)]}'
{
  "commit": "58d8a0955065fb00824865dca5b573a1becbb1ca",
  "tree": "934424489a0299c282281f5905c836729035274e",
  "parents": [
    "d9a1bd14caf5d235499319f7aee9e641c12d90a9"
  ],
  "author": {
    "name": "Cen Zhang",
    "email": "zzzccc427@gmail.com",
    "time": "Sun Oct 25 00:15:17 2026 +0800"
  },
  "committer": {
    "name": "Luiz Augusto von Dentz",
    "email": "luiz.von.dentz@intel.com",
    "time": "Tue Nov 10 10:51:05 2026 -0500"
  },
  "message": "Bluetooth: vhci: Flush suspend work after removing debugfs\n\nThe VHCI controller must remain alive until suspend_work finishes.\nvhci_release() flushes the work before removing the force_suspend\ndebugfs entry, so an active writer can queue work after that flush.\n\nA force_suspend write changing the suspend state can overlap the last\nclose of /dev/vhci as follows:\n\n    /dev/vhci close          Debugfs writer        Suspend worker\n    ---------------          --------------        --------------\n    vhci_release()           force_suspend_write()\n      flush_work() returns     [not queued yet]\n                               schedule_work() --\u003e\n                                                   hci_suspend_dev()\n                                                     check powered\n                                                     check !HCI_UNREGISTER\n                                                     hci_suspend_sync()\n                                                     unlock(req_lock)\n      vhci_debugfs_remove()\n        wait for writer\n      hci_unregister_dev()\n      hci_free_dev()\n        drop last reference\n        free hdev\n                                                   hci_clear_wake_reason()\n                                                     lock freed mutex\n                                                     use-after-free\n\nThe controller locks serialize state access but do not retain the\nallocation. Unregister drains HCI-owned work, but does not cover VHCI\u0027s\nsuspend_work on the system workqueue.\n\nFlush suspend_work again after removing the debugfs entries and before\nunregistering the controller. Removal waits for active writers and\nprevents new callbacks, so the second flush drains all remaining work\nwhile the controller and driver data are still alive. Retain the initial\nflush to preserve the existing teardown order.\n\nRuntime testing of this change was not performed.\n\nKASAN report as below:\n\n    \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n    BUG: KASAN: use-after-free in __mutex_lock+0x1e68/0x2590\n    Read of size 8 at addr ffff8881011b80b0 by task kworker/0:0/9\n\n    Workqueue: events vhci_suspend_work\n    Call Trace:\n     \u003cTASK\u003e\n     dump_stack_lvl+0x93/0xd0\n     print_report+0xce/0x630\n     ? __mutex_lock+0x1e68/0x2590\n     ? srso_alias_return_thunk+0x5/0xfbef5\n     ? __virt_addr_valid+0x20d/0x410\n     ? __mutex_lock+0x1e68/0x2590\n     kasan_report+0xe0/0x110\n     ? __mutex_lock+0x1e68/0x2590\n     __mutex_lock+0x1e68/0x2590\n     ? hci_suspend_dev+0x1ff/0x650\n     ? srso_alias_return_thunk+0x5/0xfbef5\n     ? mark_held_locks+0x40/0x70\n     ? _raw_spin_unlock_irqrestore+0x44/0x60\n     ? srso_alias_return_thunk+0x5/0xfbef5\n     ? lockdep_hardirqs_on_prepare+0xea/0x1a0\n     ? srso_alias_return_thunk+0x5/0xfbef5\n     ? __pfx___mutex_lock+0x10/0x10\n     ? _raw_spin_unlock_irqrestore+0x44/0x60\n     ? srso_alias_return_thunk+0x5/0xfbef5\n     ? pmbd_gate_site_armed+0x31/0x1c0\n     ? srso_alias_return_thunk+0x5/0xfbef5\n     ? __pfx_pmbd_probe_hit_cookie+0x10/0x10\n     ? hci_suspend_dev+0x1ff/0x650\n     hci_suspend_dev+0x1ff/0x650\n     vhci_suspend_work+0xa5/0x190\n     process_one_work+0x908/0x19c0\n     ? __pfx_process_one_work+0x10/0x10\n     ? srso_alias_return_thunk+0x5/0xfbef5\n     ? lock_is_held_type+0x8f/0x100\n     ? srso_alias_return_thunk+0x5/0xfbef5\n     worker_thread+0x65c/0xe40\n     ? __pfx_worker_thread+0x10/0x10\n     kthread+0x34f/0x460\n     ? srso_alias_return_thunk+0x5/0xfbef5\n     ? __pfx_kthread+0x10/0x10\n     ret_from_fork+0x659/0x940\n     ? __pfx_ret_from_fork+0x10/0x10\n     ? srso_alias_return_thunk+0x5/0xfbef5\n     ? __switch_to+0x74f/0xf80\n     ? __pfx_kthread+0x10/0x10\n     ret_from_fork_asm+0x1a/0x30\n     \u003c/TASK\u003e\n\n    The buggy address belongs to the physical page:\n        page: refcount:0 mapcount:0 mapping:0000000000000000\n    index:0xffff8881011b9040 pfn:0x1011b8\n    flags: 0x200000000000000(node\u003d0|zone\u003d2)\n        raw: 0200000000000000 ffffea0004073308 ffff88818863f180\n    0000000000000000\n        raw: ffff8881011b9040 0000000000000000 00000000ffffffff\n    0000000000000000\n    page dumped because: kasan: bad access detected\n\n    Memory state around the buggy address:\n     ffff8881011b7f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n     ffff8881011b8000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n    \u003effff8881011b8080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n                                         ^\n     ffff8881011b8100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n     ffff8881011b8180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n    \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nFixes: d16e6d19ccc6 (\"Bluetooth: hci_vhci: Fix calling hci_{suspend,resume}_dev\")\nAssisted-by: LLM\nSigned-off-by: Cen Zhang \u003czzzccc427@gmail.com\u003e\nTested-by: Chad Aldreda \u003cca@modelmiser.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "8f7db0102b25facbe5adb691741bff9827d9c576",
      "old_mode": 33188,
      "old_path": "drivers/bluetooth/hci_vhci.c",
      "new_id": "bedba3c140ac204b9a27ed96f3616bc26299cd09",
      "new_mode": 33188,
      "new_path": "drivers/bluetooth/hci_vhci.c"
    }
  ]
}