TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bluetooth: hci_conn: Fix UAF Write in __hci_acl_create_connection_sync

Browse Source 
[ Upstream commit 5f641f03ab ]

This fixes the UAF on __hci_acl_create_connection_sync caused by
connection abortion, it uses the same logic as to LE_LINK which uses
hci_cmd_sync_cancel to prevent the callback to run if the connection is
abort prematurely.

Reported-by: syzbot+3f0a39be7a2035700868@syzkaller.appspotmail.com
Fixes: 45340097ce ("Bluetooth: hci_conn: Only do ACL connections sequentially")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Stable-dep-of: 227a0cdf4a ("Bluetooth: MGMT: Fix not generating command complete for MGMT_OP_DISCONNECT")
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Luiz Augusto von Dentz
2024-02-09 09:08:06 -05:00
committed by Greg Kroah-Hartman
parent e78bd85af2
commit 98f66ea456
3 changed files with 13 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/net/bluetooth/hci_sync.h
+1 -2
View File
@@ -141,5 +141,4 @@ int hci_le_big_terminate_sync(struct hci_dev *hdev, u8 handle);
int hci_le_pa_terminate_sync(struct hci_dev *hdev, u16 handle);
int hci_acl_create_connection_sync(struct hci_dev *hdev,
struct hci_conn *conn);
int hci_connect_acl_sync(struct hci_dev *hdev, struct hci_conn *conn);