Luiz Augusto von Dentz 9ddda5d967 Bluetooth: SCO: Fix UAF on sco_sock_timeout ...

[ Upstream commit 1bf4470a3939c678fb822073e9ea77a0560bc6bb ]

conn->sk maybe have been unlinked/freed while waiting for sco_conn_lock
so this checks if the conn->sk is still valid by checking if it part of
sco_sk_list.

Reported-by: syzbot+4c0d0c4cde787116d465@syzkaller.appspotmail.com
Tested-by: syzbot+4c0d0c4cde787116d465@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4c0d0c4cde787116d465
Fixes: ba316be1b6 ("Bluetooth: schedule SCO timeouts with delayed_work")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2024-11-01 01:56:05 +01:00

..

9p

net/9p: add 'pooled_rbuffers' flag to struct p9_trans_module

2022-10-05 07:05:41 +09:00

bluetooth

Bluetooth: SCO: Fix UAF on sco_sock_timeout

2024-11-01 01:56:05 +01:00

caif

…

iucv

…

netfilter

netfilter: nft_set_pipapo: walk over current view on netlink dump

2024-09-30 16:23:54 +02:00

netns

xfrm: fix a data-race in xfrm_gen_index()

2023-10-25 12:03:06 +02:00

nfc

…

phonet

…

sctp

sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop

2023-03-11 13:55:26 +01:00

tc_act

net/sched: transition act_pedit to rcu and percpu stats

2023-03-11 13:55:28 +01:00

6lowpan.h

…

act_api.h

net: sched: act: move global static variable net_id to tc_action_ops

2022-09-09 08:24:41 +01:00

addrconf.h

ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr

2024-04-17 11:18:24 +02:00

af_ieee802154.h

…

af_rxrpc.h

rxrpc: Remove rxrpc_get_reply_time() which is no longer used

2022-09-01 11:44:13 +01:00

af_unix.h

af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc().

2024-05-02 16:29:27 +02:00

af_vsock.h

vsock: add API call for data ready

2022-08-23 10:43:11 +02:00

ah.h

…

amt.h

…

arp.h

neighbour: switch to standard rcu, instead of rcu_bh

2023-10-10 22:00:42 +02:00

atmclip.h

…

ax25.h

ax25: Use kernel universal linked list to implement ax25_dev_list

2024-06-12 11:03:20 +02:00

ax88796.h

…

bareudp.h

…

bond_3ad.h

net: bonding: Share lacpdu_mcast_addr definition

2022-09-16 14:34:01 +01:00

bond_alb.h

bonding (gcc13): synchronize bond_{a,t}lb_xmit() types

2023-05-11 23:03:41 +09:00

bond_options.h

…

bonding.h

bonding: fix macvlan over alb bond support

2023-08-30 16:11:04 +02:00

bpf_sk_storage.h

…

busy_poll.h

net: busy-poll: use ktime_get_ns() instead of local_clock()

2024-09-04 13:25:02 +02:00

calipso.h

…

cfg80211-wext.h

…

cfg80211.h

wifi: mac80211: add a workaround for receiving non-standard mesh A-MSDU

2024-08-29 17:30:21 +02:00

cfg802154.h

mac802154: fix llsec key resources release in mac802154_llsec_key_del

2024-04-03 15:19:31 +02:00

checksum.h

…

cipso_ipv4.h

…

cls_cgroup.h

…

codel_impl.h

…

codel_qdisc.h

…

codel.h

…

compat.h

…

datalink.h

…

dcbevent.h

…

dcbnl.h

…

devlink.h

net: devlink: add port_init/fini() helpers to allow pre-register/post-unregister functions

2022-09-30 18:17:16 -07:00

dropreason.h

net: skb: export skb drop reaons to user by TRACE_DEFINE_ENUM

2022-09-07 15:28:08 +01:00

dsa.h

net: dsa: introduce preferred_default_local_cpu_port and use on MT7530

2024-04-27 17:07:17 +02:00

dsfield.h

…

dst_cache.h

…

dst_metadata.h

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next

2022-10-03 07:52:13 +01:00

dst_ops.h

net: fix __dst_negative_advice() race

2024-06-16 13:41:40 +02:00

dst.h

net: add atomic_long_t to net_device_stats fields

2022-12-31 13:33:02 +01:00

erspan.h

…

esp.h

…

espintcp.h

…

ethoc.h

…

failover.h

…

fib_notifier.h

…

fib_rules.h

…

firewire.h

…

flow_dissector.h

flow_dissector: Add L2TPv3 dissectors

2022-09-20 09:13:38 +02:00

flow_offload.h

flow_offload: Introduce flow_match_l2tpv3

2022-09-20 09:13:38 +02:00

flow.h

inet: shrink struct flowi_common

2023-11-20 11:52:15 +01:00

fou.h

…

fq_impl.h

…

fq.h

…

garp.h

…

gen_stats.h

…

genetlink.h

genetlink: hold RCU in genlmsg_mcast()

