From nobody Tue Sep 29 13:19:20 2026 Received: from mail-yw1-f176.google.com (mail-yw1-f176.google.com [209.85.128.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2AE6B3947B5 for ; Fri, 7 Aug 2026 07:09:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.176 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786086570; cv=none; b=t1BzajyBV/T8IGOqyzrwQaNwXDN8x4iHwUmj2oPS5FnzhtVDT3g1vGNg8L42KpKIRp1XQ0snqjMkL9OfFWsu9/ns+rMvJ+pJNeOENv8OF7W37+Dg+bFk5hXGYTv66nqdu3Jmp75mPleYu2hkbE7tUjB/O5UffUv1vrRm73aF6Fk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786086570; c=relaxed/simple; bh=QxkayMbqWX5LGS74vcDIcAT7rAfRVg0XdeRJ09POBBQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=N5MwjkYRofzLx1k2/pPwQOveVUMjZUQSZChwGGEHOrbtTEkIN+UxhQiUshyBlnbqY2cpq/NPC1sFiWhRixgOe0AY44WsOSPAiR3OHAtT6ie7w4YjIKeS7b8ugwUs1SH9zKZ4iFFYc35YNAH7axIttoLR0QlueQ98Is9UJLoLMDo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=xbow.com; spf=pass smtp.mailfrom=xbow.com; dkim=pass (2048-bit key) header.d=xbow.com header.i=@xbow.com header.b=Mbo+uqYT; arc=none smtp.client-ip=209.85.128.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=xbow.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=xbow.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=xbow.com header.i=@xbow.com header.b="Mbo+uqYT" Received: by mail-yw1-f176.google.com with SMTP id 00721157ae682-80c5cb9a888so36972837b3.3 for ; Fri, 07 Aug 2026 00:09:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=xbow.com; s=google; t=1786086568; x=1786691368; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Bf+D41gEUq1+J8o+TQe2hizsluGhOg1+Pa0bHuY97Ck=; b=Mbo+uqYTm1Ql1CaGBhKx8wSLtV513CUpTMUPGQ9/T9rHej9Vhg3kIDG+5Ztv6UDoiU OIRv8rEUnwvmRQfgBRxdqhZbJAX7fFYvajPVI5Hlz8iTS3iIeQdyNCstdwVfhmcG837a SnWYJ6JkTB2fN5BzmsrwlQw2gPHSWZ90VdkePLkkA3yzLNr+vpNkxcg0hQRv7tRV+0Cr M6G4H+IDZRLF9wwCjvAQrtO2xcx0GFyqvGeuoKN4NklUWrRW9Mfkn3SPU3HLlUM/OBb4 WJif/lycKnz+w4O15LKit0E/eng/cbK4zZ2p/8meGVHunRhG49ehthumk9UZTbxfms5U rpdg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786086568; x=1786691368; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Bf+D41gEUq1+J8o+TQe2hizsluGhOg1+Pa0bHuY97Ck=; b=htxJ6ZutENKqCwPE+hpVWjzX+Dvr0+aI25blcP+bCwV/jB31BVykC+yLYcugIe+EPI nHCXrB1xpiNJd9rP/leO4joOwIKCKMDhX2OUxjp6vXq8uajOynyIpY5pZIRwtKSNbrKC hDHcaRVDUm6IKoUrymGK1ckmkhw25/70usG7moUB7NjowN22/hUWYfZd6Ns8VTefDFAp EbuywhEMt8B+thsxSbaW8P4iIASI3NDMnCPSc2qW9HjV7Zk8zFme+m54wGvOg6aG9+si FES56JodD7jkBik22ZNiq4tLE6uctEBtErB7ocWCffvYmtiH4Nxpu14598uCz2R1oNw9 nrjw== X-Forwarded-Encrypted: i=1; AHgh+RoZefA650aS8enDXXScKsVTVL8ImnIJWYE2Qp5eu9noAonYPSrpPY+Wf3gwSSnwVF2oUDDDOkcqcKtcsBw=@vger.kernel.org X-Gm-Message-State: AOJu0Yx0vbtjAvkgzZqQFstutKgXYi1gsF8UEvKpxmoe5rIL6wS8VYd1 rPaNDBVFdMGdROYpqEk3ANRAobUR3hqRQqZySR/eWPJKgT0GTnw/rXtjBl4XJzj5kOVkaaJG7dv hnR3qxaAg3w== X-Gm-Gg: AR+sD106GUHxYERm+r+5ya50otPPUqDwkjPuZb6eY0YwbEvCP7LS+xXtaxsfM1rc8wJ Wqk4zV9APGHwQQRMuPnl09AXTSMJn98EoThqObF3Qw7j1f6/PxGmDh3qrnSyXqszVS4INTq4HvA lUCulbNUnKPd9LsxcdB+jWuRTtzy+2NFbpUdagOdy+5sS/GnmwFhx17tkAMX2vkAH0ypisTFCwU A2u4RsdMl65DtRgr9yjIMu8AzLgmBXfdu5d/0V3GV9czsWe3sNjKJpev+cIyFTzmLnjmcQ501l5 +IqQ1R6xORDLbF+raQGWDZGRW9o7VlmAY2EyJMTtMpqztIEa54/b/A+HTNv4fTp9HA2lg4IRPJa XX8fYDUcIvFydd+2v4tT6sZs8Ug4z4gXMC1XIM5yzGIQiFTse56vj3wQ/R2oqHDU4zN/VjZ+nPw ApgC3BRp6n9zGPXrUM7FNLqU3awYr6IzTyyJJz7bqmuA7AyClkvy+FHVfdXufTLvD0TSKh5CsH9 M/HrEgU4dblR+WW7RGqr+H5aF42xQV21F74KBAzQ8nbOkbMYnnMPVmM39fuFfLroRnBhGuKSoaa e/X5bdXrlyvpEtDXpeFTmn0/OspVefjJdPo= X-Received: by 2002:a05:690c:2611:b0:80c:76fd:f732 with SMTP id 00721157ae682-82022539415mr125606277b3.26.1786086567779; Fri, 07 Aug 2026 00:09:27 -0700 (PDT) Received: from buildmachine.tailf331da.ts.net (ec2-3-14-143-233.us-east-2.compute.amazonaws.com. [3.14.143.233]) by smtp.gmail.com with ESMTPSA id 00721157ae682-823f0e64324sm5230367b3.19.2026.08.07.00.09.24 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Fri, 07 Aug 2026 00:09:27 -0700 (PDT) From: Baul Lee To: Luiz Augusto von Dentz , Marcel Holtmann , Brian Gix Cc: Baul Lee , Luiz Augusto von Dentz , Dmitry Antipov , linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, federico.kirschbaum@xbow.com, stable@vger.kernel.org Subject: [PATCH 1/3] Bluetooth: MGMT: remove the mesh walk from the socket destructor Date: Fri, 7 Aug 2026 16:09:14 +0900 Message-ID: <20260807070916.85771-2-baul.lee@xbow.