Re: [syzbot] [bluetooth?] [usb?] KASAN: slab-use-after-free Read in skb_dequeue (2)

[syzbot <syzbot+d06554f43a8fb48030b0@syzkaller.appspotmail.com>]

> #syz test

This crash does not have a reproducer. I cannot test it.

>
> Drain rx_work in btusb_disconnect() before kfree(data) so that any
> work item rescheduled by a late URB completion callback during
> btusb_close() is waited for before the backing data is freed.
>
> ---
>  drivers/bluetooth/btusb.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
>
> diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
> index 7f5fce93d984..5d4ea44cd3c9 100644
> --- a/drivers/bluetooth/btusb.c
> +++ b/drivers/bluetooth/btusb.c
> @@ -4462,6 +4462,15 @@ static void btusb_disconnect(struct usb_interface *intf)
>  		usb_driver_release_interface(&btusb_driver, data->intf);
>  	}
>
> +	/*
> +	 * rx_work is scheduled from URB completion handlers; btusb_close()
> +	 * (called via hci_unregister_dev) uses a non-sync cancel, so a work
> +	 * item may still be queued or executing when we reach this point.
> +	 * Wait for it before freeing data, otherwise the worker dereferences
> +	 * freed memory through skb_dequeue(&data->acl_q).
> +	 */
> +	cancel_delayed_work_sync(&data->rx_work);
> +
>  	hci_free_dev(hdev);
>  	kfree(data);
>  }
> --
> 2.53.0
>