Dan Carpenter 11eb85ec42 Bluetooth: Fix race condition in hci_release_sock() ...

Syzbot managed to trigger a use after free "KASAN: use-after-free Write
in hci_sock_bind".  I have reviewed the code manually and one possibly
cause I have found is that we are not holding lock_sock(sk) when we do
the hci_dev_put(hdev) in hci_sock_release().  My theory is that the bind
and the release are racing against each other which results in this use
after free.

Reported-by: [email protected]
Signed-off-by: Dan Carpenter <[email protected]>
Signed-off-by: Johan Hedberg <[email protected]>

2020-01-26 10:34:17 +02:00

..

bnep

netdev: pass the stuck queue to the timeout handler

2019-12-12 21:38:57 -08:00

cmtp

treewide: Add SPDX license identifier - Makefile/Kconfig

2019-05-21 10:50:46 +02:00

hidp

Bluetooth: hidp: Fix assumptions on the return value of hidp_send_message

2019-09-06 15:55:40 +02:00

rfcomm

compat_ioctl: move rfcomm handlers into driver

2019-10-23 17:23:44 +02:00

6lowpan.c

net: core: add generic lockdep keys

2019-10-24 14:53:48 -07:00

a2mp.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 284

2019-06-05 17:36:37 +02:00

a2mp.h

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 284

2019-06-05 17:36:37 +02:00

af_bluetooth.c

net: use helpers to change sk_ack_backlog

2019-11-06 16:14:48 -08:00

amp.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 284

2019-06-05 17:36:37 +02:00

amp.h

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 284

2019-06-05 17:36:37 +02:00

ecdh_helper.c

…

ecdh_helper.h

…

hci_conn.c

Bluetooth: Fix memory leak in hci_connect_le_scan

2019-11-22 10:42:53 +01:00

hci_core.c

Bluetooth: Add missing checks for HCI_ISODATA_PKT packet type

2020-01-25 16:33:46 +02:00

hci_debugfs.c

Bluetooth: Move {min,max}_key_size debugfs into hci_debugfs_create_le

2020-01-25 16:33:52 +02:00

hci_debugfs.h

…

hci_event.c

Bluetooth: Add support for LE PHY Update Complete event

2020-01-04 10:49:23 +01:00

hci_request.c

Bluetooth: Fix advertising duplicated flags

2019-11-04 10:12:05 +02:00

hci_request.h

Bluetooth: Use controller sets when available

2019-07-06 15:38:18 +02:00

hci_sock.c

Bluetooth: Fix race condition in hci_release_sock()

2020-01-26 10:34:17 +02:00

hci_sysfs.c

…

Kconfig

crypto: skcipher - rename the crypto_blkcipher module and kconfig option

2019-11-01 13:42:47 +08:00

l2cap_core.c

Bluetooth: remove redundant assignment to variable icid

2020-01-08 21:44:22 +01:00

l2cap_sock.c

Bluetooth: Add return check for L2CAP security level set

2019-04-23 18:09:07 +02:00

leds.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500

2019-06-19 17:09:55 +02:00

leds.h

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500

2019-06-19 17:09:55 +02:00

lib.c

Bluetooth: Adding a bt_dev_warn_ratelimited macro.

2020-01-04 10:41:03 +01:00

Makefile

…

mgmt_util.c

…

mgmt_util.h

…

mgmt.c

Bluetooth: fix appearance typo in mgmt.c

2020-01-22 21:23:16 +01:00

sco.c

net: rework SIOCGSTAMP ioctl handling

2019-04-19 14:07:40 -07:00

selftest.c

…

selftest.h

…

smp.c

Bluetooth: Move {min,max}_key_size debugfs into hci_debugfs_create_le

2020-01-25 16:33:52 +02:00

smp.h

…