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260807070916.85771-1-baul.lee@xbow.com> References: <20260807070916.85771-1-baul.lee@xbow.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" hci_sock_destruct() calls mgmt_cleanup(), which walks hdev->mesh_pending on every registered controller looking for entries owned by the socket being destroyed, and completes the ones it finds. It can never find one. mgmt_mesh_add() takes a reference on the owning socket for every entry it links onto the list and mgmt_mesh_remove() drops it again, so the socket's reference count cannot reach zero while one of its entries is there. The walk still races the list. mgmt_mesh_next() loads mesh_tx->sk from every node it passes, including nodes owned by other sockets, while the cmd_sync worker unlinks and frees nodes of the same list under a different lock. mgmt_cleanup() cannot take hdev->lock: it holds read_lock(&hci_dev_list_lock) across the walk, and hdev->lock sleeps. It is the one user of hdev->mesh_pending that cannot be brought under that lock. Remove mgmt_cleanup() and its caller. Discovered by XBOW, triaged by Baul Lee Fixes: b338d91703fa ("Bluetooth: Implement support for Mesh") Cc: stable@vger.kernel.org Signed-off-by: Baul Lee --- include/net/bluetooth/bluetooth.h | 1 - net/bluetooth/hci_sock.c | 1 - net/bluetooth/mgmt.c | 19 ------------------- 3 files changed, 21 deletions(-) diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/blue= tooth.h index b624da5026f5..f49cec5f01e6 100644 --- a/include/net/bluetooth/bluetooth.h +++ b/include/net/bluetooth/bluetooth.h @@ -675,7 +675,6 @@ static inline bool iso_inited(void) =20 int mgmt_init(void); void mgmt_exit(void); -void mgmt_cleanup(struct sock *sk); =20 void bt_sock_reclassify_lock(struct sock *sk, int proto); =20 diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c index 070ca388f9ac..5073f4fc3289 100644 --- a/net/bluetooth/hci_sock.c +++ b/net/bluetooth/hci_sock.c @@ -2164,7 +2164,6 @@ static int hci_sock_getsockopt(struct socket *sock, i= nt level, int optname, =20 static void hci_sock_destruct(struct sock *sk) { - mgmt_cleanup(sk); skb_queue_purge(&sk->sk_receive_queue); skb_queue_purge(&sk->sk_write_queue); skb_queue_purge(&sk->sk_error_queue); diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c index 167d75e34526..f13e73e3814f 100644 --- a/net/bluetooth/mgmt.c +++ b/net/bluetooth/mgmt.c @@ -10739,22 +10739,3 @@ void mgmt_exit(void) { hci_mgmt_chan_unregister(&chan); } - -void mgmt_cleanup(struct sock *sk) -{ - struct mgmt_mesh_tx *mesh_tx; - struct hci_dev *hdev; - - read_lock(&hci_dev_list_lock); - - list_for_each_entry(hdev, &hci_dev_list, list) { - do { - mesh_tx =3D mgmt_mesh_next(hdev, sk); - - if (mesh_tx) - mesh_send_complete(hdev, mesh_tx, true); - } while (mesh_tx); - } - - read_unlock(&hci_dev_list_lock); -} --=20 2.50.1 (Apple Git-155) From nobody Tue Sep 29 13:19:20 2026 Received: from mail-yw1-f181.google.com (mail-yw1-f181.google.com [209.85.128.