1. Patchew
  2. linux
  3. View series

[PATCH] Bluetooth: fix memory leaks in error path of hci_alloc_dev()

Bharath Reddy posted 1 patch 1 week ago
There is a newer version of this series
net/bluetooth/hci_core.c  | 3 ++-
net/bluetooth/hci_sysfs.c | 6 ++----
2 files changed, 4 insertions(+), 5 deletions(-)
[PATCH] Bluetooth: fix memory leaks in error path of hci_alloc_dev()
Posted by Bharath Reddy 1 week ago 
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

Syzbot caught a percpu memory leak in the SRCU struct when Bluetooth
HCI UART configuration fails early.

The problem boils down to a bypassed destructor. If device setup fails
before hci_register_dev() completes, the HCI_UNREGISTER flag is never
set. Later, when the device is freed, bt_host_release() sees this flag
is missing, skips hci_release_dev(), and jumps straight to kfree(hdev).
This leaks the SRCU memory, which was also incorrectly being cleaned up
in hci_unregister_dev() which is also skipped during an early abort.

To fix this and properly balance the allocation and teardown paths:

1. Move cleanup_srcu_struct() into hci_release_dev() so it directly
   mirrors the allocation in hci_alloc_dev().
2. Unconditionally call hci_release_dev() from bt_host_release() by
   dropping the HCI_UNREGISTER check. This is safe for unregistered
   devices since it only cleans up resources initialized early on in
   hci_alloc_dev().

Reported-by: syzbot+535ecc844591e50588a5@syzkaller.appspotmail.com

Signed-off-by: Bharath Reddy <kbreddy.rpbc@gmail.com>
---
 net/bluetooth/hci_core.c  | 3 ++-
 net/bluetooth/hci_sysfs.c | 6 ++----
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index c46c1236ebfa..f6bc7cb3e55c 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -2701,7 +2701,6 @@ void hci_unregister_dev(struct hci_dev *hdev)
 	write_unlock(&hci_dev_list_lock);
 
 	synchronize_srcu(&hdev->srcu);
-	cleanup_srcu_struct(&hdev->srcu);
 
 	disable_work_sync(&hdev->rx_work);
 	disable_work_sync(&hdev->cmd_work);
@@ -2774,6 +2773,8 @@ void hci_release_dev(struct hci_dev *hdev)
 	kfree_skb(hdev->sent_cmd);
 	kfree_skb(hdev->req_skb);
 	kfree_skb(hdev->recv_event);
+
+	cleanup_srcu_struct(&hdev->srcu);
 	kfree(hdev);
 }
 EXPORT_SYMBOL(hci_release_dev);
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index 041ce9adc378..261b28a25b02 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -83,10 +83,8 @@ static void bt_host_release(struct device *dev)
 {
 	struct hci_dev *hdev = to_hci_dev(dev);
 
-	if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
-		hci_release_dev(hdev);
-	else
-		kfree(hdev);
+	hci_release_dev(hdev);
+
 	module_put(THIS_MODULE);
 }
 
-- 
2.34.1
Re: [syzbot] [bluetooth?] memory leak in init_srcu_struct_fields
Posted by syzbot 1 week ago 
Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
BUG: unable to handle kernel NULL pointer dereference in hci_release_dev

