Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
memory leak in hci_conn_add
BUG: memory leak
unreferenced object 0xffff88811ad68800 (size 2048):
comm "syz-executor.0", pid 5490, jiffies 4294944403 (age 15.290s)
hex dump (first 32 bytes):
d8 ec 9c 1b 81 88 ff ff 22 01 00 00 00 00 ad de ........".......
00 00 00 00 ff ff ff ff ff ff 00 aa aa aa aa aa ................
backtrace:
[<ffffffff81576345>] kmalloc_trace+0x25/0x90 mm/slab_common.c:1114
[<ffffffff8452851f>] kmalloc include/linux/slab.h:599 [inline]
[<ffffffff8452851f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff8452851f>] hci_conn_add+0x4f/0x5e0 net/bluetooth/hci_conn.c:958
[<ffffffff84528d48>] hci_connect_acl+0x1c8/0x1e0 net/bluetooth/hci_conn.c:1661
[<ffffffff8452bc8b>] hci_connect_sco+0x4b/0x520 net/bluetooth/hci_conn.c:1714
[<ffffffff8459e1e3>] sco_connect net/bluetooth/sco.c:266 [inline]
[<ffffffff8459e1e3>] sco_sock_connect+0x1c3/0x520 net/bluetooth/sco.c:591
[<ffffffff83e96041>] __sys_connect_file+0x91/0xb0 net/socket.c:2033
[<ffffffff83e96146>] __sys_connect+0xe6/0x110 net/socket.c:2050
[<ffffffff83e9618c>] __do_sys_connect net/socket.c:2060 [inline]
[<ffffffff83e9618c>] __se_sys_connect net/socket.c:2057 [inline]
[<ffffffff83e9618c>] __x64_sys_connect+0x1c/0x20 net/socket.c:2057
[<ffffffff84b35008>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff84b35008>] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
[<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88811b630c00 (size 512):
comm "kworker/u5:1", pid 4434, jiffies 4294944487 (age 14.450s)
hex dump (first 32 bytes):
00 88 d6 1a 81 88 ff ff c0 ce 73 1a 81 88 ff ff ..........s.....
fd 03 00 00 00 00 00 00 00 06 0c 00 00 00 00 00 ................
backtrace:
[<ffffffff81576345>] kmalloc_trace+0x25/0x90 mm/slab_common.c:1114
[<ffffffff845633cd>] kmalloc include/linux/slab.h:599 [inline]
[<ffffffff845633cd>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff845633cd>] l2cap_conn_add.part.0+0x3d/0x340 net/bluetooth/l2cap_core.c:7845
[<ffffffff84570fa4>] l2cap_conn_add net/bluetooth/l2cap_core.c:71 [inline]
[<ffffffff84570fa4>] l2cap_connect_cfm+0x264/0x740 net/bluetooth/l2cap_core.c:8242
[<ffffffff8452c219>] hci_connect_cfm include/net/bluetooth/hci_core.h:1958 [inline]
[<ffffffff8452c219>] hci_conn_failed+0xb9/0x130 net/bluetooth/hci_conn.c:1259
[<ffffffff845958d9>] hci_abort_conn_sync+0x3a9/0x550 net/bluetooth/hci_sync.c:5424
[<ffffffff84525cbd>] abort_conn_sync+0x7d/0xa0 net/bluetooth/hci_conn.c:2930
[<ffffffff8458bfdd>] hci_cmd_sync_work+0xcd/0x150 net/bluetooth/hci_sync.c:306
[<ffffffff812c93bd>] process_one_work+0x23d/0x530 kernel/workqueue.c:2630
[<ffffffff812c9f67>] process_scheduled_works kernel/workqueue.c:2703 [inline]
[<ffffffff812c9f67>] worker_thread+0x327/0x590 kernel/workqueue.c:2784
[<ffffffff812d743b>] kthread+0x12b/0x170 kernel/kthread.c:388
[<ffffffff81149e95>] ret_from_fork+0x45/0x50 arch/x86/kernel/process.c:147
[<ffffffff81002be1>] ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
BUG: memory leak
unreferenced object 0xffff88811b52a800 (size 2048):
comm "syz-executor.0", pid 5736, jiffies 4294945046 (age 8.860s)
hex dump (first 32 bytes):
d8 ec 9c 1b 81 88 ff ff 22 01 00 00 00 00 ad de ........".......
