* [PATCH v2 1/1] Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel
@ 2026-09-01 15:44 Lee Jones
2026-09-01 17:00 ` Greg KH
2026-09-01 17:07 ` [v2,1/1] " bluez.test.bot
0 siblings, 2 replies; 6+ messages in thread
From: Lee Jones @ 2026-09-01 15:44 UTC (permalink / raw)
To: lee, Marcel Holtmann, Luiz Augusto von Dentz, Brian Gix,
linux-bluetooth, linux-kernel
Cc: stable
In send_cancel(), pending mesh_tx objects are removed from the
hdev->mesh_pending list and freed via mesh_send_complete(). However, if
a mesh transmission was already queued onto hdev->cmd_sync_work_list
via mesh_next(), the queued entry retains a raw pointer to mesh_tx.
When hci_cmd_sync_work later processes the entry, it attempts to
execute mesh_send_sync and its destroy callback mesh_send_start_complete
using the already freed mesh_tx pointer, leading to a use-after-free.
Fix this by invoking hci_cmd_sync_dequeue() for mesh_send_sync on the
target mesh_tx before completing it. If the entry is found and dequeued,
its destroy callback will complete and free the object; otherwise,
mesh_send_complete() is called directly.
Fixes: b338d91703fa ("Bluetooth: Implement support for Mesh")
Signed-off-by: Lee Jones <lee@kernel.org>
---
v1 => v2: Email address switch - no functional change
net/bluetooth/mgmt.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index fd045460e236..f10cf64fb79e 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -2427,14 +2427,20 @@ static int send_cancel(struct hci_dev *hdev, void *data)
do {
mesh_tx = mgmt_mesh_next(hdev, cmd->sk);
- if (mesh_tx)
- mesh_send_complete(hdev, mesh_tx, false);
+ if (mesh_tx) {
+ if (!hci_cmd_sync_dequeue(hdev, mesh_send_sync,
+ mesh_tx, NULL))
+ mesh_send_complete(hdev, mesh_tx, false);
+ }
} while (mesh_tx);
} else {
mesh_tx = mgmt_mesh_find(hdev, cancel->handle);
- if (mesh_tx && mesh_tx->sk == cmd->sk)
- mesh_send_complete(hdev, mesh_tx, false);
+ if (mesh_tx && mesh_tx->sk == cmd->sk) {
+ if (!hci_cmd_sync_dequeue(hdev, mesh_send_sync,
+ mesh_tx, NULL))
+ mesh_send_complete(hdev, mesh_tx, false);
+ }
}
mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
--
2.55.0.897.gb25b4bd76c-goog
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH v2 1/1] Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel
2026-09-01 15:44 [PATCH v2 1/1] Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel Lee Jones
@ 2026-09-01 17:00 ` Greg KH
2026-09-01 17:07 ` [v2,1/1] " bluez.test.bot
1 sibling, 0 replies; 6+ messages in thread
From: Greg KH @ 2026-09-01 17:00 UTC (permalink / raw)
To: Lee Jones
Cc: Marcel Holtmann, Luiz Augusto von Dentz, Brian Gix,
linux-bluetooth, linux-kernel, stable
On Tue, Sep 01, 2026 at 03:44:26PM +0000, Lee Jones wrote:
> In send_cancel(), pending mesh_tx objects are removed from the
> hdev->mesh_pending list and freed via mesh_send_complete(). However, if
> a mesh transmission was already queued onto hdev->cmd_sync_work_list
> via mesh_next(), the queued entry retains a raw pointer to mesh_tx.
>
> When hci_cmd_sync_work later processes the entry, it attempts to
> execute mesh_send_sync and its destroy callback mesh_send_start_complete
> using the already freed mesh_tx pointer, leading to a use-after-free.
>
> Fix this by invoking hci_cmd_sync_dequeue() for mesh_send_sync on the
> target mesh_tx before completing it. If the entry is found and dequeued,
> its destroy callback will complete and free the object; otherwise,
> mesh_send_complete() is called directly.