BUG: kernel NULL pointer dereference, address: 00000000000000b0
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 800000011280f067 P4D 800000011280f067 PUD 0 
Oops: Oops: 0000 [#1] SMP PTI
CPU: 1 UID: 0 PID: 6587 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
RIP: 0010:workqueue_sysfs_unregister kernel/workqueue.c:7632 [inline]
RIP: 0010:destroy_workqueue+0x1a/0x430 kernel/workqueue.c:6045
Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 41 57 41 56 41 55 49 89 fd 41 54 55 53 48 83 ec 08 e8 66 d6 15 00 <49> 8b 9d b0 00 00 00 48 85 db 74 19 e8 55 d6 15 00 48 8d 7b 08 49
RSP: 0018:ffffc90002177c68 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88811cb86000 RCX: ffffffff81a2820c
RDX: ffff88810aac91c0 RSI: ffffffff816e808a RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000006 R09: 0000000000000000
R10: ffffffff85600000 R11: 0000000000000001 R12: ffff88811cb87390
R13: 0000000000000000 R14: ffff88811cb86030 R15: 0000000000000000
FS:  000055556c326500(0000) GS:ffff8881b23e5000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000000000b0 CR3: 0000000129ede000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 hci_release_dev+0x62/0x250 net/bluetooth/hci_core.c:2712
 bt_host_release+0x19/0x30 net/bluetooth/hci_sysfs.c:86
 device_release+0x4d/0xd0 drivers/base/core.c:2566
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0xe4/0x1d0 lib/kobject.c:737
 put_device+0x1f/0x30 drivers/base/core.c:3814
 hci_uart_tty_close+0x155/0x1a0 drivers/bluetooth/hci_ldisc.c:587
 tty_ldisc_close+0x51/0x70 drivers/tty/tty_ldisc.c:455
 tty_ldisc_kill drivers/tty/tty_ldisc.c:613 [inline]
 tty_ldisc_release+0xd5/0x2d0 drivers/tty/tty_ldisc.c:781
 tty_release_struct+0x1a/0x90 drivers/tty/tty_io.c:1681
 tty_release+0x6b0/0x6c0 drivers/tty/tty_io.c:1852
 __fput+0x1b5/0x500 fs/file_table.c:510
 task_work_run+0x95/0xf0 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
 exit_to_user_mode_loop+0xd9/0x4a0 kernel/entry/common.c:98
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
 do_syscall_64+0x485/0x600 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe03af9cdd9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffeee0ab038 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007ffeee0ab120 RCX: 00007fe03af9cdd9
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 000000000001bd43 R08: 0000000000000001 R09: 0000000000000000
R10: 0000001b31220000 R11: 0000000000000246 R12: 00007ffeee0ab160
R13: 00007fe03b215fac R14: 000000000001bd76 R15: 00007fe03b215fa0
 </TASK>
Modules linked in:
CR2: 00000000000000b0
---[ end trace 0000000000000000 ]---
RIP: 0010:workqueue_sysfs_unregister kernel/workqueue.c:7632 [inline]
RIP: 0010:destroy_workqueue+0x1a/0x430 kernel/workqueue.c:6045
Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 41 57 41 56 41 55 49 89 fd 41 54 55 53 48 83 ec 08 e8 66 d6 15 00 <49> 8b 9d b0 00 00 00 48 85 db 74 19 e8 55 d6 15 00 48 8d 7b 08 49
RSP: 0018:ffffc90002177c68 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88811cb86000 RCX: ffffffff81a2820c
RDX: ffff88810aac91c0 RSI: ffffffff816e808a RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000006 R09: 0000000000000000
R10: ffffffff85600000 R11: 0000000000000001 R12: ffff88811cb87390
R13: 0000000000000000 R14: ffff88811cb86030 R15: 0000000000000000
FS:  000055556c326500(0000) GS:ffff8881b23e5000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000000000b0 CR3: 0000000129ede000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
   0:	90                   	nop
   1:	90                   	nop
   2:	90                   	nop
   3:	90                   	nop
   4:	90                   	nop
   5:	90                   	nop
   6:	90                   	nop
   7:	90                   	nop
   8:	90                   	nop
   9:	90                   	nop
   a:	90                   	nop
   b:	90                   	nop
   c:	90                   	nop
   d:	90                   	nop
   e:	90                   	nop
   f:	90                   	nop
  10:	f3 0f 1e fa          	endbr64
  14:	41 57                	push   %r15
  16:	41 56                	push   %r14
  18:	41 55                	push   %r13
  1a:	49 89 fd             	mov    %rdi,%r13
  1d:	41 54                	push   %r12
  1f:	55                   	push   %rbp
  20:	53                   	push   %rbx
  21:	48 83 ec 08          	sub    $0x8,%rsp
  25:	e8 66 d6 15 00       	call   0x15d690
* 2a:	49 8b 9d b0 00 00 00 	mov    0xb0(%r13),%rbx <-- trapping instruction
  31:	48 85 db             	test   %rbx,%rbx
  34:	74 19                	je     0x4f
  36:	e8 55 d6 15 00       	call   0x15d690
  3b:	48 8d 7b 08          	lea    0x8(%rbx),%rdi
  3f:	49                   	rex.WB


Tested on:

commit:         174914ea Merge tag 'v7.1-rc6-smb3-client-fixes' of git..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17cb69a6580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=5733044df9370cfc
dashboard link: https://syzkaller.appspot.com/bug?extid=535ecc844591e50588a5
compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
patch:          https://syzkaller.appspot.com/x/patch.diff?x=114b7ed2580000

Patchew 2.1-devel-ea86937

© 2016 - 2026 Red Hat, Inc.