From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out203-205-221-210.mail.qq.com (out203-205-221-210.mail.qq.com [203.205.221.210]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E953E19DF6A for ; Sat, 22 Nov 2025 07:10:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=203.205.221.210 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763795431; cv=none; b=te+F2IJqzRJAPB5EEM0OE2MDyyJo6ez4Gpcu4zshJh+xvdpjHNKleB01iKkWO2CKmQLQtBw3bbLDIE0Z2elFaGuUUA8Rpr4P5syj8gIwi6wPhR/Nnohr6JpW0L9nQ/4i31Nj+iOehNQy2MLk+aXPIqvLFbbWJLeV9Pp4wOkSIR0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763795431; c=relaxed/simple; bh=D6b8+zJTChyQxzvUuYSrxCSo1tAkAxoTwjbF/QnPQ1U=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=rJyf0BQUabQ/xLIQ+Rp9ivECefZyN9JIWnGJym3OYw0Vfj440Re9gNN4DEFwFydUPEOHNHyjuJEnDBmEdr5Z5gmcq//N/LmoDwHkKioazXwTSZRUbepOfdPI7Vr740ZWnVaahSHTYYXRGQS2C8oZcrB+cZuhZcuz2cctZdCsU+Q= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=pWE9oNa7; arc=none smtp.client-ip=203.205.221.210 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="pWE9oNa7" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1763795420; bh=wb13/J1wd/9katTpDquIzEyoonmFWtoG9VENLWX6Fr4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=pWE9oNa7YDn4l2plHwZxXPQIelJjrHZTAFCKxjEApYZCULesX9rORPfB2v8u7mn8O tWCQxJaewp+tSLMBwjtaDErD4yVtmBu9MLIeK40023LCBfu79Y18NIqNBn8yYiNT/Z bKVSWesVuecDuGDgI8o4wkwyTO+RIAWsq0x+xxl8= Received: from lxu-ped-host.. ([111.201.7.117]) by newxmesmtplogicsvrsza63-0.qq.com (NewEsmtp) with SMTP id 248B04C2; Sat, 22 Nov 2025 15:09:08 +0800 X-QQ-mid: xmsmtpt1763795348tsmp60v1c Message-ID: X-QQ-XMAILINFO: OOO9dHjlsLs7xQN+06E2fWDaspE2dqoy9WdhQH4MIXKdqNQ9jlgSihT03NBWG0 9kPF0EKIZfLSBjSkIH84VcuOj4VcIRYW5VB9SchjUycI3BfTkRxxN4aBLjy3EgXv6/kUXtNPVi7X KrAh/R1xccna95mWQHHOqTw0HoOzrWHw31cxD11JGXaJytx4XEGGSMqAVStIAMHPyiQ5rokjsoEg WToo5tftLp3URHBKval8LdkIS8fvczOz2+TEtuveOW+vFTvYfbD0V6qtBYoyxjumJ4676HhAF3PK askwURZshdUmH2voYGB1Qpwmp0O7FcmpdTvq7Qt3Wo/lEocc8XkZ1Oj9mu4tzENLkHMwCzi4ELon urotB0kPFjK5i3TgcvwrAoQasLXo0/3qTtyCis4LfK8c0qM+2gUL5v4H0p978IN2ifZ+KEuiyWow Gvje0AJfW4vMsmvUB5aalmw8CEIQeEdzQr6F4jDukHjeuVFEU1MWSpmbAN8mkzvamNpntWVi58yL Wb2Kr2rqTX+AZwsO4laUF7AR1kBuD08B7st0EscyEsbekipXPWaAjjabGVjM37RWzD9o4zFwpFKU 1FkKjMSWsHU7ruAgIlKSKH92F7mn1MAVW+lc4JOUdlUXqBFk64i2u6VDN8mWrKi4aKqmjNKcSDKP O5xg+WJ6HlFQdRx+xpymomLD/rqn+Xu5wFyWJEYv2BYXZ1A9U5rGFoFPKrfysVSJ6nTcJVt4kTgh kv96fApkry7B0aXav7B315UhIyV35YfO2NuXSJU4mfXeeoBiaBhyX3IYuICdItbHifSoe4uzHu6O joOY3gVfoIuLCJxjy6easHASi1eSdLr8pOPU4kbVgJQxqc74A22/EaMV981IPYRzxsjrsuVRxDzK BOGLHJ1m7K5TKkxhaUdoQP24vTwl71kuZuRsxEbraAyotyOD7beGWY/AVQ1j45iBrQWWc0hsGH3P 2SjMW5xYh2c8tC7ei6P/oJhjq6O1p+mOrMWzzzjfI= X-QQ-XMRINFO: MPJ6Tf5t3I/ycC2BItcBVIA= From: Edward Adam Davis To: syzbot+f098d64cc684b8dbaf65@syzkaller.appspotmail.com Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [bluetooth?] [usb?] memory leak in __hci_cmd_sync_sk Date: Sat, 22 Nov 2025 15:09:09 +0800 X-OQ-MSGID: <20251122070908.3952952-2-eadavis@qq.