* [PATCH] Bluetooth: hci_core: Fix leak of request command on tx timeout
@ 2026-09-18 1:35 Jiakai Xu
2026-09-18 6:09 ` bluez.test.bot
0 siblings, 1 reply; 2+ messages in thread
From: Jiakai Xu @ 2026-09-18 1:35 UTC (permalink / raw)
To: Marcel Holtmann, Luiz Augusto von Dentz
Cc: Luiz Augusto von Dentz, Xin Chen, linux-bluetooth, linux-kernel,
Jiakai Xu
When a command transmission times out, hci_cmd_timeout() calls
hci_cmd_sync_cancel_sync() to mark the pending request as
HCI_REQ_CANCELED and wake up the waiter. However, nothing releases
the request command skb in this path: hci_cmd_sync_complete(), the
only place which frees hdev->req_skb during normal operation, bails
out early because the request status is no longer HCI_REQ_PEND.
Since commit f5afdff569a09 ("Bluetooth: hci_core: use skb_get()
instead of skb_clone() for req_skb"), hdev->req_skb holds an extra
reference to the same skb object as hdev->sent_cmd, so both pointers
keep the buffer alive and it leaks unless the device is closed,
which a fuzzer never does. This is the leak reported by kmemleak as
"memory leak in __hci_cmd_sync_sk".
Free the request command and the last sent command on the timeout
path and clear HCI_CMD_PENDING, mirroring the cleanup done by
hci_dev_close_sync(). This is safe because the waiter has already
been woken up and later command completion events tolerate a NULL
sent_cmd/req_skb via the hci_cmd_data() NULL checks.
Fixes: 63298d6e752fc ("Bluetooth: hci_core: Cancel request on command timeout")
Signed-off-by: Jiakai Xu <xujiakai24@mails.ucas.ac.cn>
---
net/bluetooth/hci_core.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index d7355c73f93e8..d7a527d91d565 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1433,6 +1433,18 @@ static void hci_cmd_timeout(struct work_struct *work)
bt_dev_err(hdev, "command 0x%4.4x tx timeout", opcode);
hci_cmd_sync_cancel_sync(hdev, ETIMEDOUT);
+
+ /* The request has been canceled so hci_cmd_sync_complete()
+ * will no longer release the request command. Free it along
+ * with the last sent command, which shares the same data
+ * buffer, otherwise they leak when the device stays up.
+ */
+ kfree_skb(hdev->sent_cmd);
+ hdev->sent_cmd = NULL;
+
+ kfree_skb(hdev->req_skb);
+ hdev->req_skb = NULL;
+ hci_dev_clear_flag(hdev, HCI_CMD_PENDING);
} else {
bt_dev_err(hdev, "command tx timeout");
}
--
2.34.1
--
Below is the crash report:
BUG: memory leak
unreferenced object 0xffff88800b4b3000 (size 240):
comm "syz.0.963", pid 18664, jiffies 4295035394
hex dump (first 32 bytes):
00 26 94 0c 80 88 ff ff 80 e8 fe 08 81 88 ff ff .&..............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc c3a6fa22):
kmemleak_alloc_recursive home/zzzrrll/tmp/kf_src/linux-7.1.13/include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook home/zzzrrll/tmp/kf_src/linux-7.1.13/mm/slub.c:4550 [inline]
slab_alloc_node home/zzzrrll/tmp/kf_src/linux-7.1.13/mm/slub.c:4874 [inline]
kmem_cache_alloc_node_noprof+0x267/0x4c0 home/zzzrrll/tmp/kf_src/linux-7.1.13/mm/slub.c:4926
__alloc_skb+0x236/0x500 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/core/skbuff.c:702
alloc_skb home/zzzrrll/tmp/kf_src/linux-7.1.13/include/linux/skbuff.h:1385 [inline]
bt_skb_alloc home/zzzrrll/tmp/kf_src/linux-7.1.13/include/net/bluetooth/bluetooth.h:520 [inline]
hci_cmd_sync_alloc+0x30/0x120 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:58
hci_cmd_sync_add home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:99 [inline]
