]> git.ipfire.org Git - thirdparty/linux.git/commit
projects / thirdparty / linux.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 2f5d635) | patch
Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback
authorPauli Virtanen <pav@iki.fi>
Sat, 25 Jul 2026 09:59:19 +0000 (12:59 +0300)
committerLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
Tue, 28 Jul 2026 20:13:13 +0000 (16:13 -0400)
commit56e78b670356caab0b607e8aad4cf819a1909d07
treedacb598bef27bd046afa3761cdc70709b5d394cetree | snapshot
parent2f5d635ad5906b0235bc0c870e8beba3116e1e98commit | diff
Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback

There is theoretical UAF if the conn is freed while the hci_sync task is
running.

Hold refcount to avoid that. Handle NULL hcon, return 0 + do nothing to
match the previous behavior.

Fixes: 024421cf3992 ("Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
net/bluetooth/hci_sync.c diff | blob | blame | history
A mirror of Linus' kernel repository