Re: [PATCH bluetooth 0/4] Bluetooth: fix cmd_sync payload lifetimes on the cancel path

[patchwork-bot+bluetooth]

Hello:

This series was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>:

On Thu,  6 Aug 2026 20:59:53 +0800 you wrote:
> The cmd_sync worker calls entry->destroy() after running a command, and
> _hci_cmd_sync_cancel_entry() does the same when an entry is cancelled --
> but only if a destroy callback was supplied. Without one it frees the
> work entry and leaves entry->data unreleased.
> 
> These four call sites pass a heap payload with a NULL destroy callback
> and free it inside the sync function instead, so each of them leaks when
> the entry is cancelled rather than run. hci_cmd_sync_clear() cancels
> every pending entry when the controller is unregistered.
> 
> [...]

Here is the summary with links:
  - [1/4] Bluetooth: hci_conn: fix the SCO setup context lifetime
    https://git.kernel.org/bluetooth/bluetooth-next/c/7645e748704a
  - [2/4] Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths
    https://git.kernel.org/bluetooth/bluetooth-next/c/19aa86a8d171
  - [3/4] Bluetooth: MGMT: free the mesh send cancel command when it is cancelled
    https://git.kernel.org/bluetooth/bluetooth-next/c/ac0965fb4b86
  - [4/4] Bluetooth: MGMT: free the HCI command when it is cancelled
    https://git.kernel.org/bluetooth/bluetooth-next/c/f2afd8eadf5d

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html