Files
linux/include/net
Luiz Augusto von Dentz 98f66ea456 Bluetooth: hci_conn: Fix UAF Write in __hci_acl_create_connection_sync
[ Upstream commit 5f641f03abccddd1a37233ff1b8e774b9ff1f4e8 ]

This fixes the UAF on __hci_acl_create_connection_sync caused by
connection abortion, it uses the same logic as to LE_LINK which uses
hci_cmd_sync_cancel to prevent the callback to run if the connection is
abort prematurely.

Reported-by: syzbot+3f0a39be7a2035700868@syzkaller.appspotmail.com
Fixes: 45340097ce6e ("Bluetooth: hci_conn: Only do ACL connections sequentially")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Stable-dep-of: 227a0cdf4a02 ("Bluetooth: MGMT: Fix not generating command complete for MGMT_OP_DISCONNECT")
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-12 11:11:33 +02:00
..
2022-08-09 22:14:02 -07:00
2021-12-16 07:18:35 -08:00
2023-11-20 11:59:34 +01:00
2021-10-15 11:33:08 +01:00
2024-01-31 16:19:01 -08:00
2023-04-22 01:39:41 +02:00
2021-10-13 09:40:46 -07:00
2023-08-22 17:31:18 -07:00
2022-05-11 12:43:10 +01:00
2023-05-11 18:07:05 -07:00
2023-07-14 20:39:30 -07:00
2019-04-22 21:47:25 -07:00
2019-10-05 16:29:00 -07:00
2024-06-16 13:47:44 +02:00
2023-02-16 09:27:07 +01:00
2024-07-18 13:21:12 +02:00
2023-07-28 14:07:59 -07:00
2022-12-12 15:04:39 -08:00
2023-11-20 11:58:56 +01:00
2023-08-02 10:58:26 +01:00
2023-07-19 09:56:49 -07:00