kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-08 18:57:22 +00:00
Code Issues Releases Packages Activity
linux/net/bluetooth/bnep
History
Yousef Alhouseen bb067a99a0 Bluetooth: bnep: pin L2CAP connection during netdev registration 
bnep_add_connection() reads the L2CAP connection without holding the
channel lock, then passes its HCI device to register_netdev(). Controller
teardown can clear and release that connection concurrently, leaving the
network device registration path to dereference a freed parent device.

Take a reference to the L2CAP connection while holding the channel lock.
Retain it until register_netdev() has taken the parent device reference.

Fixes: 65f53e9802 ("Bluetooth: Access BNEP session addresses through L2CAP channel")
Reported-by: syzbot+fed5dce4553262f3b35c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=fed5dce4553262f3b35c
Cc: stable@vger.kernel.org
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
History 2026-07-06 10:46:57 -04:00
..
bnep.h Bluetooth: Replace zero-length array with flexible-array member 2020-02-28 08:30:02 +01:00
core.c Bluetooth: bnep: pin L2CAP connection during netdev registration 2026-07-06 10:46:57 -04:00
Kconfig treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
Makefile treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
netdev.c Bluetooth: Add SPDX id lines to some source files 2026-06-11 14:24:41 -04:00
sock.c Bluetooth: Add SPDX id lines to some source files 2026-06-11 14:24:41 -04:00