kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers/bluetooth
History
Raphael Pinsonneault-Thibeault 7a6d1e7402 Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF 
[ Upstream commit 23d22f2f71 ]

There is a KASAN: slab-use-after-free read in btusb_disconnect().
Calling "usb_driver_release_interface(&btusb_driver, data->intf)" will
free the btusb data associated with the interface. The same data is
then used later in the function, hence the UAF.

Fix by moving the accesses to btusb data to before the data is free'd.

Reported-by: syzbot+2fc81b50a4f8263a159b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2fc81b50a4f8263a159b
Tested-by: syzbot+2fc81b50a4f8263a159b@syzkaller.appspotmail.com
Fixes: fd913ef7ce ("Bluetooth: btusb: Add out-of-band wakeup support")
Signed-off-by: Raphael Pinsonneault-Thibeault <rpthibeault@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2025-12-07 06:09:27 +09:00
..
ath3k.c Bluetooth: ath3k: Fix multiple issues reported by checkpatch.pl 2024-07-05 09:14:26 +02:00
bcm203x.c Bluetooth: Use fallthrough pseudo-keyword 2020-07-10 19:09:42 +02:00
bfusb.c Bluetooth: bfusb: fix division by zero in send path 2022-01-16 09:12:43 +01:00
bluecard_cs.c Bluetooth: Use fallthrough pseudo-keyword 2020-07-10 19:09:42 +02:00
bpa10x.c Bluetooth: bpa10x: change return value 2019-09-04 16:11:46 +02:00
bt3c_cs.c Bluetooth: bt3c_cs: Fix obsolete function 2018-09-27 12:57:39 +02:00
btbcm.c Bluetooth: hci_bcm: Fall back to getting bdaddr from EFI if not set 2023-05-24 17:36:46 +01:00
btbcm.h Bluetooth: btbcm: Make btbcm_setup_patchram use btbcm_finalize 2020-04-22 19:43:58 +02:00
btintel.c Bluetooth: btintel: Fixe build regression 2024-04-13 13:01:48 +02:00
btintel.h Bluetooth: btintel: Fix WBS setting for Intel legacy ROM products 2022-04-08 14:23:24 +02:00
btmrvl_debugfs.c Bluetooth: btmrvl: Re-use kstrtol_from_user() 2018-05-30 08:16:05 +02:00
btmrvl_drv.h Bluetooth: btmrvl: Drop unused GPIO includes 2019-01-22 09:51:20 +01:00
btmrvl_main.c Bluetooth: btmrvl_sdio: Implement prevent_wake 2020-06-12 08:38:52 +02:00
btmrvl_sdio.c Bluetooth: btmrvl: Use IRQF_NO_AUTOEN flag in request_irq() 2024-10-17 15:11:20 +02:00
btmrvl_sdio.h btmrvl: add platform specific wakeup interrupt support 2016-05-02 19:26:15 +02:00
btmtksdio.c Bluetooth: btmtksdio: fix use-after-free at btmtksdio_recv_event 2022-07-12 16:35:08 +02:00
btmtkuart.c Bluetooth: btmtkuart: fix recv_buf() return value 2024-01-25 14:52:40 -08:00
btqca.c Bluetooth: qca: fix info leak when fetching board id 2024-07-05 09:14:24 +02:00
btqca.h Bluetooth: qca: fix info leak when fetching fw build id 2024-07-05 09:14:11 +02:00
btqcomsmd.c Bluetooth: btqcomsmd: Fix command timeout after setting BD address 2023-03-30 12:47:50 +02:00
btrsi.c Bluetooth: btrsi: use non-kernel-doc comment for copyright 2021-07-22 16:35:46 +02:00
btrtl.c Bluetooth: btrtl: Prevent potential NULL dereference 2025-05-02 07:44:09 +02:00
btrtl.h Bluetooth: hci_h5: Add RTL8822CS capabilities 2021-06-26 07:12:34 +02:00
btsdio.c Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition 2023-09-06 21:28:39 +01:00
btusb.c Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF 2025-12-07 06:09:27 +09:00
dtl1_cs.c networking: add and use skb_put_u8() 2017-06-16 11:48:40 -04:00
h4_recv.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
hci_ag6xx.c Bluetooth: hci_uart: Remove redundant assignment to fw_ptr 2021-06-26 07:52:41 +02:00
hci_ath.c Bluetooth: hci_uart: check for missing tty operations 2019-07-31 13:17:33 -07:00
hci_bcm.c Bluetooth: hci_bcm: Add DT compatible for CYW55572 2022-08-11 13:07:52 +02:00
hci_bcsp.c Bluetooth: bcsp: receive data only if registered 2025-12-07 06:09:24 +09:00
hci_h4.c Bluetooth: hci_h4: Remove a redundant assignment in 'h4_flush()' 2020-02-28 08:43:57 +01:00
hci_h5.c Bluetooth: hci_h5: don't call kfree_skb() under spin_lock_irqsave() 2022-12-31 13:14:20 +01:00
hci_intel.c Bluetooth: hci_intel: Add check for platform_driver_register 2022-08-17 14:23:34 +02:00
hci_ldisc.c Bluetooth: hci_uart: Fix another race during initialization 2025-05-02 07:44:07 +02:00
hci_ll.c Bluetooth: hci_ll: don't call kfree_skb() under spin_lock_irqsave() 2022-12-31 13:14:20 +01:00
hci_mrvl.c Bluetooth: hci_uart: check for missing tty operations 2019-07-31 13:17:33 -07:00
hci_nokia.c Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe() 2023-09-19 12:22:33 +02:00
hci_qca.c Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot 2024-07-18 13:07:33 +02:00
hci_serdev.c Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure 2022-10-26 12:34:44 +02:00
hci_uart.h Bluetooth: hci_uart: Fix another race during initialization 2025-05-02 07:44:07 +02:00
hci_vhci.c Bluetooth: vhci: Fix race when opening vhci device 2023-10-25 11:58:55 +02:00
Kconfig Bluetooth: Add support for virtio transport driver 2021-04-08 12:26:34 +02:00
Makefile Bluetooth: Add support for virtio transport driver 2021-04-08 12:26:34 +02:00
virtio_bt.c Bluetooth: virtio_bt: Use skb_put to set length 2022-11-10 18:15:30 +01:00