Re: [PATCH] Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>:

On Mon, 15 Jun 2026 16:09:22 +0100 you wrote:
> add_device_complete() runs from the hci_cmd_sync_work kworker, which
> holds only hci_req_sync_lock and *not* hci_dev_lock.  It calls
> hci_conn_params_lookup() and then dereferences the returned object
> (params->flags) without taking hci_dev_lock:
> 
> 	params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
> 					le_addr_type(cp->addr.type));
> 	...
> 	device_flags_changed(NULL, hdev, &cp->addr.bdaddr,
> 			     cp->addr.type, hdev->conn_flags,
> 			     params ? params->flags : 0);
> 
> [...]

Here is the summary with links:
  - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete
    https://git.kernel.org/bluetooth/bluetooth-next/c/cb20f6afc25b

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html