diff options
| author |   Pauli Virtanen <pav@iki.fi> | 2026-07-10 11:23:41 +0300 |
|---|---|---|
| committer |   Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2026-07-13 10:08:46 -0400 |
| commit | 16cd66443957e4ad42155c6fec401012f600c6f8 (patch) | |
| tree | b42bdeb6ecb44af7018b43eaf7dbd7c260106e1f /scripts/Makefile.thinlto | |
| parent | Bluetooth: hci_sync: extend conn_hash lookup critical sections (diff) | |
Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync
Dereferencing RCU-protected pointers outside critical sections is
invalid and may lead to UAF.
Take hdev->lock for hci_conn lookup and hci_abort_conn(). Don't use RCU
to ensure the conn is fully initialized at this point.
Fixes: 227a0cdf4a028 ("Bluetooth: MGMT: Fix not generating command complete for MGMT_OP_DISCONNECT")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'scripts/Makefile.thinlto')
0 files changed, 0 insertions, 0 deletions