diff options
| author | Pauli Virtanen <pav@iki.fi> | 2026-03-29 16:43:02 +0300 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2026-04-01 16:46:55 -0400 |
| commit | b255531b27da336571411248c2a72a350662bd09 (patch) | |
| tree | 8dcfa0b85edd474af87168308dbb6989b54f55a2 /drivers/usb/input/git@git.tavy.me:linux.git | |
| parent | a2639a7f0f5bf7d73f337f8f077c19415c62ed2c (diff) | |
Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt
hci_conn lookup and field access must be covered by hdev lock in
hci_le_remote_conn_param_req_evt, otherwise it's possible it is freed
concurrently.
Extend the hci_dev_lock critical section to cover all conn usage.
Fixes: 95118dd4edfec ("Bluetooth: hci_event: Use of a function table to handle LE subevents")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'drivers/usb/input/git@git.tavy.me:linux.git')
0 files changed, 0 insertions, 0 deletions