[PATCH v3 1/1] Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel

[PATCH v3 1/1] Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel

[Lee Jones]

In send_cancel(), pending mesh_tx objects are removed from the
hdev->mesh_pending list and freed via mesh_send_complete().  However, if
a mesh transmission was already queued onto hdev->cmd_sync_work_list via
mesh_next(), the queued entry retains a raw pointer to mesh_tx.

When hci_cmd_sync_work later processes the entry, it attempts to execute
mesh_send_sync and its destroy callback mesh_send_start_complete using
the already freed mesh_tx pointer, leading to a use-after-free.

Fix this by invoking hci_cmd_sync_dequeue() for mesh_send_sync on the
target mesh_tx before completing it.  If the entry is found and dequeued,
its destroy callback will complete and free the object; otherwise,
mesh_send_complete() is called directly.

Additionally, ensure the transmission queue advances after cancellation
or errors.  In mesh_send_start_complete(), call mesh_next() on error
unless err is -ECANCELED, because hci_cmd_sync_dequeue() holds
hdev->cmd_sync_work_lock and calling mesh_next() synchronously would
deadlock.  Instead, advance the queue in send_cancel() once the lock is
released and if no transmission is in progress.

Fixes: b338d91703fa ("Bluetooth: Implement support for Mesh")
Signed-off-by: Lee Jones <lee@kernel.org>
---

v1 => v2: Email address switch - no functional change
v2 -> v3:
  - Advance mesh queue in send_cancel() once cmd_sync_work_lock is released
  - Advance mesh queue on error in mesh_send_start_complete(), skipping -ECANCELED to avoid self-deadlock

 net/bluetooth/mgmt.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index fd045460e236..c2cce242958b 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -2318,6 +2318,8 @@ static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err)
 		hci_dev_clear_flag(hdev, HCI_MESH_SENDING);
 		/* Send Complete Error Code for handle */
 		mesh_send_complete(hdev, mesh_tx, false);
+		if (err != -ECANCELED)
+			mesh_next(hdev, NULL, 0);
 		return;
 	}
 
@@ -2427,19 +2429,28 @@ static int send_cancel(struct hci_dev *hdev, void *data)
 		do {
 			mesh_tx = mgmt_mesh_next(hdev, cmd->sk);
 
-			if (mesh_tx)
-				mesh_send_complete(hdev, mesh_tx, false);
+			if (mesh_tx) {
+				if (!hci_cmd_sync_dequeue(hdev, mesh_send_sync,
+							  mesh_tx, NULL))
+					mesh_send_complete(hdev, mesh_tx, false);
+			}
 		} while (mesh_tx);
 	} else {
 		mesh_tx = mgmt_mesh_find(hdev, cancel->handle);
 
-		if (mesh_tx && mesh_tx->sk == cmd->sk)
-			mesh_send_complete(hdev, mesh_tx, false);
+		if (mesh_tx && mesh_tx->sk == cmd->sk) {
+			if (!hci_cmd_sync_dequeue(hdev, mesh_send_sync,
+						  mesh_tx, NULL))
+				mesh_send_complete(hdev, mesh_tx, false);
+		}
 	}
 
 	mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
 			  0, NULL, 0);
 
+	if (!hci_dev_test_flag(hdev, HCI_MESH_SENDING))
+		mesh_next(hdev, NULL, 0);
+
 	return 0;
 }
 
-- 
2.55.0.1032.g73a4cd73de-goog

RE: [v3,1/1] Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1706 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1165484/

---Test result---

Test Summary:
CheckPatch                    PASS      0.77 seconds
VerifyFixes                   PASS      0.12 seconds
VerifySignedoff               PASS      0.11 seconds
GitLint                       FAIL      0.41 seconds
SubjectPrefix                 PASS      5.05 seconds
BuildKernel                   PASS      28.89 seconds
CheckAllWarning               PASS      33.54 seconds
CheckSparse                   PASS      36.17 seconds
BuildKernel32                 PASS      29.54 seconds
CheckKernelLLVM               PASS      34.56 seconds
TestRunnerSetup               PASS      745.28 seconds
TestRunner_mgmt-tester        FAIL      9.35 seconds
TestRunner_mesh-tester        FAIL      8.15 seconds
IncrementalBuild              PASS      27.99 seconds

Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[v3,1/1] Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel

30: B1 Line exceeds max length (105>80): "  - Advance mesh queue on error in mesh_send_start_complete(), skipping -ECANCELED to avoid self-deadlock"
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
No test result found
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner
Output:
No test result found


https://github.com/bluez/bluetooth-next/pull/772

---
Regards,
Linux Bluetooth

Re: [v3,1/1] Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel

[Lee Jones]

On Tue, 15 Sep 2026, bluez.test.bot@gmail.com wrote:

> This is automated email and please do not reply to this email!
> 
> Dear submitter,
> 
> Thank you for submitting the patches to the linux bluetooth mailing list.
> This is a CI test results with your patch series:
> PW Link:https://patchwork.kernel.org/series/1165484/
> 
> ---Test result---
> 
> Test Summary:
> CheckPatch                    PASS      0.77 seconds
> VerifyFixes                   PASS      0.12 seconds
> VerifySignedoff               PASS      0.11 seconds
> GitLint                       FAIL      0.41 seconds
> SubjectPrefix                 PASS      5.05 seconds
> BuildKernel                   PASS      28.89 seconds
> CheckAllWarning               PASS      33.54 seconds
> CheckSparse                   PASS      36.17 seconds
> BuildKernel32                 PASS      29.54 seconds
> CheckKernelLLVM               PASS      34.56 seconds
> TestRunnerSetup               PASS      745.28 seconds
> TestRunner_mgmt-tester        FAIL      9.35 seconds
> TestRunner_mesh-tester        FAIL      8.15 seconds
> IncrementalBuild              PASS      27.99 seconds
> 
> Details
> ##############################
> Test: GitLint - FAIL
> Desc: Run gitlint
> Output:
> [v3,1/1] Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel
> 
> 30: B1 Line exceeds max length (105>80): "  - Advance mesh queue on error in mesh_send_start_complete(), skipping -ECANCELED to avoid self-deadlock"

This is just the change log and can be ignored.

> ##############################
> Test: TestRunner_mgmt-tester - FAIL
> Desc: Run mgmt-tester with test-runner
> Output:
> No test result found
> ##############################
> Test: TestRunner_mesh-tester - FAIL
> Desc: Run mesh-tester with test-runner
> Output:
> No test result found

So, is this my problem or the harness's?

> https://github.com/bluez/bluetooth-next/pull/772
> 
> ---
> Regards,
> Linux Bluetooth
> 


-- 
Lee Jones

Re: [PATCH v3 1/1] Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Tue, 15 Sep 2026 12:08:22 +0000 you wrote:
> In send_cancel(), pending mesh_tx objects are removed from the
> hdev->mesh_pending list and freed via mesh_send_complete().  However, if
> a mesh transmission was already queued onto hdev->cmd_sync_work_list via
> mesh_next(), the queued entry retains a raw pointer to mesh_tx.
> 
> When hci_cmd_sync_work later processes the entry, it attempts to execute
> mesh_send_sync and its destroy callback mesh_send_start_complete using
> the already freed mesh_tx pointer, leading to a use-after-free.
> 
> [...]

Here is the summary with links:
  - [v3,1/1] Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel
    https://git.kernel.org/bluetooth/bluetooth-next/c/71af682ba469

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html