Re: [PATCH] Bluetooth: hci_uart: serialize close flush with write_work

[syzbot]

> Please test this patch.
>
> #syz test: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master

This crash does not have a reproducer. I cannot test it.

>
> From 48d953a6ee4c2e4e1e58cdf7da3d3647316e4802 Mon Sep 17 00:00:00 2001
> From: wuyankun <wuya...@uniontech.com>
> Date: Sat, 9 May 2026 15:41:19 +0800
> Subject: [PATCH] Bluetooth: hci_uart: serialize close flush with write_work
>
> hci_uart_close() calls hci_uart_flush(), and flush may free hu->tx_skb.
> At the same time, hci_uart_write_work() can still be running and access
> the same skb (for example through skb_pull()), which leads to a
> use-after-free.
>
> Fix this by canceling write_work before calling hci_uart_flush(), so the
> tx_skb lifetime is fully serialized against the TX worker.
>
> Reported-by: syzbot+da2717...@syzkaller.appspotmail.com
> Link: https://syzkaller.appspot.com/bug?extid=da2717d5c64bf7975268
> Cc: sta...@vger.kernel.org
> Signed-off-by: wuyankun <wuya...@uniontech.com>
> ---
> drivers/bluetooth/hci_ldisc.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
> index 275ea865bc29..51cc9af0f7e8 100644
> --- a/drivers/bluetooth/hci_ldisc.c
> +++ b/drivers/bluetooth/hci_ldisc.c
> @@ -263,8 +263,11 @@ static int hci_uart_open(struct hci_dev *hdev)
> /* Close device */
> static int hci_uart_close(struct hci_dev *hdev)
> {
> + struct hci_uart *hu = hci_get_drvdata(hdev);
> BT_DBG("hdev %p", hdev);
>
> + /* Ensure write_work is not touching tx_skb while flush frees it. */
> + cancel_work_sync(&hu->write_work);
> hci_uart_flush(hdev);
> hdev->flush = NULL;
> return 0;
> --
> 2.20.1
>

[wuyankun]

Please test this patch.

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master