Linux bluetooth development
 help / color / mirror / Atom feed
* [PATCH] Bluetooth: Fix Use-After-Free in hci_unregister_dev
@ 2026-06-02 21:05 Jordan Walters
  2026-06-02 21:39 ` bluez.test.bot
  0 siblings, 1 reply; 3+ messages in thread
From: Jordan Walters @ 2026-06-02 21:05 UTC (permalink / raw)
  To: linux-bluetooth, linux-kernel; +Cc: Luiz Augusto von Dentz, marcel@holtmann.org

The hci_unregister_dev() function fails to disable the cmd_timer and ncmd_timer
before freeing the hci_dev structure. If an asynchronous event or timeout occurs
during device teardown, the timer callbacks may execute after the device has
been freed, leading to a KASAN slab-use-after-free panic.

This patch adds the necessary disable_delayed_work_sync() calls to
securely flush
the timers before the teardown sequence proceeds.

Signed-off-by: Jordan Walters <gloambit@gloam.sh>
---
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index a1b2c3d4e..f5g6h7i8j 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -2671,6 +2671,8 @@ void hci_unregister_dev(struct hci_dev *hdev)
     hci_dev_do_close(hdev);

     hci_cancel_cmd_sync(hdev, -ENODEV);
+    disable_delayed_work_sync(&hdev->cmd_timer);
+    disable_delayed_work_sync(&hdev->ncmd_timer);

     /* Sync with hci_rx_work */
     cancel_work_sync(&hdev->rx_work);

^ permalink raw reply	[flat|nested] 3+ messages in thread
* [PATCH] Bluetooth: Fix Use-After-Free in hci_unregister_dev
@ 2026-06-02 23:34 Jordan Walters
  2026-06-03  2:40 ` bluez.test.bot
  0 siblings, 1 reply; 3+ messages in thread
From: Jordan Walters @ 2026-06-02 23:34 UTC (permalink / raw)
  To: linux-bluetooth, linux-kernel

The hci_unregister_dev() function fails to disable the cmd_timer and ncmd_timer
before freeing the hci_dev structure. If an asynchronous event or timeout occurs
during device teardown, the timer callbacks may execute after the device has
been freed, leading to a KASAN slab-use-after-free panic.

This patch adds the necessary disable_delayed_work_sync() calls to securely flush
the timers before the teardown sequence proceeds.

Signed-off-by: Jordan Walters <gloambit@gloam.sh>
---
 net/bluetooth/hci_core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 28d7929dc59..1cbc666527c 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -2671,6 +2671,8 @@ void hci_unregister_dev(struct hci_dev *hdev)
 	disable_work_sync(&hdev->tx_work);
 	disable_work_sync(&hdev->power_on);
 	disable_work_sync(&hdev->error_reset);
+	disable_delayed_work_sync(&hdev->cmd_timer);
+	disable_delayed_work_sync(&hdev->ncmd_timer);
 
 	hci_cmd_sync_clear(hdev);
 

^ permalink raw reply related	[flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-06-03  2:40 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-02 21:05 [PATCH] Bluetooth: Fix Use-After-Free in hci_unregister_dev Jordan Walters
2026-06-02 21:39 ` bluez.test.bot
  -- strict thread matches above, loose matches on Subject: below --
2026-06-02 23:34 [PATCH] " Jordan Walters
2026-06-03  2:40 ` bluez.test.bot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox