[PATCH] Bluetooth: hci_uart: serialize close flush with write_work

[PATCH] Bluetooth: hci_uart: serialize close flush with write_work

[wuyankun]

hci_uart_close() calls hci_uart_flush(), and flush may free hu->tx_skb.
At the same time, hci_uart_write_work() can still be running and access
the same skb (for example through skb_pull()), which leads to a
use-after-free.

Fix this by canceling write_work before calling hci_uart_flush(), so the
tx_skb lifetime is fully serialized against the TX worker.

Reported-by: syzbot+da2717d5c64bf7975268@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=da2717d5c64bf7975268
Cc: stable@vger.kernel.org
Signed-off-by: wuyankun <wuyankun@uniontech.com>
---
 drivers/bluetooth/hci_ldisc.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index 275ea865bc29..51cc9af0f7e8 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -263,8 +263,11 @@ static int hci_uart_open(struct hci_dev *hdev)
 /* Close device */
 static int hci_uart_close(struct hci_dev *hdev)
 {
+	struct hci_uart *hu = hci_get_drvdata(hdev);
 	BT_DBG("hdev %p", hdev);
 
+	/* Ensure write_work is not touching tx_skb while flush frees it. */
+	cancel_work_sync(&hu->write_work);
 	hci_uart_flush(hdev);
 	hdev->flush = NULL;
 	return 0;
-- 
2.20.1

Re: [PATCH] Bluetooth: hci_uart: serialize close flush with write_work

[syzbot]

> Please test this patch.
>
> #syz test: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master

This crash does not have a reproducer. I cannot test it.

>
> From 48d953a6ee4c2e4e1e58cdf7da3d3647316e4802 Mon Sep 17 00:00:00 2001
> From: wuyankun <wuyankun@uniontech.com>
> Date: Sat, 9 May 2026 15:41:19 +0800
> Subject: [PATCH] Bluetooth: hci_uart: serialize close flush with write_work
>
> hci_uart_close() calls hci_uart_flush(), and flush may free hu->tx_skb.
> At the same time, hci_uart_write_work() can still be running and access
> the same skb (for example through skb_pull()), which leads to a
> use-after-free.
>
> Fix this by canceling write_work before calling hci_uart_flush(), so the
> tx_skb lifetime is fully serialized against the TX worker.
>
> Reported-by: syzbot+da2717d5c64bf7975268@syzkaller.appspotmail.com
> Link: https://syzkaller.appspot.com/bug?extid=da2717d5c64bf7975268
> Cc: stable@vger.kernel.org
> Signed-off-by: wuyankun <wuyankun@uniontech.com>
> ---
>  drivers/bluetooth/hci_ldisc.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
> index 275ea865bc29..51cc9af0f7e8 100644
> --- a/drivers/bluetooth/hci_ldisc.c
> +++ b/drivers/bluetooth/hci_ldisc.c
> @@ -263,8 +263,11 @@ static int hci_uart_open(struct hci_dev *hdev)
>  /* Close device */
>  static int hci_uart_close(struct hci_dev *hdev)
>  {
> +	struct hci_uart *hu = hci_get_drvdata(hdev);
>  	BT_DBG("hdev %p", hdev);
>  
> +	/* Ensure write_work is not touching tx_skb while flush frees it. */
> +	cancel_work_sync(&hu->write_work);
>  	hci_uart_flush(hdev);
>  	hdev->flush = NULL;
>  	return 0;
> -- 
> 2.20.1
>