[v1] Bluetooth: hci_sync: cancel cmd_timer if hci_open failed

[PATCH 6.1 0/1] Bluetooth: hci_sync: cancel cmd_timer if hci_open failed

Posted by Fedor Pchelkin 2 years, 7 months ago

Syzkaller reports use-after-free in hci_cmd_timeout(). The bug was fixed
in the following patch and can be cleanly applied to 6.1 stable tree.

Due to some technical rearrangement, the fix for older stable branches
requires a different patch which I'll send you in another thread.

Re: [PATCH 6.1 0/1] Bluetooth: hci_sync: cancel cmd_timer if hci_open failed

Posted by Sasha Levin 2 years, 7 months ago

On Thu, Jan 26, 2023 at 04:36:12PM +0300, Fedor Pchelkin wrote:
>Syzkaller reports use-after-free in hci_cmd_timeout(). The bug was fixed
>in the following patch and can be cleanly applied to 6.1 stable tree.
>
>Due to some technical rearrangement, the fix for older stable branches
>requires a different patch which I'll send you in another thread.

Queued up, thanks!

-- 
Thanks,
Sasha