Re: [PATCH v6] Bluetooth: hci_conn: hold a reference for LE connection timeout

[Yaohan Li]

Hello Chengfeng,

We independently reproduced the LE connection timeout use-after-free
and tested your [PATCH v6] ("Bluetooth: hci_conn: hold a reference
for LE connection timeout") on a clean Linux v7.4-rc1 tree
(6628e7d4c6b2).

Test setup:
  - QEMU/KVM, KASAN-enabled kernel, /dev/vhci virtual controller
  - Management SET_ADVERTISING and L2CAP LE connection
  - Kprobe-assisted timing injection at le_conn_timeout() entry,
    50 ms park, with mgmt disconnect at discms=2015

Results:
  - Unpatched v7.4-rc1: 42 slab-use-after-free reports,
    with the first relevant frame in hci_conn_failed()
  - Your v6 patch applied to the clean tree: 0 KASAN reports,
    with 200 confirmed probe hits under the same timing setup
  - Control run without injection: 0 KASAN reports

This is a test of your posted v6 reference-counting patch, not
merely our independently developed fix. The result supports the
lifetime fix under the tested interleaving; it does not establish
coverage of every Bluetooth shutdown path.

I also confirmed your analysis that a naive
cancel_delayed_work_sync() replacement is NOT safe: the mgmt
disconnect path holds hdev->lock while calling hci_conn_del,
which would deadlock against le_conn_timeout's hci_dev_lock
acquisition. Your reference-counting approach is the correct
solution.

Tested-by: Yaohan Li <shunsheng1218@xxxxxxxxx>

We can provide the full console logs, build configuration, and
reproducer details privately if useful. The investigation was
AI-assisted, and the patch application and test results were
reviewed by the human tester.

Best regards,
Yaohan Li