kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/include/net/bluetooth
History
Jiexun Wang 41c8c1c792 Bluetooth: serialize accept_q access 
[ Upstream commit e83f5e24da ]

bt_sock_poll() walks the accept queue without synchronization, while
child teardown can unlink the same socket and drop its last reference.
The unsynchronized accept queue walk has existed since the initial
Bluetooth import.

Protect accept_q with a dedicated lock for queue updates and polling.
Also rework bt_accept_dequeue() to take temporary child references under
the queue lock before dropping it and locking the child socket.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reported-by: Jann Horn <jannh@google.com>
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Signed-off-by: Jiexun Wang <wangjiexun2025@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Signed-off-by: Jiexun Wang <wangjiexun2025@gmail.com>
Reviewed-by: Jann Horn <jannh@google.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-06-19 13:33:46 +02:00
..
bluetooth.h Bluetooth: serialize accept_q access 2026-06-19 13:33:46 +02:00
hci.h Bluetooth: add quirk disabling LE Read Transmit Power 2022-01-16 09:12:44 +01:00
hci_core.h Bluetooth: hci_core: Fix use-after-free in vhci_flush() 2026-06-01 17:35:09 +02:00
hci_mon.h Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name 2023-10-25 11:59:04 +02:00
hci_sock.h Bluetooth: Use only 8 bits for the HCI CMSG state flags 2020-06-12 15:10:46 +02:00
l2cap.h Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig 2026-06-19 13:33:36 +02:00
mgmt.h Bluetooth: use inclusive language in SMP 2021-06-26 07:12:37 +02:00
rfcomm.h Bluetooth: Replace zero-length array with flexible-array member 2020-02-28 08:30:02 +01:00
sco.h Bluetooth: Add support for BT_PKT_STATUS CMSG data for SCO connections 2020-06-12 15:08:49 +02:00