hci_le_pa_create_sync() exhibits the same TOCTOU pattern as hci_le_create_conn_sync(): the cmd_sync callback receives a struct hci_conn pointer via void *data, calls hci_conn_valid() at entry, and then dereferences conn->sync_handle, sets a bit on conn->flags, reads conn->dst / conn->dst_type / conn->iso_qos / conn->sid / conn->conn_timeout, and blocks waiting for HCI_EV_LE_PA_SYNC_ESTABLISHED. The wait can run for conn->conn_timeout milliseconds (typically multiple seconds for periodic-advertising-sync), giving hci_disconn_complete_evt() a wide window to retire the conn out from under the callback. A KASAN slab-use-after-free splat ("Read of size 2 at addr ... The buggy address is located 52 bytes inside of freed 8192-byte region", cache kmalloc-8k) confirms the bug on linux-next tip commit bee6ea30c487 ("Add linux-next specific files for 20260421"). Offset 52 corresponds to conn->sync_handle. Convert hci_connect_pa_sync() to the hci_cmd_sync_queue_conn_once() helper introduced in the previous patch, and balance the conn pin in create_pa_complete()'s -ECANCELED short-circuit. Prior art: Pauli Virtanen's PATCH v2 8/8 at https://lore.kernel.org/linux-bluetooth/e18591f264c50e15917cb8b9e5f9798d9880979d.1762100290.git.pav@iki.fi/. Fixes: 6d0417e4e1cf ("Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito --- net/bluetooth/hci_sync.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c index b20e07474257..43779375209b 100644 --- a/net/bluetooth/hci_sync.c +++ b/net/bluetooth/hci_sync.c @@ -7089,7 +7089,7 @@ static void create_pa_complete(struct hci_dev *hdev, void *data, int err) bt_dev_dbg(hdev, "err %d", err); if (err == -ECANCELED) - return; + goto done; hci_dev_lock(hdev); @@ -7113,6 +7113,8 @@ static void create_pa_complete(struct hci_dev *hdev, void *data, int err) unlock: hci_dev_unlock(hdev); +done: + hci_conn_put(conn); } static int hci_le_past_params_sync(struct hci_dev *hdev, struct hci_conn *conn, @@ -7251,8 +7253,8 @@ int hci_connect_pa_sync(struct hci_dev *hdev, struct hci_conn *conn) { int err; - err = hci_cmd_sync_queue_once(hdev, hci_le_pa_create_sync, conn, - create_pa_complete); + err = hci_cmd_sync_queue_conn_once(hdev, hci_le_pa_create_sync, conn, + create_pa_complete); return (err == -EEXIST) ? 0 : err; } -- 2.53.0