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1FA8D3ACA6E for ; Fri, 7 Aug 2026 07:09:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.181 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786086575; cv=none; b=JmDlXu/rszHjuN96z1iA9/Hk/hgPRGe/gWwms+xrM+poSEwzRD9mgKew0YuXVkoVYB+yaboVJS7GRG3zvU5F7K53mAoJaHtA64MAnamgJ37LE9bMNEMCIZsAjz77ZUazq/VpiZQsJ8mCCKYnqgRS0rxhbu98l+UWwHsgkF1y+XY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786086575; c=relaxed/simple; bh=V023K0hi+oTiFbDLsSZ09eMRO04DxQuoCoXXxa/kW1M=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=JTT6ke/aBIa9JPELlmH7szctBWjHILJMCdsRTmsW049Bw8IU9kzSg4YcUHiH+dj8YN1Fe7yrhEgQQc597+TEjAzwUO4EIVSg2drzwSVmW1kQ5BGlW5zpi37Me35S2RxTupMGeAOFargU593kLYO3115KSGJ384vaOtl0f+TQBPA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=xbow.com; spf=pass smtp.mailfrom=xbow.com; dkim=pass (2048-bit key) header.d=xbow.com header.i=@xbow.com header.b=RXPIn0Un; arc=none smtp.client-ip=209.85.128.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=xbow.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=xbow.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=xbow.com header.i=@xbow.com header.b="RXPIn0Un" Received: by mail-yw1-f181.google.com with SMTP id 00721157ae682-81e8fa1b8d6so43205327b3.1 for ; Fri, 07 Aug 2026 00:09:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=xbow.com; s=google; t=1786086572; x=1786691372; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=37V6VQj6ErQve4E9JugrxkbUJ1j5iYQpNy21OTRUL8c=; b=RXPIn0UnQYlgeFRd047u3mvtsblpsPMAPuEVb8jKeoL2Y6x+vQu2ZIT7XI3lggHYlv gHRsGJfMBlsD5BDYXCZk/gu7EJackap+ivcbwWU3uXl0Ojq5FyjtDF0Jtncm3KD8vdmz CzkKhYG3RJbg87IRlSUiMG1oJPDS24u0X244pGnKWUd7MMXJZmp2qXWZneraYe4vdvdy PFnME4YzTKziHVXMip+N3a8AENxPgmIpK/0F9UQvmtkdHHRIX4y5ddjEIuTOteF25FE1 lY6ktygKmHIAQq7bQ6PfYnYaEQeR+ENv+rr1ca/K9OaxZYE2EZ6+0WAg+IutU/m+U1Ac FrxA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786086572; x=1786691372; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=37V6VQj6ErQve4E9JugrxkbUJ1j5iYQpNy21OTRUL8c=; b=pNIO+lTSZA/wEZhwgXjT8rCzt1t2ay+gnUJF4K+ws2ikj0VET84IVQ2PSLOiDYAMgJ SKqQpBD/UaZJOoqdKHhCAh8BrKyWOcu3r8X7lzBEFXkt+ZmEELFrPt4X4XDbZKNKnx3z 6I3cIKCOW0j7iUHM49WekV6QnriA8bnlV+JUTNRJfXTWQAIpsVY7jeXNgmFCHT9CUP+l R8L+jwjq9BiNBH6a5CfvVjgKsgYSYSOsEsKySk5H4hxmLmKE2R8d8/zXikVTtAZqu/rG KNFip3cOeRDDR1d4Zn41TSvMlqrqQP7zRcDB8f1VShTu8tNbpjXm+cHsQX4k9lp0horo DFJQ== X-Forwarded-Encrypted: i=1; AHgh+Rr+pbASnNpwrc8jsBaewX0wFq8VhQCV2taOA4TOOdfYMpnwdlJyvKYBNei8FkIMwDD01MJ7lSUKTljIX3M=@vger.kernel.org X-Gm-Message-State: AOJu0YzvwZJqm4u5O94r9RKylJ8AvjlEF+nHgfvGEa0gu8Py4Z+RLzi3 LEArcImoYgasuEtdCHOx/h8zRnWHisNJ0y3P1i7TzV5l3BUmoL3G7pEKcvUsIXyPlAg= X-Gm-Gg: AR+sD12/XmLq+SofN8fVV4T3fPdB+CTmFd0gqYQmY0XU8kWP3uzVugDUzO8O/+/h8Uz /JsnG/Rj2oj99rEKsHcVUK9lOR4lhQV675E00puVa0YwHCt1CoOHam8tmX2WScVuLyoSnbncTpl 0d3GZDpFCDSgkqM/AVj4iTOYyiBzoo95PieekbjEbwmbCyIE35rjAeSAy+vWPVgW4lStNYjrku/ SG8PuM0/AevQnDu5X31cDGgg29S9ZiOaySOJemUrlq9ke14exQhnftecLgZnA2d4/20jO016Et+ vQmfqb2ol9vsyWKLKfs4tx0AnccY/oJFYCVq6HhKqyc+J8N9++jWtu2tjxwYWryzFm2PWdqbnrH pE4kP5Vda3bxELuNZZaF17HUkby0zyDZOun7pYpym0396TQhf6sDL7GO2RV4Rw1A+LwksAiWcm6 aibbe732SPSNQ9KG9Bw6UfoyTUuGjAG02OOycAP6ur4MBCT8hjAsJbsD8sOsOLf5UDy/KKUdPL0 gSQZUJ8NKZBNGzjV5SM44lwJVDmYO9TRLQBZVDGxYrHUXbra4B5WODM3B1qNCIjGkdDIwbK0buM 2YcJkSCYnXAcx3Ip0P1Vc4DIFrrv+FonPb0= X-Received: by 2002:a05:690c:4dc5:10b0:823:2ad3:d39a with SMTP id 00721157ae682-8232ad3da8cmr24377367b3.32.1786086571847; Fri, 07 Aug 2026 00:09:31 -0700 (PDT) Received: from buildmachine.tailf331da.ts.net (ec2-3-14-143-233.us-east-2.compute.amazonaws.com. [3.14.143.233]) by smtp.gmail.com with ESMTPSA id 00721157ae682-823f0e64324sm5230367b3.19.2026.08.07.00.09.28 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Fri, 07 Aug 2026 00:09:31 -0700 (PDT) From: Baul Lee To: Luiz Augusto von Dentz , Marcel Holtmann , Brian Gix Cc: Baul Lee , Luiz Augusto von Dentz , Dmitry Antipov , linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, federico.kirschbaum@xbow.com, stable@vger.kernel.org Subject: [PATCH 2/3] Bluetooth: MGMT: protect hdev->mesh_pending with hdev->lock Date: Fri, 7 Aug 2026 16:09:15 +0900 Message-ID: <20260807070916.85771-3-baul.lee@xbow.