linuxmsm/laptops-kernel
0
0
Fork 0
mirror of https://github.com/linux-msm/laptops-kernel.git synced 2026-08-13 14:19:53 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback

Browse Source 
There is theoretical UAF if the conn is freed while the hci_sync task is
running.

Hold refcount to avoid that. Handle NULL hcon, return 0 + do nothing to
match the previous behavior.

Fixes: 024421cf39 ("Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This commit is contained in:
Pauli Virtanen
2026-07-28 16:13:13 -04:00
committed by Luiz Augusto von Dentz
parent 2f5d635ad5
commit 56e78b6703
1 changed files with 12 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/bluetooth/hci_sync.c
+12 -4
View File
@@ -7522,10 +7522,12 @@ static void create_big_complete(struct hci_dev *hdev, void *data, int err)
bt_dev_dbg(hdev, "err %d", err);
if (err == -ECANCELED)
return;
goto done;
if (hci_conn_valid(hdev, conn))
clear_bit(HCI_CONN_CREATE_BIG_SYNC, &conn->flags);
clear_bit(HCI_CONN_CREATE_BIG_SYNC, &conn->flags);
done:
hci_conn_put(conn);
}
static int hci_le_big_create_sync(struct hci_dev *hdev, void *data)
@@ -7577,8 +7579,14 @@ int hci_connect_big_sync(struct hci_dev *hdev, struct hci_conn *conn)
{
int err;
err = hci_cmd_sync_queue_once(hdev, hci_le_big_create_sync, conn,
if (!conn)
return 0;
err = hci_cmd_sync_queue_once(hdev, hci_le_big_create_sync,
hci_conn_get(conn),
create_big_complete);
if (err)
hci_conn_put(conn);
return (err == -EEXIST) ? 0 : err;
}