Pauli Virtanen af24e338bf Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero ... hci_conn::iso_data is accessed and modified without lock or RCU. This leads to a race [Task hdev->workqueue] [Task 2] iso_recv iso_conn_put(conn) conn = LOAD hcon->iso_data iso_conn_free(conn) iso_conn_hold_unless_zero(conn) hcon->iso_data = NULL kfree(conn) kref_get_unless_zero(&conn->ref) /* UAF */ and also to races in iso_conn_add() vs. iso_conn_free(). Fix by adding spinlock hci_conn::proto_lock and using it to guard hci_conn::iso_data. Fixes: dc26097bdb ("Bluetooth: ISO: Use kref to track lifetime of iso_conn") Signed-off-by: Pauli Virtanen <pav@iki.fi> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>		2026-07-28 16:13:12 -04:00
..
acpi	ACPICA: Define acpi_ut_safe_strncpy() as strscpy_pad() alias	2026-07-01 12:29:24 +02:00
asm-generic	mm.git review status for mm-hotfixes-stable..mm-nonmm-stable	2026-06-21 13:20:19 -07:00
clocksource
crypto
cxl
drm	drm/amd/display: Force PWM backlight on Lenovo Legion 5 15ARH05	2026-07-17 17:41:15 -04:00
dt-bindings	SoC fixes for 7.2	2026-07-17 08:52:09 -07:00
hyperv
keys
kunit
kvm
linux	ethtool: Embed FEC hist ranges as buffer in struct	2026-07-27 18:23:07 -07:00
math-emu
media
memory
misc
net	Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero	2026-07-28 16:13:12 -04:00
pcmcia	Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (headers)	2026-07-03 07:38:16 +02:00
ras
rdma
rv
scsi	scsi: core: wake eh reliably when using scsi_schedule_eh	2026-07-12 22:21:22 -04:00
soc	soc/tegra: pmc: Fixes for v7.2	2026-07-10 14:40:52 +02:00
sound	Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (headers)	2026-07-03 07:38:16 +02:00
target
trace	mm/memory-failure: trace: change memory_failure_event to ras subsystem	2026-07-09 15:48:56 -07:00
uapi	for-7.2-rc4-tag	2026-07-21 08:06:24 -07:00
ufs
vdso
video
xen	xen: Replace __ASSEMBLY__ with __ASSEMBLER__ in header files	2026-07-01 09:49:52 +02:00
Kbuild