>
> Fixes: b338d91703fa ("Bluetooth: Implement support for Mesh")
> Signed-off-by: Lee Jones <lee@kernel.org>
> ---
>
> v1 => v2: Email address switch - no functional change
>
> net/bluetooth/mgmt.c | 14 ++++++++++----
> 1 file changed, 10 insertions(+), 4 deletions(-)
>
<formletter>
This is not the correct way to submit patches for inclusion in the
stable kernel tree. Please read:
https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
for how to do this properly.
</formletter>
^ permalink raw reply [flat|nested] 6+ messages in thread
* RE: [v2,1/1] Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel
2026-09-01 15:44 [PATCH v2 1/1] Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel Lee Jones
2026-09-01 17:00 ` Greg KH
@ 2026-09-01 17:07 ` bluez.test.bot
2026-09-01 17:10 ` Luiz Augusto von Dentz
1 sibling, 1 reply; 6+ messages in thread
From: bluez.test.bot @ 2026-09-01 17:07 UTC (permalink / raw)
To: linux-bluetooth, lee
[-- Attachment #1: Type: text/plain, Size: 1903 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1155482
---Test result---
Test Summary:
CheckPatch PASS 0.75 seconds
VerifyFixes PASS 0.10 seconds
VerifySignedoff PASS 0.08 seconds
GitLint PASS 0.22 seconds
SubjectPrefix PASS 0.07 seconds
BuildKernel PASS 28.57 seconds
CheckAllWarning PASS 31.59 seconds
CheckSparse PASS 29.62 seconds
BuildKernel32 PASS 27.44 seconds
CheckKernelLLVM SKIP 0.00 seconds
TestRunnerSetup PASS 510.88 seconds
TestRunner_mgmt-tester FAIL 233.06 seconds
TestRunner_mesh-tester FAIL 26.88 seconds
IncrementalBuild PASS 26.40 seconds
Details
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
Total: 501, Passed: 496 (99.0%), Failed: 1, Not Run: 4
Failed Test Cases
Read Exp Feature - Success Failed 0.262 seconds
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner
Output:
Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0
Failed Test Cases
Mesh - Send cancel - 1 Timed out 2.732 seconds
Mesh - Send cancel - 2 Timed out 1.986 seconds
https://github.com/bluez/bluetooth-next/pull/681
---
Regards,
Linux Bluetooth
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [v2,1/1] Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel
2026-09-01 17:07 ` [v2,1/1] " bluez.test.bot
@ 2026-09-01 17:10 ` Luiz Augusto von Dentz
2026-09-01 17:22 ` Luiz Augusto von Dentz
0 siblings, 1 reply; 6+ messages in thread
From: Luiz Augusto von Dentz @ 2026-09-01 17:10 UTC (permalink / raw)
To: linux-bluetooth; +Cc: lee
Hi Lee,
On Tue, Sep 1, 2026 at 1:07 PM <bluez.test.bot@gmail.com> wrote:
>
> This is automated email and please do not reply to this email!
>
> Dear submitter,
>
> Thank you for submitting the patches to the linux bluetooth mailing list.
