diff options
| author | Ruihan Li <[email protected]> | 2023-05-03 21:39:34 +0800 |
|---|---|---|
| committer | Luiz Augusto von Dentz <[email protected]> | 2023-05-19 15:37:45 -0700 |
| commit | ca1fd42e7dbfcb34890ffbf1f2f4b356776dab6f (patch) | |
| tree | d9d20f006026eff3205997d33ffe564d3db4c893 /scripts/generate_rust_target.rs | |
| parent | 9025944fddfed5966c8f102f1fe921ab3aee2c12 (diff) | |
Bluetooth: Fix potential double free caused by hci_conn_unlink
The hci_conn_unlink function is being called by hci_conn_del, which
means it should not call hci_conn_del with the input parameter conn
again. If it does, conn may have already been released when
hci_conn_unlink returns, leading to potential UAF and double-free
issues.
This patch resolves the problem by modifying hci_conn_unlink to release
only conn's child links when necessary, but never release conn itself.
Reported-by: [email protected]
Closes: https://lore.kernel.org/linux-bluetooth/[email protected]/
Fixes: 06149746e720 ("Bluetooth: hci_conn: Add support for linking multiple hcon")
Signed-off-by: Ruihan Li <[email protected]>
Signed-off-by: Luiz Augusto von Dentz <[email protected]>
Reported-by: [email protected]
Reported-by: Luiz Augusto von Dentz <[email protected]>
Reported-by: [email protected]
Diffstat (limited to 'scripts/generate_rust_target.rs')
0 files changed, 0 insertions, 0 deletions