[PATCH] Bluetooth: MGMT: Free unlisted commands on queue failure

[PATCH] Bluetooth: MGMT: Free unlisted commands on queue failure

[Jiale Yao]

mgmt_pending_new() allocates a command without adding it to the pending
list. set_phy_configuration() and read_local_ssp_oob_req() use this
helper before queuing synchronous HCI work.

If hci_cmd_sync_queue() fails, the work item does not take ownership of
the command. The error paths call mgmt_pending_remove(), which assumes
the command is linked and calls list_del() on its zeroed list node. This
can cause a NULL pointer dereference instead of releasing the command.

Free the unlisted command directly on queue failure.

Fixes: 302a1f674c00 ("Bluetooth: MGMT: Fix possible UAFs")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 net/bluetooth/mgmt.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 3b9c82bd2f02..66f167849942 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -4432,7 +4432,7 @@ static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
 				      MGMT_STATUS_FAILED);
 
 		if (cmd)
-			mgmt_pending_remove(cmd);
+			mgmt_pending_free(cmd);
 	}
 
 unlock:
@@ -8619,7 +8619,7 @@ static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
 				 read_local_oob_ext_data_complete);
 
 	if (err < 0) {
-		mgmt_pending_remove(cmd);
+		mgmt_pending_free(cmd);
 		return err;
 	}
 
-- 
2.34.1