[PATCH] Bluetooth: hci_sync: Drop the command's sk reference

[PATCH] Bluetooth: hci_sync: Drop the command's sk reference

[Weihong Guan]

hci_cmd_sync_alloc() takes a reference on the sk a command is sent for
(sock_hold()), and hci_cmd_sync_complete() means to drop it, but looks
for the sk in the response skb, which never carries one. The reference
is never dropped: every command sent with an sk leaks it, and with it
the sk and a reference on the bluetooth module.

The commands sent with an sk are LE Remove Advertising Set and LE
Clear Advertising Sets, for MGMT's Remove Advertising and the instance
removals, and Read Local OOB (Extended) Data. After each, the module's
refcnt stays one higher with no socket left open, and the module can't
be unloaded until a reboot.

Drop the reference from the request command, hdev->req_skb, before
freeing it.

Fixes: cba6b758711c ("Bluetooth: hci_sync: Make use of hci_cmd_sync_queue set 2")
Assisted-by: Claude:claude-opus-5.5
Signed-off-by: Weihong Guan <weihong.guan@gmail.com>
---
How it was found and tested: mgmt-tester on a Raspberry Pi 5 running
7.4-rc2 with net/bluetooth from bluetooth-next (hci_cmd_sync_alloc()
and hci_cmd_sync_complete() as in this tree), reading
/sys/module/bluetooth/refcnt before and after each test, alone, with
bluetoothd stopped.

Before, 11 of mgmt-tester's 515 tests left it one higher each: Read
Local OOB Data (SSP, SC), Read Local OOB Ext Data (SSP, SC), and every
one removing an extended advertising instance (Remove Ext Advertising -
Success 1, 2, Global Adv; Multi Ext Advertising - Success 4, 5; Add Ext
Advertising - Success 22; Ext Adv MGMT - AD Scan Resp - Off and On), as
did the removal case of the single-set series sent for BlueZ. A full run
left the module with stray references and no socket in
/proc/net/protocols.

After, each of them leaves it unchanged, a full run leaves it where it
started, the same tests pass and fail as before on that machine, and
dmesg has no refcount warning.

A command whose request never completes (a timeout) still has req_skb
freed elsewhere without the sk dropped; that path is left as it was.
"Bluetooth: hci_core: Fix leak of request command on tx timeout"
(Jiakai Xu, September; patchwork series 1168176) frees req_skb there,
and would need the same sock_put() for a command sent with an sk.

 net/bluetooth/hci_sync.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index d5177e146..931494348 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -31,21 +31,23 @@ static void hci_cmd_sync_complete(struct hci_dev *hdev, u8 result, u16 opcode,
 	hdev->req_result = result;
 	WRITE_ONCE(hdev->req_status, HCI_REQ_DONE);
 
-	/* Free the request command so it is not used as response */
+	/* Free the request command so it is not used as response, and drop
+	 * the reference hci_cmd_sync_alloc() took on its sk, if set: the
+	 * response skb doesn't carry it.
+	 */
 	hci_dev_lock(hdev);
-	kfree_skb(hdev->req_skb);
-	hdev->req_skb = NULL;
-	hci_dev_unlock(hdev);
-
-	if (skb) {
-		struct sock *sk = hci_skb_sk(skb);
+	if (hdev->req_skb) {
+		struct sock *sk = hci_skb_sk(hdev->req_skb);
 
-		/* Drop sk reference if set */
 		if (sk)
 			sock_put(sk);
+	}
+	kfree_skb(hdev->req_skb);
+	hdev->req_skb = NULL;
+	hci_dev_unlock(hdev);
 
+	if (skb)
 		hdev->req_rsp = skb_get(skb);
-	}
 
 	wake_up_interruptible(&hdev->req_wait_q);
 }
-- 
2.47.3

RE: Bluetooth: hci_sync: Drop the command's sk reference

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 2438 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1209014/

---Test result---

Test Summary:
CheckPatch                    FAIL      0.58 seconds
VerifyFixes                   PASS      0.09 seconds
VerifySignedoff               PASS      0.09 seconds
GitLint                       PASS      0.24 seconds
SubjectPrefix                 PASS      0.08 seconds
BuildKernel                   PASS      23.38 seconds
CheckAllWarning               PASS      27.32 seconds
CheckSparse                   PASS      29.02 seconds
BuildKernel32                 PASS      24.00 seconds
CheckKernelLLVM               PASS      24.60 seconds
TestRunnerSetup               PASS      551.26 seconds
TestRunner_l2cap-tester       PASS      13.21 seconds
TestRunner_iso-tester         PASS      9.45 seconds
TestRunner_bnep-tester        PASS      2.93 seconds
TestRunner_mgmt-tester        PASS      83.91 seconds
TestRunner_rfcomm-tester      PASS      4.09 seconds
TestRunner_sco-tester         PASS      5.11 seconds
TestRunner_ioctl-tester       PASS      4.38 seconds
TestRunner_mesh-tester        PASS      5.15 seconds
TestRunner_smp-tester         PASS      4.04 seconds
TestRunner_userchan-tester    PASS      2.91 seconds
TestRunner_6lowpan-tester     PASS      4.07 seconds
IncrementalBuild              PASS      22.60 seconds

Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
Bluetooth: hci_sync: Drop the command's sk reference
WARNING: Non-standard signature: Assisted-by:
#132: 
Assisted-by: Claude:claude-opus-5.5

ERROR: Unrecognized email address: 'Claude:claude-opus-5.5'
#132: 
Assisted-by: Claude:claude-opus-5.5

total: 1 errors, 1 warnings, 0 checks, 32 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

/home/runner/work/bluetooth-next/bluetooth-next/src/patch/14974701.patch has style problems, please review.

NOTE: Ignored message types: UNKNOWN_COMMIT_ID

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.




https://github.com/bluez/bluetooth-next/pull/1119

---
Regards,
Linux Bluetooth

Re: [PATCH] Bluetooth: hci_sync: Drop the command's sk reference

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Thu, 12 Nov 2026 03:34:28 +0000 you wrote:
> hci_cmd_sync_alloc() takes a reference on the sk a command is sent for
> (sock_hold()), and hci_cmd_sync_complete() means to drop it, but looks
> for the sk in the response skb, which never carries one. The reference
> is never dropped: every command sent with an sk leaks it, and with it
> the sk and a reference on the bluetooth module.
> 
> The commands sent with an sk are LE Remove Advertising Set and LE
> Clear Advertising Sets, for MGMT's Remove Advertising and the instance
> removals, and Read Local OOB (Extended) Data. After each, the module's
> refcnt stays one higher with no socket left open, and the module can't
> be unloaded until a reboot.
> 
> [...]

Here is the summary with links:
  - Bluetooth: hci_sync: Drop the command's sk reference
    https://git.kernel.org/bluetooth/bluetooth-next/c/f3183d7ad101

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html