diff options
| author | Pauli Virtanen <pav@iki.fi> | 2026-07-25 12:59:19 +0300 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2026-07-28 16:13:13 -0400 |
| commit | 56e78b670356caab0b607e8aad4cf819a1909d07 (patch) | |
| tree | dacb598bef27bd046afa3761cdc70709b5d394ce /include/linux/dynamic_queue_limits.h | |
| parent | 2f5d635ad5906b0235bc0c870e8beba3116e1e98 (diff) | |
Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback
There is theoretical UAF if the conn is freed while the hci_sync task is
running.
Hold refcount to avoid that. Handle NULL hcon, return 0 + do nothing to
match the previous behavior.
Fixes: 024421cf3992 ("Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'include/linux/dynamic_queue_limits.h')
0 files changed, 0 insertions, 0 deletions