iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/net/bluetooth
History
Luiz Augusto von Dentz 11e40d6c08 Bluetooth: L2CAP: Fix user-after-free 
[ Upstream commit 35fcbc4243aad7e7d020b7c1dfb14bb888b20a4f ]

This uses l2cap_chan_hold_unless_zero() after calling
__l2cap_get_chan_blah() to prevent the following trace:

Bluetooth: l2cap_core.c:static void l2cap_chan_destroy(struct kref
*kref)
Bluetooth: chan 0000000023c4974d
Bluetooth: parent 00000000ae861c08
==================================================================
BUG: KASAN: use-after-free in __mutex_waiter_is_first
kernel/locking/mutex.c:191 [inline]
BUG: KASAN: use-after-free in __mutex_lock_common
kernel/locking/mutex.c:671 [inline]
BUG: KASAN: use-after-free in __mutex_lock+0x278/0x400
kernel/locking/mutex.c:729
Read of size 8 at addr ffff888006a49b08 by task kworker/u3:2/389

Link: https://lore.kernel.org/lkml/20220622082716.478486-1-lee.jones@linaro.org
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sungwoo Kim <iam@sung-woo.kim>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-10-26 13:15:46 +02:00
..
bnep
Bluetooth: bnep: fix possible might sleep error in bnep_session
2017-08-30 10:21:52 +02:00
cmtp
Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails
2022-01-27 08:47:33 +01:00
hidp
HID: introduce hid_is_using_ll_driver
2021-12-14 10:04:46 +01:00
rfcomm
Bluetooth: RFCOMM: fix ODEBUG bug in rfcomm_dev_ioctl
2020-04-13 10:32:57 +02:00
6lowpan.c
Bluetooth: add a mutex lock to avoid UAF in do_enale_set
2020-08-21 11:01:57 +02:00
a2mp.c
Bluetooth: drop HCI device reference before return
2021-03-03 17:44:32 +01:00
a2mp.h
Bluetooth: Add BT_HS config option
2015-07-30 13:31:59 +02:00
af_bluetooth.c
Bluetooth: Avoid bt_accept_unlink() double unlinking
2018-03-22 09:17:52 +01:00
amp.c
Bluetooth: Fix null pointer dereference in amp_read_loc_assoc_final_data
2021-03-07 11:25:57 +01:00
amp.h
Bluetooth: Add BT_HS config option
2015-07-30 13:31:59 +02:00
ecc.c
Bluetooth: Add ECC library for LE Secure Connections
2014-12-03 16:51:16 +01:00
ecc.h
Bluetooth: Add ECC library for LE Secure Connections
2014-12-03 16:51:16 +01:00
hci_conn.c
Bluetooth: Disconnect if E0 is used for Level 4
2020-10-17 11:02:19 +02:00
hci_core.c
Bluetooth: Fix the creation of hdev->name
2022-05-15 19:39:17 +02:00
hci_debugfs.c
Bluetooth: Add debugfs fields for hardware and firmware info
2016-07-18 09:33:28 +03:00
hci_debugfs.h
Bluetooth: Provide option to enable/disable debugfs information
2015-02-15 18:54:13 +02:00
hci_event.c
Bluetooth: Fix use after free in hci_send_acl
2022-04-20 09:06:43 +02:00
hci_request.c
bluetooth: eliminate the potential race condition when removing the HCI controller
2021-05-22 10:40:20 +02:00
hci_request.h
Bluetooth: Fix append max 11 bytes of name to scan rsp data
2016-10-19 18:42:37 +02:00
hci_sock.c
Bluetooth: defer cleanup of resources in hci_unregister_dev()
2021-08-15 13:01:02 +02:00
hci_sysfs.c
Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times
2022-10-26 13:15:46 +02:00
Kconfig
Bluetooth: add LED trigger for indicating HCI is powered up
2016-02-23 20:29:35 +01:00
l2cap_core.c
Bluetooth: L2CAP: Fix user-after-free
2022-10-26 13:15:46 +02:00
l2cap_sock.c
Bluetooth: fix use-after-free error in lock_sock_nested()
2021-11-26 11:48:27 +01:00
leds.c
Bluetooth: Add combined LED trigger for controller power
2016-09-19 20:19:34 +02:00
leds.h
Bluetooth: Add combined LED trigger for controller power
2016-09-19 20:19:34 +02:00
lib.c
Bluetooth: Add BT_WARN and bt_dev_warn logging macros
2015-09-24 16:25:44 +02:00
Makefile
Bluetooth: add LED trigger for indicating HCI is powered up
2016-02-23 20:29:35 +01:00
mgmt_util.c
Bluetooth: Add support for sending MGMT commands and events to monitor
2016-09-19 20:19:34 +02:00
mgmt_util.h
Bluetooth: Add generic mgmt helper API
2015-03-17 18:03:08 +01:00
mgmt.c
Bluetooth: Fix the HCI to MGMT status conversion table
2021-07-20 16:21:08 +02:00
sco.c
Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout
2022-06-14 16:52:32 +02:00
selftest.c
Bluetooth: Export ECDH selftest result in debugfs
2015-04-02 08:47:38 +03:00
selftest.h
Bluetooth: Add support for self testing framework
2014-12-30 08:53:55 +02:00
smp.c
Bluetooth: SMP: Fail if remote and local public keys are identical
2021-05-26 11:29:09 +02:00
smp.h
Bluetooth: SMP: fix crash in unpairing
2018-11-10 07:42:42 -08:00