__hci_cmd_sync_sk+0x7b/0x510 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:168
__hci_cmd_sync_status_sk home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:263 [inline]
__hci_cmd_sync_status home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:287 [inline]
hci_inquiry_sync+0xe5/0x190 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:6120
hci_inquiry+0x277/0x3f0 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_core.c:372
sock_do_ioctl+0x7c/0x1e0 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/socket.c:1302
sock_ioctl+0x423/0x5d0 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/socket.c:1423
vfs_ioctl home/zzzrrll/tmp/kf_src/linux-7.1.13/fs/ioctl.c:51 [inline]
__do_sys_ioctl home/zzzrrll/tmp/kf_src/linux-7.1.13/fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xbb/0x130 home/zzzrrll/tmp/kf_src/linux-7.1.13/fs/ioctl.c:583
do_syscall_x64 home/zzzrrll/tmp/kf_src/linux-7.1.13/arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x187/0x520 home/zzzrrll/tmp/kf_src/linux-7.1.13/arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff888015014b00 (size 704):
comm "syz.0.963", pid 18664, jiffies 4295035394
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 01 04 05 33 8b 9e 13 05 ...........3....
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc 62ed5507):
kmemleak_alloc_recursive home/zzzrrll/tmp/kf_src/linux-7.1.13/include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook home/zzzrrll/tmp/kf_src/linux-7.1.13/mm/slub.c:4550 [inline]
slab_alloc_node home/zzzrrll/tmp/kf_src/linux-7.1.13/mm/slub.c:4874 [inline]
kmem_cache_alloc_node_noprof+0x267/0x4c0 home/zzzrrll/tmp/kf_src/linux-7.1.13/mm/slub.c:4926
kmalloc_reserve+0x69/0x120 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/core/skbuff.c:613
__alloc_skb+0x33c/0x500 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/core/skbuff.c:713
alloc_skb home/zzzrrll/tmp/kf_src/linux-7.1.13/include/linux/skbuff.h:1385 [inline]
bt_skb_alloc home/zzzrrll/tmp/kf_src/linux-7.1.13/include/net/bluetooth/bluetooth.h:520 [inline]
hci_cmd_sync_alloc+0x30/0x120 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:58
hci_cmd_sync_add home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:99 [inline]
__hci_cmd_sync_sk+0x7b/0x510 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:168
__hci_cmd_sync_status_sk home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:263 [inline]
__hci_cmd_sync_status home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:287 [inline]
hci_inquiry_sync+0xe5/0x190 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:6120
hci_inquiry+0x277/0x3f0 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_core.c:372
sock_do_ioctl+0x7c/0x1e0 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/socket.c:1302
sock_ioctl+0x423/0x5d0 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/socket.c:1423
vfs_ioctl home/zzzrrll/tmp/kf_src/linux-7.1.13/fs/ioctl.c:51 [inline]
__do_sys_ioctl home/zzzrrll/tmp/kf_src/linux-7.1.13/fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xbb/0x130 home/zzzrrll/tmp/kf_src/linux-7.1.13/fs/ioctl.c:583
do_syscall_x64 home/zzzrrll/tmp/kf_src/linux-7.1.13/arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x187/0x520 home/zzzrrll/tmp/kf_src/linux-7.1.13/arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff88800c942600 (size 240):
comm "syz.3.1200", pid 20339, jiffies 4295059978
hex dump (first 32 bytes):
00 25 4b 0b 80 88 ff ff 00 30 4b 0b 80 88 ff ff .%K......0K.....
