Re:[PATCH 1/2] Bluetooth: MGMT: free remove monitor command on cancel

[jiale yao]

At 2026-10-17 11:09:39, "Jiale Yao" <yaojiale02@xxxxxxx> wrote:
>remove_adv_monitor() allocates its queued command with
>mgmt_pending_new(), so the command is not linked into
>hdev->mgmt_pending. If the command-sync entry is cancelled, its
>completion callback returns without freeing the command, leaking both
>the allocation and its socket reference.
>
>Free the pending command before returning from the cancellation path.
>

Fixes: e6ed54e86aae ("Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete")

>Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
>---
> net/bluetooth/mgmt.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
>diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
>index 251a896babd5..e54a838aeada 100644
>--- a/net/bluetooth/mgmt.c
>+++ b/net/bluetooth/mgmt.c
>@@ -5682,8 +5682,10 @@ static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev,
> 	struct mgmt_pending_cmd *cmd = data;
> 	struct mgmt_cp_remove_adv_monitor *cp;
> 
>-	if (status == -ECANCELED)
>+	if (status == -ECANCELED) {
>+		mgmt_pending_free(cmd);
> 		return;
>+	}
> 
> 	hci_dev_lock(hdev);
> 
>-- 
>2.34.1