iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/net/bluetooth
History
Archie Pusaka 2033dde6aa Bluetooth: check for zapped sk before connecting 
[ Upstream commit 3af70b39fa2d415dc86c370e5b24ddb9fdacbd6f ]

There is a possibility of receiving a zapped sock on
l2cap_sock_connect(). This could lead to interesting crashes, one
such case is tearing down an already tore l2cap_sock as is happened
with this call trace:

__dump_stack lib/dump_stack.c:15 [inline]
dump_stack+0xc4/0x118 lib/dump_stack.c:56
register_lock_class kernel/locking/lockdep.c:792 [inline]
register_lock_class+0x239/0x6f6 kernel/locking/lockdep.c:742
__lock_acquire+0x209/0x1e27 kernel/locking/lockdep.c:3105
lock_acquire+0x29c/0x2fb kernel/locking/lockdep.c:3599
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:137 [inline]
_raw_spin_lock_bh+0x38/0x47 kernel/locking/spinlock.c:175
spin_lock_bh include/linux/spinlock.h:307 [inline]
lock_sock_nested+0x44/0xfa net/core/sock.c:2518
l2cap_sock_teardown_cb+0x88/0x2fb net/bluetooth/l2cap_sock.c:1345
l2cap_chan_del+0xa3/0x383 net/bluetooth/l2cap_core.c:598
l2cap_chan_close+0x537/0x5dd net/bluetooth/l2cap_core.c:756
l2cap_chan_timeout+0x104/0x17e net/bluetooth/l2cap_core.c:429
process_one_work+0x7e3/0xcb0 kernel/workqueue.c:2064
worker_thread+0x5a5/0x773 kernel/workqueue.c:2196
kthread+0x291/0x2a6 kernel/kthread.c:211
ret_from_fork+0x4e/0x80 arch/x86/entry/entry_64.S:604

Signed-off-by: Archie Pusaka <apusaka@chromium.org>
Reported-by: syzbot+abfc0f5e668d4099af73@syzkaller.appspotmail.com
Reviewed-by: Alain Michaud <alainm@chromium.org>
Reviewed-by: Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
Reviewed-by: Guenter Roeck <groeck@chromium.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-05-19 10:12:53 +02:00
..
bnep
net: make ->{get,set}sockopt in proto_ops optional
2020-07-19 18:16:41 -07:00
cmtp
net: make ->{get,set}sockopt in proto_ops optional
2020-07-19 18:16:41 -07:00
hidp
net: make ->{get,set}sockopt in proto_ops optional
2020-07-19 18:16:41 -07:00
rfcomm
Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next
2020-07-31 15:11:52 -07:00
6lowpan.c
Bluetooth: add a mutex lock to avoid UAF in do_enale_set
2020-06-23 14:30:07 +02:00
a2mp.c
Bluetooth: drop HCI device reference before return
2021-03-04 11:37:25 +01:00
a2mp.h
Bluetooth: Replace zero-length array with flexible-array member
2020-02-28 08:30:02 +01:00
af_bluetooth.c
Bluetooth: Add support for BT_PKT_STATUS CMSG data for SCO connections
2020-06-12 15:08:49 +02:00
amp.c
Bluetooth: Fix null pointer dereference in amp_read_loc_assoc_final_data
2021-03-07 12:34:10 +01:00
amp.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 284
2019-06-05 17:36:37 +02:00
ecdh_helper.c
mm, treewide: rename kzfree() to kfree_sensitive()
2020-08-07 11:33:22 -07:00
ecdh_helper.h
Fix misc new gcc warnings
2021-05-11 14:47:36 +02:00
hci_conn.c
Bluetooth: avoid deadlock between hci_dev->lock and socket lock
2021-05-14 09:50:29 +02:00
hci_core.c
Bluetooth: Add new HCI_QUIRK_NO_SUSPEND_NOTIFIER quirk
2021-03-07 12:34:10 +01:00
hci_debugfs.c
Bluetooth: debugfs option to unset MITM flag
2020-04-07 18:32:21 +02:00
hci_debugfs.h
…
hci_event.c
Bluetooth: Fix incorrect status handling in LE PHY UPDATE event
2021-05-19 10:12:52 +02:00
hci_request.c
bluetooth: eliminate the potential race condition when removing the HCI controller
2021-05-14 09:49:55 +02:00
hci_request.h
Bluetooth: Enable/Disable address resolution during le create conn
2020-07-30 09:34:43 +02:00
hci_sock.c
Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next
2020-07-31 15:11:52 -07:00
hci_sysfs.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2017-11-04 09:26:51 +09:00
Kconfig
Bluetooth: Disable High Speed by default
2020-09-25 20:21:55 +02:00
l2cap_core.c
Bluetooth: initialize skb_queue_head at l2cap_chan_create()
2021-05-19 10:12:53 +02:00
l2cap_sock.c
Bluetooth: check for zapped sk before connecting
2021-05-19 10:12:53 +02:00
leds.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
leds.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
lib.c
Bluetooth: Introduce debug feature when dynamic debug is disabled
2020-05-11 12:16:27 +02:00
Makefile
Bluetooth: implement read/set default system parameters mgmt
2020-06-12 21:41:07 +02:00
mgmt_config.c
Bluetooth: Adding a configurable autoconnect timeout
2020-07-07 17:37:03 +02:00
mgmt_config.h
Bluetooth: mgmt: Add commands for runtime configuration
2020-06-18 13:11:03 +03:00
mgmt_util.c
networking: make skb_push & __skb_push return void pointers
2017-06-16 11:48:40 -04:00
mgmt_util.h
Bluetooth: Add generic mgmt helper API
2015-03-17 18:03:08 +01:00
mgmt.c
Bluetooth: MGMT: Fix not checking if BT_HS is enabled
2020-09-25 20:21:55 +02:00
msft.c
Bluetooth: Replace zero-length array with flexible-array member
2020-10-29 17:22:59 -05:00
msft.h
Bluetooth: Add handler of MGMT_OP_READ_ADV_MONITOR_FEATURES
2020-06-18 13:11:21 +03:00
sco.c
Bluetooth: sco: Fix crash when using BT_SNDMTU/BT_RCVMTU option
2020-12-30 11:53:40 +01:00
selftest.c
Bluetooth: Remove CRYPTO_ALG_INTERNAL flag
2020-07-31 16:42:04 +03:00
selftest.h
…
smp.c
mm, treewide: rename kzfree() to kfree_sensitive()
2020-08-07 11:33:22 -07:00
smp.h
Bluetooth: SMP: fix crash in unpairing
2018-09-26 12:39:32 +03:00