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260807070916.85771-1-baul.lee@xbow.com> References: <20260807070916.85771-1-baul.lee@xbow.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" hdev->mesh_pending carries the queued struct mgmt_mesh_tx of the mesh mgmt interface. It is extended and walked from syscall context under hci_dev_lock(hdev), in mgmt_mesh_add() and mgmt_mesh_foreach(), and it is unlinked and freed from the hci_cmd_sync worker under hci_req_sync_lock(hdev), in send_cancel(), mesh_send_done_sync() and mesh_next(). The two sides hold different mutexes, so the list has no protection: MGMT_OP_MESH_READ_FEATURES on one socket can be mid-walk while MGMT_OP_MESH_SEND_CANCEL on another frees the entry it is standing on. [ 47.418949] BUG: KASAN: slab-use-after-free in send_count+0x4c/0x6c [ 47.419029] Read of size 1 at addr ffff000015943228 by task c2_race/191 [ 47.419546] send_count+0x4c/0x6c [ 47.419591] mgmt_mesh_foreach+0x68/0x100 [ 47.419637] mesh_features+0x180/0x184 [ 47.421345] Freed by task 59: [ 47.421555] mgmt_mesh_remove+0x94/0x110 [ 47.421589] send_cancel+0xd8/0x1cc [ 47.421627] hci_cmd_sync_work+0xac/0x128 Offset 40 of the freed 96-byte object is mesh_tx->handle, the byte send_count() puts in the MESH_READ_FEATURES reply. The walk also follows the LIST_POISON1 left by the concurrent list_del(), which oopses with hci_dev_lock held and never released, so every later mgmt command on that controller blocks. The same missing lock lets the worker free the object under mesh_send(), which reads mesh_tx->handle into the command complete after queueing: [ 41.093914] BUG: KASAN: slab-use-after-free in mgmt_cmd_complete+0xd0/0x= 210 [ 41.094353] Read of size 1 at addr ffff00000a0dea28 by task c1_poc/162 [ 41.096944] mgmt_mesh_remove+0x94/0x110 [ 41.096975] mesh_send_start_complete+0x128/0x160 That read already sits inside mesh_send()'s hci_dev_lock() section; it is the worker side that is missing the lock. Take hci_dev_lock(hdev) on the worker side, around the list work only and not around hci_disable_advertising_sync(), and assert it in the helpers that walk or extend the list. hci_req_sync_lock -> hdev->lock is the order this subsystem already uses: hci_cmd_sync_work() calls entry->func under req_lock, and callbacks such as hci_update_eir_sync() take hci_dev_lock() inside it. mesh_next() and mesh_send_start_complete() are destroy callbacks, and hci_cmd_sync_clear() runs a destroy callback under cmd_sync_work_lock, which every mgmt caller of hci_cmd_sync_queue() takes with hdev->lock already held. Both therefore return before hci_dev_lock() when err is -ECANCELED, as the other destroy callbacks in this file do. Without those returns lockdep reports a circular dependency, reached by closing /dev/vhci while a mesh entry is queued behind a parked req_workqueue: [ 78.211873] ffff00001b0340b8 (&hdev->lock){+.+.}-{4:4}, at: mesh_send_st= art_complete+0x88/0xf4 but task is already holding lock: [ 78.212596] ffff00001b0347c0 (&hdev->cmd_sync_work_lock){+.+.}-{4:4}, at= : hci_cmd_sync_clear+0x60/0xd4 -> #1 (&hdev->cmd_sync_work_lock){+.+.