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc d3272932):
kmemleak_alloc_recursive home/zzzrrll/tmp/kf_src/linux-7.1.13/include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook home/zzzrrll/tmp/kf_src/linux-7.1.13/mm/slub.c:4550 [inline]
slab_alloc_node home/zzzrrll/tmp/kf_src/linux-7.1.13/mm/slub.c:4874 [inline]
kmem_cache_alloc_node_noprof+0x267/0x4c0 home/zzzrrll/tmp/kf_src/linux-7.1.13/mm/slub.c:4926
__alloc_skb+0x236/0x500 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/core/skbuff.c:702
alloc_skb home/zzzrrll/tmp/kf_src/linux-7.1.13/include/linux/skbuff.h:1385 [inline]
bt_skb_alloc home/zzzrrll/tmp/kf_src/linux-7.1.13/include/net/bluetooth/bluetooth.h:520 [inline]
hci_cmd_sync_alloc+0x30/0x120 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:58
hci_cmd_sync_add home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:99 [inline]
__hci_cmd_sync_sk+0x7b/0x510 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:168
__hci_cmd_sync_status_sk home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:263 [inline]
__hci_cmd_sync_status home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:287 [inline]
hci_cmd_sync_status+0x4f/0xe0 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:298
hci_dev_cmd+0x2ca/0x420 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_core.c:699
sock_do_ioctl+0x7c/0x1e0 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/socket.c:1302
sock_ioctl+0x423/0x5d0 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/socket.c:1423
vfs_ioctl home/zzzrrll/tmp/kf_src/linux-7.1.13/fs/ioctl.c:51 [inline]
__do_sys_ioctl home/zzzrrll/tmp/kf_src/linux-7.1.13/fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xbb/0x130 home/zzzrrll/tmp/kf_src/linux-7.1.13/fs/ioctl.c:583
do_syscall_x64 home/zzzrrll/tmp/kf_src/linux-7.1.13/arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x187/0x520 home/zzzrrll/tmp/kf_src/linux-7.1.13/arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff88800ca6ac00 (size 704):
comm "syz.3.1200", pid 20339, jiffies 4295059978
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 1a 0c 01 04 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc a1b85eb5):
kmemleak_alloc_recursive home/zzzrrll/tmp/kf_src/linux-7.1.13/include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook home/zzzrrll/tmp/kf_src/linux-7.1.13/mm/slub.c:4550 [inline]
slab_alloc_node home/zzzrrll/tmp/kf_src/linux-7.1.13/mm/slub.c:4874 [inline]
kmem_cache_alloc_node_noprof+0x267/0x4c0 home/zzzrrll/tmp/kf_src/linux-7.1.13/mm/slub.c:4926
kmalloc_reserve+0x69/0x120 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/core/skbuff.c:613
__alloc_skb+0x33c/0x500 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/core/skbuff.c:713
alloc_skb home/zzzrrll/tmp/kf_src/linux-7.1.13/include/linux/skbuff.h:1385 [inline]
bt_skb_alloc home/zzzrrll/tmp/kf_src/linux-7.1.13/include/net/bluetooth/bluetooth.h:520 [inline]
hci_cmd_sync_alloc+0x30/0x120 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:58
hci_cmd_sync_add home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:99 [inline]
__hci_cmd_sync_sk+0x7b/0x510 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:168
__hci_cmd_sync_status_sk home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:263 [inline]
__hci_cmd_sync_status home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:287 [inline]
hci_cmd_sync_status+0x4f/0xe0 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:298
hci_dev_cmd+0x2ca/0x420 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_core.c:699
sock_do_ioctl+0x7c/0x1e0 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/socket.c:1302
sock_ioctl+0x423/0x5d0 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/socket.c:1423
vfs_ioctl home/zzzrrll/tmp/kf_src/linux-7.1.13/fs/ioctl.c:51 [inline]
__do_sys_ioctl home/zzzrrll/tmp/kf_src/linux-7.1.13/fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xbb/0x130 home/zzzrrll/tmp/kf_src/linux-7.1.13/fs/ioctl.c:583
do_syscall_x64 home/zzzrrll/tmp/kf_src/linux-7.1.13/arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x187/0x520 home/zzzrrll/tmp/kf_src/linux-7.1.13/arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff88800b4b2500 (size 240):
comm "syz.0.1229", pid 20584, jiffies 4295063225
hex dump (first 32 bytes):
00 2f 94 0c 80 88 ff ff 00 26 94 0c 80 88 ff ff ./.......&......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc 1152a240):
