Desmond Cheong Zhi Xi 6528cc687c Bluetooth: skip invalid hci_sync_conn_complete_evt ... [ Upstream commit 92fe24a7db ] Syzbot reported a corrupted list in kobject_add_internal [1]. This happens when multiple HCI_EV_SYNC_CONN_COMPLETE event packets with status 0 are sent for the same HCI connection. This causes us to register the device more than once which corrupts the kset list. As this is forbidden behavior, we add a check for whether we're trying to process the same HCI_EV_SYNC_CONN_COMPLETE event multiple times for one connection. If that's the case, the event is invalid, so we report an error that the device is misbehaving, and ignore the packet. Link: https://syzkaller.appspot.com/bug?extid=66264bf2fd0476be7e6c [1] Reported-by: syzbot+66264bf2fd0476be7e6c@syzkaller.appspotmail.com Tested-by: syzbot+66264bf2fd0476be7e6c@syzkaller.appspotmail.com Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2021-09-18 13:40:23 +02:00
..
6lowpan	6lowpan: iphc: Fix an off-by-one check of array index	2021-09-15 09:50:34 +02:00
9p	9p/xen: Fix end of loop tests for list_for_each_entry	2021-09-18 13:40:06 +02:00
802	net/802/garp: fix memleak in garp_request_join()	2021-07-31 08:16:11 +02:00
8021q	net: vlan: avoid leaks on register_vlan_dev() failures	2021-01-17 14:16:55 +01:00
appletalk	appletalk: Fix skb allocation size in loopback case	2021-04-07 15:00:08 +02:00
atm	net: atm: fix update of position index in lec_seq_next	2020-10-31 12:26:30 -07:00
ax25
batman-adv	batman-adv: Avoid WARN_ON timing related checks	2021-06-23 14:42:41 +02:00
bluetooth	Bluetooth: skip invalid hci_sync_conn_complete_evt	2021-09-18 13:40:23 +02:00
bpf	bpf: Fix NULL pointer dereference in bpf_get_local_storage() helper	2021-09-03 10:09:21 +02:00
bpfilter	bpfilter: Specify the log level for the kmsg message	2021-07-14 16:56:29 +02:00
bridge	net: bridge: fix memleak in br_add_if()	2021-08-18 08:59:13 +02:00
caif	net: fix uninit-value in caif_seqpkt_sendmsg	2021-07-28 14:35:38 +02:00
can	can: j1939: j1939_session_deactivate(): clarify lifetime of session object	2021-08-04 12:46:45 +02:00
ceph	libceph: clear con->out_msg on Policy::stateful_server faults	2020-10-12 15:29:27 +02:00
core	flow_dissector: Fix out-of-bounds warnings	2021-09-18 13:40:22 +02:00
dcb	net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands	2021-01-23 16:04:01 +01:00
dccp	dccp: add do-while-0 stubs for dccp_pr_debug macros	2021-08-26 08:35:41 -04:00
decnet	net: decnet: Fix sleeping inside in af_decnet	2021-07-28 14:35:38 +02:00
dns_resolver
dsa	net: dsa: properly check for the bridge_leave methods in dsa_switch_bridge_leave()	2021-07-25 14:36:20 +02:00
ethernet
ethtool	ethtool: improve compat ioctl handling	2021-09-18 13:40:21 +02:00
hsr	net: hsr: fix mac_len checks	2021-06-03 09:00:50 +02:00
ieee802154	net: Fix memory leak in ieee802154_raw_deliver	2021-08-18 08:59:12 +02:00
ife
ipv4	ipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs()	2021-09-18 13:40:22 +02:00
ipv6	ipv6: make exception cache less predictible	2021-09-15 09:50:45 +02:00
iucv	net/af_iucv: remove WARN_ONCE on malformed RX packets	2021-03-07 12:34:05 +01:00
kcm
key	af_key: relax availability checks for skb size calculation	2021-02-13 13:55:02 +01:00
