github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-12 16:18:45 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity
598dbba991
linux/net/bluetooth
History
Hyunwoo Kim 598dbba991 Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold 
sco_recv_frame() reads conn->sk under sco_conn_lock() but immediately
releases the lock without holding a reference to the socket. A concurrent
close() can free the socket between the lock release and the subsequent
sk->sk_state access, resulting in a use-after-free.

Other functions in the same file (sco_sock_timeout(), sco_conn_del())
correctly use sco_sock_hold() to safely hold a reference under the lock.

Fix by using sco_sock_hold() to take a reference before releasing the
lock, and adding sock_put() on all exit paths.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-03-19 14:42:35 -04:00
..
bnep Bluetooth: bnep: fix wild-memory-access in proto_unregister 2024-10-16 16:10:03 -04:00
cmtp Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hidp Bluetooth: HIDP: Fix possible UAF 2026-03-12 15:27:46 -04:00
rfcomm Convert 'alloc_flex' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
6lowpan.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
af_bluetooth.c Bluetooth: ISO: add socket option to report packet seqnum via CMSG 2025-07-23 10:31:19 -04:00
aosp.c Bluetooth: aosp: Fix typo in comment 2025-07-23 10:30:18 -04:00
aosp.h
coredump.c Bluetooth: hci_devcd_dump: fix out-of-bounds via dev_coredumpv 2025-07-23 10:33:57 -04:00
ecdh_helper.c Bluetooth: Use crypto_wait_req 2023-02-13 18:34:48 +08:00
ecdh_helper.h
eir.c Bluetooth: eir: Fix possible crashes on eir_create_adv_data 2025-06-11 16:29:22 -04:00
eir.h Bluetooth: eir: Fix possible crashes on eir_create_adv_data 2025-06-11 16:29:22 -04:00
hci_codec.c
hci_codec.h
hci_conn.c Bluetooth: ISO: Fix defer tests being unstable 2026-03-12 15:26:48 -04:00
hci_core.c Convert 'alloc_flex' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hci_debugfs.c Bluetooth: hci_dev: replace 'quirks' integer by 'quirk_flags' bitmap 2025-07-16 15:37:53 -04:00
hci_debugfs.h
hci_drv.c Bluetooth: Introduce HCI Driver protocol 2025-05-21 10:28:07 -04:00
hci_event.c Bluetooth: Fix using PHYs bitfields as PHY value 2026-01-29 13:27:47 -05:00
hci_sock.c Bluetooth: purge error queues in socket destructors 2026-02-23 15:30:16 -05:00
hci_sync.c Bluetooth: hci_sync: Fix hci_le_create_conn_sync 2026-03-12 15:27:05 -04:00
hci_sysfs.c Bluetooth: Allow reset via sysfs 2025-01-15 10:37:07 -05:00
iso.c Including fixes from IPsec, Bluetooth and netfilter 2026-02-26 08:00:13 -08:00
Kconfig Bluetooth: Remove BT_HS 2024-03-06 17:22:39 -05:00
l2cap_core.c Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() 2026-03-19 14:42:12 -04:00
l2cap_sock.c Including fixes from IPsec, Bluetooth and netfilter 2026-02-26 08:00:13 -08:00
leds.c Bluetooth: Use led_set_brightness() in LED trigger activate() callback 2024-09-10 13:06:11 -04:00
leds.h
lib.c Bluetooth: Fix typos in comments 2025-07-23 10:30:48 -04:00
Makefile Bluetooth: Introduce HCI Driver protocol 2025-05-21 10:28:07 -04:00
mgmt_config.c Bluetooth: mgmt: Add idle_timeout to configurable system parameters 2026-01-29 13:24:22 -05:00
mgmt_config.h
mgmt_util.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
mgmt_util.h Bluetooth: MGMT: Fix possible UAFs 2025-09-22 10:30:00 -04:00
mgmt.c Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers 2026-03-12 15:27:25 -04:00
msft.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
msft.h Bluetooth: msft: fix slab-use-after-free in msft_do_close() 2024-05-03 13:05:28 -04:00
sco.c Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold 2026-03-19 14:42:35 -04:00
selftest.c
selftest.h
smp.c Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy 2026-03-12 15:26:30 -04:00
smp.h Bluetooth: SMP: If an unallowed command is received consider it a failure 2025-07-16 15:33:30 -04:00