Re: [PATCH BlueZ 1/2] shared/mgmt: Fix notify leak in mgmt_unregister()

[patchwork-bot+bluetooth@kernel.org]

Hello:

This series was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Thu,  8 Oct 2026 05:41:01 +0200 you wrote:
> mgmt_unregister() called from a notification callback takes the entry
> off notify_list and marks it removed instead of freeing it.
> process_notify() frees the removed entries still on notify_list once
> the walk is done, so this one is never freed and its destroy callback
> never runs.
> 
> If the callback unregisters the next entry rather than its own, this
> is also a use-after-free: queue_foreach() has already saved that
> entry's queue node, and queue_remove_if() frees it. That is the crash
> fixed for mgmt_unregister_index() by commit 872729a91632
> ("shared/mgmt: Fix crash when removing index"), still present in
> mgmt_unregister().
> 
> [...]

Here is the summary with links:
  - [BlueZ,1/2] shared/mgmt: Fix notify leak in mgmt_unregister()
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=ae23df052290
  - [BlueZ,2/2] unit/test-mgmt: Test unregistering from callbacks
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=6f5eeb402d3b

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html