CVE-2023-54120

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: Fix race condition in hidp_session_thread<br /> <br /> There is a potential race condition in hidp_session_thread that may<br /> lead to use-after-free. For instance, the timer is active while<br /> hidp_del_timer is called in hidp_session_thread(). After hidp_session_put,<br /> then &amp;#39;session&amp;#39; will be freed, causing kernel panic when hidp_idle_timeout<br /> is running.<br /> <br /> The solution is to use del_timer_sync instead of del_timer.<br /> <br /> Here is the call trace:<br /> <br /> ? hidp_session_probe+0x780/0x780<br /> call_timer_fn+0x2d/0x1e0<br /> __run_timers.part.0+0x569/0x940<br /> hidp_session_probe+0x780/0x780<br /> call_timer_fn+0x1e0/0x1e0<br /> ktime_get+0x5c/0xf0<br /> lapic_next_deadline+0x2c/0x40<br /> clockevents_program_event+0x205/0x320<br /> run_timer_softirq+0xa9/0x1b0<br /> __do_softirq+0x1b9/0x641<br /> __irq_exit_rcu+0xdc/0x190<br /> irq_exit_rcu+0xe/0x20<br /> sysvec_apic_timer_interrupt+0xa1/0xc0