From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out162-62-57-137.mail.qq.com (out162-62-57-137.mail.qq.com [162.62.57.137]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2107B2D3724 for ; Sun, 23 Nov 2025 15:09:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=162.62.57.137 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763910601; cv=none; b=DLFm+LHBbEENzBr0pCdIJNMZx8vwkecuRRUSCue+6m/fxQ7pv53kIuLMjBG6PV0s8Xc2+FX2xi79ihluKoNccLQ+E5EKBeQvrSfQ8Mzv6oEo+b4cWSd+X/JztCiCJ2gAoypVEZn+bb2zuh2EVDp1fX5ZZUhDaPxBPAOSon/HsM0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763910601; c=relaxed/simple; bh=AwFhxvdGf495Ti4J+WXO6hnri1iiaEGDIYfZ19GuPAk=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=VCvxI1VEAqSjETRhO+AyxzwCwiiYcTxoC+e6nEkyaPY1u/K8a+NjC6byrwmZ+CFoCwL9uwLKc1MCWsccvf/833bZT6nCeyjvOKQyBH0EWlwAHZqqPzOpNFOtlsgTSLX7wDE+Vb4OrgOCnIUOgvuLacGqJuJBAes2Ui2nSykPSyA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=fJHPu8K7; arc=none smtp.client-ip=162.62.57.137 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="fJHPu8K7" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1763910588; bh=hGJAKRT2rvSwQR8PxASW8FsZ19p93j8N/etkAC4UTS0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=fJHPu8K7d7bRp0b0VEPmPAtZh3tYe2TBd98R5UEGjbnNhJjU05krRsjW2HxQiH3Wy jV5sFDz+rCGBd8XGeqGZVjlTpftcUTTgVGNNDtUW8p0i6Yxi+qoDLhhog9fbBCDvrg x0ZT5/0X+oVUOoSAhjcXg20q1jObomE1KYFCJAnk= Received: from lxu-ped-host.. ([111.201.7.117]) by newxmesmtplogicsvrszb43-0.qq.com (NewEsmtp) with SMTP id 21F21CAD; Sun, 23 Nov 2025 23:08:31 +0800 X-QQ-mid: xmsmtpt1763910511tpdp4guly Message-ID: X-QQ-XMAILINFO: OblCMDpF8T+NNKZJuwaLXiikCBLLCuG+LI//Xv+3BB/cSdt8oSFvNjzwCGsmWy 2yX9eLcJQq3uwmjuoT7pzMCV992umVVOGLi0NQlwx4u+vHiJzjw9nH7JKipGe85Kaxel/euvlftg 9+pcjd7fspB+wv+jhVwSzJphOCtv0T9fXv7IFCptOKJTJ+ZjW1po91HXkOtkUtwC3YRHG/9NSuzW mjOxeuExRe9NFJIcLp418DY4wt+tvfpAl7MLx+gLdhw4JXZUyIl/Yv25Zg2sffW8Plz57IrKS0Rk yMaLNwvCnA000lkq/nAkljVo5QY8o+OctOyJ+JhcxpjT9IWNGy850PZjSBkuy+CUMuehbcKZDmeb yIrvnUEH6CqtUZD57va8a8JEGZIKyTiarzrb4hvfH2eMmGXyE0waC2jP0OxekK25YwcGLJ7Sg9Tm jKsFv0642mhGKsTTJVN5pzYIIg9J/HR10+e5k2MuVxteFgIYyMX4AipLgnvQSuJ4V9xuugYKqw7o 8ra5toKs9rHmKWCNG1NMpb1x6G9ZYmU29NV4xKLI/0Wd0OPEWVsL1KF+C0O6Q0qSDoBXZTmDpYQD nNed6BLm0TsTgHFmTz944a19FOSIXgk5ivhmWplj1/1VBG63iNR2CLxiyROL3PpQwYduu0hK9kw8 PXSXLCs5ExRDTNE9SjJJ4MoGprDLPKCazj5VuwF7mcwitoTboncdcRrwDQmHhAynW0RFSbmICUHy 9UOqNIjvy+apyTiHt7jDorwnC723EWYcsxCIUHL4h/ZY2A3NHPPzmuK+RHlzEuxQaK98Rcdd7kwm ZJjxaILGkO60bTIB5KkHzQyTFQ3/Zh9joMLO4OO1zBV3dvRgKYyEnzlTnjlDnb+vLGWxtMab53gB UIq7znpFYn2NyuX+JvPFgVY+RhUwCQaa2Fs65i3olU64gxVZdwt7B56JqFdF9Lath1BQ/swsMAmG nOCkiGq4OxURg2+n9IIa4Jlj4EJck00CjxEDF0o8CN9eoOmI35nSFyNS3mFLZPjeY6cm0ji0m5f/ lyC/arx1AG1W5/ZvV3j+js1/XFuSrsYuNDWpAkYg== X-QQ-XMRINFO: OWPUhxQsoeAVDbp3OJHYyFg= From: Edward Adam Davis To: syzbot+f098d64cc684b8dbaf65@syzkaller.appspotmail.com Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [bluetooth?] [usb?] memory leak in __hci_cmd_sync_sk Date: Sun, 23 Nov 2025 23:08:31 +0800 X-OQ-MSGID: <20251123150830.4033213-2-eadavis@qq.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <691b301e.a70a0220.f6df1.0011.GAE@google.com> References: <691b301e.a70a0220.f6df1.0011.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit #syz test diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c index 6e76798ec786..1fce1a8c79ee 100644 --- a/net/bluetooth/hci_sync.c +++ b/net/bluetooth/hci_sync.c @@ -173,6 +173,8 @@ struct sk_buff *__hci_cmd_sync_sk(struct hci_dev *hdev, u16 opcode, u32 plen, if (err < 0) return ERR_PTR(err); + skb = skb_peek_tail(&req.cmd_q); +retry: err = wait_event_interruptible_timeout(hdev->req_wait_q, hdev->req_status != HCI_REQ_PEND, timeout); @@ -186,6 +188,12 @@ struct sk_buff *__hci_cmd_sync_sk(struct hci_dev *hdev, u16 opcode, u32 plen, break; case HCI_REQ_CANCELED: + if (!skb_queue_empty(&hdev->cmd_q) && hdev->req_skb != skb) { + hdev->req_status = HCI_REQ_PEND; + atomic_set(&hdev->cmd_cnt, 1); + queue_work(hdev->workqueue, &hdev->cmd_work); + goto retry; + } err = -hdev->req_result; break; diff --git a/drivers/bluetooth/hci_vhci.c b/drivers/bluetooth/hci_vhci.c index 2fef08254d78..2e12615f539e 100644 --- a/drivers/bluetooth/hci_vhci.c +++ b/drivers/bluetooth/hci_vhci.c @@ -75,6 +75,10 @@ static int vhci_send_frame(struct hci_dev *hdev, struct sk_buff *skb) { struct vhci_data *data = hci_get_drvdata(hdev); + printk("skb: %p refcnt: %u, data inited: %d, %s\n", + skb, refcount_read(&skb->users), + atomic_read(&data->initialized), + __func__); memcpy(skb_push(skb, 1), &hci_skb_pkt_type(skb), 1); skb_queue_tail(&data->readq, skb); @@ -587,6 +591,8 @@ static ssize_t vhci_read(struct file *file, skb = skb_dequeue(&data->readq); if (skb) { ret = vhci_put_user(data, skb, buf, count); + printk("skb: %p refcnt: %u len: %u, data: %p, ret: %ld, count: %lu, %s\n", + skb, refcount_read(&skb->users), skb->len, skb->data, ret, count, __func__); if (ret < 0) skb_queue_head(&data->readq, skb); else