mbox series

[6.1,0/1] Bluetooth: hci_sync: cancel cmd_timer if hci_open failed

Message ID 20230126133613.815127-1-pchelkin@ispras.ru (mailing list archive)
Headers show
Series Bluetooth: hci_sync: cancel cmd_timer if hci_open failed | expand

Message

Fedor Pchelkin Jan. 26, 2023, 1:36 p.m. UTC 
Syzkaller reports use-after-free in hci_cmd_timeout(). The bug was fixed
in the following patch and can be cleanly applied to 6.1 stable tree.

Due to some technical rearrangement, the fix for older stable branches
requires a different patch which I'll send you in another thread.

Comments

Sasha Levin Jan. 27, 2023, 2:07 a.m. UTC | #1 
On Thu, Jan 26, 2023 at 04:36:12PM +0300, Fedor Pchelkin wrote:
>Syzkaller reports use-after-free in hci_cmd_timeout(). The bug was fixed
>in the following patch and can be cleanly applied to 6.1 stable tree.
>
>Due to some technical rearrangement, the fix for older stable branches
>requires a different patch which I'll send you in another thread.

Queued up, thanks!