linux-kernel - Re: [syzbot] [bluetooth?] [usb?] KASAN: slab-use-after-free Read in btusb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250704140331.2436-1-hdanton@sina.com>
Date: Fri,  4 Jul 2025 22:03:30 +0800
From: Hillf Danton <hdanton@...a.com>
To: syzbot <syzbot+2fc81b50a4f8263a159b@...kaller.appspotmail.com>
Cc: linux-kernel@...r.kernel.org,
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [bluetooth?] [usb?] KASAN: slab-use-after-free Read in btusb_disconnect

> Date: Fri, 04 Jul 2025 01:16:32 -0700
> syzbot found the following issue on:
> 
> HEAD commit:    cf16f408364e usb: core: config: Prevent OOB read in SS end..
> git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
> console output: https://syzkaller.appspot.com/x/log.txt?x=1356f48c580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=a4c5153915e19e58
> dashboard link: https://syzkaller.appspot.com/bug?extid=2fc81b50a4f8263a159b
> compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=12cf7770580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1756f48c580000

#syz test

--- x/drivers/bluetooth/btusb.c
+++ y/drivers/bluetooth/btusb.c
@@ -4269,6 +4269,11 @@ static void btusb_disconnect(struct usb_
 
 	hci_unregister_dev(hdev);
 
+	if (data->oob_wake_irq)
+		device_init_wakeup(&data->udev->dev, false);
+	if (data->reset_gpio)
+		gpiod_put(data->reset_gpio);
+
 	if (intf == data->intf) {
 		if (data->isoc)
 			usb_driver_release_interface(&btusb_driver, data->isoc);
@@ -4284,12 +4289,6 @@ static void btusb_disconnect(struct usb_
 			usb_driver_release_interface(&btusb_driver, data->isoc);
 	}
 
-	if (data->oob_wake_irq)
-		device_init_wakeup(&data->udev->dev, false);
-
-	if (data->reset_gpio)
-		gpiod_put(data->reset_gpio);
-
 	hci_free_dev(hdev);
 }
 
--