Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Ruihan Li <lrh2000@pku.edu.cn>
To:     linux-bluetooth@vger.kernel.org
Cc:     Marcel Holtmann <marcel@holtmann.org>,
        Johan Hedberg <johan.hedberg@gmail.com>,
        Luiz Augusto von Dentz <luiz.dentz@gmail.com>,
        Ruihan Li <lrh2000@pku.edu.cn>
Subject: [PATCH v3 0/6] Bluetooth: Fix potential double free caused by hci_conn_unlink
Date:   Tue,  2 May 2023 22:57:31 +0800
Message-Id: <20230502145737.140856-1-lrh2000@pku.edu.cn>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

This patch series contains six fixes related to hci_conn_unlink. The
purpose is to prevent merge conflicts between each other. I'm not
intentially linking them together. So if any patch is not suitable,
please just let me know (I'll be grateful if you can explain the
reason).

The first three patches are the most important, each fixing a
triggerable use-after-free bug (see the report URL for details). And the
fourth through sixth patches are a bit more minor, containing mostly
tweaks and refactorings.

Changes since v2:
  * Put all fixes, adjustments, and refactorings about hci_conn_unlink
    in one patch series.
Link to v2:
  * https://lore.kernel.org/linux-bluetooth/20230430180535.168270-1-lrh2000@pku.edu.cn/
See also:
  * https://lore.kernel.org/linux-bluetooth/20230430171847.156825-1-lrh2000@pku.edu.cn/

Changes since v1:
  * Resolve merge conflicts.
Link to v1:
  * https://lore.kernel.org/linux-bluetooth/20230430172937.157999-1-lrh2000@pku.edu.cn/

Ruihan Li (6):
  Bluetooth: Fix potential double free caused by hci_conn_unlink
  Bluetooth: Refcnt drop must be placed last in hci_conn_unlink
  Bluetooth: Fix UAF in hci_conn_hash_flush again
  Bluetooth: Perform hci_conn_drop in hci_conn_unlink
  Bluetooth: Unlink CISes when LE disconnects in hci_conn_del
  Bluetooth: Avoid recursion in hci_conn_unlink

 include/net/bluetooth/hci_core.h |  2 +-
 net/bluetooth/hci_conn.c         | 96 ++++++++++++++++++--------------
 2 files changed, 54 insertions(+), 44 deletions(-)

-- 
2.40.0