Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks

Browse source

There is theoretical UAF if the conn is freed while the hci_sync task
is running.

Hold refcount to avoid that.

Fixes: 881559af5f ("Bluetooth: hci_sync: Attempt to dequeue connection attempt")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

...

This commit is contained in:

Pauli Virtanen 2026-07-25 12:59:18 +03:00 • committed by Luiz Augusto von Dentz

parent 5761d003da

commit 2f5d635ad5

1 changed files with 24 additions and 8 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

32

net/bluetooth/hci_sync.c

View file