Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor()

Commit Message

Tetsuo Handa Aug. 17, 2022, 11:14 a.m. UTC

syzbot is reporting double kfree() at remove_adv_monitor() [1], for
commit 7cf5c2978f23fdbb ("Bluetooth: hci_sync: Refactor remove Adv
Monitor") forgot to remove duplicated mgmt_pending_remove() when
merging "if (err) {" path and "if (!pending) {" path.

Link: https://syzkaller.appspot.com/bug?extid=915a8416bf15895b8e07 [1]
Reported-by: syzbot <[e-mail]>
Fixes: 7cf5c2978f23fdbb ("Bluetooth: hci_sync: Refactor remove Adv Monitor")
Signed-off-by: Tetsuo Handa <[e-mail]>
---
 net/bluetooth/mgmt.c | 1 -
 1 file changed, 1 deletion(-)

Comments

[e-mail] Aug. 17, 2022, 12:01 p.m. UTC | #1

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=668362

---Test result---

Test Summary:
CheckPatch                    FAIL      1.67 seconds
GitLint                       PASS      1.00 seconds
SubjectPrefix                 PASS      0.83 seconds
BuildKernel                   PASS      39.01 seconds
BuildKernel32                 PASS      34.80 seconds
Incremental Build with patchesPASS      49.40 seconds
TestRunner: Setup             PASS      559.58 seconds
TestRunner: l2cap-tester      PASS      19.08 seconds
TestRunner: bnep-tester       PASS      7.71 seconds
TestRunner: mgmt-tester       PASS      115.23 seconds
TestRunner: rfcomm-tester     PASS      11.41 seconds
TestRunner: sco-tester        PASS      11.14 seconds
TestRunner: smp-tester        PASS      11.07 seconds
TestRunner: userchan-tester   PASS      7.90 seconds

Details
##############################
Test: CheckPatch - FAIL - 1.67 seconds
Run checkpatch.pl script with rule in .checkpatch.conf
Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor()\ERROR:GIT_COMMIT_ID: Please use git commit description style 'commit <12+ chars of sha1> ("<title line>")' - ie: 'commit fatal: unsaf ("ace/src' is owned by someone else)")'
#63: 
commit 7cf5c2978f23fdbb ("Bluetooth: hci_sync: Refactor remove Adv
Monitor") forgot to remove duplicated mgmt_pending_remove() when

total: 1 errors, 0 warnings, 0 checks, 7 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

/github/workspace/src/12945738.patch has style problems, please review.

NOTE: Ignored message types: UNKNOWN_COMMIT_ID

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.




---
Regards,
Linux Bluetooth

[e-mail] Aug. 17, 2022, 6:52 p.m. UTC | #2

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <[e-mail]>:

On Wed, 17 Aug 2022 20:14:36 +0900 you wrote:
> syzbot is reporting double kfree() at remove_adv_monitor() [1], for
> commit 7cf5c2978f23fdbb ("Bluetooth: hci_sync: Refactor remove Adv
> Monitor") forgot to remove duplicated mgmt_pending_remove() when
> merging "if (err) {" path and "if (!pending) {" path.
> 
> Link: https://syzkaller.appspot.com/bug?extid=915a8416bf15895b8e07 [1]
> Reported-by: syzbot <[e-mail]>
> Fixes: 7cf5c2978f23fdbb ("Bluetooth: hci_sync: Refactor remove Adv Monitor")
> Signed-off-by: Tetsuo Handa <[e-mail]>
> 
> [...]

Here is the summary with links:
  - Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor()
    https://git.kernel.org/bluetooth/bluetooth-next/c/ae2b5c97cd40

You are awesome, thank you!

Patch

diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 6e31023b84f5..3d2e0773a1c1 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -5054,7 +5054,6 @@  static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev,
 		else
 			status = MGMT_STATUS_FAILED;
 
-		mgmt_pending_remove(cmd);
 		goto unlock;
 	}