[PATCH v2] Bluetooth: MSFT: Serialize handle map cleanup with event processing

[PATCH v2] Bluetooth: MSFT: Serialize handle map cleanup with event processing

[Cen Zhang]

MSFT monitor handle mappings must remain valid while vendor events look
up and use them under hdev->lock. msft_do_close() removes and frees the
mappings without that lock.

hci_dev_close_sync() clears HCI_UP and drains the RX workqueue before
MSFT cleanup. However, a transport callback that already passed
hci_recv_frame()'s state check can queue a vendor event after the drain
returns, if no earlier shutdown callback has quiesced reception. The
driver close callback runs after MSFT cleanup, so event processing can
overlap the unlocked removal. msft_monitor_device_evt() can then
traverse freed list entries or read handle_data->mgmt_handle after it is
freed.

Take hdev->lock while resetting monitor states and removing handle
mappings in msft_do_close(), as normal monitor cancellation already
does. An active event reader then finishes before its mapping is freed,
and later lookups see an empty handle map.

An instrumented kernel produced this KASAN report (timestamps removed
and unrelated frames omitted):

    BUG: KASAN: slab-use-after-free in msft_vendor_evt+0x1906/0x1990
    Read of size 2 at addr ffff888104df3602 by task kworker/u17:2/502

    Workqueue: hci0 hci_rx_work
    Call Trace:
      [...]
      msft_vendor_evt+0x1906/0x1990
      hci_vendor_evt+0x6f/0x90
      hci_event_packet+0x894/0xc70
      [...]
      hci_rx_work+0x3f8/0xfa0
      [...]

    Allocated by task 499:
      [...]
      msft_add_monitor_sync+0x6a8/0x10a0
      msft_add_monitor_pattern+0x7f/0xb0
      hci_add_adv_monitor+0x1fa/0x2e0
      [...]

    Freed by task 499:
      [...]
      kfree+0x307/0x580
      msft_do_close+0x238/0x750
      hci_dev_close_sync+0x546/0x1380
      [...]

    The buggy address belongs to the object at ffff888104df3600
      which belongs to the cache kmalloc-32 of size 32
    The buggy address is located 2 bytes inside of
      freed 32-byte region [ffff888104df3600, ffff888104df3620)
    [...]

Fixes: 145373cb1b1f ("Bluetooth: Add framework for Microsoft vendor extension")
Assisted-by: LLM
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
---
Changes in v2:
- Format the kasan report.

Link to v1: https://lore.kernel.org/r/pm-bluetooth-objects-candidate-0242-v6-e48e08db5265b66aeda9@gmail.com

diff --git a/net/bluetooth/msft.c b/net/bluetooth/msft.c
index 6f4b7c38a2474..2559c5b1bef02 100644
--- a/net/bluetooth/msft.c
+++ b/net/bluetooth/msft.c
@@ -683,6 +683,8 @@ void msft_do_close(struct hci_dev *hdev)
 
 	bt_dev_dbg(hdev, "Cleanup of MSFT extension");
 
+	hci_dev_lock(hdev);
+
 	/* The controller will silently remove all monitors on power off.
 	 * Therefore, remove handle_data mapping and reset monitor state.
 	 */
@@ -697,6 +699,8 @@ void msft_do_close(struct hci_dev *hdev)
 		kfree(handle_data);
 	}
 
+	hci_dev_unlock(hdev);
+
 	mutex_lock(&msft->filter_lock);
 	list_for_each_entry_safe(address_filter, n, &msft->address_filters,
 				 list) {

RE: [v2] Bluetooth: MSFT: Serialize handle map cleanup with event processing

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1605 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1183558/

---Test result---

Test Summary:
CheckPatch                    PASS      0.61 seconds
VerifyFixes                   PASS      0.10 seconds
VerifySignedoff               PASS      0.10 seconds
GitLint                       PASS      0.28 seconds
SubjectPrefix                 PASS      0.09 seconds
BuildKernel                   PASS      26.97 seconds
CheckAllWarning               PASS      30.62 seconds
CheckSparse                   PASS      32.83 seconds
BuildKernel32                 PASS      27.08 seconds
CheckKernelLLVM               PASS      28.50 seconds
TestRunnerSetup               PASS      665.60 seconds
TestRunner_l2cap-tester       PASS      13.84 seconds
TestRunner_iso-tester         PASS      10.10 seconds
TestRunner_bnep-tester        PASS      2.89 seconds
TestRunner_mgmt-tester        PASS      58.69 seconds
TestRunner_rfcomm-tester      PASS      4.15 seconds
TestRunner_sco-tester         PASS      5.27 seconds
TestRunner_ioctl-tester       PASS      4.37 seconds
TestRunner_mesh-tester        PASS      5.25 seconds
TestRunner_smp-tester         PASS      4.07 seconds
TestRunner_userchan-tester    PASS      2.95 seconds
TestRunner_6lowpan-tester     PASS      4.14 seconds
IncrementalBuild              PASS      25.63 seconds



https://github.com/bluez/bluetooth-next/pull/901

---
Regards,
Linux Bluetooth

Re: [PATCH v2] Bluetooth: MSFT: Serialize handle map cleanup with event processing

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Mon, 12 Oct 2026 10:48:06 +0800 you wrote:
> MSFT monitor handle mappings must remain valid while vendor events look
> up and use them under hdev->lock. msft_do_close() removes and frees the
> mappings without that lock.
> 
> hci_dev_close_sync() clears HCI_UP and drains the RX workqueue before
> MSFT cleanup. However, a transport callback that already passed
> hci_recv_frame()'s state check can queue a vendor event after the drain
> returns, if no earlier shutdown callback has quiesced reception. The
> driver close callback runs after MSFT cleanup, so event processing can
> overlap the unlocked removal. msft_monitor_device_evt() can then
> traverse freed list entries or read handle_data->mgmt_handle after it is
> freed.
> 
> [...]

Here is the summary with links:
  - [v2] Bluetooth: MSFT: Serialize handle map cleanup with event processing
    https://git.kernel.org/bluetooth/bluetooth-next/c/0b72281125b2

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html