Bluetooth: hci_sync: Serialize local codec list cleanup
Subsystems (3)
PATCH 1/1 Bluetooth: hci_sync: Serialize local codec list cleanup
hci_dev_close_sync() clears hdev->local_codecs after releasing hdev->lock. Codec list additions and both traversals in sco_sock_getsockopt() use that lock, but the close path does not. A close and BT_CODEC query can therefore interleave as follows:
hci_dev_close_sync() sco_sock_getsockopt()
hci_dev_lock()
fetch codec entry
hci_codec_list_clear()
kfree(entry)
read entry->idThe reader then accesses an entry which the close path has freed. KASAN reported:
BUG: KASAN: slab-use-after-free in sco_sock_getsockopt+0xfa0/0xfe0 Read of size 1 at addr ffff8881001c3450 Call Trace: sco_sock_getsockopt+0xfa0/0xfe0 do_sock_getsockopt+0x537/0x7b0 __sys_getsockopt+0xf2/0x170 Allocated by task 92: hci_codec_list_add.isra.0+0x2c/0x440 hci_read_codec_capabilities+0x224/0x590 hci_read_supported_codecs+0x2c2/0x640 Freed by task 92: kfree+0x131/0x3c0 hci_codec_list_clear+0xd8/0x160 hci_dev_close_sync+0x92a/0xfa0
Take hdev->lock around the clear operation at its existing point in the close path. This makes the clear wait for active readers and prevents a new traversal until the list is empty without changing teardown ordering.
--- net/bluetooth/hci_sync.c | 2 ++ 1 file changed, 2 insertions(+)
net/bluetooth/hci_sync.c +2 -0
@@ -5648,7 +5648,9 @@ int hci_dev_close_sync(struct hci_dev *hdev)memset (hdev->eir,0 ,sizeof (hdev->eir));memset (hdev->dev_class,0 ,sizeof (hdev->dev_class));bacpy (&hdev->random_addr,BDADDR_ANY ); +hci_dev_lock (hdev);hci_codec_list_clear (&hdev->local_codecs); +hci_dev_unlock (hdev);hci_dev_put (hdev);return err;
Signature · 1 line
2.43.0
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1149960
---Test result---
Test Summary:
CheckPatch PASS 0.72 seconds VerifyFixes PASS 0.13 seconds VerifySignedoff PASS 0.13 seconds GitLint PASS 0.32 seconds SubjectPrefix PASS 0.12 seconds BuildKernel PASS 26.27 seconds CheckAllWarning PASS 28.87 seconds CheckSparse PASS 27.54 seconds BuildKernel32 PASS 26.00 seconds CheckKernelLLVM SKIP 0.00 seconds TestRunnerSetup PASS 471.98 seconds TestRunner_l2cap-tester PASS 78.99 seconds TestRunner_iso-tester PASS 108.23 seconds TestRunner_bnep-tester PASS 19.14 seconds TestRunner_mgmt-tester FAIL 220.33 seconds TestRunner_rfcomm-tester PASS 25.53 seconds TestRunner_sco-tester PASS 31.73 seconds TestRunner_ioctl-tester PASS 26.14 seconds TestRunner_mesh-tester FAIL 26.17 seconds TestRunner_smp-tester PASS 24.10 seconds TestRunner_userchan-tester PASS 20.12 seconds TestRunner_6lowpan-tester PASS 23.38 seconds IncrementalBuild PASS 24.45 seconds
Details
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis Output:
Clang not found
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner Output:
Total: 501, Passed: 495 (98.8%), Failed: 2, Not Run: 4
Failed Test Cases
Read Exp Feature - Success Failed 0.252 seconds LL Privacy - Remove Device 3 (Disable RL) Failed 0.424 seconds
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner Output:
Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0
Failed Test Cases
Mesh - Send cancel - 1 Timed out 2.684 seconds Mesh - Send cancel - 2 Timed out 1.992 seconds
https://github.com/bluez/bluetooth-next/pull/631
---
Regards,
Linux Bluetooth
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1149960/
---Test result---
Test Summary:
CheckPatch PASS 0.68 seconds VerifyFixes PASS 0.12 seconds VerifySignedoff PASS 0.10 seconds GitLint PASS 0.30 seconds SubjectPrefix PASS 0.10 seconds BuildKernel PASS 27.24 seconds CheckAllWarning PASS 31.28 seconds CheckSparse PASS 33.71 seconds BuildKernel32 PASS 27.91 seconds CheckKernelLLVM PASS 30.83 seconds TestRunnerSetup PASS 728.94 seconds TestRunner_l2cap-tester PASS 44.51 seconds TestRunner_iso-tester PASS 91.19 seconds TestRunner_bnep-tester PASS 12.16 seconds TestRunner_mgmt-tester FAIL 143.15 seconds TestRunner_rfcomm-tester PASS 16.12 seconds TestRunner_sco-tester PASS 21.19 seconds TestRunner_ioctl-tester PASS 17.26 seconds TestRunner_mesh-tester FAIL 18.16 seconds TestRunner_smp-tester PASS 14.84 seconds TestRunner_userchan-tester PASS 12.95 seconds TestRunner_6lowpan-tester PASS 15.19 seconds IncrementalBuild PASS 25.59 seconds
Details
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner Output:
Total: 501, Passed: 496 (99.0%), Failed: 1, Not Run: 4
Failed Test Cases
Read Exp Feature - Success Failed 0.140 seconds
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner Output:
Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0
Failed Test Cases
Mesh - Send cancel - 1 Timed out 2.356 seconds Mesh - Send cancel - 2 Timed out 1.996 seconds
https://github.com/bluez/bluetooth-next/pull/741
---
Regards,
Linux Bluetooth
This patch was applied to bluetooth/bluetooth-next.git (master) by Luiz Augusto von Dentz <[email protected]>:
Hello:
This patch was applied to bluetooth/bluetooth-next.git (master) by Luiz Augusto von Dentz <[email protected]>:
Quoted 5 lines · On Sat, 22 Aug 2026 01:43:50 +0800 you wrote:
hci_dev_close_sync()clearshdev->local_codecsafter releasinghdev->lock. Codec list additions and both traversals insco_sock_getsockopt()use that lock, but the close path does not. A close andBT_CODECquery can therefore interleave as follows:
Quoted 8 lines
hci_dev_close_sync()sco_sock_getsockopt()
hci_dev_lock()
fetch codec entry
hci_codec_list_clear()kfree(entry) read entry->id[...]
Here is the summary with links:
- Bluetooth: hci_sync: Serialize local codec list cleanup
https://git.kernel.org/bluetooth/bluetooth-next/c/ee0662ba1e0a
You are awesome, thank you!
Signature · 2 lines
Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html