In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev<\/p>\n
The command and ACL RPMsg endpoints store struct btqcomsmd as their
\ncallback private data. The receive callbacks dereference btq->hdev
\nwithout taking an hci_dev reference.<\/p>\n
The current teardown order frees the hci_dev before destroying the RPMsg
\nendpoints in both the hci_register_dev() error path and the driver remove
\npath. If WCNSS delivers data in that window, the endpoint callback can
\nrun with an already freed hci_dev and pass it to the Bluetooth core.<\/p>\n
For qcom_smd endpoints, rpmsg_destroy_ept() closes the channel and clears
\nthe callback under the channel recv_lock. The receive path holds the same
\nlock while invoking the callback, so destroying the endpoints first both
\nprevents new callbacks and serializes with any callback already running.<\/p>\n
Destroy the command and ACL endpoints before hci_free_dev(). Keep
\nhci_unregister_dev() first during remove so the HCI core stops issuing
\noperations before the transport endpoints are shut down. In the full
\nregistration-error cleanup path, return directly after freeing the hci_dev
\nto avoid falling through to the partial-construction labels and destroying
\nthe endpoints twice.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev<\/p>\n
The command and ACL RPMsg endpoints store struct btqcomsmd as<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29064","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29064","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29064"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29064"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29064"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}