From: Luiz Augusto von Dentz Date: Thu, 27 Jan 2022 01:21:00 +0000 (-0800) Subject: Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=0b94f2651f56b9e4aa5f012b0d7eb57308c773cf;p=linux.git Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set hci_cmd_sync_queue shall return an error if HCI_UNREGISTER flag has been set as that means hci_unregister_dev has been called so it will likely cause a uaf after the timeout as the hdev will be freed. Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Marcel Holtmann --- diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c index 2fe8c60dc62bc..6e71aa6b6feae 100644 --- a/net/bluetooth/hci_sync.c +++ b/net/bluetooth/hci_sync.c @@ -382,6 +382,9 @@ int hci_cmd_sync_queue(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, { struct hci_cmd_sync_work_entry *entry; + if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) + return -ENODEV; + entry = kmalloc(sizeof(*entry), GFP_KERNEL); if (!entry) return -ENOMEM;