diff options
| author | Cen Zhang <zzzccc427@163.com> | 2025-09-29 08:30:17 +0300 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2025-10-24 17:20:15 +0300 |
| commit | 09b0cd1297b4dbfe736aeaa0ceeab2265f47f772 (patch) | |
| tree | 5b11afe1ca5cc08cbdb03979683bb9b57e80566b /include | |
| parent | 1ab665817448c31f4758dce43c455bd4c5e460aa (diff) | |
| download | linux-09b0cd1297b4dbfe736aeaa0ceeab2265f47f772.tar.xz | |
Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once
hci_cmd_sync_dequeue_once() does lookup and then cancel
the entry under two separate lock sections. Meanwhile,
hci_cmd_sync_work() can also delete the same entry,
leading to double list_del() and "UAF".
Fix this by holding cmd_sync_work_lock across both
lookup and cancel, so that the entry cannot be removed
concurrently.
Fixes: 505ea2b29592 ("Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue")
Reported-by: Cen Zhang <zzzccc427@163.com>
Signed-off-by: Cen Zhang <zzzccc427@163.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'include')
0 files changed, 0 insertions, 0 deletions