diff options
| author | Pauli Virtanen <pav@iki.fi> | 2026-07-25 12:59:17 +0300 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2026-07-28 16:13:12 -0400 |
| commit | 5761d003daa987ac81463f570713ce9c9dd204e5 (patch) | |
| tree | 0260911a9cad3836cdbbdf9e44f3dac0bf4c2149 /include/linux/timerqueue_types.h | |
| parent | b640ff9af3c809ff5ea2077fbba17df1594ec1e4 (diff) | |
Bluetooth: hci_conn: hold conn reference in abort_conn_sync()
There is theoretical UAF if the conn is freed while the hci_sync task is
running.
Hold refcount to avoid that.
Fixes: 227a0cdf4a02 ("Bluetooth: MGMT: Fix not generating command complete for MGMT_OP_DISCONNECT")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'include/linux/timerqueue_types.h')
0 files changed, 0 insertions, 0 deletions