[PATCH 2/2] Bluetooth: msft: free detached address filter on cancel

[PATCH 2/2] Bluetooth: msft: free detached address filter on cancel

[Jiale Yao]

An address filter queued for addition can be detached from the MSFT
filter list and marked AF_STATE_REMOVING before its command-sync work
runs. If the queued entry is then cancelled, its NULL destroy callback
leaves the detached filter without an owner.

Install a destroy callback that frees a cancelled filter only when it
has reached AF_STATE_REMOVING. Filters that are still linked remain
owned by the normal close cleanup path.

Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 net/bluetooth/msft.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/net/bluetooth/msft.c b/net/bluetooth/msft.c
index d9dd722db3eb..b9f8f089cc72 100644
--- a/net/bluetooth/msft.c
+++ b/net/bluetooth/msft.c
@@ -928,6 +928,16 @@ static int msft_add_address_filter_sync(struct hci_dev *hdev, void *data)
 	return 0;
 }
 
+static void msft_add_address_filter_destroy(struct hci_dev *hdev, void *data,
+					    int err)
+{
+	struct msft_monitor_addr_filter_data *address_filter = data;
+
+	if (err == -ECANCELED &&
+	    address_filter->state == AF_STATE_REMOVING)
+		kfree(address_filter);
+}
+
 /* This function requires the caller holds msft->filter_lock */
 static struct msft_monitor_addr_filter_data *msft_add_address_filter
 		(struct hci_dev *hdev, u8 addr_type, bdaddr_t *bdaddr,
@@ -959,7 +969,7 @@ static struct msft_monitor_addr_filter_data *msft_add_address_filter
 	list_add_tail(&address_filter->list, &msft->address_filters);
 
 	err = hci_cmd_sync_queue(hdev, msft_add_address_filter_sync,
-				 address_filter, NULL);
+				 address_filter, msft_add_address_filter_destroy);
 	if (err < 0) {
 		bt_dev_err(hdev, "MSFT: Add address %pMR filter err", bdaddr);
 		list_del(&address_filter->list);
-- 
2.34.1

Re:[PATCH 2/2] Bluetooth: msft: free detached address filter on cancel

[jiale yao]

At 2026-10-17 11:10:22, "Jiale Yao" <yaojiale02@163.com> wrote:
>An address filter queued for addition can be detached from the MSFT
>filter list and marked AF_STATE_REMOVING before its command-sync work
>runs. If the queued entry is then cancelled, its NULL destroy callback
>leaves the detached filter without an owner.
>
>Install a destroy callback that frees a cancelled filter only when it
>has reached AF_STATE_REMOVING. Filters that are still linked remain
>owned by the normal close cleanup path.
>

Fixes: 9e14606d8f38 ("Bluetooth: msft: Extended monitor tracking by address filter")

>Signed-off-by: Jiale Yao <yaojiale02@163.com>
>---
> net/bluetooth/msft.c | 12 +++++++++++-
> 1 file changed, 11 insertions(+), 1 deletion(-)
>
>diff --git a/net/bluetooth/msft.c b/net/bluetooth/msft.c
>index d9dd722db3eb..b9f8f089cc72 100644
>--- a/net/bluetooth/msft.c
>+++ b/net/bluetooth/msft.c
>@@ -928,6 +928,16 @@ static int msft_add_address_filter_sync(struct hci_dev *hdev, void *data)
> 	return 0;
> }
> 
>+static void msft_add_address_filter_destroy(struct hci_dev *hdev, void *data,
>+					    int err)
>+{
>+	struct msft_monitor_addr_filter_data *address_filter = data;
>+
>+	if (err == -ECANCELED &&
>+	    address_filter->state == AF_STATE_REMOVING)
>+		kfree(address_filter);
>+}
>+
> /* This function requires the caller holds msft->filter_lock */
> static struct msft_monitor_addr_filter_data *msft_add_address_filter
> 		(struct hci_dev *hdev, u8 addr_type, bdaddr_t *bdaddr,
>@@ -959,7 +969,7 @@ static struct msft_monitor_addr_filter_data *msft_add_address_filter
> 	list_add_tail(&address_filter->list, &msft->address_filters);
> 
> 	err = hci_cmd_sync_queue(hdev, msft_add_address_filter_sync,
>-				 address_filter, NULL);
>+				 address_filter, msft_add_address_filter_destroy);
> 	if (err < 0) {
> 		bt_dev_err(hdev, "MSFT: Add address %pMR filter err", bdaddr);
> 		list_del(&address_filter->list);
>-- 
>2.34.1