From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out162-62-57-210.mail.qq.com (out162-62-57-210.mail.qq.com [162.62.57.210]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 872532D7DEE for ; Sun, 23 Nov 2025 14:33:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=162.62.57.210 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763908434; cv=none; b=CmMm695LOAP42adDp97oU8Dqs5YLQ2AFFtHvDzRH8Qr2GLZGSNa2fpY757wE5/M0786tVhEPhChsXFWzqt4wN/Bb9ehYVlgRQGFos1R4B7QC43IicQsGm8gEKHwad+H2CsjxnPrV+LGOd0IsxrsWXRFzd1jlyr/+c6c7uDvo3eA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763908434; c=relaxed/simple; bh=bkA4pHeFbjSEz/z5ywxOO5pTXz4iDzvJq1UjR1K224c=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=Ofdn2c9P/e/kpJPx9W4/ccvoT+XEzSLKoj+C/p3h5KNTWlQLLSfZLnjYTP1u51ELxLZk45OJ+1wETczBFvU1vC5SSxfsQYSsFSSQvW6QkHOZQcU4eJsadDAJrK7FoWxLA6cZZJKsJOpqk33AqldtfWPVNQe0oYYBVSYI6f//hX0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=DVSzQG/8; arc=none smtp.client-ip=162.62.57.210 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="DVSzQG/8" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1763908417; bh=KbhdnRL8WjbnXIEvRPuw7LqUHnN1CUxNZeVqLG4DGNo=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=DVSzQG/87gye0wxrpBNyr1viMCejnbgg2a3Z2zkfpiSek7lwMqAUHRaCH3E09wWvk Ht/hZoLuVhYfgNRWHTfLB3bVNnZ4bVFB8uUFvQx454/2SPhapb1FTr/yUrkawHL7cu f9poZwMntY4TxBwFAfpupo6mysq7J3Ljzg672jOA= Received: from lxu-ped-host.. ([111.201.7.117]) by newxmesmtplogicsvrsza63-0.qq.com (NewEsmtp) with SMTP id 863AA277; Sun, 23 Nov 2025 22:33:35 +0800 X-QQ-mid: xmsmtpt1763908415tczsnbjd8 Message-ID: X-QQ-XMAILINFO: MqG4KXyEKpQy4ZOQmQBWWzaS7NaCzyyGe7YzQiXfjPcgYa/+G//kurKaQL9n70 WFkeXOvR9wjo6yj94MRUMMKE8AXSpkJGwZMsfftiEibWLvVc0MbQTTEHK9mdFbj/mAMnkVfooaDv y4OJReWOpr0uCXyKlpeDZIMyqhO7LgqQUmvWcywXrmc5KUE3yOpyb+k/GhFT2zm1jwMtmP0JyOYK s/vdg8O9GYek1TwPiiRkXb8NMp3smTfDgxwoCEoW4VmJUXc8hcZUE+MPRL/X6tLHF9xXLlfzM66X J7NCn36lgbkc25z+Q7noqmc425kKxXCKOKoy9tpH8gW+aWxPbE+mLtlzlbJr2GFPe072CFBjd9Ci 27o7/UWHPeLhsjVZmFGe9LtyrCDL2+i+ln5yb2XOqSARnhqoucCDGwrmMm4BQfv3XzLYDJ5tJhAT /TkSqQlEuHh5JK8eW5S0Bz9jlBIhFfovvMNi1365zCfaPM+4rFEeCa92lYBp0KAUelJeWVxt90HD S8iqv96+znxdOUNxzPZKiv0XGedBGuMw/zTbt5jlQFdT+KEOjt5wgxec1YjSaBU1HszSBX52lOA/ a7Mm0BBSDyyKeBwfHJeDAL7zRlQoc23zlqWiGv5E/U16aOFpH7ROaNbNxWjxIzeUKipizC9bqYR4 A+4qD8JMlDKzZ2IV0HZ48/Qolc3j6H6t/KbEjRhpwpD0t8xJp3y2lBJgLaCa1MW42uTn3EMQOK/v f0+uadvQF6BeG5TakN0KnB7KLqzApdOVRAVq4Gu62fOZJ4WBcGTMyp7nEwLJbbYG0Sb93Zy/9RHc dD9RjU6c6uXtXIh0IM55KPO5Numv3DcijcpOA3HdaedLq9D+Xu5Kr18ZsllyhSO4B1V+ZgBEq7dg SbMs2yD0aJARow2nN16/eoqAE/dtJOWsJ3pHFbDvVbCY5lPGAYeXcMJyDEqoAYjGLp69YMyH0gLD tO7UzQaZhzxIotCTvYXW5NOqhbzLJwjxwpozXy8OlpUAZ1uQIoDwARFlpuZdqs6TBd94Qlfhjmbo jRothVArF7/lC4ojMm X-QQ-XMRINFO: NyFYKkN4Ny6FSmKK/uo/jdU= From: Edward Adam Davis To: syzbot+f098d64cc684b8dbaf65@syzkaller.appspotmail.com Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [bluetooth?] [usb?] memory leak in __hci_cmd_sync_sk Date: Sun, 23 Nov 2025 22:33:36 +0800 X-OQ-MSGID: <20251123143335.4031392-2-eadavis@qq.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <691b301e.a70a0220.f6df1.0011.GAE@google.com> References: <691b301e.a70a0220.f6df1.0011.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit #syz test diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c index 6e76798ec786..f3898f8b007e 100644 --- a/net/bluetooth/hci_sync.c +++ b/net/bluetooth/hci_sync.c @@ -173,6 +173,8 @@ struct sk_buff *__hci_cmd_sync_sk(struct hci_dev *hdev, u16 opcode, u32 plen, if (err < 0) return ERR_PTR(err); + skb = skb_peek_tail(&req.cmd_q); +retry: err = wait_event_interruptible_timeout(hdev->req_wait_q, hdev->req_status != HCI_REQ_PEND, timeout); @@ -186,6 +188,11 @@ struct sk_buff *__hci_cmd_sync_sk(struct hci_dev *hdev, u16 opcode, u32 plen, break; case HCI_REQ_CANCELED: + if (!skb_queue_empty(&hdev->cmd_q) && hdev->req_skb != skb) { + atomic_set(&hdev->cmd_cnt, 1); + queue_work(hdev->workqueue, &hdev->cmd_work); + goto retry; + } err = -hdev->req_result; break; diff --git a/drivers/bluetooth/hci_vhci.c b/drivers/bluetooth/hci_vhci.c index 2fef08254d78..2e12615f539e 100644 --- a/drivers/bluetooth/hci_vhci.c +++ b/drivers/bluetooth/hci_vhci.c @@ -75,6 +75,10 @@ static int vhci_send_frame(struct hci_dev *hdev, struct sk_buff *skb) { struct vhci_data *data = hci_get_drvdata(hdev); + printk("skb: %p refcnt: %u, data inited: %d, %s\n", + skb, refcount_read(&skb->users), + atomic_read(&data->initialized), + __func__); memcpy(skb_push(skb, 1), &hci_skb_pkt_type(skb), 1); skb_queue_tail(&data->readq, skb); @@ -587,6 +591,8 @@ static ssize_t vhci_read(struct file *file, skb = skb_dequeue(&data->readq); if (skb) { ret = vhci_put_user(data, skb, buf, count); + printk("skb: %p refcnt: %u len: %u, data: %p, ret: %ld, count: %lu, %s\n", + skb, refcount_read(&skb->users), skb->len, skb->data, ret, count, __func__); if (ret < 0) skb_queue_head(&data->readq, skb); else