Re: [v1] bluetooth: hci_core: Fix use-after-free in vhci_flush().

[Kuniyuki Iwashima <kuni1840@gmail.com>]

From: Pauli Virtanen <pav@iki.fi>
Date: Sat, 14 Jun 2025 14:30:18 +0300
> pe, 2025-06-13 kello 19:20 -0700, Kuniyuki Iwashima kirjoitti:
> 
> [clip]
> > > ##############################
> > > Test: TestRunner_mesh-tester - FAIL
> > > Desc: Run mesh-tester with test-runner
> > > Output:
> > > BUG: KASAN: slab-use-after-free in run_timer_softirq+0x76b/0x7d0
> > > WARNING: CPU: 0 PID: 68 at kernel/workqueue.c:2257 __queue_work+0x93e/0xba0
> > > Total: 10, Passed: 9 (90.0%), Failed: 1, Not Run: 0
> > 
> > It seems the same splat can be seen on other patches.
> > https://lore.kernel.org/linux-bluetooth/?q=KASAN+run_timer_softirq
> > 
> > Is this a known issue, or are we all making the same mistake ?
> > If latter, can I get the full splat 
> 
> https://github.com/BluezTestBot/bluetooth-next/pull/2887/checks
> 
> But probably it's an existing issue.

I agree this is a separate issue.

To me, disable_work_sync(&hdev->rx_work) in hci_unregister_dev()
is doing the proper synchronisation between the work, so it might
be a problem in the workqueue code.


> 
> > and some guidance to run
> > the same test locally (if it's easy to set up) ?
> 
> Please see
> https://github.com/bluez/bluez/blob/master/doc/test-runner.rst#examples
> 
> I does not reproduce locally for me however.

Thanks!