kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/net
History
Helen Koike 03d4eafb0f Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb 
[ Upstream commit b6552e0503 ]

Before using sk pointer, check if it is null.

Fix the following:

 KASAN: null-ptr-deref in range [0x0000000000000260-0x0000000000000267]
 CPU: 0 UID: 0 PID: 5985 Comm: kworker/0:5 Not tainted 7.0.0-rc4-00029-ga989fde763f4 #1 PREEMPT(full)
 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-9.fc43 06/10/2025
 Workqueue: events l2cap_info_timeout
 RIP: 0010:kasan_byte_accessible+0x12/0x30
 Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cce
 veth0_macvtap: entered promiscuous mode
 RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202
 RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001
 RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c
 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
 R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000
 R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001
 FS:  0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 00005582615a5008 CR3: 000000007007e000 CR4: 0000000000752ef0
 PKRU: 55555554
 Call Trace:
  <TASK>
  __kasan_check_byte+0x12/0x40
  lock_acquire+0x79/0x2e0
  lock_sock_nested+0x48/0x100
  ? l2cap_sock_ready_cb+0x46/0x160
  l2cap_sock_ready_cb+0x46/0x160
  l2cap_conn_start+0x779/0xff0
  ? __pfx_l2cap_conn_start+0x10/0x10
  ? l2cap_info_timeout+0x60/0xa0
  ? __pfx___mutex_lock+0x10/0x10
  l2cap_info_timeout+0x68/0xa0
  ? process_scheduled_works+0xa8d/0x18c0
  process_scheduled_works+0xb6e/0x18c0
  ? __pfx_process_scheduled_works+0x10/0x10
  ? assign_work+0x3d5/0x5e0
  worker_thread+0xa53/0xfc0
  kthread+0x388/0x470
  ? __pfx_worker_thread+0x10/0x10
  ? __pfx_kthread+0x10/0x10
  ret_from_fork+0x51e/0xb90
  ? __pfx_ret_from_fork+0x10/0x10
 veth1_macvtap: entered promiscuous mode
  ? __switch_to+0xc7d/0x1450
  ? __pfx_kthread+0x10/0x10
  ret_from_fork_asm+0x1a/0x30
  </TASK>
 Modules linked in:
 ---[ end trace 0000000000000000 ]---
 batman_adv: batadv0: Interface activated: batadv_slave_0
 batman_adv: batadv0: Interface activated: batadv_slave_1
 netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
 netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
 netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
 netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
 RIP: 0010:kasan_byte_accessible+0x12/0x30
 Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cce
 ieee80211 phy39: Selected rate control algorithm 'minstrel_ht'
 RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202
 RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001
 RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c
 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
 R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000
 R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001
 FS:  0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 00007f7e16139e9c CR3: 000000000e74e000 CR4: 0000000000752ef0
 PKRU: 55555554
 Kernel panic - not syncing: Fatal exception

