| tag | 4901393ec80e99fc4a75302ca5808e28cd8db633 | |
|---|---|---|
| tagger | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | Wed Oct 23 10:26:51 2024 -0400 |
| object | 246b435ad668596aa0e2bbb9d491b6413861211a |
bluetooth pull request for net: - hci_core: Disable works on hci_unregister_dev - SCO: Fix UAF on sco_sock_timeout - ISO: Fix UAF on iso_sock_timeout
| commit | 246b435ad668596aa0e2bbb9d491b6413861211a | [log] [tgz] |
|---|---|---|
| author | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | Tue Oct 22 15:35:49 2024 -0400 |
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | Wed Oct 23 10:21:14 2024 -0400 |
| tree | 8582bba5fa0274ee5772f7072283e3adc9cd62b6 | |
| parent | 1bf4470a3939c678fb822073e9ea77a0560bc6bb [diff] |
Bluetooth: ISO: Fix UAF on iso_sock_timeout
conn->sk maybe have been unlinked/freed while waiting for iso_conn_lock
so this checks if the conn->sk is still valid by checking if it part of
iso_sk_list.
Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>