> This is a CI test results with your patch series:
> PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1155482
>
> ---Test result---
>
> Test Summary:
> CheckPatch PASS 0.75 seconds
> VerifyFixes PASS 0.10 seconds
> VerifySignedoff PASS 0.08 seconds
> GitLint PASS 0.22 seconds
> SubjectPrefix PASS 0.07 seconds
> BuildKernel PASS 28.57 seconds
> CheckAllWarning PASS 31.59 seconds
> CheckSparse PASS 29.62 seconds
> BuildKernel32 PASS 27.44 seconds
> CheckKernelLLVM SKIP 0.00 seconds
> TestRunnerSetup PASS 510.88 seconds
> TestRunner_mgmt-tester FAIL 233.06 seconds
> TestRunner_mesh-tester FAIL 26.88 seconds
> IncrementalBuild PASS 26.40 seconds
>
> Details
> ##############################
> Test: CheckKernelLLVM - SKIP
> Desc: Build kernel with LLVM + context analysis
> Output:
> Clang not found
> ##############################
> Test: TestRunner_mgmt-tester - FAIL
> Desc: Run mgmt-tester with test-runner
> Output:
> Total: 501, Passed: 496 (99.0%), Failed: 1, Not Run: 4
>
> Failed Test Cases
> Read Exp Feature - Success Failed 0.262 seconds
> ##############################
> Test: TestRunner_mesh-tester - FAIL
> Desc: Run mesh-tester with test-runner
> Output:
> Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0
>
> Failed Test Cases
> Mesh - Send cancel - 1 Timed out 2.732 seconds
> Mesh - Send cancel - 2 Timed out 1.986 seconds
These are preexisting errorrs but I was hoping your changes would address them.
>
> https://github.com/bluez/bluetooth-next/pull/681
>
> ---
> Regards,
> Linux Bluetooth
>
--
Luiz Augusto von Dentz
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [v2,1/1] Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel
2026-09-01 17:10 ` Luiz Augusto von Dentz
@ 2026-09-01 17:22 ` Luiz Augusto von Dentz
2026-09-02 10:24 ` Lee Jones
0 siblings, 1 reply; 6+ messages in thread
From: Luiz Augusto von Dentz @ 2026-09-01 17:22 UTC (permalink / raw)
To: linux-bluetooth; +Cc: lee
Hi Lee,
On Tue, Sep 1, 2026 at 1:10 PM Luiz Augusto von Dentz
<luiz.dentz@gmail.com> wrote:
>
> Hi Lee,
>
> On Tue, Sep 1, 2026 at 1:07 PM <bluez.test.bot@gmail.com> wrote:
> >
> > This is automated email and please do not reply to this email!
> >
> > Dear submitter,
> >
> > Thank you for submitting the patches to the linux bluetooth mailing list.
> > This is a CI test results with your patch series:
> > PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1155482
> >
> > ---Test result---
> >
> > Test Summary:
> > CheckPatch PASS 0.75 seconds
> > VerifyFixes PASS 0.10 seconds
> > VerifySignedoff PASS 0.08 seconds
> > GitLint PASS 0.22 seconds
> > SubjectPrefix PASS 0.07 seconds
> > BuildKernel PASS 28.57 seconds
> > CheckAllWarning PASS 31.59 seconds
> > CheckSparse PASS 29.62 seconds
> > BuildKernel32 PASS 27.44 seconds
> > CheckKernelLLVM SKIP 0.00 seconds
> > TestRunnerSetup PASS 510.88 seconds
> > TestRunner_mgmt-tester FAIL 233.06 seconds
> > TestRunner_mesh-tester FAIL 26.88 seconds
> > IncrementalBuild PASS 26.40 seconds
> >
> > Details
> > ##############################
> > Test: CheckKernelLLVM - SKIP
> > Desc: Build kernel with LLVM + context analysis
> > Output:
> > Clang not found
> > ##############################
> > Test: TestRunner_mgmt-tester - FAIL
> > Desc: Run mgmt-tester with test-runner
> > Output:
> > Total: 501, Passed: 496 (99.0%), Failed: 1, Not Run: 4
> >
> > Failed Test Cases
> > Read Exp Feature - Success Failed 0.262 seconds
> > ##############################
> > Test: TestRunner_mesh-tester - FAIL
> > Desc: Run mesh-tester with test-runner
> > Output:
> > Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0
> >
> > Failed Test Cases
> > Mesh - Send cancel - 1 Timed out 2.732 seconds
> > Mesh - Send cancel - 2 Timed out 1.986 seconds
>
> These are preexisting errorrs but I was hoping your changes would address them.
