Bluetooth: hci_sync: hold conn in hci_past_sync() callback

Avoids giving freed pointers to hci_conn_valid(), which kmalloc may have
reused.

Hold refcount to avoid that.

Fixes: d3413703d5f8 ("Bluetooth: ISO: Add support to bind to trigger PAST")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index f50d7cd3a331df66cf05000def3d9118d978b27b..0118342ac7ea23445be01bbcd3e9713a6f073fad 100644 (file)
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -7606,6 +7606,8 @@ static void past_complete(struct hci_dev *hdev, void *data, int err)
 
        bt_dev_dbg(hdev, "err %d", err);
 
+       hci_conn_put(past->conn);
+       hci_conn_put(past->le);
        kfree(past);
 }
 
@@ -7670,8 +7672,8 @@ int hci_past_sync(struct hci_conn *conn, struct hci_conn *le)
        if (!data)
                return -ENOMEM;
 
-       data->conn = conn;
-       data->le = le;
+       data->conn = hci_conn_get(conn);
+       data->le = hci_conn_get(le);
 
        if (conn->role == HCI_ROLE_MASTER)
                err = hci_cmd_sync_queue_once(conn->hdev,
@@ -7681,8 +7683,11 @@ int hci_past_sync(struct hci_conn *conn, struct hci_conn *le)
                err = hci_cmd_sync_queue_once(conn->hdev, hci_le_past_sync,
                                              data, past_complete);
 
-       if (err)
+       if (err) {
+               hci_conn_put(data->conn);
+               hci_conn_put(data->le);
                kfree(data);
+       }
 
        return (err == -EEXIST) ? 0 : err;
 }