kmemleak_alloc_recursive home/zzzrrll/tmp/kf_src/linux-7.1.13/include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook home/zzzrrll/tmp/kf_src/linux-7.1.13/mm/slub.c:4550 [inline]
slab_alloc_node home/zzzrrll/tmp/kf_src/linux-7.1.13/mm/slub.c:4874 [inline]
kmem_cache_alloc_node_noprof+0x267/0x4c0 home/zzzrrll/tmp/kf_src/linux-7.1.13/mm/slub.c:4926
__alloc_skb+0x236/0x500 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/core/skbuff.c:702
alloc_skb home/zzzrrll/tmp/kf_src/linux-7.1.13/include/linux/skbuff.h:1385 [inline]
bt_skb_alloc home/zzzrrll/tmp/kf_src/linux-7.1.13/include/net/bluetooth/bluetooth.h:520 [inline]
hci_cmd_sync_alloc+0x30/0x120 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:58
hci_cmd_sync_add home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:99 [inline]
__hci_cmd_sync_sk+0x7b/0x510 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:168
__hci_cmd_sync_status_sk home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:263 [inline]
__hci_cmd_sync_status home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:287 [inline]
hci_cmd_sync_status+0x4f/0xe0 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:298
hci_dev_cmd+0x2ca/0x420 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_core.c:699
sock_do_ioctl+0x7c/0x1e0 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/socket.c:1302
sock_ioctl+0x423/0x5d0 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/socket.c:1423
vfs_ioctl home/zzzrrll/tmp/kf_src/linux-7.1.13/fs/ioctl.c:51 [inline]
__do_sys_ioctl home/zzzrrll/tmp/kf_src/linux-7.1.13/fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xbb/0x130 home/zzzrrll/tmp/kf_src/linux-7.1.13/fs/ioctl.c:583
do_syscall_x64 home/zzzrrll/tmp/kf_src/linux-7.1.13/arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x187/0x520 home/zzzrrll/tmp/kf_src/linux-7.1.13/arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff888015017180 (size 704):
comm "syz.0.1229", pid 20584, jiffies 4295063225
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 1a 0c 01 04 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc a1b85eb5):
kmemleak_alloc_recursive home/zzzrrll/tmp/kf_src/linux-7.1.13/include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook home/zzzrrll/tmp/kf_src/linux-7.1.13/mm/slub.c:4550 [inline]
slab_alloc_node home/zzzrrll/tmp/kf_src/linux-7.1.13/mm/slub.c:4874 [inline]
kmem_cache_alloc_node_noprof+0x267/0x4c0 home/zzzrrll/tmp/kf_src/linux-7.1.13/mm/slub.c:4926
kmalloc_reserve+0x69/0x120 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/core/skbuff.c:613
__alloc_skb+0x33c/0x500 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/core/skbuff.c:713
alloc_skb home/zzzrrll/tmp/kf_src/linux-7.1.13/include/linux/skbuff.h:1385 [inline]
bt_skb_alloc home/zzzrrll/tmp/kf_src/linux-7.1.13/include/net/bluetooth/bluetooth.h:520 [inline]
hci_cmd_sync_alloc+0x30/0x120 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:58
hci_cmd_sync_add home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:99 [inline]
__hci_cmd_sync_sk+0x7b/0x510 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:168
__hci_cmd_sync_status_sk home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:263 [inline]
__hci_cmd_sync_status home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:287 [inline]
hci_cmd_sync_status+0x4f/0xe0 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_sync.c:298
hci_dev_cmd+0x2ca/0x420 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/bluetooth/hci_core.c:699
sock_do_ioctl+0x7c/0x1e0 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/socket.c:1302
sock_ioctl+0x423/0x5d0 home/zzzrrll/tmp/kf_src/linux-7.1.13/net/socket.c:1423
vfs_ioctl home/zzzrrll/tmp/kf_src/linux-7.1.13/fs/ioctl.c:51 [inline]
__do_sys_ioctl home/zzzrrll/tmp/kf_src/linux-7.1.13/fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xbb/0x130 home/zzzrrll/tmp/kf_src/linux-7.1.13/fs/ioctl.c:583
do_syscall_x64 home/zzzrrll/tmp/kf_src/linux-7.1.13/arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x187/0x520 home/zzzrrll/tmp/kf_src/linux-7.1.13/arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
<<<<<<<<<<<<<<< tail report >>>>>>>>>>>>>>>
sock_do_ioctl+0x7c/0x1e0
sock_ioctl+0x423/0x5d0
__se_sys_ioctl+0xbb/0x130
do_syscall_64+0x187/0x520
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff888015014b00 (size 704):
comm "syz.0.963", pid 18664, jiffies 4295035394
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 01 04 05 33 8b 9e 13 05 ...........3....
