aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorZheng Wang <zyytlz.wz@163.com>2023-03-09 16:07:39 +0800
committerLuiz Augusto von Dentz <luiz.von.dentz@intel.com>2023-03-14 16:01:41 -0700
commitf132c2d1308895b0a10e0f0c5f9f25e680777913 (patch)
tree7f1273a5eee919b697036cc5757df1b5c4a3110f
parentb8e482d02513a9e6cd5208dfe615fb69727e9d82 (diff)
downloadbluetooth-next-f132c2d13088.tar.gz
Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work
Notice: this object is not reachable from any branch.
In btsdio_probe, &data->work was bound with btsdio_work.In btsdio_send_frame, it was started by schedule_work. If we call btsdio_remove with an unfinished job, there may be a race condition and cause UAF bug on hdev. Fixes: ddbaf13e3609 ("[Bluetooth] Add generic driver for Bluetooth SDIO devices") Signed-off-by: Zheng Wang <zyytlz.wz@163.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Notice: this object is not reachable from any branch.
-rw-r--r--drivers/bluetooth/btsdio.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/bluetooth/btsdio.c b/drivers/bluetooth/btsdio.c
index f19d31ee37ea8..51000320e1ea8 100644
--- a/drivers/bluetooth/btsdio.c
+++ b/drivers/bluetooth/btsdio.c
@@ -354,6 +354,7 @@ static void btsdio_remove(struct sdio_func *func)
BT_DBG("func %p", func);
+ cancel_work_sync(&data->work);
if (!data)
return;