Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel

In send_cancel(), pending mesh_tx objects are removed from the hdev->mesh_pending list and freed via mesh_send_complete(). However, if a mesh transmission was already queued onto hdev->cmd_sync_work_list via mesh_next(), the queued entry retains a raw pointer to mesh_tx.

When hci_cmd_sync_work later processes the entry, it attempts to execute mesh_send_sync and its destroy callback mesh_send_start_complete using the already freed mesh_tx pointer, leading to a use-after-free.

Fix this by invoking hci_cmd_sync_dequeue() for mesh_send_sync on the target mesh_tx before completing it. If the entry is found and dequeued, its destroy callback will complete and free the object; otherwise, mesh_send_complete() is called directly.

Additionally, ensure the transmission queue advances after cancellation or errors. In mesh_send_start_complete(), call mesh_next() on error unless err is -ECANCELED, because hci_cmd_sync_dequeue() holds hdev->cmd_sync_work_lock and calling mesh_next() synchronously would deadlock. Instead, advance the queue in send_cancel() once the lock is released and if no transmission is in progress.

---

v1 => v2: Email address switch - no functional change
v2 -> v3:
- Advance mesh queue in send_cancel() once cmd_sync_work_lock is released
- Advance mesh queue on error in mesh_send_start_complete(), skipping -ECANCELED to avoid self-deadlock

 net/bluetooth/mgmt.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

index fd045460e236..c2cce242958b 100644
@@ -2318,6 +2318,8 @@ static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err)
 		hci_dev_clear_flag(hdev, HCI_MESH_SENDING);
 		/* Send Complete Error Code for handle */
 		mesh_send_complete(hdev, mesh_tx, false);
+		if (err != -ECANCELED)
+			mesh_next(hdev, NULL, 0);
 		return;
 	}
 

@@ -2427,19 +2429,28 @@ static int send_cancel(struct hci_dev *hdev, void *data)
 		do {
 			mesh_tx = mgmt_mesh_next(hdev, cmd->sk);
 
-			if (mesh_tx)
-				mesh_send_complete(hdev, mesh_tx, false);
+			if (mesh_tx) {
+				if (!hci_cmd_sync_dequeue(hdev, mesh_send_sync,
+							  mesh_tx, NULL))
+					mesh_send_complete(hdev, mesh_tx, false);
+			}
 		} while (mesh_tx);
 	} else {
 		mesh_tx = mgmt_mesh_find(hdev, cancel->handle);
 
-		if (mesh_tx && mesh_tx->sk == cmd->sk)
-			mesh_send_complete(hdev, mesh_tx, false);
+		if (mesh_tx && mesh_tx->sk == cmd->sk) {
+			if (!hci_cmd_sync_dequeue(hdev, mesh_send_sync,
+						  mesh_tx, NULL))
+				mesh_send_complete(hdev, mesh_tx, false);
+		}
 	}
 
 	mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
 			  0, NULL, 0);
 
+	if (!hci_dev_test_flag(hdev, HCI_MESH_SENDING))
+		mesh_next(hdev, NULL, 0);
+
 	return 0;
 }
 

2.55.0.1032.g73a4cd73de-goog

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1165484/

---Test result---

Test Summary:

CheckPatch                    PASS      0.77 seconds
VerifyFixes                   PASS      0.12 seconds
VerifySignedoff               PASS      0.11 seconds
GitLint                       FAIL      0.41 seconds
SubjectPrefix                 PASS      5.05 seconds
BuildKernel                   PASS      28.89 seconds
CheckAllWarning               PASS      33.54 seconds
CheckSparse                   PASS      36.17 seconds
BuildKernel32                 PASS      29.54 seconds
CheckKernelLLVM               PASS      34.56 seconds
TestRunnerSetup               PASS      745.28 seconds
TestRunner_mgmt-tester        FAIL      9.35 seconds
TestRunner_mesh-tester        FAIL      8.15 seconds
IncrementalBuild              PASS      27.99 seconds

Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[v3,1/1] Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel

30: B1 Line exceeds max length (105>80): " - Advance mesh queue on error in mesh_send_start_complete(), skipping -ECANCELED to avoid self-deadlock"
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
No test result found
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner
Output:
No test result found

https://github.com/bluez/bluetooth-next/pull/772

---
Regards,
Linux Bluetooth

This is just the change log and can be ignored.

So, is this my problem or the harness's?

Lee Jones