Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Luiz Augusto von Dentz 74a466a157 Bluetooth: SCO: Fix UAF on sco_sock_timeout ... commit 1bf4470a39 upstream. conn->sk maybe have been unlinked/freed while waiting for sco_conn_lock so this checks if the conn->sk is still valid by checking if it part of sco_sk_list. Reported-by: syzbot+4c0d0c4cde787116d465@syzkaller.appspotmail.com Tested-by: syzbot+4c0d0c4cde787116d465@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=4c0d0c4cde787116d465 Fixes: ba316be1b6 ("Bluetooth: schedule SCO timeouts with delayed_work") Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com> Signed-off-by: He Zhe <zhe.he@windriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		History 2025-05-02 07:44:25 +02:00
..
bluetooth.h	Bluetooth: SCO: Fix UAF on sco_sock_timeout	2025-05-02 07:44:25 +02:00
hci.h	Bluetooth: add quirk disabling LE Read Transmit Power	2022-01-16 09:12:44 +01:00
hci_core.h	Revert "Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE"	2024-09-12 11:07:43 +02:00
hci_mon.h	Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name	2023-10-25 11:59:04 +02:00
hci_sock.h	Bluetooth: Use only 8 bits for the HCI CMSG state flags	2020-06-12 15:10:46 +02:00
l2cap.h	Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put	2022-08-03 12:03:40 +02:00
mgmt.h	Bluetooth: use inclusive language in SMP	2021-06-26 07:12:37 +02:00
rfcomm.h	Bluetooth: Replace zero-length array with flexible-array member	2020-02-28 08:30:02 +01:00
sco.h	Bluetooth: Add support for BT_PKT_STATUS CMSG data for SCO connections	2020-06-12 15:08:49 +02:00