projects / linux-2.6-microblaze.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: b640ff9) | patch
Bluetooth: hci_conn: hold conn reference in abort_conn_sync()
authorPauli Virtanen <pav@iki.fi>
Sat, 25 Jul 2026 09:59:17 +0000 (12:59 +0300)
committerLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
Tue, 28 Jul 2026 20:13:12 +0000 (16:13 -0400)
commit5761d003daa987ac81463f570713ce9c9dd204e5
tree0260911a9cad3836cdbbdf9e44f3dac0bf4c2149tree
parentb640ff9af3c809ff5ea2077fbba17df1594ec1e4commit | diff
Bluetooth: hci_conn: hold conn reference in abort_conn_sync()

There is theoretical UAF if the conn is freed while the hci_sync task is
running.

Hold refcount to avoid that.

Fixes: 227a0cdf4a02 ("Bluetooth: MGMT: Fix not generating command complete for MGMT_OP_DISCONNECT")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
net/bluetooth/hci_conn.c diff | blob | history
MicroBlaze GIT Repository