Hi Baul,
On Fri, Aug 7, 2026 at 6:15 AM Baul Lee <baul.lee@xbow.com> wrote:
>
> hdev->mesh_pending is extended and walked from syscall context under
> hdev->lock, and unlinked and freed from the hci_cmd_sync worker under
> hci_req_sync_lock, so the list has no protection; the objects on it are
> also handed to hci_cmd_sync_queue() as raw pointers, and those work
> entries outlive the list. Three use-after-frees follow, all reproduced
> under KASAN.
>
> Patch 1 removes mgmt_cleanup(), the one walker of the list that cannot
> take hdev->lock. Patch 2 puts the list under hdev->lock on the worker
> side and asserts it in the helpers. Patch 3 gives the object a
> reference count for the work entry. The order matters: the assertions
> in patch 2 have no violating caller left once patch 1 is in, and the
> reference in patch 3 is only well defined once every unlink happens
> under one lock.
>
> Reaching any of this needs CAP_NET_ADMIN in the init user namespace.
> hci_sock.c sets HCI_SOCK_TRUSTED at bind under capable() rather than
> ns_capable() and gates every later mgmt command on it, and the mesh
> commands additionally need HCI_MESH_EXPERIMENTAL. Nothing in
> hci_event.c touches hdev->mesh_pending.
>
> Each reproducer was run at identical parameters on the unpatched and the
> patched kernel, built with KASAN, PROVE_LOCKING, DEBUG_LIST and
> DEBUG_ATOMIC_SLEEP: every splat the unpatched kernel produces is gone.
>
> v2: rebased onto bluetooth-next, where send_cancel() no longer ends in
> mgmt_pending_free(), so v1 did not apply for the CI. Context only,
> no other change; v1 applies as posted to the bluetooth tree, which
> still has that line.
>
> Baul Lee (3):
> Bluetooth: MGMT: remove the mesh walk from the socket destructor
> Bluetooth: MGMT: protect hdev->mesh_pending with hdev->lock
> Bluetooth: MGMT: reference-count struct mgmt_mesh_tx
>
> include/net/bluetooth/bluetooth.h | 1 -
> net/bluetooth/hci_sock.c | 1 -
> net/bluetooth/mgmt.c | 72 ++++++++++++++++++++++++---------------
> net/bluetooth/mgmt_util.c | 31 +++++++++++++++--
> net/bluetooth/mgmt_util.h | 3 ++
> 5 files changed, 76 insertions(+), 32 deletions(-)
>
> --
> 2.50.1 (Apple Git-155)
Sashiko found a couple of problems:
https://sashiko.dev/#/patchset/20260807101529.17348-1-baul.lee%40xbow.com
--
Luiz Augusto von Dentz