linux-stable/net/bluetooth
Hillf Danton 2a154903ce Bluetooth: prefetch channel before killing sock
Prefetch channel before killing sock in order to fix UAF like

 BUG: KASAN: use-after-free in l2cap_sock_release+0x24c/0x290 net/bluetooth/l2cap_sock.c:1212
 Read of size 8 at addr ffff8880944904a0 by task syz-fuzzer/9751

Reported-by: syzbot+c3c5bdea7863886115dc@syzkaller.appspotmail.com
Fixes: 6c08fc896b ("Bluetooth: Fix refcount use-after-free issue")
Cc: Manish Mandlik <mmandlik@google.com>
Signed-off-by: Hillf Danton <hdanton@sina.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2020-02-05 09:05:04 +01:00
..
bnep netdev: pass the stuck queue to the timeout handler 2019-12-12 21:38:57 -08:00
cmtp treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
hidp Bluetooth: optimize barrier usage for Rmw atomics 2020-01-29 19:50:44 +01:00
rfcomm compat_ioctl: move rfcomm handlers into driver 2019-10-23 17:23:44 +02:00
6lowpan.c net: core: add generic lockdep keys 2019-10-24 14:53:48 -07:00
a2mp.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 284 2019-06-05 17:36:37 +02:00
a2mp.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 284 2019-06-05 17:36:37 +02:00
af_bluetooth.c net: use helpers to change sk_ack_backlog 2019-11-06 16:14:48 -08:00
amp.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 284 2019-06-05 17:36:37 +02:00
amp.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 284 2019-06-05 17:36:37 +02:00
ecdh_helper.c Bluetooth: let the crypto subsystem generate the ecc privkey 2017-10-06 20:35:47 +02:00
ecdh_helper.h Bluetooth: let the crypto subsystem generate the ecc privkey 2017-10-06 20:35:47 +02:00
hci_conn.c Bluetooth: Fix memory leak in hci_connect_le_scan 2019-11-22 10:42:53 +01:00
hci_core.c Bluetooth: Add missing checks for HCI_ISODATA_PKT packet type 2020-01-25 16:33:46 +02:00
hci_debugfs.c Bluetooth: Move {min,max}_key_size debugfs into hci_debugfs_create_le 2020-01-25 16:33:52 +02:00
hci_debugfs.h
hci_event.c Bluetooth: Add support for LE PHY Update Complete event 2020-01-04 10:49:23 +01:00
hci_request.c Bluetooth: Fix advertising duplicated flags 2019-11-04 10:12:05 +02:00
hci_request.h Bluetooth: Use controller sets when available 2019-07-06 15:38:18 +02:00
hci_sock.c Bluetooth: Fix race condition in hci_release_sock() 2020-01-26 10:34:17 +02:00
hci_sysfs.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-11-04 09:26:51 +09:00
Kconfig crypto: skcipher - rename the crypto_blkcipher module and kconfig option 2019-11-01 13:42:47 +08:00
l2cap_core.c Bluetooth: Fix refcount use-after-free issue 2020-01-29 04:53:12 +01:00
l2cap_sock.c Bluetooth: prefetch channel before killing sock 2020-02-05 09:05:04 +01:00
leds.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
leds.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
lib.c Bluetooth: Adding a bt_dev_warn_ratelimited macro. 2020-01-04 10:41:03 +01:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
mgmt.c Bluetooth: fix appearance typo in mgmt.c 2020-01-22 21:23:16 +01:00
mgmt_util.c networking: make skb_push & __skb_push return void pointers 2017-06-16 11:48:40 -04:00
mgmt_util.h
sco.c net: rework SIOCGSTAMP ioctl handling 2019-04-19 14:07:40 -07:00
selftest.c Bluetooth: Fix compiler warning with selftest duration calculation 2017-10-06 21:49:13 +03:00
selftest.h
smp.c Bluetooth: SMP: Fix SALT value in some comments 2020-01-28 08:02:29 +01:00
smp.h Bluetooth: SMP: fix crash in unpairing 2018-09-26 12:39:32 +03:00