[PATCH bluetooth] Bluetooth: hci_sync: take hci_dev_lock in hci_clear_adv_instance_sync

[Xiang Mei <xmei5@asu.edu>]

hci_clear_adv_instance_sync() runs on the cmd_sync worker without
hdev->lock, yet walks hdev->adv_instances and calls
hci_remove_adv_instance()/hci_find_adv_instance()/hci_get_next_instance(),
all of which require hdev->lock. The list is otherwise serialized by
hdev->lock (add/remove_advertising mutate it, read_adv_features()
traverses it), so a concurrent holder can list_del()+kfree() or list_add()
an adv_info node mid-traversal, causing a use-after-free and list
corruption. Reachable by racing MGMT_OP_SET_LE(off) or advertising timeout
expiry against MGMT add/remove/read advertising:

  BUG: KASAN: slab-use-after-free in read_adv_features+0x44b/0x500
  Read of size 8 at addr ffff888013878000 by task exploit/150
  ...
  Call Trace:
   read_adv_features (net/bluetooth/mgmt.c:8546)
   hci_sock_sendmsg (net/bluetooth/hci_sock.c:1719)
   sock_write_iter (net/socket.c:1241)
   vfs_write (fs/read_write.c:687)
   ksys_write (fs/read_write.c:739)
   do_syscall_64 (arch/x86/entry/syscall_64.c:94)
  ...
  Freed by task 52:
  ...
  Oops: general protection fault, probably for non-canonical address
  RIP: 0010:read_adv_features (net/bluetooth/mgmt.c:8548)

Hold hdev->lock around the traversal. Both callers run on the worker
without hdev->lock, so this cannot deadlock.

Fixes: c249ea9b4309 ("Bluetooth: Move Adv Instance timer to hci_sync")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Xiang Mei <xmei5@asu.edu>
---
 net/bluetooth/hci_sync.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index 3be8c3581c6c..6b566c67ee98 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -487,6 +487,8 @@ int hci_clear_adv_instance_sync(struct hci_dev *hdev, struct sock *sk,
 	int err;
 	u8 rem_inst;
 
+	hci_dev_lock(hdev);
+
 	/* Cancel any timeout concerning the removed instance(s). */
 	if (!instance || hdev->cur_adv_instance == instance)
 		cancel_adv_timeout(hdev);
@@ -525,6 +527,8 @@ int hci_clear_adv_instance_sync(struct hci_dev *hdev, struct sock *sk,
 		}
 	}
 
+	hci_dev_unlock(hdev);
+
 	if (!hdev_is_powered(hdev) || hci_dev_test_flag(hdev, HCI_ADVERTISING))
 		return 0;
 
-- 
2.43.0