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc 62ed5507):
kmem_cache_alloc_node_noprof+0x267/0x4c0
kmalloc_reserve+0x69/0x120
__alloc_skb+0x33c/0x500
hci_cmd_sync_alloc+0x30/0x120
__hci_cmd_sync_sk+0x7b/0x510
hci_inquiry_sync+0xe5/0x190
hci_inquiry+0x277/0x3f0
sock_do_ioctl+0x7c/0x1e0
sock_ioctl+0x423/0x5d0
__se_sys_ioctl+0xbb/0x130
do_syscall_64+0x187/0x520
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff88800c942600 (size 240):
comm "syz.3.1200", pid 20339, jiffies 4295059978
hex dump (first 32 bytes):
00 25 4b 0b 80 88 ff ff 00 30 4b 0b 80 88 ff ff .%K......0K.....
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc d3272932):
kmem_cache_alloc_node_noprof+0x267/0x4c0
__alloc_skb+0x236/0x500
hci_cmd_sync_alloc+0x30/0x120
__hci_cmd_sync_sk+0x7b/0x510
hci_cmd_sync_status+0x4f/0xe0
hci_dev_cmd+0x2ca/0x420
sock_do_ioctl+0x7c/0x1e0
sock_ioctl+0x423/0x5d0
__se_sys_ioctl+0xbb/0x130
do_syscall_64+0x187/0x520
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff88800ca6ac00 (size 704):
comm "syz.3.1200", pid 20339, jiffies 4295059978
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 1a 0c 01 04 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc a1b85eb5):
kmem_cache_alloc_node_noprof+0x267/0x4c0
kmalloc_reserve+0x69/0x120
__alloc_skb+0x33c/0x500
hci_cmd_sync_alloc+0x30/0x120
__hci_cmd_sync_sk+0x7b/0x510
hci_cmd_sync_status+0x4f/0xe0
hci_dev_cmd+0x2ca/0x420
sock_do_ioctl+0x7c/0x1e0
sock_ioctl+0x423/0x5d0
__se_sys_ioctl+0xbb/0x130
do_syscall_64+0x187/0x520
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff88800b4b2500 (size 240):
comm "syz.0.1229", pid 20584, jiffies 4295063225
hex dump (first 32 bytes):
00 2f 94 0c 80 88 ff ff 00 26 94 0c 80 88 ff ff ./.......&......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc 1152a240):
kmem_cache_alloc_node_noprof+0x267/0x4c0
__alloc_skb+0x236/0x500
hci_cmd_sync_alloc+0x30/0x120
__hci_cmd_sync_sk+0x7b/0x510
hci_cmd_sync_status+0x4f/0xe0
hci_dev_cmd+0x2ca/0x420
sock_do_ioctl+0x7c/0x1e0
sock_ioctl+0x423/0x5d0
__se_sys_ioctl+0xbb/0x130
do_syscall_64+0x187/0x520
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff888015017180 (size 704):
comm "syz.0.1229", pid 20584, jiffies 4295063225
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 1a 0c 01 04 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc a1b85eb5):
kmem_cache_alloc_node_noprof+0x267/0x4c0
kmalloc_reserve+0x69/0x120
__alloc_skb+0x33c/0x500
hci_cmd_sync_alloc+0x30/0x120
__hci_cmd_sync_sk+0x7b/0x510
hci_cmd_sync_status+0x4f/0xe0
hci_dev_cmd+0x2ca/0x420
sock_do_ioctl+0x7c/0x1e0
sock_ioctl+0x423/0x5d0
__se_sys_ioctl+0xbb/0x130
do_syscall_64+0x187/0x520
entry_SYSCALL_64_after_hwframe+0x77/0x7f
<<<<<<<<<<<<<<< tail report >>>>>>>>>>>>>>>
sock_do_ioctl+0x7c/0x1e0
sock_ioctl+0x423/0x5d0
__se_sys_ioctl+0xbb/0x130
do_syscall_64+0x187/0x520
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff88800c942600 (size 240):
comm "syz.3.1200", pid 20339, jiffies 4295059978
hex dump (first 32 bytes):
00 25 4b 0b 80 88 ff ff 00 30 4b 0b 80 88 ff ff .%K......0K.....
