Re: [PATCH] Bluetooth: hci_sync: Fix command skb lifetime during scan setup

[patchwork-bot+bluetooth@kernel.org]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Mon,  5 Oct 2026 00:26:12 +0800 you wrote:
> During PA sync scan setup, hci_le_set_ext_scan_param_sync() gets the
> address used for the PA_LINK lookup from hci_sent_cmd_data(). The
> returned pointer borrows storage from sent_cmd or req_skb, without
> holding a reference to either skb.
> 
> The scan worker runs on req_workqueue while hci_cmd_work() runs on the
> separate device workqueue. After the scan worker loads sent_cmd, the
> command worker can free and replace it before hci_sent_cmd_data()
> dereferences the skb. The command payload can also be freed between
> returning from the helper and comparing the address. The connection
> lookup's RCU critical section does not protect the command skb.
> 
> [...]

Here is the summary with links:
  - Bluetooth: hci_sync: Fix command skb lifetime during scan setup
    https://git.kernel.org/bluetooth/bluetooth-next/c/9af12272061d

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html