]> www.infradead.org Git - nvme.git/commit
bluetooth/hci: disallow setting handle bigger than HCI_CONN_HANDLE_MAX
authorPavel Skripkin <paskripkin@gmail.com>
Thu, 20 Jun 2024 19:27:47 +0000 (22:27 +0300)
committerLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
Fri, 28 Jun 2024 18:30:50 +0000 (14:30 -0400)
commit1cc18c2ab2e8c54c355ea7c0423a636e415a0c23
tree1557a8ec129898c888a99e89dba685cf33ea8df9
parent596b6f081336e77764ca35cfeab66d0fcdbe544e
bluetooth/hci: disallow setting handle bigger than HCI_CONN_HANDLE_MAX

Syzbot hit warning in hci_conn_del() caused by freeing handle that was
not allocated using ida allocator.

This is caused by handle bigger than HCI_CONN_HANDLE_MAX passed by
hci_le_big_sync_established_evt(), which makes code think it's unset
connection.

Add same check for handle upper bound as in hci_conn_set_handle() to
prevent warning.

Link: https://syzkaller.appspot.com/bug?extid=b2545b087a01a7319474
Reported-by: syzbot+b2545b087a01a7319474@syzkaller.appspotmail.com
Fixes: 181a42edddf5 ("Bluetooth: Make handle of hci_conn be unique")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
net/bluetooth/hci_conn.c