}-{4:4}: [ 78.214268] hci_update_passive_scan+0x6c/0x84 [ 78.214455] mgmt_set_powered_complete+0x1b0/0x1f8 The other leg of the cycle, mgmt_set_powered_complete() calling hci_update_passive_scan() with hdev->lock held, is an existing in-tree path. The entry such a return leaves on hdev->mesh_pending stays there, as entries already do across an unregister. Discovered by XBOW, triaged by Baul Lee Fixes: b338d91703fa ("Bluetooth: Implement support for Mesh") Fixes: 3bb88524b7d0 ("Bluetooth: MGMT: iterate over mesh commands in mgmt_m= esh_foreach()") Cc: stable@vger.kernel.org Signed-off-by: Baul Lee --- net/bluetooth/mgmt.c | 30 ++++++++++++++++++++++++++++-- net/bluetooth/mgmt_util.c | 8 ++++++++ 2 files changed, 36 insertions(+), 2 deletions(-) diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c index f13e73e3814f..583e05ec4377 100644 --- a/net/bluetooth/mgmt.c +++ b/net/bluetooth/mgmt.c @@ -1081,6 +1081,8 @@ static void mesh_send_complete(struct hci_dev *hdev, { u8 handle =3D mesh_tx->handle; =20 + lockdep_assert_held(&hdev->lock); + if (!silent) mgmt_event(MGMT_EV_MESH_PACKET_CMPLT, hdev, &handle, sizeof(handle), NULL); @@ -1095,11 +1097,16 @@ static int mesh_send_done_sync(struct hci_dev *hdev= , void *data) hci_dev_clear_flag(hdev, HCI_MESH_SENDING); if (list_empty(&hdev->adv_instances)) hci_disable_advertising_sync(hdev); + + hci_dev_lock(hdev); + mesh_tx =3D mgmt_mesh_next(hdev, NULL); =20 if (mesh_tx) mesh_send_complete(hdev, mesh_tx, false); =20 + hci_dev_unlock(hdev); + return 0; } =20 @@ -1107,11 +1114,19 @@ static int mesh_send_sync(struct hci_dev *hdev, voi= d *data); static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int= err); static void mesh_next(struct hci_dev *hdev, void *data, int err) { - struct mgmt_mesh_tx *mesh_tx =3D mgmt_mesh_next(hdev, NULL); + struct mgmt_mesh_tx *mesh_tx; =20 - if (!mesh_tx) + if (err =3D=3D -ECANCELED) return; =20 + hci_dev_lock(hdev); + + mesh_tx =3D mgmt_mesh_next(hdev, NULL); + if (!mesh_tx) { + hci_dev_unlock(hdev); + return; + } + err =3D hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx, mesh_send_start_complete); =20 @@ -1119,6 +1134,8 @@ static void mesh_next(struct hci_dev *hdev, void *dat= a, int err) mesh_send_complete(hdev, mesh_tx, false); else hci_dev_set_flag(hdev, HCI_MESH_SENDING); + + hci_dev_unlock(hdev); } =20 static void mesh_send_done(struct work_struct *work) @@ -2304,12 +2321,17 @@ static void mesh_send_start_complete(struct hci_dev= *hdev, void *data, int err) unsigned long mesh_send_interval; u8 mgmt_err =3D mgmt_status(err); =20 + if (err =3D=3D -ECANCELED) + return; + /* Report any errors here, but don't report completion */ =20 if (mgmt_err) { hci_dev_clear_flag(hdev, HCI_MESH_SENDING); /* Send Complete Error Code for handle */ + hci_dev_lock(hdev); mesh_send_complete(hdev, mesh_tx, false); + hci_dev_unlock(hdev); return; } =20 @@ -2415,6 +2437,8 @@ static int send_cancel(struct hci_dev *hdev, void *da= ta) struct mgmt_cp_mesh_send_cancel *cancel =3D (void *)cmd->param; struct mgmt_mesh_tx *mesh_tx; =20 + hci_dev_lock(hdev); + if (!cancel->handle) { do { mesh_tx =3D mgmt_mesh_next(hdev, cmd->sk); @@ -2429,6 +2453,8 @@ static int send_cancel(struct hci_dev *hdev, void *da= ta) mesh_send_complete(hdev, mesh_tx, false); } =20 + hci_dev_unlock(hdev); + mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 0, NULL, 0); mgmt_pending_free(cmd); diff --git a/net/bluetooth/mgmt_util.c b/net/bluetooth/mgmt_util.c index 6ea107c0e054..a822091f2907 100644 --- a/net/bluetooth/mgmt_util.c +++ b/net/bluetooth/mgmt_util.c @@ -369,6 +369,8 @@ void mgmt_mesh_foreach(struct hci_dev *hdev, { struct mgmt_mesh_tx *mesh_tx, *tmp; =20 + lockdep_assert_held(&hdev->lock); + list_for_each_entry_safe(mesh_tx, tmp, &hdev->mesh_pending, list) { if (!sk || mesh_tx->sk =3D=3D sk) cb(mesh_tx, data); @@ -379,6 +381,8 @@ struct mgmt_mesh_tx *mgmt_mesh_next(struct hci_dev *hde= v, struct sock *sk) { struct mgmt_mesh_tx *mesh_tx; =20 + lockdep_assert_held(&hdev->lock); + if (list_empty(&hdev->mesh_pending)) return NULL; =20 @@ -394,6 +398,8 @@ struct mgmt_mesh_tx *mgmt_mesh_find(struct hci_dev *hde= v, u8 handle) { struct mgmt_mesh_tx *mesh_tx; =20 + lockdep_assert_held(&hdev->lock); + if (list_empty(&hdev->mesh_pending)) return NULL; =20 @@ -410,6 +416,8 @@ struct mgmt_mesh_tx *mgmt_mesh_add(struct sock *sk, str= uct hci_dev *hdev, { struct mgmt_mesh_tx *mesh_tx; =20 + lockdep_assert_held(&hdev->lock); + mesh_tx =3D kzalloc_obj(*mesh_tx); if (!mesh_tx) return NULL; --=20 2.50.1 (Apple Git-155) From nobody Tue Sep 29 13:19:20 2026 Received: from mail-yw1-f180.google.com (mail-yw1-f180.google.com [209.85.128.