Re: [PATCH v2] Bluetooth: MSFT: Serialize handle map cleanup with event processing

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>:

On Mon, 12 Oct 2026 10:48:06 +0800 you wrote:
> MSFT monitor handle mappings must remain valid while vendor events look
> up and use them under hdev->lock. msft_do_close() removes and frees the
> mappings without that lock.
> 
> hci_dev_close_sync() clears HCI_UP and drains the RX workqueue before
> MSFT cleanup. However, a transport callback that already passed
> hci_recv_frame()'s state check can queue a vendor event after the drain
> returns, if no earlier shutdown callback has quiesced reception. The
> driver close callback runs after MSFT cleanup, so event processing can
> overlap the unlocked removal. msft_monitor_device_evt() can then
> traverse freed list entries or read handle_data->mgmt_handle after it is
> freed.
> 
> [...]

Here is the summary with links:
  - [v2] Bluetooth: MSFT: Serialize handle map cleanup with event processing
    https://git.kernel.org/bluetooth/bluetooth-next/c/0b72281125b2

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html