Messages in this thread Patch in this message | | | From | Hillf Danton <> | Subject | Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in __hci_req_sync | Date | Sat, 13 Apr 2024 16:55:42 +0800 |
| |
On Sat, 13 Apr 2024 00:58:39 -0700 > syzbot has found a reproducer for the following issue on: > > HEAD commit: 8f2c057754b2 Merge tag 'arm64-fixes' of git://git.kernel.o.. > git tree: upstream > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=171da243180000
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 8f2c057754b2
--- x/net/bluetooth/hci_request.c +++ y/net/bluetooth/hci_request.c @@ -102,6 +102,7 @@ void hci_req_sync_complete(struct hci_de { bt_dev_dbg(hdev, "result 0x%2.2x", result); + hci_req_sync_lock(hdev); if (hdev->req_status == HCI_REQ_PEND) { hdev->req_result = result; hdev->req_status = HCI_REQ_DONE; @@ -111,6 +112,7 @@ void hci_req_sync_complete(struct hci_de } wake_up_interruptible(&hdev->req_wait_q); } + hci_req_sync_unlock(hdev); } /* Execute request and wait for completion. */ --
| |