Luiz Augusto von Dentz
7453847fb2
Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync ...
Fixes the following trace where hci_acl_create_conn_sync attempts to
call hci_abort_conn_sync after timeout:
BUG: KASAN: slab-use-after-free in hci_abort_conn_sync
(net/bluetooth/hci_sync.c:5439)
Read of size 2 at addr ffff88800322c032 by task kworker/u3:2/36
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38
04/01/2014
Workqueue: hci0 hci_cmd_sync_work
Call Trace:
<TASK>
dump_stack_lvl (./arch/x86/include/asm/irqflags.h:26
./arch/x86/include/asm/irqflags.h:67 ./arch/x86/include/asm/irqflags.h:127
lib/dump_stack.c:107)
print_report (mm/kasan/report.c:378 mm/kasan/report.c:488)
? preempt_count_sub (kernel/sched/core.c:5889)
? __virt_addr_valid (./arch/x86/include/asm/preempt.h:103 (discriminator 1)
./include/linux/rcupdate.h:865 (discriminator 1)
./include/linux/mmzone.h:2026 (discriminator 1)
arch/x86/mm/physaddr.c:65 (discriminator 1))
? hci_abort_conn_sync (net/bluetooth/hci_sync.c:5439)
kasan_report (mm/kasan/report.c:603)
? hci_abort_conn_sync (net/bluetooth/hci_sync.c:5439)
hci_abort_conn_sync (net/bluetooth/hci_sync.c:5439)
? __pfx_hci_abort_conn_sync (net/bluetooth/hci_sync.c:5433)
hci_acl_create_conn_sync (net/bluetooth/hci_sync.c:6681)
Fixes: 45340097ce6e ("Bluetooth: hci_conn: Only do ACL connections sequentially")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2024-03-06 17:24:28 -05:00
2024-02-09 14:12:01 -08:00
2023-12-13 05:44:30 +09:00
2023-10-28 11:29:28 +01:00
2024-02-26 11:46:12 +00:00
2023-12-26 20:31:01 +00:00
2024-02-09 14:12:01 -08:00
2024-02-02 12:44:16 +00:00
2024-03-06 17:24:28 -05:00
2024-01-31 20:40:56 -08:00
2024-02-29 14:24:56 -08:00
2024-01-05 08:06:35 -08:00
2024-02-20 15:32:45 +01:00
2024-02-07 14:43:29 +01:00
2024-03-06 08:07:44 +00:00
2024-02-02 12:19:26 +00:00
2024-02-21 17:11:04 -08:00
2024-01-11 10:07:29 -08:00
2024-02-26 11:46:12 +00:00
2024-03-05 19:07:13 -08:00
2024-02-08 18:32:29 -08:00
2024-02-29 14:24:56 -08:00
2024-02-26 11:46:12 +00:00
2023-12-15 10:50:18 +00:00
2024-03-06 12:37:06 +00:00
2024-03-06 12:37:06 +00:00
2024-02-22 18:28:13 -08:00
2024-02-21 11:28:57 +00:00
2024-02-09 14:12:01 -08:00
2024-02-22 15:29:26 -08:00
2024-01-30 13:49:09 +01:00
2024-02-29 14:24:56 -08:00
2023-12-15 11:14:57 +01:00
2024-02-29 14:24:56 -08:00
2024-02-26 11:46:12 +00:00
2024-03-04 13:07:46 +00:00
2023-11-18 15:00:51 +00:00
2024-03-02 20:50:59 -08:00
2024-02-28 19:37:34 -08:00
2024-03-06 08:07:45 +00:00
2024-03-05 11:21:18 -08:00
2024-02-09 12:54:38 -08:00
2024-03-05 13:41:16 +01:00
2024-02-22 09:05:50 +01:00
2023-12-29 08:43:59 +00:00
2024-01-01 18:41:29 +00:00
2024-02-15 16:20:04 -08:00
2023-12-21 22:17:23 +01:00
2023-12-15 11:59:53 +00:00
2024-02-05 12:34:07 +00:00
2024-02-22 15:29:26 -08:00
2024-02-15 16:20:04 -08:00
2024-03-05 15:49:35 +01:00
2024-01-29 13:39:48 -05:00
2024-02-16 09:36:37 +00:00
2024-02-15 13:18:19 +01:00
2024-02-29 09:07:16 -08:00
2024-02-22 15:29:26 -08:00
2024-01-23 15:13:54 +01:00
2024-02-29 14:24:56 -08:00
2023-12-26 20:31:01 +00:00
2024-03-02 20:50:59 -08:00
2024-03-02 20:50:59 -08:00
2023-12-12 14:24:14 +01:00
2024-02-18 10:19:21 +00:00
2024-01-31 16:41:16 -08:00
2024-02-28 19:29:46 -08:00
7453847fb2