[PATCH v3] Bluetooth: Fix Use-After-Free in hci_unregister_dev

[PATCH v3] Bluetooth: Fix Use-After-Free in hci_unregister_dev

[Jordan Walters]

The hci_unregister_dev() function fails to safely cancel the cmd_timer
and ncmd_timer before freeing the hci_dev structure. If an asynchronous
event or timeout occurs during device teardown, the timer callbacks
may execute after the device has been freed, leading to a KASAN
slab-use-after-free panic.

This patch adds cancel_delayed_work_sync() calls at the end of
hci_unregister_dev() after all teardown procedures have completed.
This ensures the timers are fully flushed before the struct is freed,
preventing any use-after-free conditions.

Signed-off-by: Jordan Walters <jaggyaur@gmail.com>
---
 net/bluetooth/hci_core.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 28d7929dc59..3db1b3738b5 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -2698,6 +2698,9 @@ void hci_unregister_dev(struct hci_dev *hdev)
 		rfkill_unregister(hdev->rfkill);
 		rfkill_destroy(hdev->rfkill);
 	}
 
 	device_del(&hdev->dev);
+
+	cancel_delayed_work_sync(&hdev->cmd_timer);
+	cancel_delayed_work_sync(&hdev->ncmd_timer);
+
 	/* Actual cleanup is deferred until hci_release_dev(). */
 	hci_dev_put(hdev);
 }

Re: [PATCH v3] Bluetooth: Fix Use-After-Free in hci_unregister_dev

[Luiz Augusto von Dentz]

Hi Jordan,

On Wed, Jun 3, 2026 at 4:09 AM Jordan Walters <jaggyaur@gmail.com> wrote:
>
> The hci_unregister_dev() function fails to safely cancel the cmd_timer
> and ncmd_timer before freeing the hci_dev structure. If an asynchronous
> event or timeout occurs during device teardown, the timer callbacks
> may execute after the device has been freed, leading to a KASAN
> slab-use-after-free panic.
>
> This patch adds cancel_delayed_work_sync() calls at the end of
> hci_unregister_dev() after all teardown procedures have completed.
> This ensures the timers are fully flushed before the struct is freed,
> preventing any use-after-free conditions.
>
> Signed-off-by: Jordan Walters <jaggyaur@gmail.com>
> ---
>  net/bluetooth/hci_core.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
> index 28d7929dc59..3db1b3738b5 100644
> --- a/net/bluetooth/hci_core.c
> +++ b/net/bluetooth/hci_core.c
> @@ -2698,6 +2698,9 @@ void hci_unregister_dev(struct hci_dev *hdev)
>                 rfkill_unregister(hdev->rfkill);
>                 rfkill_destroy(hdev->rfkill);
>         }
>
>         device_del(&hdev->dev);
> +
> +       cancel_delayed_work_sync(&hdev->cmd_timer);
> +       cancel_delayed_work_sync(&hdev->ncmd_timer);
> +
>         /* Actual cleanup is deferred until hci_release_dev(). */
>         hci_dev_put(hdev);
>  }

I'm not sure what's happening, but I cannot apply this change with
`git am`. Also, why did you revert to using `cancel` instead of
`disable`?

-- 
Luiz Augusto von Dentz