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc d3272932):
kmem_cache_alloc_node_noprof+0x267/0x4c0
__alloc_skb+0x236/0x500
hci_cmd_sync_alloc+0x30/0x120
__hci_cmd_sync_sk+0x7b/0x510
hci_cmd_sync_status+0x4f/0xe0
hci_dev_cmd+0x2ca/0x420
sock_do_ioctl+0x7c/0x1e0
sock_ioctl+0x423/0x5d0
__se_sys_ioctl+0xbb/0x130
do_syscall_64+0x187/0x520
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff88800ca6ac00 (size 704):
comm "syz.3.1200", pid 20339, jiffies 4295059978
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 1a 0c 01 04 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc a1b85eb5):
kmem_cache_alloc_node_noprof+0x267/0x4c0
kmalloc_reserve+0x69/0x120
__alloc_skb+0x33c/0x500
hci_cmd_sync_alloc+0x30/0x120
__hci_cmd_sync_sk+0x7b/0x510
hci_cmd_sync_status+0x4f/0xe0
hci_dev_cmd+0x2ca/0x420
sock_do_ioctl+0x7c/0x1e0
sock_ioctl+0x423/0x5d0
__se_sys_ioctl+0xbb/0x130
do_syscall_64+0x187/0x520
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff88800b4b2500 (size 240):
comm "syz.0.1229", pid 20584, jiffies 4295063225
hex dump (first 32 bytes):
00 2f 94 0c 80 88 ff ff 00 26 94 0c 80 88 ff ff ./.......&......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc 1152a240):
kmem_cache_alloc_node_noprof+0x267/0x4c0
__alloc_skb+0x236/0x500
hci_cmd_sync_alloc+0x30/0x120
__hci_cmd_sync_sk+0x7b/0x510
hci_cmd_sync_status+0x4f/0xe0
hci_dev_cmd+0x2ca/0x420
sock_do_ioctl+0x7c/0x1e0
sock_ioctl+0x423/0x5d0
__se_sys_ioctl+0xbb/0x130
do_syscall_64+0x187/0x520
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff888015017180 (size 704):
comm "syz.0.1229", pid 20584, jiffies 4295063225
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 1a 0c 01 04 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc a1b85eb5):
kmem_cache_alloc_node_noprof+0x267/0x4c0
kmalloc_reserve+0x69/0x120
__alloc_skb+0x33c/0x500
hci_cmd_sync_alloc+0x30/0x120
__hci_cmd_sync_sk+0x7b/0x510
hci_cmd_sync_status+0x4f/0xe0
hci_dev_cmd+0x2ca/0x420
sock_do_ioctl+0x7c/0x1e0
sock_ioctl+0x423/0x5d0
__se_sys_ioctl+0xbb/0x130
do_syscall_64+0x187/0x520
entry_SYSCALL_64_after_hwframe+0x77/0x7f
<<<<<<<<<<<<<<< tail report >>>>>>>>>>>>>>>
sock_do_ioctl+0x7c/0x1e0
sock_ioctl+0x423/0x5d0
__se_sys_ioctl+0xbb/0x130
do_syscall_64+0x187/0x520
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff88800ca6ac00 (size 704):
comm "syz.3.1200", pid 20339, jiffies 4295059978
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 1a 0c 01 04 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc a1b85eb5):
kmem_cache_alloc_node_noprof+0x267/0x4c0
kmalloc_reserve+0x69/0x120
__alloc_skb+0x33c/0x500
hci_cmd_sync_alloc+0x30/0x120
__hci_cmd_sync_sk+0x7b/0x510
hci_cmd_sync_status+0x4f/0xe0
hci_dev_cmd+0x2ca/0x420
sock_do_ioctl+0x7c/0x1e0
sock_ioctl+0x423/0x5d0
