diff options
| author | Jordan Walters <jaggyaur@gmail.com> | 2026-06-03 11:50:47 +0300 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2026-06-11 21:24:40 +0300 |
| commit | 5edcc018fa6e80b2c478454a4a8229c23d67c181 (patch) | |
| tree | 92d3ff650d8d82f4e9b456056324eb11082f5864 /tools/lib/python | |
| parent | 96d006ae6445679436b945593950fd465eba7e76 (diff) | |
| download | linux-5edcc018fa6e80b2c478454a4a8229c23d67c181.tar.xz | |
Bluetooth: hci_core: Fix UAF in hci_unregister_dev()
hci_unregister_dev() does not disable cmd_timer and ncmd_timer
before the hci_dev structure is freed. If a timeout fires
during device teardown, the callback dereferences freed memory
(including the hdev->reset function pointer), leading to a
use-after-free.
Add disable_delayed_work_sync() calls alongside the existing
disable_work_sync() calls to ensure both timers are fully
quiesced before teardown proceeds.
Fixes: 0d151a103775 ("Bluetooth: hci_core: cancel all works upon hci_unregister_dev()")
Signed-off-by: Jordan Walters <jaggyaur@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'tools/lib/python')
0 files changed, 0 insertions, 0 deletions