Edward Adam Davis 605572e64c bluetooth/l2cap: sync sock recv cb and release ... [ Upstream commit 89e856e124 ] The problem occurs between the system call to close the sock and hci_rx_work, where the former releases the sock and the latter accesses it without lock protection. CPU0 CPU1 ---- ---- sock_close hci_rx_work l2cap_sock_release hci_acldata_packet l2cap_sock_kill l2cap_recv_frame sk_free l2cap_conless_channel l2cap_sock_recv_cb If hci_rx_work processes the data that needs to be received before the sock is closed, then everything is normal; Otherwise, the work thread may access the released sock when receiving data. Add a chan mutex in the rx callback of the sock to achieve synchronization between the sock release and recv cb. Sock is dead, so set chan data to NULL, avoid others use invalid sock pointer. Reported-and-tested-by: syzbot+b7f6f8c9303466e16c8a@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis <eadavis@qq.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-07-25 09:49:18 +02:00
..
6lowpan
9p	net/9p: fix uninit-value in p9_client_rpc()	2024-06-16 13:41:38 +02:00
802
8021q	vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING	2024-01-31 16:17:04 -08:00
appletalk	appletalk: Fix Use-After-Free in atalk_ioctl	2023-12-20 17:00:19 +01:00
atm	atm: Fix Use-After-Free in do_vcc_ioctl	2023-12-20 17:00:17 +01:00
ax25	ax25: Replace kfree() in ax25_dev_free() with ax25_dev_put()	2024-06-21 14:35:32 +02:00
batman-adv	batman-adv: Don't accept TT entries for out-of-spec VIDs	2024-07-05 09:31:58 +02:00
bluetooth	bluetooth/l2cap: sync sock recv cb and release	2024-07-25 09:49:18 +02:00
bpf	bpf: Set run context for rawtp test_run callback	2024-06-21 14:35:33 +02:00
bpfilter
bridge	net: bridge: mst: fix suspicious rcu usage in br_mst_set_state	2024-06-21 14:35:52 +02:00
caif
can	net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new	2024-07-05 09:31:56 +02:00
ceph	libceph: fix race between delayed_work() and ceph_monc_stop()	2024-07-18 13:18:41 +02:00
core	bpf: Refactor some inode/task/sk storage functions for reuse	2024-07-18 13:18:34 +02:00
dcb	net: dcb: choose correct policy to parse DCB_ATTR_BCN	2023-08-11 12:08:17 +02:00
dccp	Fix race for duplicate reqsk on identical SYN	2024-07-05 09:31:46 +02:00
devlink	devlink: remove reload failed checks in params get/set callbacks	2023-09-23 11:11:01 +02:00
dns_resolver	keys, dns: Fix size check of V1 server-list header	2024-01-25 15:27:38 -08:00
dsa	net: dsa: introduce preferred_default_local_cpu_port and use on MT7530	2024-04-27 17:07:17 +02:00
ethernet	ethernet: Add helper for assigning packet type when dest address does not match device address	2024-05-02 16:29:29 +02:00
ethtool	ethtool: netlink: do not return SQI value if link is down	2024-07-18 13:18:35 +02:00
hsr	hsr: Simplify code for announcing HSR nodes timer setup	2024-05-17 11:56:13 +02:00
ieee802154
ife	net: sched: ife: fix potential use-after-free	2024-01-01 12:38:56 +00:00
ipv4	tcp: avoid too many retransmit packets	2024-07-18 13:18:37 +02:00
ipv6	ila: block BH in ila_output()	2024-07-25 09:49:11 +02:00
iucv	net/iucv: Avoid explicit cpumask var allocation on stack	2024-07-05 09:31:49 +02:00
kcm	net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function	2024-03-26 18:20:42 -04:00
key	net: af_key: fix sadb_x_filter validation	2023-08-23 17:52:32 +02:00
