Re: [PATCH] Bluetooth: hci_sync: Fix inquiry cache use-after-free

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>:

On Sun, 27 Sep 2026 01:28:31 +0800 you wrote:
> The sync command worker holds hdev->req_lock, but inquiry-cache updates
> and flushes use hdev->lock. Both hci_acl_create_conn_sync() and
> hci_stop_discovery_sync() look up entries and read their fields without
> taking hdev->lock.
> 
> After either lookup returns, a concurrent HCIINQUIRY ioctl can acquire
> hdev->lock and flush the cache, freeing the entry. The worker then reads
> the freed entry while preparing a create-connection or remote-name-cancel
> command. The list traversal also races with cache updates and removal.
> 
> [...]

Here is the summary with links:
  - Bluetooth: hci_sync: Fix inquiry cache use-after-free
    https://git.kernel.org/bluetooth/bluetooth-next/c/8ed67535fdff

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html