAJX8Tk34U/Rse9uWyIOUnzJY8/WPuobuMDCZ6Z2SpirGdtaF0egdNoTUYxoiU9750hkMT/Pw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763686515; c=relaxed/simple; bh=A4zFHqEZ0BIR97BLcuOAyuV9jpLXhwHyjhkQ1PmA7uY=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=jhOWsnk5W3GsmOFaSONWFOZbkyUW/6I0Xxw7PhfI+Yg9p/MA3Dp3yjixxM1ZAM14Umz1shtJjOdvVbsSo01C6xAqJCEwv9gUJyqFGDSGNlODzopOt9+0DrB9gOnePYg6o6bCWG6lCMstK2iXMH6+dPrgUKpwSIk6ovl4FAQqDhQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=T4Dl3tSe; arc=none smtp.client-ip=162.62.57.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="T4Dl3tSe" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1763686507; bh=YX5LGlz7r0OsHVHeMGaBCKxVKL5wEHt0ec0jRDcvFEs=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=T4Dl3tSewoXzbp8c2SVXYvNhVMx5K3alePXpYVn6gsT33YY1rgjZ7lv9hW9Z0kqIN xZrSui4798vF/5TgwdtIJ/8XdUacT9gdrZzK7iujhk8WBEC7poukDsOG6UV1D8F8nS ddW//Dvr460GqdE3Ar2Uvl7DhJC8LyfgCHlggZbI= Received: from lxu-ped-host.. ([111.201.7.117]) by newxmesmtplogicsvrsza63-0.qq.com (NewEsmtp) with SMTP id DC590E37; Fri, 21 Nov 2025 08:55:05 +0800 X-QQ-mid: xmsmtpt1763686505tn7sl7uzl Message-ID: X-QQ-XMAILINFO: NorxfGcNkh5bxfSW7cjMQEfg/kWTGqgwftXc2hXCuxiGJAlyF8eUX46MC4nLCn vFIKu1sNFUNgOzO7xlGuSP71Z6DyqklBUBFREbr3PN0CZzV5OZSekUgwYJ7UfF9ZDtZHz+RmcZHK mliHUhEiCTBV5vhZn/z8yye+YFH9LSehMOwux7yWoNctYIkE1OcrvgWd5qY7ttWY/s2ovreumOpV eaxlyXfbrrGUWBckTI2m6CYTG/sxxKsWt65FYJrhM6GXaUj4ntEKjqI5Nw3SjhN773d4dSMIRQnq HZxMX35q5svVCfCB9xGx26N6r6aezdwAzBA1Gcoz5+TXAW3354s7MQOw1tvcRVBJeiEGoPCBschg 9ByZOlLR90mjz3POakjLaqr2K1wZ2Drmfith5+9X6Ru4298ssmaEFaHOR09/0q61DVjCuQfHhUlC iGNCPe5AsZlA4DXpCIR0e6nKJ5Y7Dwq0M8M5KBwj0s4imyLjMTB5wnMr0AKrQMkSS/YqszooA3aS +zQVUp+DOJecau8siQ9l1QkYh9x7+OxYMuxqPd7SbMlwTjC7rJowAlEePADU2DaaH9GmMjDrZ8G6 04IBQnZlnFc8Cp3NWC/E7vA4UsGHJHh+KaeVAiXGnkoD0NQC3tvVeog7jb3CRw5BORu4qyhNKnN/ nRSDxCyVhVo/NUKSey6MWpNMI/itImIsDEmDLze70Uy5fIrve7vlcXkttrb+5Er+t3ek/RJNEQHu 6ep69w5AyfKt0d85MjpTyjFs7wuu5OMMq85CZNTMxQruxD1fb+5zfR1b6Ja6aAwfDlf8MWuSUueZ c51tmFtChxSsAvdnOYedVZ7GQrppYMMa5D1z0CSjKPNNhDxCGREz6CBSMxIoW1ssTC7ji9K9q12Z JeXdoenvVBwCAb7OVop/zne+wkCPa2ajTZiO3VYEOKgCz3R/ATLgAzZkWC/YoTTtpn8ZuVNB5xda IwS0iQccVSuzWR21NLNsxoysPSWJpX5q4L0EhJgy8nH9N0pzeXt6J86IwuJ05fr6x2Atgt4BS68q ZjjwEzduvIJ68AeKGccW5DQNQ72eA= X-QQ-XMRINFO: M/715EihBoGSf6IYSX1iLFg= From: Edward Adam Davis To: syzbot+f098d64cc684b8dbaf65@syzkaller.appspotmail.com Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [bluetooth?] [usb?] memory leak in __hci_cmd_sync_sk Date: Fri, 21 Nov 2025 08:55:05 +0800 X-OQ-MSGID: <20251121005504.3884424-2-eadavis@qq.