linux-kernel - Re: [syzbot] [bluetooth?] BUG: corrupted list in mgmt_pending

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20241128111101.1788-1-hdanton@sina.com>
Date: Thu, 28 Nov 2024 19:11:01 +0800
From: Hillf Danton <hdanton@...a.com>
To: syzbot <syzbot+cc0cc52e7f43dc9e6df1@...kaller.appspotmail.com>
Cc: linux-kernel@...r.kernel.org,
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [bluetooth?] BUG: corrupted list in mgmt_pending_remove

On Thu, 28 Nov 2024 00:52:26 -0800
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    5dfd7d940094 Merge branch 'bnxt_en-bug-fixes'
> git tree:       net
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=10c5ef5f980000

#stz test

--- x/net/bluetooth/hci_sync.c
+++ y/net/bluetooth/hci_sync.c
@@ -308,6 +308,7 @@ static void hci_cmd_sync_work(struct wor
 
 	bt_dev_dbg(hdev, "");
 
+	hci_req_sync_lock(hdev);
 	/* Dequeue all entries and run them */
 	while (1) {
 		struct hci_cmd_sync_work_entry *entry;
@@ -328,15 +329,14 @@ static void hci_cmd_sync_work(struct wor
 		if (entry->func) {
 			int err;
 
-			hci_req_sync_lock(hdev);
 			err = entry->func(hdev, entry->data);
 			if (entry->destroy)
 				entry->destroy(hdev, entry->data, err);
-			hci_req_sync_unlock(hdev);
 		}
 
 		kfree(entry);
 	}
+	hci_req_sync_unlock(hdev);
 }
 
 static void hci_cmd_sync_cancel_work(struct work_struct *work)
@@ -5192,6 +5192,15 @@ int hci_dev_close_sync(struct hci_dev *h
 			cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
 	}
 
+	do {
+		struct hci_cmd_sync_work_entry *entry, *tmp;
+
+		mutex_lock(&hdev->cmd_sync_work_lock);
+		list_for_each_entry_safe(entry, tmp, &hdev->cmd_sync_work_list, list)
+			_hci_cmd_sync_cancel_entry(hdev, entry, -ECANCELED);
+		mutex_unlock(&hdev->cmd_sync_work_lock);
+	} while (0);
+
 	/* Avoid potential lockdep warnings from the *_flush() calls by
 	 * ensuring the workqueue is empty up front.
 	 */
--