Looks like there are more problems:
https://sashiko.dev/#/patchset/20260901154427.3991920-1-lee%40kernel.org
> >
> > https://github.com/bluez/bluetooth-next/pull/681
> >
> > ---
> > Regards,
> > Linux Bluetooth
> >
>
>
> --
> Luiz Augusto von Dentz
--
Luiz Augusto von Dentz
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [v2,1/1] Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel
2026-09-01 17:22 ` Luiz Augusto von Dentz
@ 2026-09-02 10:24 ` Lee Jones
0 siblings, 0 replies; 6+ messages in thread
From: Lee Jones @ 2026-09-02 10:24 UTC (permalink / raw)
To: Luiz Augusto von Dentz; +Cc: linux-bluetooth
On Tue, 01 Sep 2026, Luiz Augusto von Dentz wrote:
> Hi Lee,
>
> On Tue, Sep 1, 2026 at 1:10 PM Luiz Augusto von Dentz
> <luiz.dentz@gmail.com> wrote:
> >
> > Hi Lee,
> >
> > On Tue, Sep 1, 2026 at 1:07 PM <bluez.test.bot@gmail.com> wrote:
> > >
> > > This is automated email and please do not reply to this email!
> > >
> > > Dear submitter,
> > >
> > > Thank you for submitting the patches to the linux bluetooth mailing list.
> > > This is a CI test results with your patch series:
> > > PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1155482
> > >
> > > ---Test result---
> > >
> > > Test Summary:
> > > CheckPatch PASS 0.75 seconds
> > > VerifyFixes PASS 0.10 seconds
> > > VerifySignedoff PASS 0.08 seconds
> > > GitLint PASS 0.22 seconds
> > > SubjectPrefix PASS 0.07 seconds
> > > BuildKernel PASS 28.57 seconds
> > > CheckAllWarning PASS 31.59 seconds
> > > CheckSparse PASS 29.62 seconds
> > > BuildKernel32 PASS 27.44 seconds
> > > CheckKernelLLVM SKIP 0.00 seconds
> > > TestRunnerSetup PASS 510.88 seconds
> > > TestRunner_mgmt-tester FAIL 233.06 seconds
> > > TestRunner_mesh-tester FAIL 26.88 seconds
> > > IncrementalBuild PASS 26.40 seconds
> > >
> > > Details
> > > ##############################
> > > Test: CheckKernelLLVM - SKIP
> > > Desc: Build kernel with LLVM + context analysis
> > > Output:
> > > Clang not found
> > > ##############################
> > > Test: TestRunner_mgmt-tester - FAIL
> > > Desc: Run mgmt-tester with test-runner
> > > Output:
> > > Total: 501, Passed: 496 (99.0%), Failed: 1, Not Run: 4
> > >
> > > Failed Test Cases
> > > Read Exp Feature - Success Failed 0.262 seconds
> > > ##############################
> > > Test: TestRunner_mesh-tester - FAIL
> > > Desc: Run mesh-tester with test-runner
> > > Output:
> > > Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0
> > >
> > > Failed Test Cases
> > > Mesh - Send cancel - 1 Timed out 2.732 seconds
> > > Mesh - Send cancel - 2 Timed out 1.986 seconds
> >
> > These are preexisting errorrs but I was hoping your changes would address them.
>
> Looks like there are more problems:
>
> https://sashiko.dev/#/patchset/20260901154427.3991920-1-lee%40kernel.org
That's annoying! I ran Sashiko on this locally before pushing.
Looking now.
--
Lee Jones
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-09-02 10:24 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-01 15:44 [PATCH v2 1/1] Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel Lee Jones
2026-09-01 17:00 ` Greg KH
2026-09-01 17:07 ` [v2,1/1] " bluez.test.bot
2026-09-01 17:10 ` Luiz Augusto von Dentz
2026-09-01 17:22 ` Luiz Augusto von Dentz
2026-09-02 10:24 ` Lee Jones
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox