Re: [PATCH v6] Bluetooth: hci_conn: hold a reference for LE connection timeout

[Chengfeng Ye]

Hi Yaohan,

On Wed, Nov 4, 2026 at 1:20 PM Yaohan Li <shunsheng1218@xxxxxxxxx> wrote:
>
> Hello Chengfeng,
>
> We independently reproduced the LE connection timeout use-after-free
> and tested your [PATCH v6] ("Bluetooth: hci_conn: hold a reference
> for LE connection timeout") on a clean Linux v7.4-rc1 tree
> (6628e7d4c6b2).
>
> Test setup:
>   - QEMU/KVM, KASAN-enabled kernel, /dev/vhci virtual controller
>   - Management SET_ADVERTISING and L2CAP LE connection
>   - Kprobe-assisted timing injection at le_conn_timeout() entry,
>     50 ms park, with mgmt disconnect at discms=2015
>
> Results:
>   - Unpatched v7.4-rc1: 42 slab-use-after-free reports,
>     with the first relevant frame in hci_conn_failed()
>   - Your v6 patch applied to the clean tree: 0 KASAN reports,
>     with 200 confirmed probe hits under the same timing setup
>   - Control run without injection: 0 KASAN reports
>
> This is a test of your posted v6 reference-counting patch, not
> merely our independently developed fix. The result supports the
> lifetime fix under the tested interleaving; it does not establish
> coverage of every Bluetooth shutdown path.
>
> I also confirmed your analysis that a naive
> cancel_delayed_work_sync() replacement is NOT safe: the mgmt
> disconnect path holds hdev->lock while calling hci_conn_del,
> which would deadlock against le_conn_timeout's hci_dev_lock
> acquisition. Your reference-counting approach is the correct
> solution.
>
> Tested-by: Yaohan Li <shunsheng1218@xxxxxxxxx>

Thank you for reproducing the issue and testing the v6 patch, the
detailed results and your confirmation of the locking issue are
helpful. I also appreciate your Tested-by tag.

> We can provide the full console logs, build configuration, and
> reproducer details privately if useful. The investigation was
> AI-assisted, and the patch application and test results were
> reviewed by the human tester.
>
> Best regards,
> Yaohan Li

Best regards,
Chengfeng