diff options
| author | Pauli Virtanen <pav@iki.fi> | 2026-07-10 11:23:41 +0300 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2026-07-10 15:55:33 -0400 |
| commit | f3f75fd597f25c511b0ebeef53016564007b7c13 (patch) | |
| tree | 7ff4e53356cdfc8c97e14a57382ca6ef9f7c8e94 /net/openvswitch/datapath.c | |
| parent | 17f5bfb02164e2bb052c22f81ceb243e1fa31942 (diff) | |
| download | linux-next-f3f75fd597f25c511b0ebeef53016564007b7c13.tar.gz linux-next-f3f75fd597f25c511b0ebeef53016564007b7c13.zip | |
Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync
Dereferencing RCU-protected pointers outside critical sections is
invalid and may lead to UAF.
Take hdev->lock for hci_conn lookup and hci_abort_conn(). Don't use RCU
to ensure the conn is fully initialized at this point.
Fixes: 227a0cdf4a028 ("Bluetooth: MGMT: Fix not generating command complete for MGMT_OP_DISCONNECT")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'net/openvswitch/datapath.c')
0 files changed, 0 insertions, 0 deletions