Re: [PATCH] Bluetooth: msft: fix slab-use-after-free in msft_do_close()

[Sungwoo Kim <iam@xxxxxxxxxxxx>]

Hello,

Could you not apply this? I found an error.

On Sat, Apr 27, 2024 at 1:19 AM Sungwoo Kim <iam@xxxxxxxxxxxx> wrote:
>
> +
> +static struct msft_data *msft_data_hold_unless_zero(struct msft_data *msft)
> +{
> +       BT_DBG("msft %p orig refcnt %u", msft, kref_read(&msft->kref));

Here, msft could be NULL. &msft->kref causes a null-ptr-deref error.
I already sent a v2 patch fixing this.

> +
> +       if (!msft)
> +               return NULL;
> +
> +       if (!kref_get_unless_zero(&msft->kref))
> +               return NULL;
> +
> +       return msft;
> +}
> +

Thanks,
Sungwoo.