Luiz Augusto von Dentz 5f641f03ab Bluetooth: hci_conn: Fix UAF Write in __hci_acl_create_connection_sync ...

This fixes the UAF on __hci_acl_create_connection_sync caused by
connection abortion, it uses the same logic as to LE_LINK which uses
hci_cmd_sync_cancel to prevent the callback to run if the connection is
abort prematurely.

Reported-by: syzbot+3f0a39be7a2035700868@syzkaller.appspotmail.com
Fixes: 45340097ce ("Bluetooth: hci_conn: Only do ACL connections sequentially")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

2024-03-06 17:23:52 -05:00

..

bluetooth.h

net: implement lockless SO_PRIORITY

2023-10-01 19:09:54 +01:00

coredump.h

Bluetooth: Add support for hci devcoredump

2023-04-23 21:57:59 -07:00

hci_core.h

Bluetooth: hci_conn: Always use sk_timeo as conn_timeout

2024-03-06 17:22:41 -05:00

hci_mon.h

Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name

2023-10-13 20:06:33 -07:00

hci_sock.h

Bluetooth: Fix HCIGETDEVINFO regression

2022-09-08 14:33:53 -07:00

hci_sync.h

Bluetooth: hci_conn: Fix UAF Write in __hci_acl_create_connection_sync

2024-03-06 17:23:52 -05:00

hci.h

Bluetooth: hci_conn: Only do ACL connections sequentially

2024-03-06 17:22:40 -05:00

iso.h

Bluetooth: ISO: Add broadcast support

2022-07-22 17:14:13 -07:00

l2cap.h

Bluetooth: hci_conn: Always use sk_timeo as conn_timeout

2024-03-06 17:22:41 -05:00

mgmt.h

Bluetooth: Check for ISO support in controller

2023-08-11 11:31:23 -07:00

rfcomm.h

Bluetooth: Replace zero-length array with flexible-array member

2020-02-28 08:30:02 +01:00

sco.h

Bluetooth: af_bluetooth: Make BT_PKT_STATUS generic

2023-08-11 11:49:16 -07:00