[PATCH] Bluetooth: MGMT: Free unlisted commands on queue failure

[PATCH] Bluetooth: MGMT: Free unlisted commands on queue failure

[Jiale Yao]

mgmt_pending_new() allocates a command without adding it to the pending
list. set_phy_configuration() and read_local_ssp_oob_req() use this
helper before queuing synchronous HCI work.

If hci_cmd_sync_queue() fails, the work item does not take ownership of
the command. The error paths call mgmt_pending_remove(), which assumes
the command is linked and calls list_del() on its zeroed list node. This
can cause a NULL pointer dereference instead of releasing the command.

Free the unlisted command directly on queue failure.

Fixes: 302a1f674c00 ("Bluetooth: MGMT: Fix possible UAFs")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 net/bluetooth/mgmt.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 3b9c82bd2f02..66f167849942 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -4432,7 +4432,7 @@ static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
 				      MGMT_STATUS_FAILED);
 
 		if (cmd)
-			mgmt_pending_remove(cmd);
+			mgmt_pending_free(cmd);
 	}
 
 unlock:
@@ -8619,7 +8619,7 @@ static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
 				 read_local_oob_ext_data_complete);
 
 	if (err < 0) {
-		mgmt_pending_remove(cmd);
+		mgmt_pending_free(cmd);
 		return err;
 	}
 
-- 
2.34.1

RE: Bluetooth: MGMT: Free unlisted commands on queue failure

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1128 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1195135/

---Test result---

Test Summary:
CheckPatch                    PASS      0.80 seconds
VerifyFixes                   PASS      0.13 seconds
VerifySignedoff               PASS      0.14 seconds
GitLint                       PASS      0.36 seconds
SubjectPrefix                 PASS      0.13 seconds
BuildKernel                   PASS      33.66 seconds
CheckAllWarning               PASS      38.89 seconds
CheckSparse                   PASS      41.80 seconds
BuildKernel32                 PASS      33.97 seconds
CheckKernelLLVM               PASS      37.75 seconds
TestRunnerSetup               PASS      778.04 seconds
TestRunner_mgmt-tester        PASS      89.18 seconds
TestRunner_mesh-tester        PASS      11.23 seconds
IncrementalBuild              PASS      31.85 seconds



https://github.com/bluez/bluetooth-next/pull/1014

---
Regards,
Linux Bluetooth