Luiz Augusto von Dentz 98f66ea456 Bluetooth: hci_conn: Fix UAF Write in __hci_acl_create_connection_sync ...

[ Upstream commit 5f641f03ab ]

This fixes the UAF on __hci_acl_create_connection_sync caused by
connection abortion, it uses the same logic as to LE_LINK which uses
hci_cmd_sync_cancel to prevent the callback to run if the connection is
abort prematurely.

Reported-by: syzbot+3f0a39be7a2035700868@syzkaller.appspotmail.com
Fixes: 45340097ce ("Bluetooth: hci_conn: Only do ACL connections sequentially")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Stable-dep-of: 227a0cdf4a ("Bluetooth: MGMT: Fix not generating command complete for MGMT_OP_DISCONNECT")
Signed-off-by: Sasha Levin <sashal@kernel.org>

2024-09-12 11:11:33 +02:00

..

bluetooth.h

Bluetooth: SCO: Fix not validating setsockopt user input

2024-04-17 11:19:30 +02:00

coredump.h

…

hci_core.h

Bluetooth: Remove pending ACL connection attempts

2024-09-12 11:11:33 +02:00

hci_mon.h

Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name

2023-10-13 20:06:33 -07:00

hci_sock.h

…

hci_sync.h

Bluetooth: hci_conn: Fix UAF Write in __hci_acl_create_connection_sync

2024-09-12 11:11:33 +02:00

hci.h

Bluetooth: hci_conn: Only do ACL connections sequentially

2024-09-12 11:11:33 +02:00

iso.h

…

l2cap.h

Bluetooth: compute LE flow credits based on recvbuf space

2024-06-12 11:11:55 +02:00

mgmt.h

…

rfcomm.h

…

sco.h

…