Message ID | 20241002152522.3328164-1-luiz.dentz@gmail.com |
---|---|
State | New |
Headers | show |
Series | [v1] Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync | expand |
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c index fb0946eac8a4..40c4a36d2be3 100644 --- a/net/bluetooth/hci_conn.c +++ b/net/bluetooth/hci_conn.c @@ -289,6 +289,9 @@ static int hci_enhanced_setup_sync(struct hci_dev *hdev, void *data) kfree(conn_handle); + if (!hci_conn_valid(hdev, conn)) + return -ECANCELED; + bt_dev_dbg(hdev, "hcon %p", conn); configure_datapath_sync(hdev, &conn->codec);