[PATCH 1/2] Bluetooth: MGMT: free remove monitor command on cancel

[PATCH 1/2] Bluetooth: MGMT: free remove monitor command on cancel

[Jiale Yao]

remove_adv_monitor() allocates its queued command with
mgmt_pending_new(), so the command is not linked into
hdev->mgmt_pending. If the command-sync entry is cancelled, its
completion callback returns without freeing the command, leaking both
the allocation and its socket reference.

Free the pending command before returning from the cancellation path.

Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 net/bluetooth/mgmt.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 251a896babd5..e54a838aeada 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -5682,8 +5682,10 @@ static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev,
 	struct mgmt_pending_cmd *cmd = data;
 	struct mgmt_cp_remove_adv_monitor *cp;
 
-	if (status == -ECANCELED)
+	if (status == -ECANCELED) {
+		mgmt_pending_free(cmd);
 		return;
+	}
 
 	hci_dev_lock(hdev);
 
-- 
2.34.1

RE: [1/2] Bluetooth: MGMT: free remove monitor command on cancel

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 839 bytes --]

This is an automated email and please do not reply to this email.

Dear Submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
While preparing the CI tests, the patches you submitted couldn't be applied to the current HEAD of the repository.

----- Output -----

error: patch failed: net/bluetooth/mgmt.c:5682
error: net/bluetooth/mgmt.c: patch does not apply
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"

Please resolve the issue and submit the patches again.


---
Regards,
Linux Bluetooth

Re:[PATCH 1/2] Bluetooth: MGMT: free remove monitor command on cancel

[jiale yao]

At 2026-10-17 11:09:39, "Jiale Yao" <yaojiale02@163.com> wrote:
>remove_adv_monitor() allocates its queued command with
>mgmt_pending_new(), so the command is not linked into
>hdev->mgmt_pending. If the command-sync entry is cancelled, its
>completion callback returns without freeing the command, leaking both
>the allocation and its socket reference.
>
>Free the pending command before returning from the cancellation path.
>

Fixes: e6ed54e86aae ("Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete")

>Signed-off-by: Jiale Yao <yaojiale02@163.com>
>---
> net/bluetooth/mgmt.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
>diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
>index 251a896babd5..e54a838aeada 100644
>--- a/net/bluetooth/mgmt.c
>+++ b/net/bluetooth/mgmt.c
>@@ -5682,8 +5682,10 @@ static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev,
> 	struct mgmt_pending_cmd *cmd = data;
> 	struct mgmt_cp_remove_adv_monitor *cp;
> 
>-	if (status == -ECANCELED)
>+	if (status == -ECANCELED) {
>+		mgmt_pending_free(cmd);
> 		return;
>+	}
> 
> 	hci_dev_lock(hdev);
> 
>-- 
>2.34.1