2024-11-01 01:56:00 +01:00

geneve.h

…

gre.h

…

gro_cells.h

…

gro.h

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2022-08-25 16:07:42 -07:00

gtp.h

…

gue.h

…

hwbm.h

…

icmp.h

…

ieee80211_radiotap.h

…

ieee802154_netdev.h

net: ieee802154: return -EINVAL for unknown addr type

2022-10-07 08:42:00 +01:00

if_inet6.h

net: ipv6: support reporting otherwise unknown prefix flags in RTM_NEWPREFIX

2023-12-20 17:00:15 +01:00

ife.h

…

ila.h

…

inet6_connection_sock.h

…

inet6_hashtables.h

net: remove duplicate reuseport_lookup functions

2024-06-12 11:03:12 +02:00

inet_common.h

inet: factor out locked section of inet_accept() in a new helper

2024-06-12 11:03:53 +02:00

inet_connection_sock.h

Fix race for duplicate reqsk on identical SYN

2024-07-05 09:31:46 +02:00

inet_dscp.h

…

inet_ecn.h

…

inet_frag.h

…

inet_hashtables.h

net: remove duplicate reuseport_lookup functions

2024-06-12 11:03:12 +02:00

inet_sock.h

udp: fix busy polling

2024-01-31 16:17:04 -08:00

inet_timewait_sock.h

tcp/dccp: do not care about families in inet_twsk_purge()

2024-08-29 17:30:44 +02:00

inetpeer.h

…

ioam6.h

…

ip6_checksum.h

…

ip6_fib.h

ipv6: Remove in6addr_any alternatives.

2023-09-19 12:28:10 +02:00

ip6_route.h

ipv6: fix source address selection with route leak

2024-08-14 13:53:02 +02:00

ip6_tunnel.h

…

ip_fib.h

ipv4: Fix incorrect TOS in route get reply

2024-08-03 08:49:24 +02:00

ip_tunnels.h

geneve: Fix incorrect inner network header offset when innerprotoinherit is set

2024-06-21 14:35:51 +02:00

ip_vs.h

ipvs: Update width of source for ip_vs_sync_conn_options

2023-05-24 17:32:39 +01:00

ip.h

icmp: change the order of rate limits

2024-10-17 15:21:27 +02:00

ipcomp.h

xfrm: ipcomp: add extack to ipcomp{4,6}_init_state

2022-09-29 07:18:00 +02:00

ipconfig.h

…

ipv6_frag.h

…

ipv6_stubs.h

bpf: Derive source IP addr via bpf_*_fib_lookup()

2024-03-06 14:45:20 +00:00

ipv6.h

tcp: Fix bind() regression for v4-mapped-v6 wildcard address.

2023-09-19 12:28:10 +02:00

iw_handler.h

…

kcm.h

kcm: Serialise kcm_sendmsg() for the same socket.

2024-08-29 17:30:44 +02:00

l3mdev.h

…

lag.h

…

lapb.h

…

lib80211.h

…

llc_c_ac.h

…

llc_c_ev.h

…

llc_c_st.h

…

llc_conn.h

…

llc_if.h

…

llc_pdu.h

llc: Drop support for ETH_P_TR_802_2.

2024-01-31 16:17:04 -08:00

llc_s_ac.h

…

llc_s_ev.h

…

llc_s_st.h

…

llc_sap.h

…

llc.h

…

lwtunnel.h

lwt: Check LWTUNNEL_XMIT_CONTINUE strictly

2023-09-13 09:42:33 +02:00

mac80211.h

wifi: mac80211: don't use rate mask for offchannel TX either

2024-10-17 15:20:38 +02:00

mac802154.h

…

macsec.h

macsec: Enable devices to advertise whether they update sk_buff md_dst during offloads

2024-05-02 16:29:32 +02:00

mctp.h

mctp: Handle error of rtnl_register_module().

2024-10-17 15:22:23 +02:00

mctpdevice.h

…

mip6.h

…

mld.h

…

mpls_iptunnel.h

…

mpls.h

…

mptcp.h

mptcp: remove MPTCP 'ifdef' in TCP SYN cookies

2023-01-07 11:11:44 +01:00

mrp.h

mrp: introduce active flags to prevent UAF when applicant uninit

2022-12-31 13:33:02 +01:00

ncsi.h

…

ndisc.h

neighbour: switch to standard rcu, instead of rcu_bh

2023-10-10 22:00:42 +02:00

neighbour.h

neighbour: fix data-races around n->output

2023-10-10 22:00:42 +02:00

net_debug.h

…

net_failover.h

…

net_namespace.h

…

net_ratelimit.h

…

net_trackers.h

…

netdev_queues.h

net: provide macros for commonly copied lockless queue stop/wake code

2024-11-01 01:56:04 +01:00

netevent.h

…

netlabel.h

…

netlink.h

netlink: split up copies in the ack construction

2023-10-10 22:00:44 +02:00

netprio_cgroup.h

…

netrom.h

…

nexthop.h

ipv6: remove nexthop_fib6_nh_bh()

2023-10-10 22:00:46 +02:00

nl802154.h

net: ieee802154: Fix compilation error when CONFIG_IEEE802154_NL802154_EXPERIMENTAL is disabled

2022-09-02 19:59:08 -07:00

nsh.h

…

p8022.h

…

page_pool.h

page_pool: fix inconsistency for page_pool_ring_[un]lock()

2023-06-05 09:26:20 +02:00

pie.h

…

ping.h

net/ipv4: ping_group_range: allow GID from 2147483648 to 4294967294

2023-06-14 11:15:16 +02:00

pkt_cls.h

net: sched: cls_api: introduce tc_cls_bind_class() helper

2022-10-02 16:07:17 +01:00

pkt_sched.h

net/sched: make psched_mtu() RTNL-less safe

2023-07-23 13:49:27 +02:00

pptp.h

…

protocol.h

…

psample.h

…

psnap.h

…

raw.h

raw: Fix NULL deref in raw_get_next().

2023-04-13 16:55:23 +02:00

rawv6.h

…

red.h

treewide: use get_random_u32() when possible

2022-10-11 17:42:58 -06:00

regulatory.h

wifi: cfg80211: fix regulatory disconnect with OCB/NAN

2023-07-19 16:21:10 +02:00

request_sock.h

…

rose.h

…

route.h

net: annotate data-races around sk->sk_mark

2023-08-11 12:08:14 +02:00

rpl.h

ipv6: rpl: Fix Route of Death.

2023-06-14 11:15:20 +02:00

rsi_91x.h

…

rtnetlink.h

rtnetlink: Add bulk registration helpers for rtnetlink message handlers.

2024-10-17 15:22:23 +02:00

rtnh.h

…

sch_generic.h

net/sched: accept TCA_STAB only for root qdisc

2024-10-17 15:22:22 +02:00

scm.h

scm: fix MSG_CTRUNC setting condition for SO_PASSSEC

2023-05-11 23:03:18 +09:00

secure_seq.h

…

seg6_hmac.h

…

seg6_local.h

…

seg6.h

…

selftests.h

…

slhc_vj.h

…

smc.h

…

snmp.h

…

sock_reuseport.h

soreuseport: Fix socket selection for SO_INCOMING_CPU.

2022-12-31 13:32:04 +01:00

sock.h

net: Fix an unsafe loop on the list

2024-10-17 15:22:27 +02:00

Space.h

…

stp.h

…

strparser.h

…

switchdev.h

net: bridge: switchdev: Skip MDB replays of deferred events on offload

2024-03-01 13:26:35 +01:00

tcp_states.h

…

tcp.h

tcp: check skb is non-NULL in tcp_rto_delta_us()

2024-10-17 15:21:13 +02:00

timewait_sock.h

…

tipc.h

…

tls_toe.h

…

tls.h

tls: fix race between async notify and socket close

2024-02-23 09:12:31 +01:00

transp_v6.h

…

tso.h

…

tun_proto.h

…

udp_tunnel.h

udp: lockless UDP_ENCAP_L2TPINUDP / UDP_GRO

2024-01-10 17:10:28 +01:00

udp.h

ipv4, ipv6: Use splice_eof() to flush

2024-01-10 17:10:27 +01:00

udplite.h

tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct().

2022-10-12 17:50:37 -07:00

vsock_addr.h

…

vxlan.h

vxlan: Fix nexthop hash size

2023-08-11 12:08:17 +02:00

wext.h

…

x25.h

…

x25device.h

…

xdp_priv.h

…

xdp_sock_drv.h

xsk: Remove unused xsk_buff_discard

2022-09-30 07:55:46 -07:00

xdp_sock.h

…

xdp.h

xdp: Adjust xdp_frame layout to avoid using bitfields

2022-09-26 13:28:19 -07:00

xfrm.h

xfrm: respect ip protocols rules criteria when performing dst lookups

2024-11-01 01:56:03 +01:00

xsk_buff_pool.h

xsk: Fix unaligned descriptor validation

2023-05-11 23:03:21 +09:00