[PATCH v2] Bluetooth: Fix Use-After-Free in hci_unregister_dev

[PATCH v2] Bluetooth: Fix Use-After-Free in hci_unregister_dev

[Jordan Walters]

The hci_unregister_dev() function fails to safely cancel the cmd_timer
and ncmd_timer before freeing the hci_dev structure. If an asynchronous
event or timeout occurs during device teardown, the timer callbacks
may execute after the device has been freed, leading to a KASAN
slab-use-after-free panic.

In v1, the timers were disabled too early in the teardown sequence,
which caused deadlocks in CI testing (mgmt-tester and mesh-tester)
because the HCI teardown process relies on these timers to safely
time out the HCI_OP_RESET command.

This patch adds cancel_delayed_work_sync() calls at the very end
of hci_unregister_dev() after all teardown procedures have completed,
guaranteeing the timers are fully flushed before the struct is freed.

Signed-off-by: Jordan Walters <jaggyaur@gmail.com>
---
 net/bluetooth/hci_core.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 28d7929dc59..3db1b3738b5 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -2698,6 +2698,9 @@ void hci_unregister_dev(struct hci_dev *hdev)
 		rfkill_unregister(hdev->rfkill);
 		rfkill_destroy(hdev->rfkill);
 	}
 
+	cancel_delayed_work_sync(&hdev->cmd_timer);
+	cancel_delayed_work_sync(&hdev->ncmd_timer);
+
 	hci_dev_put(hdev);
 }

RE: [v2] Bluetooth: Fix Use-After-Free in hci_unregister_dev

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 551 bytes --]

This is an automated email and please do not reply to this email.

Dear Submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
While preparing the CI tests, the patches you submitted couldn't be applied to the current HEAD of the repository.

----- Output -----

error: patch failed: net/bluetooth/hci_core.c:2698
error: net/bluetooth/hci_core.c: patch does not apply
hint: Use 'git am --show-current-patch' to see the failed patch

Please resolve the issue and submit the patches again.


---
Regards,
Linux Bluetooth