* [PATCH 1/2] Bluetooth: MGMT: free remove monitor command on cancel
@ 2026-10-17 3:09 Jiale Yao
2026-10-17 7:36 ` jiale yao
0 siblings, 1 reply; 2+ messages in thread
From: Jiale Yao @ 2026-10-17 3:09 UTC (permalink / raw)
To: Marcel Holtmann, Luiz Augusto von Dentz, linux-bluetooth, linux-kernel
Cc: Jiale Yao
remove_adv_monitor() allocates its queued command with
mgmt_pending_new(), so the command is not linked into
hdev->mgmt_pending. If the command-sync entry is cancelled, its
completion callback returns without freeing the command, leaking both
the allocation and its socket reference.
Free the pending command before returning from the cancellation path.
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
net/bluetooth/mgmt.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 251a896babd5..e54a838aeada 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -5682,8 +5682,10 @@ static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev,
struct mgmt_pending_cmd *cmd = data;
struct mgmt_cp_remove_adv_monitor *cp;
- if (status == -ECANCELED)
+ if (status == -ECANCELED) {
+ mgmt_pending_free(cmd);
return;
+ }
hci_dev_lock(hdev);
--
2.34.1
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re:[PATCH 1/2] Bluetooth: MGMT: free remove monitor command on cancel
2026-10-17 3:09 [PATCH 1/2] Bluetooth: MGMT: free remove monitor command on cancel Jiale Yao
@ 2026-10-17 7:36 ` jiale yao
0 siblings, 0 replies; 2+ messages in thread
From: jiale yao @ 2026-10-17 7:36 UTC (permalink / raw)
To: Marcel Holtmann, Luiz Augusto von Dentz, linux-bluetooth, linux-kernel
At 2026-10-17 11:09:39, "Jiale Yao" <yaojiale02@163.com> wrote:
>remove_adv_monitor() allocates its queued command with
>mgmt_pending_new(), so the command is not linked into
>hdev->mgmt_pending. If the command-sync entry is cancelled, its
>completion callback returns without freeing the command, leaking both
>the allocation and its socket reference.
>
>Free the pending command before returning from the cancellation path.
>
Fixes: e6ed54e86aae ("Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete")
>Signed-off-by: Jiale Yao <yaojiale02@163.com>
>---
> net/bluetooth/mgmt.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
>diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
>index 251a896babd5..e54a838aeada 100644
>--- a/net/bluetooth/mgmt.c
>+++ b/net/bluetooth/mgmt.c
>@@ -5682,8 +5682,10 @@ static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev,
> struct mgmt_pending_cmd *cmd = data;
> struct mgmt_cp_remove_adv_monitor *cp;
>
>- if (status == -ECANCELED)
>+ if (status == -ECANCELED) {
>+ mgmt_pending_free(cmd);
> return;
>+ }
>
> hci_dev_lock(hdev);
>
>--
>2.34.1
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-10-17 7:36 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-10-17 3:09 [PATCH 1/2] Bluetooth: MGMT: free remove monitor command on cancel Jiale Yao
2026-10-17 7:36 ` jiale yao
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®