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 27A5C3A6B8A for ; Fri, 7 Aug 2026 07:09:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.180 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786086578; cv=none; b=KKcCVHWj5+Ri4qjhxKgcxPCt6jGE4eyBehLLUdLGgtQSWUofHwW/cmBD5nicmkK2VaMIuUv+1mwuuCmFy1lxqEng9gkTrvJ261/VHd+dnEQXexuL6CUi75doIQECWTlHJwaIB+mtEG4EC58TNk9w1fKTlnbNTFZuYGNykUS9L7Y= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786086578; c=relaxed/simple; bh=VoeN281Q/Ynlf8Lr5X/qG2nEweiKHrjONDeipjZasVI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=CVqXQkFwjdvYtBmJlEUDH5EsDWRV65RKSmCc6zSzdmgK8xL9aYaCaHmZR6ua5QPYaVJX6WcQjaynsEg5SrkpB7M+8MyCATSnSv/XWmiJIH25XQMxzpfA6/UusPNq9wka8jovjfgonrs2PiRsmdTlJkZZt6XDw+oNpb2rs+RnM2Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=xbow.com; spf=pass smtp.mailfrom=xbow.com; dkim=pass (2048-bit key) header.d=xbow.com header.i=@xbow.com header.b=NArUmkls; arc=none smtp.client-ip=209.85.128.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=xbow.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=xbow.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=xbow.com header.i=@xbow.com header.b="NArUmkls" Received: by mail-yw1-f180.google.com with SMTP id 00721157ae682-81ed2a06b9eso31833287b3.3 for ; Fri, 07 Aug 2026 00:09:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=xbow.com; s=google; t=1786086576; x=1786691376; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=XwYAmUiFKZyLt0eV4KfzGWIesmvuZyHS4RTZnrKIuJU=; b=NArUmklsviy9vOBU0vsXIi8CpwrNh4n6Z0lm39FgMHdsUv6pfohvm4TMLOQNzeJUeJ 3f19KIOEIfqllkFko+cauYKHnp2izjZqE0u1QKOP0VCVbzG71xaKtlo+z6c7vDKmNa1J tScsEWl4Od7KXBAJQ9QsEwQwCzU3gQerMMPxfsBPZ6t6Qswa1ZyPuV4UnQE91Y++z5/5 BAtXHVoV/PusEgZc0/kZm5xZAZV8Ts+zO9mAZFpjvZ0eKk7j1YxpPevqdPOGC8Sqdlbj jaleC7G4QSru5XBTbCIoQhM8XFn3sXeMZhtRf+lHTO0HK27aedTuackrUDcu5taACshH /bfw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786086576; x=1786691376; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=XwYAmUiFKZyLt0eV4KfzGWIesmvuZyHS4RTZnrKIuJU=; b=YniTpGHFMhPASoBYnTDnZ33blLOxJBHswm0Z1gUZCzLCRwLNzcIpmtraxO6adNpMAD Dg0bvDzuchOrmBB6hLlxgohzkw0EmjYm0ArPOEiLO8C3uUwrvmvG8YTfcckD0mTp0mBX UNcm5whV2aLvR8dzM1jmdRVShK1Nz+C5BnZonlNtLGIf/ktDxlr5O3d0jKtavkBLTnH3 5Dw1z7TOkRGrLPevvSm2gI9VI7H5pXbZEWsA3EXZulcRPWwZ1p5Z4XqcWweFBNwrJtIu s+7iTH9I3mQz+ixPj55Kdb8r4sI+8OvI4MqDllaXTqMZtPFLR8plEovfEL5H9wKDT4sD eQ+g== X-Forwarded-Encrypted: i=1; AHgh+RohZyEnUe2CeXocxYLOZVna3q7CWSYqSSVufB6l1c43UdlWCu5Fl1f6FUB2D0JEDX5Os0fl/zl+L1WT+8M=@vger.kernel.org X-Gm-Message-State: AOJu0YyViG37b4IRXIJcMJVfj7IfIMAU/lhCYZbQtLWJ7nuQn0SDr4ls YDwW9gusF9uKGHf8QR7T6btUW95lEimMLQStavZXxMFSEOsgMX4S3ejSk9QIY9jGrdk= X-Gm-Gg: AR+sD13sl+NMNf0B6BTO1fPEgmm0oD0LUf1JWUL4L8LXTm5lBQFGtUaVsU68c2Y9HNU DDyKzi42ThIj9tTta0sj8b9KetrbOMeFoAXbCcIslSIkdU5DoI5zAwIDGCTAXnv85avI/UqNL8w lnfgv8hmnbBJsaiIAUbMVIXz3OPkkin1g6JD8+rvuILkKLeYRjUpHX2sCHH5uz5cvXBmnxvx7cR GXsIOUN8GPBv5IN6TKUBnnKjPg18BPds4Y7iNCXvQxvl8M0DPnfzZNspKOlhve69YDxHsLuUEnD Ww2BOiKjPbEUAKJ76ZyWHsXpbqIBHoTaASxAZVnLbikzk9asK26PIIoJ0+AGFi7YwwsneCifjZz 7Dr+nAbGVORA6BoMzYlvCw05d5vqOHn74+ObMlBV3liyjMsP8nAyPV6Lhlt716GBrfS2hVVyzs0 Eyc60Tyrc6jQGa7CluLvmrILgG0VmFAoM6iVkN1hKyH1iIK5JayzjoPtGJdGAvdzm/5J0/Gki5C EWJE+PnRgThLJOZh7ipYSI3M09MypBq8HzoOOeFMrZot/naIO4ZYpXddU6JpYCF5f+72G1SwoAm nlja1/iCd5fV8wFKY3IlNZOZWOptN1LQ2Mw= X-Received: by 2002:a05:690c:6892:b0:81d:d035:eb4b with SMTP id 00721157ae682-8225ba2bd22mr40559047b3.19.1786086575744; Fri, 