Re: [PATCH v6 1/2] Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()

[patchwork-bot+bluetooth@kernel.org]

Hello:

This series was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Mon, 15 Jun 2026 11:33:05 -0400 you wrote:
> hci_abort_conn() read hci_skb_event(hdev->sent_cmd) when a connection
> was pending, but hdev->sent_cmd can be NULL while req_status is still
> HCI_REQ_PEND, leading to a NULL pointer dereference and a general
> protection fault from the hci_rx_work() receive path.
> 
> Instead of inspecting hdev->sent_cmd, track the in-flight create
> connection command with a new per-connection HCI_CONN_CREATE flag and
> route all cancellation through hci_cancel_connect_sync(), which
> dispatches to a dedicated per-type cancel function. The create command
> is in exactly one of two states: still queued, or in flight. The cancel
> function holds cmd_sync_work_lock across the whole decision: the worker
> takes this lock to dequeue every entry, so while it is held a queued
> command cannot start running and an in-flight command cannot complete
> and let the next command become pending. This keeps the flag test and
> hci_cmd_sync_cancel() atomic with respect to the worker, so a queued
> command is simply dequeued, and an in-flight command owned by this
> connection is cancelled without the risk of cancelling an unrelated
> command that became pending in the meantime. CIS uses the same flag
> mechanism via HCI_CONN_CREATE_CIS but cannot be dequeued per-connection.
> 
> [...]

Here is the summary with links:
  - [v6,1/2] Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
    https://git.kernel.org/bluetooth/bluetooth-next/c/76c2d047410b
  - [v6,2/2] Bluetooth: hci_sync: Remove unused hci_cmd_sync_dequeue_once()
    https://git.kernel.org/bluetooth/bluetooth-next/c/8047d832767f

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html