Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel

PATCH Superseded Lee Jones 4 participants 6 messages Sep 1 – Sep 2

Subsystems (3)

Stable branch Bluetooth drivers Bluetooth

lore

Share & tools

lore

Lee Jones

author

2026-09-01 15:44 UTC #0 lore raw

PATCH v2 1/1 Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel

In send_cancel(), pending mesh_tx objects are removed from the hdev->mesh_pending list and freed via mesh_send_complete(). However, if a mesh transmission was already queued onto hdev->cmd_sync_work_list via mesh_next(), the queued entry retains a raw pointer to mesh_tx.

When hci_cmd_sync_work later processes the entry, it attempts to execute mesh_send_sync and its destroy callback mesh_send_start_complete using the already freed mesh_tx pointer, leading to a use-after-free.

Fix this by invoking hci_cmd_sync_dequeue() for mesh_send_sync on the target mesh_tx before completing it. If the entry is found and dequeued, its destroy callback will complete and free the object; otherwise, mesh_send_complete() is called directly.

Fixes b338d91703fa ("Bluetooth: Implement support for Mesh")

Signed-off-by Lee Jones <[email protected]>

---

v1 => v2: Email address switch - no functional change

 net/bluetooth/mgmt.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

net/bluetooth/mgmt.c +10 -4

index fd045460e236..f10cf64fb79e 100644
@@ -2427,14 +2427,20 @@ static int send_cancel(struct hci_dev *hdev, void *data)
 		do {
 			mesh_tx = mgmt_mesh_next(hdev, cmd->sk);
 
-			if (mesh_tx)
-				mesh_send_complete(hdev, mesh_tx, false);
+			if (mesh_tx) {
+				if (!hci_cmd_sync_dequeue(hdev, mesh_send_sync,
+							  mesh_tx, NULL))
+					mesh_send_complete(hdev, mesh_tx, false);
+			}
 		} while (mesh_tx);
 	} else {
 		mesh_tx = mgmt_mesh_find(hdev, cancel->handle);
 
-		if (mesh_tx && mesh_tx->sk == cmd->sk)
-			mesh_send_complete(hdev, mesh_tx, false);
+		if (mesh_tx && mesh_tx->sk == cmd->sk) {
+			if (!hci_cmd_sync_dequeue(hdev, mesh_send_sync,
+						  mesh_tx, NULL))
+				mesh_send_complete(hdev, mesh_tx, false);
+		}
 	}
 
 	mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,

Signature · 1 line

2.55.0.897.gb25b4bd76c-goog

Greg KH

maintainer

2026-09-01 17:00 UTC #1 lore raw

Quoted 14 lines · Lee Jones

In send_cancel(), pending mesh_tx objects are removed from the hdev->mesh_pending list and freed via mesh_send_complete(). However, if a mesh transmission was already queued onto hdev->cmd_sync_work_list via mesh_next(), the queued entry retains a raw pointer to mesh_tx.
When hci_cmd_sync_work later processes the entry, it attempts to execute mesh_send_sync and its destroy callback mesh_send_start_complete using the already freed mesh_tx pointer, leading to a use-after-free.
Fix this by invoking hci_cmd_sync_dequeue() for mesh_send_sync on the target mesh_tx before completing it. If the entry is found and dequeued, its destroy callback will complete and free the object; otherwise, mesh_send_complete() is called directly.

Quoted 9 lines

Fixes b338d91703fa ("Bluetooth: Implement support for Mesh")
Signed-off-by Lee Jones <[email protected]>
---
v1 => v2: Email address switch - no functional change
 net/bluetooth/mgmt.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

This is not the correct way to submit patches for inclusion in the stable kernel tree. Please read:
https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
for how to do this properly.

</formletter>

[email protected]

2026-09-01 17:07 UTC #2 lore raw

In reply to Lee Jones

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1155482

---Test result---

Test Summary:

CheckPatch                    PASS      0.75 seconds
VerifyFixes                   PASS      0.10 seconds
VerifySignedoff               PASS      0.08 seconds
GitLint                       PASS      0.22 seconds
SubjectPrefix                 PASS      0.07 seconds
BuildKernel                   PASS      28.57 seconds
CheckAllWarning               PASS      31.59 seconds
CheckSparse                   PASS      29.62 seconds
BuildKernel32                 PASS      27.44 seconds
CheckKernelLLVM               SKIP      0.00 seconds
TestRunnerSetup               PASS      510.88 seconds
TestRunner_mgmt-tester        FAIL      233.06 seconds
TestRunner_mesh-tester        FAIL      26.88 seconds
IncrementalBuild              PASS      26.40 seconds

Details
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis Output:
Clang not found
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner Output:
Total: 501, Passed: 496 (99.0%), Failed: 1, Not Run: 4

Failed Test Cases
Read Exp Feature - Success Failed 0.262 seconds
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner Output:
Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0

Failed Test Cases

Mesh - Send cancel - 1                               Timed out    2.732 seconds
Mesh - Send cancel - 2                               Timed out    1.986 seconds

https://github.com/bluez/bluetooth-next/pull/681

---
Regards,
Linux Bluetooth

Luiz Augusto von Dentz

maintainer

2026-09-01 17:10 UTC #3 lore raw

Hi Lee,

Quoted 47 lines · On Tue, Sep 1, 2026 at 1:07 PM <[email protected]> wrote:

