Re: [PATCH v2 1/1] Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel

[Greg KH]

On Tue, Sep 01, 2026 at 03:44:26PM +0000, Lee Jones wrote:
> In send_cancel(), pending mesh_tx objects are removed from the
> hdev->mesh_pending list and freed via mesh_send_complete(). However, if
> a mesh transmission was already queued onto hdev->cmd_sync_work_list
> via mesh_next(), the queued entry retains a raw pointer to mesh_tx.
> 
> When hci_cmd_sync_work later processes the entry, it attempts to
> execute mesh_send_sync and its destroy callback mesh_send_start_complete
> using the already freed mesh_tx pointer, leading to a use-after-free.
> 
> Fix this by invoking hci_cmd_sync_dequeue() for mesh_send_sync on the
> target mesh_tx before completing it. If the entry is found and dequeued,
> its destroy callback will complete and free the object; otherwise,
> mesh_send_complete() is called directly.
> 
> Fixes: b338d91703fa ("Bluetooth: Implement support for Mesh")
> Signed-off-by: Lee Jones <lee@xxxxxxxxxx>
> ---
> 
> v1 => v2: Email address switch - no functional change
> 
>  net/bluetooth/mgmt.c | 14 ++++++++++----
>  1 file changed, 10 insertions(+), 4 deletions(-)
> 

<formletter>

This is not the correct way to submit patches for inclusion in the
stable kernel tree.  Please read:
    https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
for how to do this properly.

</formletter>