diff options
| author |   Ruihan Li <lrh2000@pku.edu.cn> | 2023-05-03 21:39:34 +0800 |
|---|---|---|
| committer |   Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2023-05-19 15:37:45 -0700 |
| commit | ca1fd42e7dbfcb34890ffbf1f2f4b356776dab6f (patch) | |
| tree | d9d20f006026eff3205997d33ffe564d3db4c893 /tools/perf/scripts/python/export-to-sqlite.py | |
| parent | net: fec: add dma_wmb to ensure correct descriptor values (diff) | |
| download | wireguard-linux-ca1fd42e7dbfcb34890ffbf1f2f4b356776dab6f.tar.xz wireguard-linux-ca1fd42e7dbfcb34890ffbf1f2f4b356776dab6f.zip | |
Bluetooth: Fix potential double free caused by hci_conn_unlink
The hci_conn_unlink function is being called by hci_conn_del, which
means it should not call hci_conn_del with the input parameter conn
again. If it does, conn may have already been released when
hci_conn_unlink returns, leading to potential UAF and double-free
issues.
This patch resolves the problem by modifying hci_conn_unlink to release
only conn's child links when necessary, but never release conn itself.
Reported-by: syzbot+690b90b14f14f43f4688@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-bluetooth/000000000000484a8205faafe216@google.com/
Fixes: 06149746e720 ("Bluetooth: hci_conn: Add support for linking multiple hcon")
Signed-off-by: Ruihan Li <lrh2000@pku.edu.cn>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Reported-by: syzbot+690b90b14f14f43f4688@syzkaller.appspotmail.com
Reported-by: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Reported-by: syzbot+8bb72f86fc823817bc5d@syzkaller.appspotmail.com
Diffstat (limited to '')
0 files changed, 0 insertions, 0 deletions