Commit 0b94f265 authored by Luiz Augusto von Dentz's avatar Luiz Augusto von Dentz Committed by Marcel Holtmann
Browse files

Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set 



hci_cmd_sync_queue shall return an error if HCI_UNREGISTER flag has
been set as that means hci_unregister_dev has been called so it will
likely cause a uaf after the timeout as the hdev will be freed.

Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
parent adce573b

net/bluetooth/hci_sync.c

+3 −0
Original line number Diff line number Diff line
@@ -382,6 +382,9 @@ int hci_cmd_sync_queue(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, 
{

	struct hci_cmd_sync_work_entry *entry;



	if (hci_dev_test_flag(hdev, HCI_UNREGISTER))

		return -ENODEV;



	entry = kmalloc(sizeof(*entry), GFP_KERNEL);

	if (!entry)

		return -ENOMEM;