Ivan Pravdin ca94b2b036 Bluetooth: bcsp: receive data only if registered ... Currently, bcsp_recv() can be called even when the BCSP protocol has not been registered. This leads to a NULL pointer dereference, as shown in the following stack trace: KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f] RIP: 0010:bcsp_recv+0x13d/0x1740 drivers/bluetooth/hci_bcsp.c:590 Call Trace: <TASK> hci_uart_tty_receive+0x194/0x220 drivers/bluetooth/hci_ldisc.c:627 tiocsti+0x23c/0x2c0 drivers/tty/tty_io.c:2290 tty_ioctl+0x626/0xde0 drivers/tty/tty_io.c:2706 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f To prevent this, ensure that the HCI_UART_REGISTERED flag is set before processing received data. If the protocol is not registered, return -EUNATCH. Reported-by: syzbot+4ed6852d4da4606c93da@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=4ed6852d4da4606c93da Tested-by: syzbot+4ed6852d4da4606c93da@syzkaller.appspotmail.com Signed-off-by: Ivan Pravdin <ipravdin.official@gmail.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>		2025-09-27 11:37:02 -04:00
..
accel	accel/ivpu: Prevent recovery work from being queued during device removal	2025-09-01 12:37:21 +02:00
accessibility
acpi	Several RISC-V fixes for v6.17-rc5:	2025-09-07 08:15:56 -07:00
amba
android
ata	ata: ahci_xgene: Use int type for 'rc' to store error codes	2025-08-28 13:36:14 +09:00
atm	atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().	2025-08-22 17:23:15 -07:00
auxdisplay
base	Mitigate VMSCAPE issue with indirect branch predictor flushes	2025-09-10 20:52:16 -07:00
bcma
block	block-6.17-20250918	2025-09-19 12:26:20 -07:00
bluetooth	Bluetooth: bcsp: receive data only if registered	2025-09-27 11:37:02 -04:00
bus
cache
cdrom
cdx
char
clk	Allwinner Clock Fixes for 6.17	2025-09-19 21:28:01 -07:00
clocksource
comedi
connector
counter
cpufreq	cpufreq: Initialize cpufreq-based invariance before subsys	2025-09-20 13:00:20 +02:00
cpuidle
crypto	crypto: ccp - Always pass in an error pointer to __sev_platform_shutdown_locked()	2025-09-13 12:07:44 +08:00
cxl
dax
dca
devfreq
dibs	dibs: Check correct variable in dibs_init()	2025-09-26 15:10:59 -07:00
dio
dma	dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate	2025-09-02 15:01:51 +05:30
dma-buf
dpll	dpll: zl3073x: Fix double free in zl3073x_devlink_flash_update()	2025-09-26 15:23:55 -07:00
edac	EDAC/altera: Delete an inappropriate dma_free_coherent() call	2025-08-25 13:56:16 +02:00
eisa
extcon
firewire	firewire: core: fix overlooked update of subsystem ABI version	2025-09-20 12:17:50 +09:00
firmware	soc: fixes for 6.17, part 3	2025-09-24 14:37:44 -07:00
fpga
fsi
fwctl
gnss
gpio	intel-gpio for v6.17-1	2025-09-16 11:36:37 +02:00
gpu	amd-drm-fixes-6.17-2025-09-18:	2025-09-19 12:35:09 +10:00
greybus
hid	hid-for-linus-2025092201	2025-09-22 11:01:37 -07:00
hsi
hte
hv
hwmon	hwmon: (ina238) Correctly clamp power limits	2025-09-01 08:03:05 -07:00
hwspinlock
hwtracing
i2c	i2c: rtl9300: remove broken SMBus Quick operation support	2025-09-04 00:31:34 +02:00
