linux-kernel - Re: #syz test

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <6988ec14.050a0220.1ad825.0006.GAE@google.com>
Date: Sun, 08 Feb 2026 12:03:32 -0800
From: syzbot <syzbot+3609b9b48e68e1fe47fd@...kaller.appspotmail.com>
To: youjingxiaogao2@...il.com
Cc: youjingxiaogao2@...il.com, linux-kernel@...r.kernel.org, 
	syzkaller-bugs@...glegroups.com
Subject: Re: #syz test

> #syz test git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
> master
>
> From d5153b84b90fa80ee0d041d1bd28bd465f7913ec Mon Sep 17 00:00:00 2001
> From: Masahiro Kawada <youjingxiaogao2@...il.com>
> Date: Mon, 9 Feb 2026 04:47:14 +0900
> Subject: [PATCH] Bluetooth: fix use-after-free in hci_conn_drop
>
> Fix a use-after-free in hci_conn_drop triggered via hci_cmd_sync_work.
>
> In hci_conn_del(), hci_cmd_sync_dequeue() is called after
> hci_conn_cleanup() which may have already freed the conn pointer.
> Fix by moving the dequeue before cleanup.
>
> Additionally, le_read_features_complete() calls hci_conn_drop(conn)
> without checking whether conn is still valid. When
> hci_le_read_remote_features_sync() blocks waiting for an HCI event,
> another thread can free conn through hci_conn_del(). Fix by adding
> a hci_conn_valid() check before calling hci_conn_drop().
>
> Reported-by: syzbot+3609b9b48e68e1fe47fd@...kaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=3609b9b48e68e1fe47fd
> Signed-off-by: Masahiro Kawada <youjingxiaogao2@...il.com>
> ---
>  net/bluetooth/hci_conn.c | 6 +++---
>  net/bluetooth/hci_sync.c | 3 +++
>  2 files changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
> index 0795818963a..aa3607327ad 100644
> --- a/net/bluetooth/hci_conn.c
> +++ b/net/bluetooth/hci_conn.c
> @@ -1232,15 +1232,15 @@ void hci_conn_del(struct hci_conn *conn)
>   skb_queue_purge(&conn->data_q);
>   skb_queue_purge(&conn->tx_q.queue);
>
> + /* Dequeue callbacks using connection pointer as data */
> + hci_cmd_sync_dequeue(hdev, NULL, conn, NULL);
> +
>   /* Remove the connection from the list and cleanup its remaining
>   * state. This is a separate function since for some cases like
>   * BT_CONNECT_SCAN we *only* want the cleanup part without the
>   * rest of hci_conn_del.
>   */
>   hci_conn_cleanup(conn);
> -
> - /* Dequeue callbacks using connection pointer as data */
> - hci_cmd_sync_dequeue(hdev, NULL, conn, NULL);
>  }
>
>  struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src, uint8_t
> src_type)
> diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
> index f04a90bce4a..f31086c187f 100644
> --- a/net/bluetooth/hci_sync.c
> +++ b/net/bluetooth/hci_sync.c
> @@ -7371,6 +7371,9 @@ static void le_read_features_complete(struct hci_dev
> *hdev, void *data, int err)
>   if (err == -ECANCELED)
>   return;
>
> + if (!hci_conn_valid(hdev, conn))
> + return;
> +
>   hci_conn_drop(conn);
>  }
>
> -- 
> 2.43.0

Command #2:
I've failed to parse your command.
Did you perhaps forget to provide the branch name, or added an extra ':'?
Please use one of the two supported formats:
1. #syz test
2. #syz test: repo branch-or-commit-hash
Note the lack of ':' in option 1.