From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out203-205-221-240.mail.qq.com (out203-205-221-240.mail.qq.com [203.205.221.240]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A06F8199252 for ; Sun, 16 Nov 2025 08:02:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=203.205.221.240 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763280158; cv=none; b=p1j9iEcUKHpHErqHzrA/hvCiK0U+jdZooNlWiCoi0V/m+nKvvYEBlqaAPtpshPhpASG1L9Dn+hJ59WUDlRv4MEVbQ/h425UQqObYXZPj0P7tE2WaoipihGLWGHzP92JTRlcFe/wxgvYWBlVUcMxhuHlgfEsRxohBCr5IFQeBmdo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763280158; c=relaxed/simple; bh=KmBPiMWD3CuwX33wM+Mz3dZ8qpfXLG2djw9PLSYqkpk=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=T0oojZ6SBX/BhRb5Ql4ElKSUSUXsaqOTZd0sNSRnU/dPfFI3ZqazyVfQcPG3XYWMRxxICM1R11yVoK8V3MmdbMFGpK4IPINsmP34gLvnVNe2VaOescGO5GVmPGhk9gjEpj7/ZXbAQjmbu8RtSdhvm12FKSXAgM644+7PXOUUhOA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=BoWeqGhw; arc=none smtp.client-ip=203.205.221.240 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="BoWeqGhw" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1763280148; bh=AFN14/IjoGN4YeqjwTU6PsQRSCA6NlmQ+6lH2imS394=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=BoWeqGhwo73Yv1QP6vZvkwmkirS0Eo11ASk/SPboCFGduMtZEA7MMU4ZMtVX8aX05 PUePXJqxxeAXAARBVWCjLGEyf1kfbRJutprxlUHpAmLNTvAd0fn00tDnn0m7k4Mg2t 7D4rCcNuT6nmeNCL1CP3Y5cRTkQcTpqOWIFckW+0= Received: from lxu-ped-host.. ([111.201.7.117]) by newxmesmtplogicsvrszc43-0.qq.com (NewEsmtp) with SMTP id 9A81E05; Sun, 16 Nov 2025 16:02:26 +0800 X-QQ-mid: xmsmtpt1763280146tarp81uoe Message-ID: X-QQ-XMAILINFO: NtvpdyJXE1j9tuACecvh+XIW9vHLL/KtuLUp01pHPWGSSnyE8r42J+o0Ye3BKD s2iapTLqZhqJotG0MhqO6Zp2ZXRGSJYXLHnTEvmVW75hiY9MpaNzI4JKHPLmvKmM7UeBefH9cNwI BUK3VVSA61WI32IAGuT542ggTi8GwBqTk7ip22etyK5JQjpOnZ73R12MerB60R95DTqGUKUm3n/b JvQbNwW4eybAhUkzJD68BFRIjz42Jf9D/xaDwiHlmKT/LSXYf4mF2HcLZq0V8/4qWX4bGgkUMqlA fTPHGgtnKISs7sVWpMXfLblt6lAFShex2QdVpYnx8vwmEF836Mibx4Mhle3QIfcYQDDQx3+fFpS3 stMFO/XX0LiHMZ4+8GCYXD/rd21vVEc1vosHjVgCfjSaZZf+K1000MDwX8bL6GN2f+SVl/OS1pEX TsPKpdgnvGbBUA8ODUgfKI3r8ixDWV2CZUhtIRrtigi+ZH8/0hD8l77Val8qUdnseFIxtcVHh3hV ZPxe/C2PMi1NF/Z5PtYDYtby/5HoB3vgnW9nfnavor3C5Zojjj6qYfthYjGDLLa/mfQDFBLO5jAz +TRC1wedXRlkb7Eqyqsfjru+Op4c1CGyswr11xHYEsHe6ma7ZA/u1CNYcLt4qly+oGiwIggOLV24 YzWboWJwL6zTkCXgKTyyWfgyEnP+nUXljnLaax6U62y3x0jUEDLsw0azw22Lu7sOrWhbczhwCbPT o7RdinjGyXGnvxjy10Pmuog8rK5tQTR3wh+0DmKyH/ygM09HP9p3NP8ZoMmirkOQAGZnVT/LQzgz rvrSVh1/i7HWNVSNBoWI9iSq6jD4TUipZAjueGGJE2uwIp073ikhnTj413u8Z9l2OBhrfhMDzhWQ 6+bdTxRaXQkZY9LZeJmr4gBGX2m24a37sCPHNv98jjQ6qh2iTGRSySBR/U1mtd+sQ5Vn7u0+oFMW vkUiZ+ueNK1CzA8JWyqh/pKi6ZnOSzN4Q519EYFFc= X-QQ-XMRINFO: MPJ6Tf5t3I/ycC2BItcBVIA= From: Edward Adam Davis To: syzbot+9aa47cd4633a3cf92a80@syzkaller.appspotmail.com Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in mgmt_pending_remove Date: Sun, 16 Nov 2025 16:02:27 +0800 X-OQ-MSGID: <20251116080226.43469-2-eadavis@qq.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <69197079.a70a0220.3124cb.0070.GAE@google.com> References: <69197079.a70a0220.3124cb.0070.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit #syz test diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c index 262bf984d2aa..33e725798c34 100644 --- a/net/bluetooth/mgmt.c +++ b/net/bluetooth/mgmt.c @@ -9474,7 +9474,9 @@ void mgmt_index_removed(struct hci_dev *hdev) if (hci_test_quirk(hdev, HCI_QUIRK_RAW_DEVICE)) return; + hci_dev_lock(hdev); mgmt_pending_foreach(0, hdev, true, cmd_complete_rsp, &match); + hci_dev_unlock(hdev); if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0,