Skip to content
Commit 1cc18c2a authored by Pavel Skripkin's avatar Pavel Skripkin Committed by Luiz Augusto von Dentz
Browse files

bluetooth/hci: disallow setting handle bigger than HCI_CONN_HANDLE_MAX



Syzbot hit warning in hci_conn_del() caused by freeing handle that was
not allocated using ida allocator.

This is caused by handle bigger than HCI_CONN_HANDLE_MAX passed by
hci_le_big_sync_established_evt(), which makes code think it's unset
connection.

Add same check for handle upper bound as in hci_conn_set_handle() to
prevent warning.

Link: https://syzkaller.appspot.com/bug?extid=b2545b087a01a7319474
Reported-by: default avatar <syzbot+b2545b087a01a7319474@syzkaller.appspotmail.com>
Fixes: 181a42ed

 ("Bluetooth: Make handle of hci_conn be unique")
Signed-off-by: default avatarPavel Skripkin <paskripkin@gmail.com>
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
parent 596b6f08
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment