)]}'
{
  "commit": "12917f591cea1af36087dba5b9ec888652f0b42a",
  "tree": "a2d2aa6bf047257b9d495e904419cb05e04468ba",
  "parents": [
    "badff6c3bed8923a1257a853f137d447976eec30"
  ],
  "author": {
    "name": "Siwei Zhang",
    "email": "oss@fourdim.xyz",
    "time": "Mon Jun 15 11:33:05 2026 -0400"
  },
  "committer": {
    "name": "Luiz Augusto von Dentz",
    "email": "luiz.von.dentz@intel.com",
    "time": "Mon Jul 06 10:46:57 2026 -0400"
  },
  "message": "Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()\n\nhci_abort_conn() read hci_skb_event(hdev-\u003esent_cmd) when a connection\nwas pending, but hdev-\u003esent_cmd can be NULL while req_status is still\nHCI_REQ_PEND, leading to a NULL pointer dereference and a general\nprotection fault from the hci_rx_work() receive path.\n\nInstead of inspecting hdev-\u003esent_cmd, track the in-flight create\nconnection command with a new per-connection HCI_CONN_CREATE flag and\nroute all cancellation through hci_cancel_connect_sync(), which\ndispatches to a dedicated per-type cancel function. The create command\nis in exactly one of two states: still queued, or in flight. The cancel\nfunction holds cmd_sync_work_lock across the whole decision: the worker\ntakes this lock to dequeue every entry, so while it is held a queued\ncommand cannot start running and an in-flight command cannot complete\nand let the next command become pending. This keeps the flag test and\nhci_cmd_sync_cancel() atomic with respect to the worker, so a queued\ncommand is simply dequeued, and an in-flight command owned by this\nconnection is cancelled without the risk of cancelling an unrelated\ncommand that became pending in the meantime. CIS uses the same flag\nmechanism via HCI_CONN_CREATE_CIS but cannot be dequeued per-connection.\n\nhci_acl_create_conn_sync() and hci_le_create_conn_sync() clear\nHCI_CONN_CREATE after the create command completes, but the command\nstatus handler can free conn via hci_conn_del() (for example when the\ncontroller rejects the connection) while the worker is still blocked on\nthe connection complete event. Hold a reference on conn across the\ncreate command so the flag can be cleared without a use-after-free.\n\nFixes: a13f316e90fd (\"Bluetooth: hci_conn: Consolidate code for aborting connections\")\nCc: stable@vger.kernel.org\nSuggested-by: XIAO WU \u003cxiaowu.417@qq.com\u003e\nAssisted-by: Claude:claude-opus-4-8\nSigned-off-by: Siwei Zhang \u003coss@fourdim.xyz\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "7e15da47fe3ac39f4be6abfe593396b19fb5e015",
      "old_mode": 33188,
      "old_path": "include/net/bluetooth/hci_core.h",
      "new_id": "4ca09298e11ae759493221947aa6ba2687b185ab",
      "new_mode": 33188,
      "new_path": "include/net/bluetooth/hci_core.h"
    },
    {
      "type": "modify",
      "old_id": "c335372e406211fe03a285ce6123a874c85fd66a",
      "old_mode": 33188,
      "old_path": "net/bluetooth/hci_conn.c",
      "new_id": "1966cd153d9730dda12c1ce64cdd930bb50dcee0",
      "new_mode": 33188,
      "new_path": "net/bluetooth/hci_conn.c"
    },
    {
      "type": "modify",
      "old_id": "3be8c3581c6caadeeea56e14e09d4123deb4ec03",
      "old_mode": 33188,
      "old_path": "net/bluetooth/hci_sync.c",
      "new_id": "c896d4edd0133e3c1ff3304cd71c984372a22732",
      "new_mode": 33188,
      "new_path": "net/bluetooth/hci_sync.c"
    }
  ]
}