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <691b301e.a70a0220.f6df1.0011.GAE@google.com> References: <691b301e.a70a0220.f6df1.0011.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit #syz test diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index 3418d7b964a1..187dda1e5950 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -1466,7 +1466,7 @@ static void hci_cmd_timeout(struct work_struct *work) if (hdev->req_skb) { u16 opcode = hci_skb_opcode(hdev->req_skb); - bt_dev_err(hdev, "command 0x%4.4x tx timeout", opcode); + bt_dev_err(hdev, "command 0x%4.4x skb: %p tx timeout hdev: %p", opcode, hdev->req_skb, hdev); hci_cmd_sync_cancel_sync(hdev, ETIMEDOUT); } else { @@ -4138,6 +4138,7 @@ static void hci_send_cmd_sync(struct hci_dev *hdev, struct sk_buff *skb) if (hci_skb_opcode(skb) != HCI_OP_NOP) { err = hci_send_frame(hdev, skb); + printk("err: %d, skb: %p, %s\n", err, skb, __func__); if (err < 0) { hci_cmd_sync_cancel_sync(hdev, -err); return; @@ -4163,6 +4164,7 @@ static void hci_cmd_work(struct work_struct *work) /* Send queued commands */ if (atomic_read(&hdev->cmd_cnt)) { skb = skb_dequeue(&hdev->cmd_q); + printk("dequeue skb:%p, hdev: %p, %s\n", skb, hdev, __func__); if (!skb) return; diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c index 6e76798ec786..4bf39cd402be 100644 --- a/net/bluetooth/hci_sync.c +++ b/net/bluetooth/hci_sync.c @@ -158,8 +158,9 @@ struct sk_buff *__hci_cmd_sync_sk(struct hci_dev *hdev, u16 opcode, u32 plen, struct sock *sk) { struct hci_request req; - struct sk_buff *skb; + struct sk_buff *skb, *new_skb; int err = 0; + unsigned long flags; bt_dev_dbg(hdev, "Opcode 0x%4.4x", opcode); @@ -169,6 +170,7 @@ struct sk_buff *__hci_cmd_sync_sk(struct hci_dev *hdev, u16 opcode, u32 plen, hdev->req_status = HCI_REQ_PEND; + new_skb = skb_peek_tail(&req.cmd_q); err = hci_req_sync_run(&req); if (err < 0) return ERR_PTR(err); @@ -203,16 +205,33 @@ struct sk_buff *__hci_cmd_sync_sk(struct hci_dev *hdev, u16 opcode, u32 plen, if (err < 0) { kfree_skb(skb); - return ERR_PTR(err); + goto out; } /* If command return a status event skb will be set to NULL as there are * no parameters. */ - if (!skb) - return ERR_PTR(-ENODATA); + if (!skb) { + err = -ENODATA; + goto out; + } return skb; + +out: + if (!skb_queue_empty(&hdev->cmd_q)) { + spin_lock_irqsave(&hdev->cmd_q.lock, flags); + skb = __skb_dequeue_tail(&hdev->cmd_q); + spin_unlock_irqrestore(&hdev->cmd_q.lock, flags); + } else { + printk("!!!!!!!!! skb: %p, nskb: %p, %s\n", skb, new_skb, __func__); + skb = new_skb; + } + + printk(">>>>> remove skb: %p, tskb: %p, hdev: %p, %s\n", skb, new_skb, hdev, __func__); + kfree_skb(skb); + + return ERR_PTR(err); } EXPORT_SYMBOL(__hci_cmd_sync_sk);