diff options
| author |   Shuvam Pandey <shuvampandey1@gmail.com> | 2026-04-09 00:32:30 +0545 |
|---|---|---|
| committer |   Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2026-04-13 09:19:42 -0400 |
| commit | 85fa3512048793076eef658f66489112dcc91993 (patch) | |
| tree | 81ca8abf09de66bca541fbea2c16ede8c44be813 /include/uapi/linux/ssh:/git@git.zx2c4.com | |
| parent | Bluetooth: hci.h: Avoid a couple -Wflex-array-member-not-at-end warnings (diff) | |
Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
hci_conn lookup and field access must be covered by hdev lock in
hci_user_passkey_notify_evt() and hci_keypress_notify_evt(), otherwise
the connection can be freed concurrently.
Extend the hci_dev_lock critical section to cover all conn usage in both
handlers.
Keep the existing keypress notification behavior unchanged by routing
the early exits through a common unlock path.
Fixes: 92a25256f142 ("Bluetooth: mgmt: Implement support for passkey notification")
Cc: stable@vger.kernel.org
Signed-off-by: Shuvam Pandey <shuvampandey1@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'include/uapi/linux/ssh:/git@git.zx2c4.com')
0 files changed, 0 insertions, 0 deletions