From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out162-62-57-137.mail.qq.com (out162-62-57-137.mail.qq.com [162.62.57.137]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B3DF53D561 for ; Fri, 21 Nov 2025 00:59:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=162.62.57.137 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763686744; cv=none; b=J3dZfNPatL+rcMqELK/nzKluPAtZFxrOFPczZrBk2V6lnZHq5dhmFDr3zqWZfjSQgOoN3P8ScuW/nzNzmbrlDqBUE2Olu4ohPcHHWc4Siz5BKp/TY3a02DDqFbw+3re5wM7NTIphjxmqMxUfGfH7rbHyUmNQGVXkkSHxpMYmyx4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763686744; c=relaxed/simple; bh=2FD6HxXwZiyLr4vVAst+7QJwDGAJalKq3KQn9GLA+Xw=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=a2JO1+++vCKRHhaYPKwFdpnI2j0pJuKziEB2cuXdKO7ZGeIIf0KK2zH56lFcqKmbvA3qPqzNgm8EuzcF9Igpru8c0GcrQ1poqOYk1CGgOSnBB1eIygFNpeP0RFnm+mbTmetnsC7swiebwaTpYjBoThT/58rjIHe1rot5Ig9IxYI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=HRtTnz8Z; arc=none smtp.client-ip=162.62.57.137 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="HRtTnz8Z" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1763686729; bh=w5fJKXDeqmUr5DjRp6T7R5FimGqPwmMFQFYJq+QxsI4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=HRtTnz8Zp4hfQnzIg4Doaj6W6w/RJeo2bi484LfZwbfTz659HWgyO0IUKAyFQLUfw Nt/vXJKxQPZagecou1PNEwdmQZJa8O8L9yM7m1NaOiBmIutmt8SjBlppEXkx9Sh5P3 gre5NyOJT+F9DtIVEd7+dKXMOawh6pFlZQNSMz+o= Received: from lxu-ped-host.. ([111.201.7.117]) by newxmesmtplogicsvrsza63-0.qq.com (NewEsmtp) with SMTP id E67A703D; Fri, 21 Nov 2025 08:57:39 +0800 X-QQ-mid: xmsmtpt1763686659t14hsxldu Message-ID: X-QQ-XMAILINFO: NGZp1yYNf7Y+qTvmkc3igdFAGfuhw7SK7Qsmdj2KBUotKFnO2g8A9NqcGOH320 xpkLan6kFHkjPBRkbbKu+Mn/9N1ZItAV38TRI2e0hUzW6CgxaaN3nhn8YvW3+1bMhfenXY+rwZ3C bV0f8JVucBU6+6K7N0p9kbwgMJ602u/GdMB+8h1Efs3bSrDThjfz+mkRySna7/gj7sn/7IRoRL4n Mzvf48aDBEK1pKuInTD38/82lFxsiAXID88EgLiGysJ48Ivpov445JZOVoRjexOXNwI9JaammYrV TZ8PckCYPG5KjuOX0Ys6sp2KB9galSVg/HzrB7IMXgaaH5yWh7YC6AgoJt3aGaNb6AqepSo/45Nf /6zYmJrJaW12Diybgee0g82CRR5VytVia5CHZOcYwJBRYcNs6INcVVJ7EWahQan3ouyV3cPp3ibt Np2VximkG8arPLQkIpqgA910YlBj3fBpnbdYnigdGbGkAAww8r1wF/yX/BHkabg/NR/DJxAVrM2P W3l+W538S+efXC0ezBhuKHN4Q+f8mjKtnTxMTCWoEZ9Z2KV6eMk0OdSIQPYe+VpUijWo3NfYfdbw jZzEzZetaCXr78Hg1BJeOpCQQJhG4sFgq/KF5IOG6U9N+6ZWqNK8JuGzQcD5l8TV2ElXd4MoozjM wLy6hYc8IPlRcNfg0Q51imQ6eQ0ua63y6XC9kzcpjb4R5QmzPR9pl6wlz8vAjrdzeuZcuQ6Yxcgo tCA5pNQVpGRDc4iu9MyV93dSxhO6/3/MUoOp0XVWGifHV5/ctXA1kZ/KVcWTrbaHiQKb1MiQGEWm hIeCH+Y5CakaGGlazkYa+hAt+3YwH8m6M6myLbomkzePJJFV6YPaFMYfkCwwnB9bKzo1102ZiV2h Ep7M3JsubDGkfCtHMJqpcN5V2OF3eWP3R5atRzA7GrAu8Lqx2lbajB8jxWL0Up6H+btLO4voEkxh NkS0yjYFISEBDlVNt3o1TgwvbpcoOZIxKOUwSL0Hy+7J4zGZGfsfifQwOGDm+i6Bgs/xui+ynPBd wCnqNSzjqyn4/z+Yf4a9wJR4o08Whhu7/wdPsrR/I6vz5CR84DcDTk2mZrR5KtRMC0BRuDYIw4vn gUuEPV X-QQ-XMRINFO: MPJ6Tf5t3I/ycC2BItcBVIA= From: Edward Adam Davis To: syzbot+f098d64cc684b8dbaf65@syzkaller.appspotmail.com Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [bluetooth?] [usb?] memory leak in __hci_cmd_sync_sk Date: Fri, 21 Nov 2025 08:57:40 +0800 X-OQ-MSGID: <20251121005739.3884674-2-eadavis@qq.