This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1155482
---Test result---
Test Summary:
CheckPatch                    PASS      0.75 seconds
VerifyFixes                   PASS      0.10 seconds
VerifySignedoff               PASS      0.08 seconds
GitLint                       PASS      0.22 seconds
SubjectPrefix                 PASS      0.07 seconds
BuildKernel                   PASS      28.57 seconds
CheckAllWarning               PASS      31.59 seconds
CheckSparse                   PASS      29.62 seconds
BuildKernel32                 PASS      27.44 seconds
CheckKernelLLVM               SKIP      0.00 seconds
TestRunnerSetup               PASS      510.88 seconds
TestRunner_mgmt-tester        FAIL      233.06 seconds
TestRunner_mesh-tester        FAIL      26.88 seconds
IncrementalBuild              PASS      26.40 seconds
Details
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis Output:
Clang not found
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner Output:
Total: 501, Passed: 496 (99.0%), Failed: 1, Not Run: 4
Failed Test Cases
Read Exp Feature - Success Failed 0.262 seconds
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner Output:
Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0

Quoted 3 lines

Failed Test Cases

Mesh - Send cancel - 1                               Timed out    2.732 seconds
Mesh - Send cancel - 2                               Timed out    1.986 seconds

These are preexisting errorrs but I was hoping your changes would address them.

Quoted 7 lines

https://github.com/bluez/bluetooth-next/pull/681
---
Regards,
Linux Bluetooth

Signature · 1 line

Luiz Augusto von Dentz

Luiz Augusto von Dentz

maintainer

2026-09-01 17:22 UTC #4 lore raw

Hi Lee,

Quoted 51 lines · Luiz Augusto von Dentz

Hi Lee,
Quoted 47 lines · On Tue, Sep 1, 2026 at 1:07 PM <[email protected]> wrote:
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1155482
---Test result---
Test Summary:
CheckPatch                    PASS      0.75 seconds
VerifyFixes                   PASS      0.10 seconds
VerifySignedoff               PASS      0.08 seconds
GitLint                       PASS      0.22 seconds
SubjectPrefix                 PASS      0.07 seconds
BuildKernel                   PASS      28.57 seconds
CheckAllWarning               PASS      31.59 seconds
CheckSparse                   PASS      29.62 seconds
BuildKernel32                 PASS      27.44 seconds
CheckKernelLLVM               SKIP      0.00 seconds
TestRunnerSetup               PASS      510.88 seconds
TestRunner_mgmt-tester        FAIL      233.06 seconds
TestRunner_mesh-tester        FAIL      26.88 seconds
IncrementalBuild              PASS      26.40 seconds
Details
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis Output:
Clang not found
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner Output:
Total: 501, Passed: 496 (99.0%), Failed: 1, Not Run: 4
Failed Test Cases
Read Exp Feature - Success Failed 0.262 seconds
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner Output:
Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0

Quoted 5 lines

Quoted 3 lines
Failed Test Cases
Mesh - Send cancel - 1                               Timed out    2.732 seconds
Mesh - Send cancel - 2                               Timed out    1.986 seconds
These are preexisting errorrs but I was hoping your changes would address them.

Looks like there are more problems:

https://sashiko.dev/#/patchset/20260901154427.3991920-1-lee%40kernel.org

Quoted 11 lines

Quoted 7 lines
https://github.com/bluez/bluetooth-next/pull/681
---
Regards,
Linux Bluetooth
--
Luiz Augusto von Dentz

Signature · 1 line

Luiz Augusto von Dentz

Lee Jones

author

2026-09-02 10:24 UTC #5 lore raw

Quoted 59 lines · Luiz Augusto von Dentz

Hi Lee,
Quoted 55 lines · Luiz Augusto von Dentz
Hi Lee,
Quoted 50 lines · On Tue, Sep 1, 2026 at 1:07 PM <[email protected]> wrote:
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1155482
---Test result---
Test Summary:
CheckPatch                    PASS      0.75 seconds
VerifyFixes                   PASS      0.10 seconds
VerifySignedoff               PASS      0.08 seconds
GitLint                       PASS      0.22 seconds
SubjectPrefix                 PASS      0.07 seconds
BuildKernel                   PASS      28.57 seconds
CheckAllWarning               PASS      31.59 seconds
CheckSparse                   PASS      29.62 seconds
BuildKernel32                 PASS      27.44 seconds
CheckKernelLLVM               SKIP      0.00 seconds
TestRunnerSetup               PASS      510.88 seconds
TestRunner_mgmt-tester        FAIL      233.06 seconds
TestRunner_mesh-tester        FAIL      26.88 seconds
IncrementalBuild              PASS      26.40 seconds
Details
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis Output:
Clang not found
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner Output:
Total: 501, Passed: 496 (99.0%), Failed: 1, Not Run: 4
Failed Test Cases
Read Exp Feature - Success Failed 0.262 seconds
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner Output:
Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0
Failed Test Cases
Mesh - Send cancel - 1                               Timed out    2.732 seconds
Mesh - Send cancel - 2                               Timed out    1.986 seconds

Quoted 5 lines

Quoted 1 line
These are preexisting errorrs but I was hoping your changes would address them.
Looks like there are more problems:
https://sashiko.dev/#/patchset/20260901154427.3991920-1-lee%40kernel.org

That's annoying! I ran Sashiko on this locally before pushing.

Looking now.

Signature · 1 line

Lee Jones