Luiz Augusto von Dentz 98f66ea456 Bluetooth: hci_conn: Fix UAF Write in __hci_acl_create_connection_sync ...

[ Upstream commit 5f641f03abccddd1a37233ff1b8e774b9ff1f4e8 ]

This fixes the UAF on __hci_acl_create_connection_sync caused by
connection abortion, it uses the same logic as to LE_LINK which uses
hci_cmd_sync_cancel to prevent the callback to run if the connection is
abort prematurely.

Reported-by: syzbot+3f0a39be7a2035700868@syzkaller.appspotmail.com
Fixes: 45340097ce6e ("Bluetooth: hci_conn: Only do ACL connections sequentially")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Stable-dep-of: 227a0cdf4a02 ("Bluetooth: MGMT: Fix not generating command complete for MGMT_OP_DISCONNECT")
Signed-off-by: Sasha Levin <sashal@kernel.org>

2024-09-12 11:11:33 +02:00

..

acpi

ACPICA: Add a depth argument to acpi_execute_reg_methods()

2024-08-29 17:33:13 +02:00

asm-generic

vmlinux.lds.h: catch .bss..L* sections into BSS")

2024-08-03 08:53:35 +02:00

clocksource

pwm: xilinx: Fix u32 overflow issue in 32-bit width PWM mode.

2024-09-08 07:54:44 +02:00

crypto

crypto: af_alg - Disallow multiple in-flight AIO requests

2024-01-25 15:35:16 -08:00

drm

drm/mipi-dsi: Fix theoretical int overflow in mipi_dsi_generic_write_seq()

2024-08-03 08:53:45 +02:00

dt-bindings

clk: renesas: r8a779g0: Correct PFC/GPIO parent clocks

2024-03-26 18:19:47 -04:00

keys

integrity: PowerVM support for loading third party code signing keys

2023-08-17 20:12:35 +00:00

kunit

Merge tag 'mm-nonmm-stable-2023-08-28-22-48' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2023-08-29 14:53:51 -07:00

kvm

KVM: arm64: Fix host-programmed guest events in nVHE

2024-04-10 16:35:48 +02:00

linux

regulator: core: Stub devm_regulator_bulk_get_const() if !CONFIG_REGULATOR

2024-09-12 11:11:32 +02:00

math-emu

…

media

media: cec: core: avoid recursive cec_claim_log_addrs

2024-06-12 11:12:43 +02:00

memory

…

misc

…

net

Bluetooth: hci_conn: Fix UAF Write in __hci_acl_create_connection_sync

2024-09-12 11:11:33 +02:00

pcmcia

…

ras

…

rdma

RDMA/core: Fix umem iterator when PAGE_SIZE is greater then HCA pgsz

2023-12-13 18:45:16 +01:00

rv

rv: Set variable 'da_mon_##name' to static

2023-09-01 21:00:00 -04:00

scsi

scsi: core: Fix the return value of scsi_logical_block_count()

2024-08-29 17:33:52 +02:00

soc

net: mscc: ocelot: serialize access to the injection/extraction groups

2024-08-29 17:33:45 +02:00

sound

ALSA: ump: Transmit RPN/NRPN message at each MSB/LSB data reception

2024-09-08 07:54:30 +02:00

target

scsi: target: iscsi: Remove the unused netif_timeout attribute

2023-07-11 12:33:32 -04:00

trace

platform/x86/intel/ifs: Gen2 Scan test support

2024-08-14 13:58:37 +02:00

uapi

Revert "misc: fastrpc: Restrict untrusted app to attach to privileged PD"

2024-08-29 17:33:10 +02:00

ufs

scsi: ufs: core: Check LSDBS cap when !mcq

2024-09-08 07:54:29 +02:00

vdso

…

video

fbdev: stifb: Make the STI next font pointer a 32-bit signed offset

2023-11-28 17:19:58 +00:00

xen

xen/events: reduce externally visible helper functions

2024-03-01 13:34:57 +01:00