mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity
linux-stable/net/bluetooth
History
Desmond Cheong Zhi Xi f4712fa993 Bluetooth: call sock_hold earlier in sco_conn_del 
In sco_conn_del, conn->sk is read while holding on to the
sco_conn.lock to avoid races with a socket that could be released
concurrently.

However, in between unlocking sco_conn.lock and calling sock_hold,
it's possible for the socket to be freed, which would cause a
use-after-free write when sock_hold is finally called.

To fix this, the reference count of the socket should be increased
while the sco_conn.lock is still held.

Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
 		2021-09-03 16:33:10 -07:00
..
bnep Bluetooth: bnep: Use the correct print format 2021-06-26 07:12:40 +02:00
cmtp Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow 2021-08-05 15:05:37 +02:00
hidp Bluetooth: hidp: Use the correct print format 2021-06-26 07:12:40 +02:00
rfcomm Bluetooth: switch to lock_sock in RFCOMM 2021-08-10 10:40:48 -07:00
6lowpan.c Bluetooth: 6lowpan: Use the correct print format 2021-06-26 07:12:41 +02:00
Kconfig Bluetooth: Add support for reading AOSP vendor capabilities 2021-04-06 14:11:23 -07:00
Makefile Bluetooth: Add support for reading AOSP vendor capabilities 2021-04-06 14:11:23 -07:00
a2mp.c Bluetooth: a2mp: Use the correct print format 2021-06-26 07:12:41 +02:00
a2mp.h Bluetooth: Replace zero-length array with flexible-array member 2020-02-28 08:30:02 +01:00
af_bluetooth.c Bluetooth: fix indentation and alignment reported by checkpatch 2021-01-29 16:51:45 +01:00
amp.c Bluetooth: amp: Use the correct print format 2021-06-26 07:12:41 +02:00
amp.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 284 2019-06-05 17:36:37 +02:00
aosp.c Bluetooth: Add support for reading AOSP vendor capabilities 2021-04-06 14:11:23 -07:00
aosp.h Bluetooth: Add support for reading AOSP vendor capabilities 2021-04-06 14:11:23 -07:00
ecdh_helper.c crypto: ecdh - move curve_id of ECDH from the key to algorithm name 2021-03-13 00:04:03 +11:00
ecdh_helper.h Fix misc new gcc warnings 2021-04-27 17:05:53 -07:00
hci_conn.c Bluetooth: Fix using RPA when address has been resolved 2021-08-30 23:14:55 +02:00
hci_core.c Bluetooth: Fix using address type from events 2021-08-30 23:14:55 +02:00
hci_debugfs.c Bluetooth: use inclusive language when filtering devices 2021-06-26 07:12:44 +02:00
hci_debugfs.h
…
hci_event.c Bluetooth: Fix using RPA when address has been resolved 2021-08-30 23:14:55 +02:00
hci_request.c Bluetooth: Fix not generating RPA when required 2021-08-03 23:30:50 +02:00
hci_request.h Bluetooth: Resume advertising after LE connection 2020-11-09 13:33:19 +01:00
hci_sock.c Bluetooth: reorganize functions from hci_sock_sendmsg() 2021-08-30 16:16:49 +02:00
hci_sysfs.c bluetooth-next pull request for net-next: 2021-08-20 12:16:05 +01:00
l2cap_core.c Bluetooth: Fix using RPA when address has been resolved 2021-08-30 23:14:55 +02:00
l2cap_sock.c Bluetooth: fix use-after-free error in lock_sock_nested() 2021-09-01 07:36:08 +02:00
leds.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
leds.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
lib.c Bluetooth: Introduce debug feature when dynamic debug is disabled 2020-05-11 12:16:27 +02:00
mgmt.c Bluetooth: Support the quality report events 2021-08-30 16:44:32 +02:00
mgmt_config.c Bluetooth: mgmt: Use the correct print format 2021-06-26 07:12:42 +02:00
mgmt_config.h Bluetooth: mgmt: Add commands for runtime configuration 2020-06-18 13:11:03 +03:00
mgmt_util.c
…
mgmt_util.h
…
msft.c Bluetooth: msft: Use the correct print format 2021-06-26 07:12:42 +02:00
msft.h Bluetooth: Allow Microsoft extension to indicate curve validation 2021-04-08 12:26:34 +02:00
sco.c Bluetooth: call sock_hold earlier in sco_conn_del 2021-09-03 16:33:10 -07:00
selftest.c crypto: ecdh - move curve_id of ECDH from the key to algorithm name 2021-03-13 00:04:03 +11:00
selftest.h
…
smp.c Bluetooth: use inclusive language in HCI role comments 2021-06-26 07:12:43 +02:00
smp.h Bluetooth: use inclusive language in SMP 2021-06-26 07:12:37 +02:00