i3c
idle
iio
infiniband	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2025-09-25 11:00:59 -07:00
input	Input updates for v6.17-rc5	2025-09-14 08:09:37 -07:00
interconnect
iommu	iommufd 6.17 second rc pull	2025-09-22 11:16:14 -07:00
ipack
irqchip	irqchip/gic-v5: Remove undue WARN_ON()s in the IRS affinity parsing	2025-08-24 12:54:06 +02:00
isdn	mISDN: Fix memory leak in dsp_hwec_enable()	2025-08-29 19:19:39 -07:00
leds
macintosh
mailbox
mcb
md	block-6.17-20250918	2025-09-19 12:26:20 -07:00
media
memory
memstick
message
mfd
misc
mmc	mmc: sdhci-pci-gli: GL9767: Fix initializing the UHS-II interface during a power-on	2025-09-12 15:00:52 +02:00
most
mtd	mtd: spinand: winbond: Fix oob_layout for W25N01JW	2025-09-05 17:03:44 +02:00
mux
net	octeon_ep_vf: Add support to retrieve hardware channel information	2025-09-26 17:43:24 -07:00
nfc
ntb
nubus
nvdimm
nvme	nvme: fix PI insert on write	2025-09-02 12:21:42 -07:00
nvmem
of	17 hotfixes. 13 are cc:stable and the remainder address post-6.16 issues	2025-09-02 13:18:00 -07:00
opp
parisc
parport
pci	pci-v6.17-fixes-3	2025-09-12 10:46:10 -07:00
pcmcia
peci
perf
phy	phy: qcom: qmp-pcie: Fix PHY initialization when powered down by firmware	2025-09-01 22:29:20 +05:30
pinctrl	pinctrl: airoha: fix wrong MDIO function bitmaks	2025-09-08 23:01:19 +02:00
platform	platform-drivers-x86 for v6.17-4	2025-09-18 09:22:34 -07:00
pmdomain	pmdomain: renesas: rmobile-sysc: Don't keep unused PM domains powered-on	2025-09-11 12:36:55 +02:00
pnp
power	power: supply: bq27xxx: restrict no-battery detection to bq27000	2025-09-06 02:11:38 +02:00
powercap
pps
ps3
ptp	ptp_ocp: make ptp_ocp driver compatible with PTP_EXTTS_REQUEST2	2025-09-19 17:00:06 -07:00
pwm
rapidio
ras
regulator	regulator: sy7636a: fix lifecycle of power good gpio	2025-09-08 16:33:24 +01:00
remoteproc
reset	reset: eyeq: fix OF node leak	2025-08-27 16:40:13 +02:00
rpmsg
rtc
s390	dibs: Move event handling to dibs layer	2025-09-23 11:13:22 +02:00
sbus
scsi	scsi: sr: Reinstate rotational media flag	2025-08-30 21:46:21 -04:00
sh
siox
slimbus
soc	soc: fixes for 6.17, part 2	2025-09-03 14:44:34 -07:00
soundwire
spi	spi: spi-qpic-snand: unregister ECC engine on probe error and device remove	2025-09-03 14:49:58 +01:00
spmi
ssb
staging	wifi: drivers: indicate support for attributes in NL80211_CMD_SET_BSS	2025-09-04 11:19:02 +02:00
target
tc
tee	OP-TEE driver fix for v6.17	2025-09-01 10:35:03 +02:00
thermal
thunderbolt
tty	TTY/Serial fixes for 6.17-rc6	2025-09-14 10:54:54 -07:00
ufs	scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE	2025-09-09 22:38:38 -04:00
uio
usb	USB: core: remove the move buf action	2025-09-12 13:41:55 +02:00
vdpa
vfio
vhost	vhost-net: flush batched before enabling notifications	2025-09-19 04:15:26 -04:00
video
virt
virtio	virtio_input: Improve freeze handling	2025-08-26 03:38:19 -04:00
w1
watchdog
xen
zorro
Kconfig
Makefile	dibs: Create drivers/dibs	2025-09-23 11:13:21 +02:00