Fixes: 54a59aa2b5 ("Bluetooth: Add l2cap_chan->ops->ready()")
Signed-off-by: Helen Koike <koike@igalia.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2026-04-18 10:33:24 +02:00
..
6lowpan 6lowpan: iphc: Fix an off-by-one check of array index 2021-07-22 16:19:03 +02:00
9p net/9p: fix double req put in p9_fd_cancelled 2025-10-19 16:21:28 +02:00
802 net: 802: LLC+SNAP OID:PID lookup on start of skb data 2025-01-23 17:15:49 +01:00
8021q net: vlan: sync VLAN features with lower device 2025-12-07 06:09:26 +09:00
appletalk net: appletalk: Fix use-after-free in AARP proxy probe 2025-08-28 16:24:04 +02:00
atm atm: lec: fix null-ptr-deref in lec_arp_clear_vccs 2026-04-18 10:33:10 +02:00
ax25 ax25: properly unshare skbs in ax25_kiss_rcv() 2025-09-09 18:50:20 +02:00
batman-adv batman-adv: avoid OGM aggregation when skb tailroom is insufficient 2026-04-18 10:33:19 +02:00
bluetooth Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb 2026-04-18 10:33:24 +02:00
bpf bpf: Do not let BPF test infra emit invalid GSO types to stack 2026-02-06 16:41:58 +01:00
bpfilter bpfilter: Specify the log level for the kmsg message 2021-06-25 13:13:50 +02:00
bridge net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled 2026-04-18 10:33:10 +02:00
caif caif: fix integer underflow in cffrml_receive() 2026-01-19 13:09:44 +01:00
can can: statistics: add missing atomic access in hot path 2026-04-18 10:33:24 +02:00
ceph libceph: admit message frames only in CEPH_CON_S_OPEN state 2026-04-18 10:33:14 +02:00
core net: Handle napi_schedule() calls from non-interrupt 2026-04-18 10:33:18 +02:00
dcb net: dcb: choose correct policy to parse DCB_ATTR_BCN 2023-08-11 15:13:53 +02:00
dccp net: fix data-races around sk->sk_forward_alloc 2025-01-23 17:16:04 +01:00
dns_resolver keys, dns: Fix size check of V1 server-list header 2024-01-25 14:52:46 -08:00
dsa net: dsa: free routing table on probe failure 2026-02-19 16:21:45 +01:00
ethernet gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers 2024-09-12 11:07:47 +02:00
ethtool ethtool: add support to set/get tx copybreak buf size via ethtool 2026-03-04 07:19:36 -05:00
hsr net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() 2026-01-19 13:09:46 +01:00
ieee802154 net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() 2024-12-14 19:51:37 +01:00
ife net: sched: ife: fix potential use-after-free 2024-01-05 15:13:29 +01:00
ipv4 esp: fix skb leak with espintcp and async crypto 2026-04-18 10:33:24 +02:00
ipv6 esp: fix skb leak with espintcp and async crypto 2026-04-18 10:33:24 +02:00
iucv s390/iucv: fix receive buffer virtual vs physical address confusion 2024-09-04 13:23:27 +02:00
kcm kcm: Serialise kcm_sendmsg() for the same socket. 2024-09-04 13:23:32 +02:00
key af_key: validate families in pfkey_send_migrate() 2026-04-18 10:33:24 +02:00
l2tp l2tp: do not use sock_hold() in pppol2tp_session_get_sock() 2026-04-18 10:33:17 +02:00
l3mdev net: Add l3mdev index to flow struct and avoid oif reset for port devices 2024-10-17 15:11:57 +02:00
lapb net: lapb: Use list_for_each_entry() to simplify code in lapb_iface.c 2021-06-08 16:31:25 -07:00
llc llc: fix data loss when reading from a socket in llc_ui_recvmsg() 2025-06-04 14:38:06 +02:00
mac80211 wifi: mac80211: fix NULL deref in mesh_matches_local() 2026-04-18 10:33:21 +02:00
mac802154 mac802154: check local interfaces before deleting sdata list 2025-01-23 17:16:00 +01:00
mctp net: mctp: Prevent duplicate binds 2025-08-28 16:24:20 +02:00
mpls mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). 2025-06-27 11:05:36 +01:00
mptcp mptcp: pm: avoid sending RM_ADDR over same subflow 2026-04-18 10:33:19 +02:00
ncsi net: ncsi: fix skb leak in error paths 2026-04-18 10:33:15 +02:00
netfilter netfilter: nft_set_pipapo: split gc into unlink and reclaim phase 2026-04-18 10:33:22 +02:00
netlabel calipso: unlock rcu before returning -EAFNOSUPPORT 2025-06-27 11:05:22 +01:00
netlink netlink: avoid infinite retry looping in netlink_unicast() 2025-08-28 16:24:15 +02:00
netrom netrom: fix double-free in nr_route_frame() 2026-02-06 16:41:58 +01:00
nfc nfc: rawsock: cancel tx_work before socket teardown 2026-04-18 10:33:10 +02:00
nsh nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). 2024-05-17 11:50:48 +02:00
openvswitch net: openvswitch: Avoid needlessly taking the RTNL on vport destroy 2026-01-19 13:09:56 +01:00
packet net/packet: fix a race in packet_set_ring() and packet_notifier() 2025-08-28 16:24:14 +02:00
phonet phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() 2025-08-28 16:23:59 +02:00
psample psample: Require 'CAP_NET_ADMIN' when joining "packets" group 2023-12-13 18:36:37 +01:00
qrtr net: qrtr: Update packets cloning when broadcasting 2024-10-17 15:11:08 +02:00
rds net/rds: Clear reconnect pending bit 2026-03-04 07:20:11 -05:00
rfkill net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer 2025-10-02 13:39:09 +02:00
rose net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect 2026-04-18 10:33:20 +02:00
rxrpc rxrpc: Fix oops due to non-existence of prealloc backlog struct 2025-07-17 18:30:48 +02:00
sched net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit 2026-04-18 10:33:12 +02:00
sctp sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT 2026-02-06 16:41:52 +01:00
smc net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() 2026-04-18 10:33:21 +02:00
strparser strparser: Fix signed/unsigned mismatch bug 2025-12-07 06:09:29 +09:00
sunrpc sunrpc: fix cache_request leak in cache_release 2026-04-18 10:33:17 +02:00
switchdev net: make switchdev_bridge_port_{,unoffload} loosely coupled with the bridge 2021-08-04 12:35:07 +01:00
tipc tipc: fix divide-by-zero in tipc_sk_filter_connect() 2026-04-18 10:33:14 +02:00
tls tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). 2026-02-06 16:42:01 +01:00
unix af_unix: Don't leave consecutive consumed OOB skbs. 2025-10-02 13:39:14 +02:00
vmw_vsock vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 2026-03-04 07:20:11 -05:00
wireless wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() 2026-04-18 10:33:19 +02:00
x25 net/x25: fix incorrect parameter validation in the x25_getsockopt() function 2024-03-26 18:21:23 -04:00
xdp xsk: fix OOB map writes when deleting elements 2024-12-14 19:51:33 +01:00
xfrm xfrm: Fix the usage of skb->sk 2026-04-18 10:33:24 +02:00
compat.c net: Return the correct errno code 2021-06-03 15:13:56 -07:00
devres.c net: devres: Correct a grammatical error 2021-06-11 12:55:28 -07:00
Kconfig Remove DECnet support from kernel 2023-06-21 15:59:15 +02:00
Makefile Remove DECnet support from kernel 2023-06-21 15:59:15 +02:00
socket.c net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. 2026-01-19 13:10:11 +01:00
sysctl_net.c net: Ensure net namespace isolation of sysctls 2021-04-12 13:27:11 -07:00