Re: [syzbot] [bluetooth?] [usb?] KASAN: slab-use-after-free Read in btusb_disconnect

[Hillf Danton <hdanton@sina.com>]

> Date: Fri, 04 Jul 2025 01:16:32 -0700
> syzbot found the following issue on:
> 
> HEAD commit:    cf16f408364e usb: core: config: Prevent OOB read in SS end..
> git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
> console output: https://syzkaller.appspot.com/x/log.txt?x=1356f48c580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=a4c5153915e19e58
> dashboard link: https://syzkaller.appspot.com/bug?extid=2fc81b50a4f8263a159b
> compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=12cf7770580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1756f48c580000

#syz test

--- x/drivers/bluetooth/btusb.c
+++ y/drivers/bluetooth/btusb.c
@@ -4269,6 +4269,11 @@ static void btusb_disconnect(struct usb_
 
 	hci_unregister_dev(hdev);
 
+	if (data->oob_wake_irq)
+		device_init_wakeup(&data->udev->dev, false);
+	if (data->reset_gpio)
+		gpiod_put(data->reset_gpio);
+
 	if (intf == data->intf) {
 		if (data->isoc)
 			usb_driver_release_interface(&btusb_driver, data->isoc);
@@ -4284,12 +4289,6 @@ static void btusb_disconnect(struct usb_
 			usb_driver_release_interface(&btusb_driver, data->isoc);
 	}
 
-	if (data->oob_wake_irq)
-		device_init_wakeup(&data->udev->dev, false);
-
-	if (data->reset_gpio)
-		gpiod_put(data->reset_gpio);
-
 	hci_free_dev(hdev);
 }
 
--