diff options
| author | Pauli Virtanen <pav@iki.fi> | 2026-07-20 17:53:33 +0300 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2026-07-28 14:45:34 -0400 |
| commit | d57e506f6a1e3929611340fae87c1e4823f4d85c (patch) | |
| tree | 3d3907cdabd90b061788eabe78b53820e5974586 /include/linux/debugobjects.h | |
| parent | e095f249e2209674f6366f6db0383a2b96e19239 (diff) | |
Bluetooth: ISO: clear iso_data always when detaching conn from hcon
When setting conn->hcon = NULL, also conn->hcon->iso_data = NULL is
necessary, otherwise later iso_conn_free() will UAF.
Fix clearing of iso_data in iso_sock_disconn()
Fixes KASAN: slab-use-after-free in iso_conn_hold_unless_zero on
iso_sock_release() followed by hci_abort_conn_sync().
Fixes: fbdc4bc47268 ("Bluetooth: ISO: Use defer setup to separate PA sync and BIG sync")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'include/linux/debugobjects.h')
0 files changed, 0 insertions, 0 deletions