Luiz Augusto von Dentz 15fc21695e Bluetooth: L2CAP: Fix user-after-free ...

[ Upstream commit 35fcbc4243 ]

This uses l2cap_chan_hold_unless_zero() after calling
__l2cap_get_chan_blah() to prevent the following trace:

Bluetooth: l2cap_core.c:static void l2cap_chan_destroy(struct kref
*kref)
Bluetooth: chan 0000000023c4974d
Bluetooth: parent 00000000ae861c08
==================================================================
BUG: KASAN: use-after-free in __mutex_waiter_is_first
kernel/locking/mutex.c:191 [inline]
BUG: KASAN: use-after-free in __mutex_lock_common
kernel/locking/mutex.c:671 [inline]
BUG: KASAN: use-after-free in __mutex_lock+0x278/0x400
kernel/locking/mutex.c:729
Read of size 8 at addr ffff888006a49b08 by task kworker/u3:2/389

Link: https://lore.kernel.org/lkml/20220622082716.478486-1-lee.jones@linaro.org
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sungwoo Kim <iam@sung-woo.kim>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2022-10-21 12:39:11 +02:00

..

bnep

bluetooth: Use netif_rx().

2022-03-07 11:40:41 +00:00

cmtp

Merge branch 'signal-for-v5.17' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace

2022-01-17 05:49:30 +02:00

hidp

Bluetooth: move from strlcpy with unused retval to strscpy

2022-08-25 16:26:18 -07:00

rfcomm

Bluetooth: RFCOMM: Fix possible deadlock on socket shutdown/release

2022-10-21 12:38:10 +02:00

6lowpan.c

bluetooth: Use netif_rx().

2022-03-07 11:40:41 +00:00

a2mp.c

…

a2mp.h

…

af_bluetooth.c

Bluetooth: Add BTPROTO_ISO socket type

2022-07-22 17:13:39 -07:00

amp.c

…

amp.h

…

aosp.c

Bluetooth: Fix null pointer deref on unexpected status event

2022-08-08 17:04:37 -07:00

aosp.h

Bluetooth: aosp: Support AOSP Bluetooth Quality Report

2021-11-02 19:37:52 +01:00

ecdh_helper.c

…

ecdh_helper.h

…

eir.c

Bluetooth: Add initial implementation of BIS connections

2022-07-22 17:13:56 -07:00

eir.h

Bluetooth: Add initial implementation of BIS connections

2022-07-22 17:13:56 -07:00

hci_codec.c

…

hci_codec.h

…

hci_conn.c

Bluetooth: hci_conn: Fix updating ISO QoS PHY

2022-08-08 17:04:11 -07:00

hci_core.c

Bluetooth: Prevent double register of suspend

2022-10-21 12:38:18 +02:00

hci_debugfs.c

…

hci_debugfs.h

…

hci_event.c

Bluetooth: hci_event: Make sure ISO events don't affect non-ISO connections

2022-10-21 12:39:09 +02:00

hci_request.c

Bluetooth: Add initial implementation of BIS connections

2022-07-22 17:13:56 -07:00

hci_request.h

Bluetooth: Add initial implementation of BIS connections

2022-07-22 17:13:56 -07:00

hci_sock.c

Bluetooth: Prevent double register of suspend

2022-10-21 12:38:18 +02:00

hci_sync.c

Bluetooth: hci_sync: Fix not indicating power state

2022-10-21 12:38:19 +02:00

hci_sysfs.c

Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times

2022-10-21 12:39:09 +02:00

iso.c

Bluetooth: ISO: Fix not handling shutdown condition

2022-08-25 16:26:17 -07:00

Kconfig

Bluetooth: Add initial implementation of CIS connections

2022-07-22 17:13:22 -07:00

l2cap_core.c

Bluetooth: L2CAP: Fix user-after-free

2022-10-21 12:39:11 +02:00

l2cap_sock.c

Bluetooth: L2CAP: uninitialized variables in l2cap_sock_setsockopt()

2022-01-07 08:40:11 +01:00

leds.c

…

leds.h

…

lib.c

Bluetooth: Add bt_status

2022-07-21 17:15:31 -07:00

Makefile

Bluetooth: Add BTPROTO_ISO socket type

2022-07-22 17:13:39 -07:00

mgmt_config.c

…

mgmt_config.h

…

mgmt_util.c

Bluetooth: Keep MGMT pending queue ordered FIFO

2022-05-13 13:05:48 +02:00

mgmt_util.h

Bluetooth: mgmt: Introduce mgmt_alloc_skb and mgmt_send_event_skb

2021-12-07 17:05:52 +01:00

mgmt.c

Bluetooth: avoid hci_dev_test_and_set_flag() in mgmt_init_hdev()

2022-10-21 12:38:08 +02:00

msft.c

Bluetooth: Fix null pointer deref on unexpected status event

2022-08-08 17:04:37 -07:00

msft.h

Bluetooth: hci_sync: Refactor remove Adv Monitor

2022-07-21 17:14:55 -07:00

sco.c

Bluetooth: HCI: Add HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN quirk

2022-05-13 13:05:48 +02:00

selftest.c

…

selftest.h

…

smp.c

…

smp.h

…