AbhinavMir a79734d6df wireless/bluetooth/bt_hcicore.c: Balance conn and buffer refs in hci_acl(). ... hci_acl() looked up the connection with bt_conn_lookup_handle(), which returns a new reference, but never released it. This leaked one conn reference for every received ACL packet. bt_conn_receive() also consumes the buffer on every path: it forwards to l2cap (which releases) or stores the buffer in conn->rx without an addref. The hci_rx_work() worker then called bt_buf_release() on the same buffer, which caused a double free or use-after-free. Take an extra buffer reference for the worker to release, and release the connection reference from the lookup. Assisted-by: Fable Signed-off-by: AbhinavMir <atg271@gmail.com>		2026-08-15 11:51:19 +08:00
..
bt_atomic.h
bt_att.c
bt_att.h
bt_buf.c
bt_buf.h
bt_conn.c
bt_conn.h
bt_gatt.c
bt_hcicore.c
bt_hcicore.h
bt_ioctl.c
bt_ioctl.h
bt_keys.c
bt_keys.h
bt_l2cap.c
bt_l2cap.h
bt_netdev.c
bt_queue.c
bt_queue.h
bt_services.c
bt_smp.c
bt_smp.h
bt_uuid.c
CMakeLists.txt
Kconfig
Make.defs