Re: [PATCH] Bluetooth: RFCOMM: Fix session UAF in set_termios

[email protected] Mon, 20 Jul 2026 20:20:10 +0000

Newsgroups	org.kernel.vger.linux-bluetooth,org.kernel.vger.linux-kernel,org.kernel.vger.stable
Message-ID	<178457881088.4151939.5706907972052659419.git-patchwork-notify@kernel.org>

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <[email protected]>:

On Mon, 20 Jul 2026 00:03:11 +0800 you wrote:
> rfcomm_tty_set_termios() tests dlc->session without rfcomm_mutex and
> later passes the pointer to rfcomm_send_rpn(). The latter dereferences
> both session->initiator and session->sock. Meanwhile, krfcommd can
> unlink the DLC and free the session while holding rfcomm_mutex.
> 
> The race can proceed as follows:
> 
> [...]

Here is the summary with links:
  - Bluetooth: RFCOMM: Fix session UAF in set_termios
    https://git.kernel.org/bluetooth/bluetooth-next/c/2ac5f666025e

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html