Messages in this thread Patch in this message | | | Date | Thu, 02 Nov 2023 18:01:47 -0700 | Subject | Re: [syzbot] test uaf in hci_conn_drop | From | syzbot <> |
| |
For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org.
***
Subject: test uaf in hci_conn_drop Author: lizhi.xu@windriver.com
#syz test git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git 8de1e7afcc1c
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c index 15b33579007c..757ff04bb5d8 100644 --- a/net/bluetooth/hci_sysfs.c +++ b/net/bluetooth/hci_sysfs.c @@ -13,6 +13,8 @@ static const struct class bt_class = { static void bt_link_release(struct device *dev) { struct hci_conn *conn = to_hci_conn(dev); + struct sco_conn *scn = container_of(conn, struct sco_conn, hci_conn); + scn->hci_conn = NULL; kfree(conn); }
| |