Yousef Alhouseen bb067a99a0 Bluetooth: bnep: pin L2CAP connection during netdev registration ... bnep_add_connection() reads the L2CAP connection without holding the channel lock, then passes its HCI device to register_netdev(). Controller teardown can clear and release that connection concurrently, leaving the network device registration path to dereference a freed parent device. Take a reference to the L2CAP connection while holding the channel lock. Retain it until register_netdev() has taken the parent device reference. Fixes: 65f53e9802 ("Bluetooth: Access BNEP session addresses through L2CAP channel") Reported-by: syzbot+fed5dce4553262f3b35c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=fed5dce4553262f3b35c Cc: stable@vger.kernel.org Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>		2026-07-06 10:46:57 -04:00
..
bnep.h	Bluetooth: Replace zero-length array with flexible-array member	2020-02-28 08:30:02 +01:00
core.c	Bluetooth: bnep: pin L2CAP connection during netdev registration	2026-07-06 10:46:57 -04:00
Kconfig	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
Makefile	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
netdev.c	Bluetooth: Add SPDX id lines to some source files	2026-06-11 14:24:41 -04:00
sock.c	Bluetooth: Add SPDX id lines to some source files	2026-06-11 14:24:41 -04:00