07 Aug 2026 00:09:35 -0700 (PDT) Received: from buildmachine.tailf331da.ts.net (ec2-3-14-143-233.us-east-2.compute.amazonaws.com. [3.14.143.233]) by smtp.gmail.com with ESMTPSA id 00721157ae682-823f0e64324sm5230367b3.19.2026.08.07.00.09.32 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Fri, 07 Aug 2026 00:09:35 -0700 (PDT) From: Baul Lee To: Luiz Augusto von Dentz , Marcel Holtmann , Brian Gix Cc: Baul Lee , Luiz Augusto von Dentz , Dmitry Antipov , linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, federico.kirschbaum@xbow.com, stable@vger.kernel.org Subject: [PATCH 3/3] Bluetooth: MGMT: reference-count struct mgmt_mesh_tx Date: Fri, 7 Aug 2026 16:09:16 +0900 Message-ID: <20260807070916.85771-4-baul.lee@xbow.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260807070916.85771-1-baul.lee@xbow.com> References: <20260807070916.85771-1-baul.lee@xbow.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" hci_cmd_sync_submit() stores the caller's pointer in a work entry and takes no reference to what it names. hci_cmd_sync_work() drains that list from the head on an ordered workqueue, so an entry queued earlier runs to completion before a later one is looked at. mesh_send() links a struct mgmt_mesh_tx onto hdev->mesh_pending and queues mesh_send_sync() with the raw pointer. A MESH_SEND_CANCEL issued before that send leaves its send_cancel() entry ahead in the queue, so send_cancel() runs first: it picks the object out of hdev->mesh_pending with mgmt_mesh_next(), which returns it without unlinking it, and frees it through mesh_send_complete(). Nothing invalidates the pointer the later entry still holds, so mesh_send_sync() and its destroy callback mesh_send_start_complete() run on freed memory: [ 43.618774] BUG: KASAN: slab-use-after-free in mesh_send_sync+0xec/0x1b4 [ 43.618851] Write of size 1 at addr ffff000009f2a6a9 by task kworker/u5:= 2/148 [ 43.619464] mesh_send_sync+0xec/0x1b4 [ 43.619531] hci_cmd_sync_work+0xac/0x128 [ 43.620882] Freed by task 148: [ 43.621171] mgmt_mesh_remove+0x94/0x110 [ 43.621218] send_cancel+0xd8/0x1cc [ 43.621270] hci_cmd_sync_work+0xac/0x128 Offset 41 is mesh_tx->instance, the only byte mesh_send_sync() stores through mesh_tx; it reads further fields of the same freed object, and hci_set_adv_instance_data() copies 31 of those bytes into a live struct adv_info. The free and the use are consecutive iterations of one hci_cmd_sync_work() loop on one kworker, so queue order alone decides it. Give struct mgmt_mesh_tx a reference count. hdev->mesh_pending holds one, and every pointer handed to hci_cmd_sync_queue() takes a second one that the destroy callback drops, so a cancel that unlinks the object while a work entry is still queued no longer releases it. mgmt_mesh_remove() becomes an unlink plus a put and returns early when the object is already unlinked, because it can now outlive its removal from the list. The list reference is still dropped under hci_dev_lock() only, so mesh_send()'s use of mesh_tx->handle after queueing stays covered by the lock it holds. A cancel that arrives before the queued mesh_send_sync() now lets that send run rather than freeing the object under it; suppressing the transmission as well is a separate change. hci_cmd_sync_dequeue() is the other in-tree option, but mgmt_mesh_remove() is not given the hci_dev it needs and cannot tell whether the work entry has already been taken off cmd_sync_work_list. Discovered by XBOW, triaged by Baul Lee Fixes: b338d91703fa ("Bluetooth: Implement support for Mesh") Cc: stable@vger.kernel.org Signed-off-by: Baul Lee --- net/bluetooth/mgmt.c | 25 +++++++++++++++++-------- net/bluetooth/mgmt_util.c | 23 +++++++++++++++++++++-- net/bluetooth/mgmt_util.h | 3 +++ 3 files changed, 