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <691b301e.a70a0220.f6df1.0011.GAE@google.com> References: <691b301e.a70a0220.f6df1.0011.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit #syz test diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index 3418d7b964a1..62469dba9e63 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -1466,7 +1466,7 @@ static void hci_cmd_timeout(struct work_struct *work) if (hdev->req_skb) { u16 opcode = hci_skb_opcode(hdev->req_skb); - bt_dev_err(hdev, "command 0x%4.4x tx timeout", opcode); + bt_dev_err(hdev, "command 0x%4.4x skb: %p tx timeout", opcode, hdev->req_skb); hci_cmd_sync_cancel_sync(hdev, ETIMEDOUT); } else { diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c index 6e76798ec786..7fc79b7ee4b9 100644 --- a/net/bluetooth/hci_sync.c +++ b/net/bluetooth/hci_sync.c @@ -133,6 +133,8 @@ static int hci_req_sync_run(struct hci_request *req) return -ENODATA; skb = skb_peek_tail(&req->cmd_q); + printk("status: %u, result: %u, skb: %p, %s\n", + hdev->req_status, hdev->req_result, skb, __func__); bt_cb(skb)->hci.req_complete_skb = hci_cmd_sync_complete; bt_cb(skb)->hci.req_flags |= HCI_REQ_SKB; @@ -158,8 +160,9 @@ struct sk_buff *__hci_cmd_sync_sk(struct hci_dev *hdev, u16 opcode, u32 plen, struct sock *sk) { struct hci_request req; - struct sk_buff *skb; + struct sk_buff *skb, *skb_tail; int err = 0; + unsigned long flags; bt_dev_dbg(hdev, "Opcode 0x%4.4x", opcode); @@ -169,6 +172,7 @@ struct sk_buff *__hci_cmd_sync_sk(struct hci_dev *hdev, u16 opcode, u32 plen, hdev->req_status = HCI_REQ_PEND; + skb_tail = skb_peek_tail(&req.cmd_q); err = hci_req_sync_run(&req); if (err < 0) return ERR_PTR(err); @@ -201,18 +205,35 @@ struct sk_buff *__hci_cmd_sync_sk(struct hci_dev *hdev, u16 opcode, u32 plen, bt_dev_dbg(hdev, "end: err %d", err); + printk("err: %d, status: %u, result: %u, skb: %p, %s\n", + err, hdev->req_status, hdev->req_result, skb, __func__); if (err < 0) { kfree_skb(skb); - return ERR_PTR(err); + goto out; } /* If command return a status event skb will be set to NULL as there are * no parameters. */ - if (!skb) - return ERR_PTR(-ENODATA); + if (!skb) { + err = -ENODATA; + goto out; + } return skb; + +out: + if (!skb_queue_empty(&hdev->cmd_q)) { + spin_lock_irqsave(&hdev->cmd_q.lock, flags); + skb = __skb_dequeue_tail(&hdev->cmd_q); + spin_unlock_irqrestore(&hdev->cmd_q.lock, flags); + } else + skb = skb_tail; + + printk("remove skb: %p, %s\n", skb, __func__); + kfree_skb(skb); + + return ERR_PTR(err); } EXPORT_SYMBOL(__hci_cmd_sync_sk);