CVE-2023-54120

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: Fix race condition in hidpsessionthread

There is a potential race condition in hidpsessionthread that may lead to use-after-free. For instance, the timer is active while hidpdeltimer is called in hidpsessionthread(). After hidpsessionput, then 'session' will be freed, causing kernel panic when hidpidletimeout is running.

The solution is to use deltimersync instead of del_timer.

Here is the call trace:

? hidpsessionprobe+0x780/0x780 calltimerfn+0x2d/0x1e0 __runtimers.part.0+0x569/0x940 hidpsessionprobe+0x780/0x780 calltimerfn+0x1e0/0x1e0 ktimeget+0x5c/0xf0 lapicnextdeadline+0x2c/0x40 clockeventsprogramevent+0x205/0x320 runtimersoftirq+0xa9/0x1b0 __do_softirq+0x1b9/0x641 _irqexitrcu+0xdc/0x190 irqexitrcu+0xe/0x20 sysvecapictimerinterrupt+0xa1/0xc0