Bluetooth: hci_conn: Fix UAF Write in __hci_acl_create_connection_sync

Browse source

[ Upstream commit 5f641f03ab ]

This fixes the UAF on __hci_acl_create_connection_sync caused by
connection abortion, it uses the same logic as to LE_LINK which uses
hci_cmd_sync_cancel to prevent the callback to run if the connection is
abort prematurely.

Reported-by: syzbot+3f0a39be7a2035700868@syzkaller.appspotmail.com
Fixes: 45340097ce ("Bluetooth: hci_conn: Only do ACL connections sequentially")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Stable-dep-of: 227a0cdf4a ("Bluetooth: MGMT: Fix not generating command complete for MGMT_OP_DISCONNECT")
Signed-off-by: Sasha Levin <sashal@kernel.org>

...

This commit is contained in:

Luiz Augusto von Dentz 2024-02-09 09:08:06 -05:00 • committed by Greg Kroah-Hartman

parent e78bd85af2

commit 98f66ea456

3 changed files with 13 additions and 9 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

3

include/net/bluetooth/hci_sync.h

View file