kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/net
History
Shuvam Pandey d28311539a Bluetooth: hci_event: fix potential UAF in SSP passkey handlers 
[ Upstream commit 85fa351204 ]

hci_conn lookup and field access must be covered by hdev lock in
hci_user_passkey_notify_evt() and hci_keypress_notify_evt(), otherwise
the connection can be freed concurrently.

Extend the hci_dev_lock critical section to cover all conn usage in both
handlers.

Keep the existing keypress notification behavior unchanged by routing
the early exits through a common unlock path.

Fixes: 92a25256f1 ("Bluetooth: mgmt: Implement support for passkey notification")
Cc: stable@vger.kernel.org
Signed-off-by: Shuvam Pandey <shuvampandey1@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-06-19 13:33:42 +02:00
..
6lowpan 6lowpan: fix off-by-one in multicast context address compression 2026-06-19 13:33:33 +02:00
9p net/9p: fix double req put in p9_fd_cancelled 2025-10-19 16:21:28 +02:00
802 net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr 2026-06-19 13:33:34 +02:00
8021q net: vlan: sync VLAN features with lower device 2025-12-07 06:09:26 +09:00
appletalk net: appletalk: Fix use-after-free in AARP proxy probe 2025-08-28 16:24:04 +02:00
atm atm: lec: fix use-after-free in sock_def_readable() 2026-04-18 10:33:29 +02:00
ax25 ax25: properly unshare skbs in ax25_kiss_rcv() 2025-09-09 18:50:20 +02:00
batman-adv batman-adv: bla: avoid double decrement of bla.num_requests 2026-06-19 13:33:25 +02:00
bluetooth Bluetooth: hci_event: fix potential UAF in SSP passkey handlers 2026-06-19 13:33:42 +02:00
bpf bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb 2026-06-01 17:35:29 +02:00
bpfilter bpfilter: Specify the log level for the kmsg message 2021-06-25 13:13:50 +02:00
bridge net: bridge: use a stable FDB dst snapshot in RCU readers 2026-06-19 13:33:41 +02:00
caif net: caif: clear client service pointer on teardown 2026-06-01 17:35:14 +02:00
can can: raw: fix ro->uniq use-after-free in raw_rcv() 2026-06-01 17:35:04 +02:00
ceph libceph: handle rbtree insertion error in decode_choose_args() 2026-06-01 17:35:45 +02:00
core net: guard timestamp cmsgs to real error queue skbs 2026-06-19 13:33:35 +02:00
dcb net: dcb: choose correct policy to parse DCB_ATTR_BCN 2023-08-11 15:13:53 +02:00
dccp net: fix data-races around sk->sk_forward_alloc 2025-01-23 17:16:04 +01:00
dns_resolver keys, dns: Fix size check of V1 server-list header 2024-01-25 14:52:46 -08:00
dsa net: dsa: free routing table on probe failure 2026-02-19 16:21:45 +01:00
ethernet gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers 2024-09-12 11:07:47 +02:00
ethtool ethtool: eeprom: add more safeties to EEPROM Netlink fallback 2026-06-19 13:33:24 +02:00
hsr net: hsr: fix VLAN add unwind on slave errors 2026-04-18 10:33:31 +02:00
ieee802154 ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() 2026-06-19 13:33:34 +02:00
ife net: sched: ife: fix potential use-after-free 2024-01-05 15:13:29 +01:00
ipv4 net/tcp-md5: Fix MAC comparison to be constant-time 2026-06-19 13:33:39 +02:00
ipv6 net/tcp-md5: Fix MAC comparison to be constant-time 2026-06-19 13:33:39 +02:00
iucv net/iucv: fix locking in .getsockopt 2026-06-19 13:33:23 +02:00
kcm kcm: Serialise kcm_sendmsg() for the same socket. 2024-09-04 13:23:32 +02:00
key xfrm: route MIGRATE notifications to caller's netns 2026-06-19 13:33:28 +02:00
l2tp l2tp: Drop large packets with UDP encap 2026-06-01 17:35:03 +02:00
l3mdev net: Add l3mdev index to flow struct and avoid oif reset for port devices 2024-10-17 15:11:57 +02:00
lapb net: lapb: Use list_for_each_entry() to simplify code in lapb_iface.c 2021-06-08 16:31:25 -07:00