l2tp	net l2tp: drop flow hash on forward	2024-05-17 11:55:59 +02:00
l3mdev
lapb
llc	llc: call sock_orphan() at release time	2024-02-05 20:13:01 +00:00
mac80211	wifi: mac80211: fix UBSAN noise in ieee80211_prep_hw_scan()	2024-07-25 09:49:10 +02:00
mac802154	net: mac802154: Fix racy device stats updates by DEV_STATS_INC() and DEV_STATS_ADD()	2024-07-25 09:49:17 +02:00
mctp	net: mctp: copy skb ext data when fragmenting	2024-03-26 18:20:37 -04:00
mpls	net: mpls: error out if inner headers are not set	2024-04-13 13:05:27 +02:00
mptcp	mptcp: pm: update add_addr counters after connect	2024-06-21 14:35:59 +02:00
ncsi	net/ncsi: Fix the multi thread manner of NCSI driver	2024-06-21 14:35:33 +02:00
netfilter	netfilter: nf_tables: unconditionally flush pending work before notifier	2024-07-11 12:47:12 +02:00
netlabel	calipso: fix memory leak in netlbl_calipso_add_pass()	2024-01-25 15:27:20 -08:00
netlink	netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter	2024-03-06 14:45:06 +00:00
netrom	netrom: Fix a memory leak in nr_heartbeat_expiry()	2024-06-27 13:46:18 +02:00
nfc	nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()	2024-06-12 11:03:53 +02:00
nsh	nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().	2024-05-17 11:55:59 +02:00
openvswitch	openvswitch: Set the skbuff pkt_type for proper pmtud support.	2024-06-12 11:03:51 +02:00
packet	af_packet: avoid a false positive warning in packet_setsockopt()	2024-06-27 13:46:15 +02:00
phonet	phonet: fix rtm_phonet_notify() skb allocation	2024-05-17 11:56:12 +02:00
psample	psample: Require 'CAP_NET_ADMIN' when joining "packets" group	2023-12-13 18:39:11 +01:00
qrtr	net: qrtr: ns: Fix module refcnt	2024-06-12 11:03:32 +02:00
rds	net/rds: fix possible cp null dereference	2024-04-10 16:28:25 +02:00
rfkill	net: rfkill: gpio: set GPIO direction	2024-01-01 12:39:04 +00:00
rose	net/rose: fix races in rose_kill_by_device()	2024-01-01 12:38:57 +00:00
rxrpc	rxrpc: Fix response to PING RESPONSE ACKs to a dead call	2024-02-16 19:06:27 +01:00
sched	net/sched: Fix UAF when resolving a clash	2024-07-18 13:18:35 +02:00
sctp	sctp: prefer struct_size over open coded arithmetic	2024-07-11 12:47:07 +02:00
smc	net/smc: avoid overwriting when adjusting sock bufsizes	2024-06-21 14:35:33 +02:00
strparser
sunrpc	net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket	2024-07-18 13:18:35 +02:00
switchdev	net: bridge: switchdev: Skip MDB replays of deferred events on offload	2024-03-01 13:26:35 +01:00
tipc	tipc: force a dst refcount before doing decryption	2024-06-27 13:46:19 +02:00
tls	tls: fix missing memory barrier in tls_init	2024-06-12 11:03:53 +02:00
unix	af_unix: Read with MSG_PEEK loops if the first unread byte is OOB	2024-06-21 14:35:53 +02:00
vmw_vsock	vsock/virtio: fix packet delivery to tap device	2024-04-10 16:28:25 +02:00
wireless	wifi: cfg80211: wext: add extra SIOCSIWSCAN data check	2024-07-25 09:49:13 +02:00
x25	net/x25: fix incorrect parameter validation in the x25_getsockopt() function	2024-03-26 18:20:42 -04:00
xdp	xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING	2024-04-17 11:18:23 +02:00
xfrm	net: fix __dst_negative_advice() race	2024-06-16 13:41:40 +02:00
compat.c
devres.c
Kconfig
Kconfig.debug
Makefile	devlink: move code to a dedicated directory	2023-08-30 16:11:00 +02:00
socket.c	splice, net: Add a splice_eof op to file-ops and socket-ops	2024-01-10 17:10:27 +01:00
sysctl_net.c