l2tp	net: l2tp: reduce log level of messages in receive path, add counter instead	2021-03-17 17:06:11 +01:00
l3mdev
lapb	net: lapb: Copy the skb before sending a packet	2021-02-10 09:29:14 +01:00
llc	net: llc: fix skb_over_panic	2021-08-04 12:46:43 +02:00
mac80211	mac80211: Fix insufficient headroom issue for AMSDU	2021-09-15 09:50:40 +02:00
mac802154	net: mac802154: Fix general protection fault	2021-04-14 08:42:13 +02:00
mpls	net: avoid infinite loop in mpls_gso_segment when mpls_hlen == 0	2021-03-17 17:06:11 +01:00
mptcp	mptcp: fix warning in __skb_flow_dissect() when do syn cookie for subflow join	2021-07-28 14:35:34 +02:00
ncsi	net/ncsi: Avoid channel_monitor hrtimer deadlock	2021-04-14 08:42:08 +02:00
netfilter	netfilter: nftables: clone set element expression template	2021-09-12 08:58:27 +02:00
netlabel	net: cipso: fix warnings in netlbl_cipsov4_add_std	2021-09-15 09:50:35 +02:00
netlink	netlink: Deal with ESRCH error in nlmsg_notify()	2021-09-18 13:40:18 +02:00
netrom	netrom: Decrease sock refcount when sock timers expire	2021-07-28 14:35:38 +02:00
nfc	net/nfc/rawsock.c: fix a permission check bug	2021-06-16 12:01:35 +02:00
nsh
openvswitch	ovs: clear skb->tstamp in forwarding path	2021-08-26 08:35:50 -04:00
packet	net/packet: annotate accesses to po->ifindex	2021-06-30 08:47:22 -04:00
phonet
psample	net: psample: Fix netlink skb length with tunnel info	2021-03-07 12:34:07 +01:00
qrtr	net: qrtr: fix another OOB Read in qrtr_endpoint_post	2021-09-03 10:09:21 +02:00
rds	net/rds: dma_map_sg is entitled to merge entries	2021-09-03 10:09:28 +02:00
rfkill	rfkill: Fix use-after-free in rfkill_resume()	2020-11-12 09:18:06 +01:00
rose	rose: Fix Null pointer dereference in rose_send_frame()	2020-11-20 10:04:58 -08:00
rxrpc	rxrpc: Fix clearance of Tx/Rx ring when releasing a call	2021-02-17 11:02:28 +01:00
sched	net: sched: Fix qdisc_rate_table refcount leak when get tcf_block failed	2021-09-15 09:50:45 +02:00
sctp	sctp: move the active_key update after sh_keys is added	2021-08-12 13:22:06 +02:00
smc	net/smc: fix wait on already cleared link	2021-08-18 08:59:10 +02:00
strparser
sunrpc	sunrpc: Fix return value of get_srcport()	2021-09-18 13:40:14 +02:00
switchdev	net: switchdev: don't set port_obj_info->handled true when -EOPNOTSUPP	2021-02-07 15:37:12 +01:00
tipc	tipc: keep the skb in rcv queue until the whole data is read	2021-09-18 13:40:18 +02:00
tls	tls: prevent oversized sendfile() hangs by ignoring MSG_MORE	2021-07-14 16:56:24 +02:00
unix	af_unix: fix garbage collect vs MSG_PEEK	2021-07-31 08:16:11 +02:00
vmw_vsock	vsock/virtio: avoid potential deadlock when vsock device remove	2021-08-18 08:59:14 +02:00
wimax	genetlink: move to smaller ops wherever possible	2020-10-02 19:11:11 -07:00
wireless	cfg80211: Fix possible memory leak in function cfg80211_bss_update	2021-08-04 12:46:41 +02:00
x25	net/x25: Return the correct errno code	2021-06-18 10:00:06 +02:00
xdp	xsk: Fix broken Tx ring validation	2021-07-14 16:56:23 +02:00
xfrm	net: xfrm: Fix end of loop tests for list_for_each_entry	2021-08-26 08:35:35 -04:00
compat.c	net: Return the correct errno code	2021-06-18 10:00:06 +02:00
devres.c
Kconfig	drop_monitor: Convert to using devlink tracepoint	2020-09-30 18:01:26 -07:00
Makefile
socket.c	ethtool: improve compat ioctl handling	2021-09-18 13:40:21 +02:00
sysctl_net.c