llc llc: fix data loss when reading from a socket in llc_ui_recvmsg() 2025-06-04 14:38:06 +02:00
mac80211 wifi: mac80211: check tdls flag in ieee80211_tdls_oper 2026-06-01 17:35:45 +02:00
mac802154 mac802154: check local interfaces before deleting sdata list 2025-01-23 17:16:00 +01:00
mctp net: mctp: fix don't require received header reserved bits to be zero 2026-06-19 13:33:41 +02:00
mpls mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). 2025-06-27 11:05:36 +01:00
mptcp mptcp: sockopt: check timestamping ret value 2026-06-19 13:33:37 +02:00
ncsi net: ncsi: fix skb leak in error paths 2026-04-18 10:33:15 +02:00
netfilter netfilter: nft_tunnel: fix use-after-free on object destroy 2026-06-19 13:33:36 +02:00
netlabel netlabel: validate unlabeled address and mask attribute lengths 2026-06-19 13:33:35 +02:00
netlink net: netlink: don't set nsid on local notifications 2026-06-19 13:33:23 +02:00
netrom netrom: fix double-free in nr_route_frame() 2026-02-06 16:41:58 +01:00
nfc nfc: hci: fix out-of-bounds read in HCP header parsing 2026-06-19 13:33:28 +02:00
nsh nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). 2024-05-17 11:50:48 +02:00
openvswitch net: openvswitch: fix possible kfree_skb of ERR_PTR 2026-06-19 13:33:35 +02:00
packet net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() 2026-06-19 13:33:40 +02:00
phonet phonet/pep: disable BH around forwarded sk_receive_skb() 2026-06-01 17:35:46 +02:00
psample psample: Require 'CAP_NET_ADMIN' when joining "packets" group 2023-12-13 18:36:37 +01:00
qrtr net: qrtr: ns: Limit the total number of nodes 2026-06-19 13:33:41 +02:00
rds net: rds: clear i_sends on setup unwind 2026-06-19 13:33:38 +02:00
rfkill net: rfkill: prevent unlimited numbers of rfkill events from being created 2026-04-18 10:33:38 +02:00
rose net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect 2026-04-18 10:33:20 +02:00
rxrpc rxrpc: Fix missing validation of ticket length in non-XDR key preparsing 2026-06-01 17:35:12 +02:00
sched net/sched: act_api: use RCU with deferred freeing for action lifecycle 2026-06-19 13:33:33 +02:00
sctp sctp: stream: fully roll back denied add-stream state 2026-06-19 13:33:38 +02:00
smc net/smc: Do not re-initialize smc hashtables 2026-06-19 13:33:23 +02:00
strparser net: strparser: fix skb_head leak in strp_abort_strp() 2026-06-01 17:35:14 +02:00
sunrpc SUNRPC: Do not dereference non-socket transports in sysfs 2026-06-01 17:35:44 +02:00
switchdev net: make switchdev_bridge_port_{,unoffload} loosely coupled with the bridge 2021-08-04 12:35:07 +01:00
tipc tipc: fix double-free in tipc_buf_append() 2026-06-01 17:35:40 +02:00
tls net: tls: prevent chain-after-chain in plain text SG 2026-06-01 17:35:50 +02:00
unix af_unix: read UNIX_DIAG_VFS data under unix_state_lock 2026-06-01 17:35:03 +02:00
vmw_vsock vsock/vmci: fix sk_ack_backlog leak on failed handshake 2026-06-19 13:33:37 +02:00
wireless wifi: cfg80211: advance loop vars in cfg80211_merge_profile() 2026-06-01 17:35:47 +02:00
x25 net/x25: Fix overflow when accumulating packets 2026-04-18 10:33:31 +02:00
xdp xsk: tighten UMEM headroom validation to account for tailroom and min frame 2026-06-01 17:35:02 +02:00
xfrm xfrm: espintcp: do not reuse an in-progress partial send 2026-06-19 13:33:36 +02:00
compat.c net: Return the correct errno code 2021-06-03 15:13:56 -07:00
devres.c net: devres: Correct a grammatical error 2021-06-11 12:55:28 -07:00
Kconfig Remove DECnet support from kernel 2023-06-21 15:59:15 +02:00
Makefile Remove DECnet support from kernel 2023-06-21 15:59:15 +02:00
socket.c net: guard timestamp cmsgs to real error queue skbs 2026-06-19 13:33:35 +02:00
sysctl_net.c net: Ensure net namespace isolation of sysctls 2021-04-12 13:27:11 -07:00