github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-24 06:24:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
master
linux/include/net/bluetooth
History
Weiming Shi d236517c26 Bluetooth: coredump: Quiesce dump work on unregister 
hci_devcd_handle_pkt_init() arms dump_timeout and coredump producers
queue dump_rx without holding an hdev reference. Unregister leaves both
works live, so disconnecting during an active dump lets them access hdev
after hci_release_dev() frees it.

Shut down coredump processing during unregister. Close the producer gate
under dump_q.lock before disabling both works, then free the active buffer
and queued packets under hci_dev_lock. Serializing the gate with enqueue
prevents controller-specific workers from adding packets after the final
purge.

Fixes: 9695ef876f ("Bluetooth: Add support for hci devcoredump")
Reported-by: syzbot+b170dbf55520ebf5969a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=b170dbf55520ebf5969a
Reported-by: Aby Sam Ross <abysamross@gmail.com>
Link: https://lore.kernel.org/r/20260322210849.68743-1-abysamross@gmail.com
Suggested-by: Aby Sam Ross <abysamross@gmail.com>
Reported-by: Tristan Madani <tristan@talencesecurity.com>
Link: https://lore.kernel.org/r/20260814231248.3096377-1-tristmd@gmail.com
Reported-by: Xiang Mei <xmei5@asu.edu>
Assisted-by: OpenAI Codex:gpt-5
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-09-15 14:49:41 -04:00
..
bluetooth.h Bluetooth: Add SPDX id lines to some source files 2026-06-11 14:24:41 -04:00
coredump.h Bluetooth: coredump: Quiesce dump work on unregister 2026-09-15 14:49:41 -04:00
hci_core.h Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference 2026-08-24 13:06:39 -04:00
hci_drv.h Bluetooth: Annotate struct hci_drv_rp_read_info with __counted_by_le() 2025-09-27 11:37:00 -04:00
hci_mon.h Bluetooth: Add SPDX id lines to some source files 2026-06-11 14:24:41 -04:00
hci_sock.h Bluetooth: Add SPDX id lines to some source files 2026-06-11 14:24:41 -04:00
hci_sync.h Bluetooth: Add MGMT Load Connection Subrate command 2026-08-07 15:38:32 -04:00
hci.h Bluetooth: hci_event: Use 255 as max event payload length in hci_ev_table[] 2026-08-07 15:40:27 -04:00
iso.h Bluetooth: ISO: Add broadcast support 2022-07-22 17:14:13 -07:00
l2cap.h Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan 2026-08-24 13:06:49 -04:00
mgmt.h Bluetooth: Add MGMT Load Connection Subrate command 2026-08-07 15:38:32 -04:00
rfcomm.h Bluetooth: RFCOMM: Fix session UAF in set_termios 2026-07-20 17:41:07 -04:00
sco.h Bluetooth: Add SPDX id lines to some source files 2026-06-11 14:24:41 -04:00