From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from xmbghk7.mail.qq.com (xmbghk7.mail.qq.com [43.163.128.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 650D8262FC0 for ; Tue, 18 Nov 2025 02:53:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=43.163.128.54 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763434387; cv=none; b=X8sMxisuj1Kc+eeygdlaXLYTDrT48rek5UmZwHLLaD4OsTUa2mBmd/p6Hv+jku19yIfelXUkySuUhID3hxZtbK4iW+BjmB+fBFAddm111Yb97XHRmEkIfVmz+EcxKnx6FxpyYg8U2DV7wuiGjZTG+Tm/fBho/mYGpIIiXWvXeuo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763434387; c=relaxed/simple; bh=1dcl9Kcai32fxF8wB6smy+9Qq90h8Z4uVrbbu7hXTOc=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=Q/+9fRuFZn9m56BEVY1FnwzeIxjdfovOOfg+5sYA+uVzNd5KwH3o2Rlv5V/Ui2+ovkLAW0DaCuImb7/n56/TqUM9ky1CxqxOKCn0NdPPzBFVxopBNfgfC/e7rCd47NOpyBWyxt+rIU32PqnGvsektxNGUtn1QKBND6A7G2/ePjE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=CcMZevzu; arc=none smtp.client-ip=43.163.128.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="CcMZevzu" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1763434383; bh=3ud0awHYxQ5wfQ+0IY9YTaTpl9JliFDkH2ba5hq5GTA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=CcMZevzu9dR1bghXdR4msGaQdbuIa4N4nXKrf36jfNwMfxEadJ9ZJhMT+qrO7gIzJ +YKAneOlD5J+bujsDOUDUF6F6gOBTP2YaIQWTJoS3eO170wTDT4cVCrlOOs5l1g+/e stBRcPdVxRJU609vmKDtu79LY1xO72OfiLu4SP+E= Received: from lxu-ped-host.. ([111.201.7.117]) by newxmesmtplogicsvrsza36-0.qq.com (NewEsmtp) with SMTP id D411FCB9; Tue, 18 Nov 2025 10:53:01 +0800 X-QQ-mid: xmsmtpt1763434381tklzz3n98 Message-ID: X-QQ-XMAILINFO: OW+Aa38L0qVBLmuQI0SQYG+PnnMdgKl8lsoy4yq0fW6nB5rTqqEnOtT3x0VOds 61yO1T5d2Pxb6bGc2zeXOIRAbn0A98YeEnctGOvCA38mU2hcr5fceoattI9BQPpKYr9v0u/NVIzD 4SQhErPCLLAh2L6aI5/uuIQbIQO/ESRkz8GK+ZuFs5eU0vzPY0sSj3XYMF1aGDr4Mhm6HjtiXzZT SvUo6IGKoHD90bGhCTYrn5k9712U96Xk3f1XXVZ/oXV4Q5TFqTSjO7gEQ2IDBlbUzzhFBUho7/qS ZpBKYcJtQqRs6anKFJgubvODLKGLMXtGJNeT1OkkoK/QFPdJsfCC/ZtKf2rpOC8IYqwPznrx36jf 3tx4SqLa5I1LNkSUhlP0aHo45P2tHa6cXAAx66NQOVpgtD5ftS+v89/ck4xnslT+cWJKM0Hh+tx3 1nM5BqZCMnfkNwWc13mnBbqZGYIpghdrTRxKJHrCg9TiUBZ90T3Mjmk6yqhg9xLcJxSkulsr8ihr SUUI8J5TqRcRwyulcwb15CnCuLQAKl3wQpuldUcV68g0fpJ3BuTEnZi+qZ8wQgYAngyP6geZThOm CPnXeEB31V5KV6dP9ANHxskCDWS7XCN8ezH9VmvHO5S1iZz3/MbHsQg0sXxWWgR5B0tEONuBoZhr pfMUCSFA/bI3Ws0Yx2g7d74bd+WI9buYuZEPnJe1lTiYMCr5U+Aeuk2QXeAfQDwYyNjCz0FUcnC+ w3D/qyp31cygdmEVivuVaaZRStviuuXx7D0XSFC/SGbZyhX3a5QyWfmR2Edz5DjrfVoZnF6zWaAq Kkhw2bDKP0rFeretXZNfrnPhmdXm7pMAmQP+pOAVkFbQdhVpskeCX6O4D1qBUBuP/f5uxb4aehLd hKqER3ch6vRaJxdmmbx1ykeWO9WWybbo+5DjvEECiJhnZ8fqJRON80CkGWHBxycHQQZQBoAeF086 +OlorsONK66p+DodLr5Q7QbJzo58x1fxrx8650cjQOZ/NTSDLtQg== X-QQ-XMRINFO: Nq+8W0+stu50PRdwbJxPCL0= From: Edward Adam Davis To: syzbot+f098d64cc684b8dbaf65@syzkaller.appspotmail.com Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [bluetooth?] [usb?] memory leak in __hci_cmd_sync_sk Date: Tue, 18 Nov 2025 10:53:01 +0800 X-OQ-MSGID: <20251118025300.4101149-2-eadavis@qq.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <691b301e.a70a0220.f6df1.0011.GAE@google.com> References: <691b301e.a70a0220.f6df1.0011.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit #syz test diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c index 6e76798ec786..553cfc4f7886 100644 --- a/net/bluetooth/hci_sync.c +++ b/net/bluetooth/hci_sync.c @@ -177,8 +177,11 @@ struct sk_buff *__hci_cmd_sync_sk(struct hci_dev *hdev, u16 opcode, u32 plen, hdev->req_status != HCI_REQ_PEND, timeout); - if (err == -ERESTARTSYS) + if (err == -ERESTARTSYS) { + flush_work(&hdev->cmd_work); + skb_queue_purge(&req.cmd_q); return ERR_PTR(-EINTR); + } switch (hdev->req_status) { case HCI_REQ_DONE: