Luiz Augusto von Dentz 9ddda5d967 Bluetooth: SCO: Fix UAF on sco_sock_timeout ...

[ Upstream commit 1bf4470a3939c678fb822073e9ea77a0560bc6bb ]

conn->sk maybe have been unlinked/freed while waiting for sco_conn_lock
so this checks if the conn->sk is still valid by checking if it part of
sco_sk_list.

Reported-by: syzbot+4c0d0c4cde787116d465@syzkaller.appspotmail.com
Tested-by: syzbot+4c0d0c4cde787116d465@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4c0d0c4cde787116d465
Fixes: ba316be1b6 ("Bluetooth: schedule SCO timeouts with delayed_work")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2024-11-01 01:56:05 +01:00

..

bluetooth.h

Bluetooth: SCO: Fix UAF on sco_sock_timeout

2024-11-01 01:56:05 +01:00

hci_core.h

Bluetooth: hci_core: Fix sending MGMT_EV_CONNECT_FAILED

2024-10-17 15:20:42 +02:00

hci_mon.h

…

hci_sock.h

…

hci_sync.h

Bluetooth: L2CAP: Fix deadlock

2024-07-25 09:49:20 +02:00

hci.h

Bluetooth: add quirk for broken address properties

2024-04-10 16:28:24 +02:00

iso.h

…

l2cap.h

Bluetooth: compute LE flow credits based on recvbuf space

2024-06-12 11:03:20 +02:00

mgmt.h

…

rfcomm.h

…

sco.h

…