41 insertions(+), 10 deletions(-) diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c index 583e05ec4377..c562f8c95294 100644 --- a/net/bluetooth/mgmt.c +++ b/net/bluetooth/mgmt.c @@ -1127,13 +1127,15 @@ static void mesh_next(struct hci_dev *hdev, void *d= ata, int err) return; } =20 - err =3D hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx, + err =3D hci_cmd_sync_queue(hdev, mesh_send_sync, mgmt_mesh_get(mesh_tx), mesh_send_start_complete); =20 - if (err < 0) + if (err < 0) { + mgmt_mesh_put(mesh_tx); mesh_send_complete(hdev, mesh_tx, false); - else + } else { hci_dev_set_flag(hdev, HCI_MESH_SENDING); + } =20 hci_dev_unlock(hdev); } @@ -2322,7 +2324,7 @@ static void mesh_send_start_complete(struct hci_dev *= hdev, void *data, int err) u8 mgmt_err =3D mgmt_status(err); =20 if (err =3D=3D -ECANCELED) - return; + goto put; =20 /* Report any errors here, but don't report completion */ =20 @@ -2332,12 +2334,15 @@ static void mesh_send_start_complete(struct hci_dev= *hdev, void *data, int err) hci_dev_lock(hdev); mesh_send_complete(hdev, mesh_tx, false); hci_dev_unlock(hdev); - return; + goto put; } =20 mesh_send_interval =3D msecs_to_jiffies((send->cnt) * 25); queue_delayed_work(hdev->req_workqueue, &hdev->mesh_send_done, mesh_send_interval); + +put: + mgmt_mesh_put(mesh_tx); } =20 static int mesh_send_sync(struct hci_dev *hdev, void *data) @@ -2538,11 +2543,15 @@ static int mesh_send(struct sock *sk, struct hci_de= v *hdev, void *data, u16 len) sending =3D hci_dev_test_flag(hdev, HCI_MESH_SENDING); mesh_tx =3D mgmt_mesh_add(sk, hdev, send, len); =20 - if (!mesh_tx) + if (!mesh_tx) { err =3D -ENOMEM; - else if (!sending) - err =3D hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx, + } else if (!sending) { + err =3D hci_cmd_sync_queue(hdev, mesh_send_sync, + mgmt_mesh_get(mesh_tx), mesh_send_start_complete); + if (err < 0) + mgmt_mesh_put(mesh_tx); + } =20 if (err < 0) { bt_dev_err(hdev, "Send Mesh Failed %d", err); diff --git a/net/bluetooth/mgmt_util.c b/net/bluetooth/mgmt_util.c index a822091f2907..c7543964525a 100644 --- a/net/bluetooth/mgmt_util.c +++ b/net/bluetooth/mgmt_util.c @@ -422,6 +422,7 @@ struct mgmt_mesh_tx *mgmt_mesh_add(struct sock *sk, str= uct hci_dev *hdev, if (!mesh_tx) return NULL; =20 + refcount_set(&mesh_tx->ref, 1); hdev->mesh_send_ref++; if (!hdev->mesh_send_ref) hdev->mesh_send_ref++; @@ -438,9 +439,27 @@ struct mgmt_mesh_tx *mgmt_mesh_add(struct sock *sk, st= ruct hci_dev *hdev, return mesh_tx; } =20 -void mgmt_mesh_remove(struct mgmt_mesh_tx *mesh_tx) +struct mgmt_mesh_tx *mgmt_mesh_get(struct mgmt_mesh_tx *mesh_tx) +{ + refcount_inc(&mesh_tx->ref); + + return mesh_tx; +} + +void mgmt_mesh_put(struct mgmt_mesh_tx *mesh_tx) { - list_del(&mesh_tx->list); + if (!refcount_dec_and_test(&mesh_tx->ref)) + return; + sock_put(mesh_tx->sk); kfree(mesh_tx); } + +void mgmt_mesh_remove(struct mgmt_mesh_tx *mesh_tx) +{ + if (list_empty(&mesh_tx->list)) + return; + + list_del_init(&mesh_tx->list); + mgmt_mesh_put(mesh_tx); +} diff --git a/net/bluetooth/mgmt_util.h b/net/bluetooth/mgmt_util.h index 20810cf06e81..b38970c1332c 100644 --- a/net/bluetooth/mgmt_util.h +++ b/net/bluetooth/mgmt_util.h @@ -19,6 +19,7 @@ =20 struct mgmt_mesh_tx { struct list_head list; + refcount_t ref; int index; size_t param_len; struct sock *sk; @@ -72,4 +73,6 @@ struct mgmt_mesh_tx *mgmt_mesh_find(struct hci_dev *hdev,= u8 handle); struct mgmt_mesh_tx *mgmt_mesh_next(struct hci_dev *hdev, struct sock *sk); struct mgmt_mesh_tx *mgmt_mesh_add(struct sock *sk, struct hci_dev *hdev, void *data, u16 len); +struct mgmt_mesh_tx *mgmt_mesh_get(struct mgmt_mesh_tx *mesh_tx); +void mgmt_mesh_put(struct mgmt_mesh_tx *mesh_tx); void mgmt_mesh_remove(struct mgmt_mesh_tx *mesh_tx); --=20 2.50.1 (Apple Git-155)