Re: [syzbot] Re: KASAN: use-after-free Read in netdev_unregister_kobject

[syzbot <syzbot+6cf5652d3df49fae2e3f@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: Re: KASAN: use-after-free Read in netdev_unregister_kobject
Author: dmantipov@yandex.ru

#syz test git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next fb4560832d4c91d73680538d6659ac2c024ec9d5

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 629c302f7407..aaa7849c74f4 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -2716,7 +2716,6 @@ void hci_unregister_dev(struct hci_dev *hdev)
  		rfkill_destroy(hdev->rfkill);
  	}

-	device_del(&hdev->dev);
  	/* Actual cleanup is deferred until hci_release_dev(). */
  	hci_dev_put(hdev);
  }
@@ -2756,6 +2755,8 @@ void hci_release_dev(struct hci_dev *hdev)
  	kfree_skb(hdev->sent_cmd);
  	kfree_skb(hdev->req_skb);
  	kfree_skb(hdev->recv_event);
+
+	device_del(&hdev->dev);
  	kfree(hdev);
  }
  EXPORT_SYMBOL(hci_release_dev);