00 00 00 00 ff ff ff ff ff ff 00 aa aa aa aa aa ................
backtrace:
[<ffffffff81576345>] kmalloc_trace+0x25/0x90 mm/slab_common.c:1114
[<ffffffff8452851f>] kmalloc include/linux/slab.h:599 [inline]
[<ffffffff8452851f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff8452851f>] hci_conn_add+0x4f/0x5e0 net/bluetooth/hci_conn.c:958
[<ffffffff84528d48>] hci_connect_acl+0x1c8/0x1e0 net/bluetooth/hci_conn.c:1661
[<ffffffff8452bc8b>] hci_connect_sco+0x4b/0x520 net/bluetooth/hci_conn.c:1714
[<ffffffff8459e1e3>] sco_connect net/bluetooth/sco.c:266 [inline]
[<ffffffff8459e1e3>] sco_sock_connect+0x1c3/0x520 net/bluetooth/sco.c:591
[<ffffffff83e96041>] __sys_connect_file+0x91/0xb0 net/socket.c:2033
[<ffffffff83e96146>] __sys_connect+0xe6/0x110 net/socket.c:2050
[<ffffffff83e9618c>] __do_sys_connect net/socket.c:2060 [inline]
[<ffffffff83e9618c>] __se_sys_connect net/socket.c:2057 [inline]
[<ffffffff83e9618c>] __x64_sys_connect+0x1c/0x20 net/socket.c:2057
[<ffffffff84b35008>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff84b35008>] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
[<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88811b96be00 (size 512):
comm "kworker/u5:1", pid 4434, jiffies 4294945129 (age 8.030s)
hex dump (first 32 bytes):
00 a8 52 1b 81 88 ff ff c0 ce 73 1a 81 88 ff ff ..R.......s.....
fd 03 00 00 00 00 00 00 00 06 0c 00 00 00 00 00 ................
backtrace:
[<ffffffff81576345>] kmalloc_trace+0x25/0x90 mm/slab_common.c:1114
[<ffffffff845633cd>] kmalloc include/linux/slab.h:599 [inline]
[<ffffffff845633cd>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff845633cd>] l2cap_conn_add.part.0+0x3d/0x340 net/bluetooth/l2cap_core.c:7845
[<ffffffff84570fa4>] l2cap_conn_add net/bluetooth/l2cap_core.c:71 [inline]
[<ffffffff84570fa4>] l2cap_connect_cfm+0x264/0x740 net/bluetooth/l2cap_core.c:8242
[<ffffffff8452c219>] hci_connect_cfm include/net/bluetooth/hci_core.h:1958 [inline]
[<ffffffff8452c219>] hci_conn_failed+0xb9/0x130 net/bluetooth/hci_conn.c:1259
[<ffffffff845958d9>] hci_abort_conn_sync+0x3a9/0x550 net/bluetooth/hci_sync.c:5424
[<ffffffff84525cbd>] abort_conn_sync+0x7d/0xa0 net/bluetooth/hci_conn.c:2930
[<ffffffff8458bfdd>] hci_cmd_sync_work+0xcd/0x150 net/bluetooth/hci_sync.c:306
[<ffffffff812c93bd>] process_one_work+0x23d/0x530 kernel/workqueue.c:2630
[<ffffffff812c9f67>] process_scheduled_works kernel/workqueue.c:2703 [inline]
[<ffffffff812c9f67>] worker_thread+0x327/0x590 kernel/workqueue.c:2784
[<ffffffff812d743b>] kthread+0x12b/0x170 kernel/kthread.c:388
[<ffffffff81149e95>] ret_from_fork+0x45/0x50 arch/x86/kernel/process.c:147
[<ffffffff81002be1>] ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
Tested on:
commit: 3ef20de6 Bluetooth: btrtl: Ignore error return for hci..
git tree:
https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/ master
console output:
https://syzkaller.appspot.com/x/log.txt?x=17335345680000
kernel config:
https://syzkaller.appspot.com/x/.config?x=cb15b0f9fa999067