diff options
| author | Ruihan Li <lrh2000@pku.edu.cn> | 2023-05-03 16:39:34 +0300 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2023-05-20 01:37:45 +0300 |
| commit | ca1fd42e7dbfcb34890ffbf1f2f4b356776dab6f (patch) | |
| tree | d9d20f006026eff3205997d33ffe564d3db4c893 /net/dns_resolver | |
| parent | 9025944fddfed5966c8f102f1fe921ab3aee2c12 (diff) | |
| download | linux-ca1fd42e7dbfcb34890ffbf1f2f4b356776dab6f.tar.xz | |
Bluetooth: Fix potential double free caused by hci_conn_unlink
The hci_conn_unlink function is being called by hci_conn_del, which
means it should not call hci_conn_del with the input parameter conn
again. If it does, conn may have already been released when
hci_conn_unlink returns, leading to potential UAF and double-free
issues.
This patch resolves the problem by modifying hci_conn_unlink to release
only conn's child links when necessary, but never release conn itself.
Reported-by: syzbot+690b90b14f14f43f4688@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-bluetooth/000000000000484a8205faafe216@google.com/
Fixes: 06149746e720 ("Bluetooth: hci_conn: Add support for linking multiple hcon")
Signed-off-by: Ruihan Li <lrh2000@pku.edu.cn>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Reported-by: syzbot+690b90b14f14f43f4688@syzkaller.appspotmail.com
Reported-by: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Reported-by: syzbot+8bb72f86fc823817bc5d@syzkaller.appspotmail.com
Diffstat (limited to 'net/dns_resolver')
0 files changed, 0 insertions, 0 deletions