Re: [PATCH] Bluetooth: vhci: Serialize packet reception with device creation

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>:

On Sat, 24 Oct 2026 23:28:23 +0800 you wrote:
> The hci_dev passed to hci_recv_frame() must stay alive until the receive
> operation finishes. __vhci_create_device() stores data->hdev before
> hci_register_dev() and frees the device if registration fails.
> vhci_get_user() checks and uses that pointer without taking the
> open_mutex held by the creator or a device reference.
> 
> An incoming packet write can overlap the delayed default-create work
> scheduled by vhci_open(). If registration fails before acquiring the
> registration reference, the following order is possible:
> 
> [...]

Here is the summary with links:
  - Bluetooth: vhci: Serialize packet reception with device creation
    https://git.kernel.org/bluetooth/bluetooth-next/c/f8ba3e2e82f0

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html