From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <stable-owner@vger.kernel.org>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
	aws-us-west-2-korg-lkml-1.web.codeaurora.org
Received: from vger.kernel.org (vger.kernel.org [23.128.96.18])
	by smtp.lore.kernel.org (Postfix) with ESMTP id 491E9EC8742
	for <stable@archiver.kernel.org>; Thu,  7 Sep 2023 16:24:11 +0000 (UTC)
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S241323AbjIGQYJ (ORCPT <rfc822;stable@archiver.kernel.org>);
        Thu, 7 Sep 2023 12:24:09 -0400
Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38510 "EHLO
        lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S242400AbjIGQWr (ORCPT
        <rfc822;stable@vger.kernel.org>); Thu, 7 Sep 2023 12:22:47 -0400
Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140])
        by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EF6685255;
        Thu,  7 Sep 2023 09:20:23 -0700 (PDT)
Received: by smtp.kernel.org (Postfix) with ESMTPSA id 04096C116A5;
        Thu,  7 Sep 2023 10:16:53 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org;
        s=korg; t=1694081814;
        bh=+yxi0fgZJulF5cIi8DZ0uhXbDieooxm6LIqEiuMrOAI=;
        h=Date:From:To:Cc:Subject:References:In-Reply-To:From;
        b=2ulexrK4hboftGDRCTT9HPEaBJLr5SRU/v185Bon4qp9+VIWYxWKXEZ1h/wiiZfzD
         IG0vXhtNGLnODmebM5MtXHM3Iigh5Hb+KiAqDRcqH0OyRDV5+gXjrKpxqrgQiDzxuZ
         k3IS8f6aqC+QXRYB0tRiKnXJYBq7j78bBMyeoH4k=
Date:   Thu, 7 Sep 2023 11:16:51 +0100
From:   Greg KH <gregkh@linuxfoundation.org>
To:     Deepak Rathore <deeratho@cisco.com>
Cc:     stable@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [v6.1.52][PATCH] Bluetooth: btsdio: fix use after free bug in
 btsdio_remove due to race condition
Message-ID: <2023090738-passive-snowless-3b9d@gregkh>
References: <20230906121525.3946250-1-deeratho@cisco.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20230906121525.3946250-1-deeratho@cisco.com>
Precedence: bulk
List-ID: <stable.vger.kernel.org>
X-Mailing-List: stable@vger.kernel.org

On Wed, Sep 06, 2023 at 05:45:25PM +0530, Deepak Rathore wrote:
> From: Zheng Wang <zyytlz.wz@163.com>
> 
> [ Upstream commit 73f7b171b7c09139eb3c6a5677c200dc1be5f318 ]
> 
> In btsdio_probe, the data->work is bound with btsdio_work. It will be
> started in btsdio_send_frame.
> 
> If the btsdio_remove runs with a unfinished work, there may be a race
> condition that hdev is freed but used in btsdio_work. Fix it by
> canceling the work before do cleanup in btsdio_remove.
> 
> Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> Signed-off-by: Deepak Rathore <deeratho@cisco.com>
> 

What tree(s) are you wanting this applied to?

thanks,

greg k-h