Re: Bluetooth: mgmt: Fix heap overflow in mgmt_mesh_add
From: Maiquel Paiva
Date: Thu Feb 19 2026 - 14:29:57 EST
Hello Daniel and Luiz,
Daniel, thank you for the detailed analysis of the lock.
Once again, I made the mistake of analyzing the function in isolation.
In fact, I used `hdev->lock` in v4 of this series,
but I changed it to `mgmt_pending_lock` (and `guard(mutex)`)
specifically because it was suggested during a v4 review
to align with other list protections in that file.
But your analysis makes it clear that the primary device lock
already serializes this path.
Luiz, I fully agree with removing/reverting `003ca042a386` as well.
The list operations are already secure, thank you both for noticing this.
I consider this whole discussion a great learning experience on how to
track complete call paths and lock routes before introducing new locks!
Thanks,
Maiquel Paiva