Re: [PATCH v2] Bluetooth: mgmt: fix race in read_unconf_index_list()

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>:

On Tue, 15 Sep 2026 12:59:52 -0300 you wrote:
> read_unconf_index_list() counts unconfigured controllers before allocating
> its response, then checks the device flags again while filling it.
> 
> hci_dev_list_lock stabilizes list membership, but it does not serialize the
> per-device flags. During asynchronous controller setup, the worker can set
> HCI_UNCONFIGURED and clear HCI_SETUP between the two passes. A controller
> omitted from the allocation count can then become eligible for the fill
> pass, causing an out-of-bounds write to rp->index[].
> 
> [...]

Here is the summary with links:
  - [v2] Bluetooth: mgmt: fix race in read_unconf_index_list()
    https://git.kernel.org/bluetooth/bluetooth-next/c/b5dbb41b212c

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html