__se_sys_ioctl+0xbb/0x130
do_syscall_64+0x187/0x520
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff88800b4b2500 (size 240):
comm "syz.0.1229", pid 20584, jiffies 4295063225
hex dump (first 32 bytes):
00 2f 94 0c 80 88 ff ff 00 26 94 0c 80 88 ff ff ./.......&......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc 1152a240):
kmem_cache_alloc_node_noprof+0x267/0x4c0
__alloc_skb+0x236/0x500
hci_cmd_sync_alloc+0x30/0x120
__hci_cmd_sync_sk+0x7b/0x510
hci_cmd_sync_status+0x4f/0xe0
hci_dev_cmd+0x2ca/0x420
sock_do_ioctl+0x7c/0x1e0
sock_ioctl+0x423/0x5d0
__se_sys_ioctl+0xbb/0x130
do_syscall_64+0x187/0x520
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff888015017180 (size 704):
comm "syz.0.1229", pid 20584, jiffies 4295063225
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 1a 0c 01 04 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc a1b85eb5):
kmem_cache_alloc_node_noprof+0x267/0x4c0
kmalloc_reserve+0x69/0x120
__alloc_skb+0x33c/0x500
hci_cmd_sync_alloc+0x30/0x120
__hci_cmd_sync_sk+0x7b/0x510
hci_cmd_sync_status+0x4f/0xe0
hci_dev_cmd+0x2ca/0x420
sock_do_ioctl+0x7c/0x1e0
sock_ioctl+0x423/0x5d0
__se_sys_ioctl+0xbb/0x130
do_syscall_64+0x187/0x520
entry_SYSCALL_64_after_hwframe+0x77/0x7f
<<<<<<<<<<<<<<< tail report >>>>>>>>>>>>>>>
sock_do_ioctl+0x7c/0x1e0
sock_ioctl+0x423/0x5d0
__se_sys_ioctl+0xbb/0x130
do_syscall_64+0x187/0x520
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff88800b4b2500 (size 240):
comm "syz.0.1229", pid 20584, jiffies 4295063225
hex dump (first 32 bytes):
00 2f 94 0c 80 88 ff ff 00 26 94 0c 80 88 ff ff ./.......&......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc 1152a240):
kmem_cache_alloc_node_noprof+0x267/0x4c0
__alloc_skb+0x236/0x500
hci_cmd_sync_alloc+0x30/0x120
__hci_cmd_sync_sk+0x7b/0x510
hci_cmd_sync_status+0x4f/0xe0
hci_dev_cmd+0x2ca/0x420
sock_do_ioctl+0x7c/0x1e0
sock_ioctl+0x423/0x5d0
__se_sys_ioctl+0xbb/0x130
do_syscall_64+0x187/0x520
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff888015017180 (size 704):
comm "syz.0.1229", pid 20584, jiffies 4295063225
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 1a 0c 01 04 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc a1b85eb5):
kmem_cache_alloc_node_noprof+0x267/0x4c0
kmalloc_reserve+0x69/0x120
__alloc_skb+0x33c/0x500
hci_cmd_sync_alloc+0x30/0x120
__hci_cmd_sync_sk+0x7b/0x510
hci_cmd_sync_status+0x4f/0xe0
hci_dev_cmd+0x2ca/0x420
sock_do_ioctl+0x7c/0x1e0
sock_ioctl+0x423/0x5d0
__se_sys_ioctl+0xbb/0x130
do_syscall_64+0x187/0x520
entry_SYSCALL_64_after_hwframe+0x77/0x7f
<<<<<<<<<<<<<<< tail report >>>>>>>>>>>>>>>
sock_do_ioctl+0x7c/0x1e0
sock_ioctl+0x423/0x5d0
__se_sys_ioctl+0xbb/0x130
do_syscall_64+0x187/0x520
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff888015017180 (size 704):