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <691b301e.a70a0220.f6df1.0011.GAE@google.com> References: <691b301e.a70a0220.f6df1.0011.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit #syz test diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index 3418d7b964a1..62469dba9e63 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -1466,7 +1466,7 @@ static void hci_cmd_timeout(struct work_struct *work) if (hdev->req_skb) { u16 opcode = hci_skb_opcode(hdev->req_skb); - bt_dev_err(hdev, "command 0x%4.4x tx timeout", opcode); + bt_dev_err(hdev, "command 0x%4.4x skb: %p tx timeout", opcode, hdev->req_skb); hci_cmd_sync_cancel_sync(hdev, ETIMEDOUT); } else { diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c index 6e76798ec786..cfcc8bde77e2 100644 --- a/net/bluetooth/hci_sync.c +++ b/net/bluetooth/hci_sync.c @@ -133,6 +133,8 @@ static int hci_req_sync_run(struct hci_request *req) return -ENODATA; skb = skb_peek_tail(&req->cmd_q); + printk("status: %u, result: %u, skb: %p, %s\n", + hdev->req_status, hdev->req_result, skb, __func__); bt_cb(skb)->hci.req_complete_skb = hci_cmd_sync_complete; bt_cb(skb)->hci.req_flags |= HCI_REQ_SKB; @@ -158,8 +160,9 @@ struct sk_buff *__hci_cmd_sync_sk(struct hci_dev *hdev, u16 opcode, u32 plen, struct sock *sk) { struct hci_request req; - struct sk_buff *skb; + struct sk_buff *skb, *skb_tail; int err = 0; + unsigned long flags; bt_dev_dbg(hdev, "Opcode 0x%4.4x", opcode); @@ -169,6 +172,7 @@ struct sk_buff *__hci_cmd_sync_sk(struct hci_dev *hdev, u16 opcode, u32 plen, hdev->req_status = HCI_REQ_PEND; + skb_tail = skb_peek_tail(&req.cmd_q); err = hci_req_sync_run(&req); if (err < 0) return ERR_PTR(err); @@ -201,18 +205,35 @@ struct sk_buff *__hci_cmd_sync_sk(struct hci_dev *hdev, u16 opcode, u32 plen, bt_dev_dbg(hdev, "end: err %d", err); + printk("err: %d, status: %u, result: %u, skb: %p, %s\n", + err, hdev->req_status, hdev->req_result, skb, __func__); if (err < 0) { kfree_skb(skb); - return ERR_PTR(err); + goto out; } /* If command return a status event skb will be set to NULL as there are * no parameters. */ - if (!skb) - return ERR_PTR(-ENODATA); + if (!skb) { + err = -ENODATA; + goto out; + } return skb; + +out: + if (!skb_queue_empty(&hdev->cmd_q)) { + spin_lock_irqsave(&hdev->cmd_q.lock, flags); + skb = __skb_dequeue_tail(&req.cmd_q); + spin_unlock_irqrestore(&hdev->cmd_q.lock, flags); + } else + skb = skb_tail; + + printk("remove skb: %p, %s\n", skb, __func__); + kfree_skb(skb); + + return ERR_PTR(err); } EXPORT_SYMBOL(__hci_cmd_sync_sk);