[6.1,0/1] Bluetooth: hci_sync: cancel cmd_timer if hci_open failed

Message ID	20230126133613.815127-1-pchelkin@ispras.ru
Headers	show Return-Path: <linux-bluetooth-owner@vger.kernel.org> From: Fedor Pchelkin <pchelkin@ispras.ru> To: stable@vger.kernel.org, Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Fedor Pchelkin <pchelkin@ispras.ru>, Archie Pusaka <apusaka@chromium.org>, Abhishek Pandit-Subedi <abhishekpandit@google.com>, Marcel Holtmann <marcel@holtmann.org>, Johan Hedberg <johan.hedberg@gmail.com>, Luiz Augusto von Dentz <luiz.dentz@gmail.com>, "David S. Miller" <davem@davemloft.net>, Jakub Kicinski <kuba@kernel.org>, linux-bluetooth@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Alexey Khoroshilov <khoroshilov@ispras.ru>, lvc-project@linuxtesting.org Subject: [PATCH 6.1 0/1] Bluetooth: hci_sync: cancel cmd_timer if hci_open failed Date: Thu, 26 Jan 2023 16:36:12 +0300 Message-Id: <20230126133613.815127-1-pchelkin@ispras.ru> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	Bluetooth: hci_sync: cancel cmd_timer if hci_open failed \| expand [6.1,0/1] Bluetooth: hci_sync: cancel cmd_timer if hci_open failed [6.1,1/1] Bluetooth: hci_sync: cancel cmd_timer if hci_open failed

Message ID

20230126133613.815127-1-pchelkin@ispras.ru

Headers

From: Fedor Pchelkin <pchelkin@ispras.ru>
To: stable@vger.kernel.org,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Fedor Pchelkin <pchelkin@ispras.ru>,
        Archie Pusaka <apusaka@chromium.org>,
        Abhishek Pandit-Subedi <abhishekpandit@google.com>,
        Marcel Holtmann <marcel@holtmann.org>,
        Johan Hedberg <johan.hedberg@gmail.com>,
        Luiz Augusto von Dentz <luiz.dentz@gmail.com>,
        "David S. Miller" <davem@davemloft.net>,
        Jakub Kicinski <kuba@kernel.org>,
        linux-bluetooth@vger.kernel.org, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org,
        Alexey Khoroshilov <khoroshilov@ispras.ru>,
        lvc-project@linuxtesting.org
Subject: [PATCH 6.1 0/1] Bluetooth: hci_sync: cancel cmd_timer if hci_open
 failed
Date: Thu, 26 Jan 2023 16:36:12 +0300
Message-Id: <20230126133613.815127-1-pchelkin@ispras.ru>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

Series

Bluetooth: hci_sync: cancel cmd_timer if hci_open failed | expand

Message

Fedor Pchelkin Jan. 26, 2023, 1:36 p.m. UTC

Syzkaller reports use-after-free in hci_cmd_timeout(). The bug was fixed
in the following patch and can be cleanly applied to 6.1 stable tree.

Due to some technical rearrangement, the fix for older stable branches
requires a different patch which I'll send you in another thread.