comm "syz.0.1229", pid 20584, jiffies 4295063225
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 1a 0c 01 04 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc a1b85eb5):
kmem_cache_alloc_node_noprof+0x267/0x4c0
kmalloc_reserve+0x69/0x120
__alloc_skb+0x33c/0x500
hci_cmd_sync_alloc+0x30/0x120
__hci_cmd_sync_sk+0x7b/0x510
hci_cmd_sync_status+0x4f/0xe0
hci_dev_cmd+0x2ca/0x420
sock_do_ioctl+0x7c/0x1e0
sock_ioctl+0x423/0x5d0
__se_sys_ioctl+0xbb/0x130
do_syscall_64+0x187/0x520
entry_SYSCALL_64_after_hwframe+0x77/0x7f
<<<<<<<<<<<<<<< tail report >>>>>>>>>>>>>>>
---
^ permalink raw reply related [flat|nested] 2+ messages in thread
* RE: Bluetooth: hci_core: Fix leak of request command on tx timeout
2026-09-18 1:35 [PATCH] Bluetooth: hci_core: Fix leak of request command on tx timeout Jiakai Xu
@ 2026-09-18 6:09 ` bluez.test.bot
0 siblings, 0 replies; 2+ messages in thread
From: bluez.test.bot @ 2026-09-18 6:09 UTC (permalink / raw)
To: linux-bluetooth, xujiakai24
[-- Attachment #1: Type: text/plain, Size: 2226 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1168176/
---Test result---
Test Summary:
CheckPatch PASS 1.55 seconds
VerifyFixes PASS 0.10 seconds
VerifySignedoff PASS 0.12 seconds
GitLint PASS 0.29 seconds
SubjectPrefix PASS 0.10 seconds
BuildKernel PASS 28.35 seconds
CheckAllWarning PASS 32.12 seconds
CheckSparse PASS 34.74 seconds
BuildKernel32 PASS 28.23 seconds
CheckKernelLLVM PASS 32.98 seconds
TestRunnerSetup PASS 726.33 seconds
TestRunner_l2cap-tester PASS 16.27 seconds
TestRunner_iso-tester PASS 26.55 seconds
TestRunner_bnep-tester PASS 3.21 seconds
TestRunner_mgmt-tester FAIL 59.84 seconds
TestRunner_rfcomm-tester PASS 4.94 seconds
TestRunner_sco-tester PASS 7.53 seconds
TestRunner_ioctl-tester PASS 4.62 seconds
TestRunner_mesh-tester FAIL 8.18 seconds
TestRunner_smp-tester PASS 4.28 seconds
TestRunner_userchan-tester PASS 3.58 seconds
TestRunner_6lowpan-tester PASS 4.35 seconds
IncrementalBuild PASS 25.94 seconds
Details
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
Total: 501, Passed: 496 (99.0%), Failed: 1, Not Run: 4
Failed Test Cases
Read Exp Feature - Success Failed 0.031 seconds
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner
Output:
Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0
Failed Test Cases
Mesh - Send cancel - 1 Timed out 2.451 seconds
Mesh - Send cancel - 2 Timed out 1.998 seconds
https://github.com/bluez/bluetooth-next/pull/786
---
Regards,
Linux Bluetooth
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-09-18 6:09 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-18 1:35 [PATCH] Bluetooth: hci_core: Fix leak of request command on tx timeout Jiakai Xu
2026-09-18 6:09 ` bluez.test.bot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox