Luiz Augusto von Dentz 876ac72d53 Bluetooth: ISO: Fix UAF on iso_sock_timeout ...

[ Upstream commit 246b435ad668596aa0e2bbb9d491b6413861211a ]

conn->sk maybe have been unlinked/freed while waiting for iso_conn_lock
so this checks if the conn->sk is still valid by checking if it part of
iso_sk_list.

Fixes: ccf74f2390 ("Bluetooth: Add BTPROTO_ISO socket type")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2024-11-01 01:56:05 +01:00

..

bnep

Bluetooth: bnep: fix wild-memory-access in proto_unregister

2024-11-01 01:56:01 +01:00

cmtp

…

hidp

…

rfcomm

Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change

2024-10-17 15:22:19 +02:00

6lowpan.c

…

a2mp.c

…

a2mp.h

…

af_bluetooth.c

Bluetooth: SCO: Fix UAF on sco_sock_timeout

2024-11-01 01:56:05 +01:00

amp.c

…

amp.h

…

aosp.c

…

aosp.h

…

ecdh_helper.c

…

ecdh_helper.h

…

eir.c

Bluetooth: Fix eir name length

2024-03-26 18:20:42 -04:00

eir.h

…

hci_codec.c

…

hci_codec.h

…

hci_conn.c

Bluetooth: hci_core: Fix sending MGMT_EV_CONNECT_FAILED

2024-10-17 15:20:42 +02:00

hci_core.c

Bluetooth: Fix usage of __hci_cmd_sync_status

2024-10-17 15:22:12 +02:00

hci_debugfs.c

Bluetooth: Fix TOCTOU in HCI debugfs implementation

2024-04-10 16:28:24 +02:00

hci_debugfs.h

…

hci_event.c

Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE

2024-10-17 15:22:02 +02:00

hci_request.c

Bluetooth: Fix memory leak in hci_req_sync_complete()

2024-04-17 11:18:22 +02:00

hci_request.h

Bluetooth: Delete unused hci_req_prepare_suspend() declaration

2023-10-10 22:00:40 +02:00

hci_sock.c

Bluetooth: hci_sock: Fix not validating setsockopt user input

2024-10-17 15:21:33 +02:00

hci_sync.c

Bluetooth: hci_sync: Ignore errors from HCI_OP_REMOTE_NAME_REQ_CANCEL

2024-10-17 15:20:42 +02:00

hci_sysfs.c

Bluetooth: Fix double free in hci_conn_cleanup

2023-11-28 17:06:56 +00:00

iso.c

Bluetooth: ISO: Fix UAF on iso_sock_timeout

2024-11-01 01:56:05 +01:00

Kconfig

…

l2cap_core.c

Bluetooth: l2cap: always unlock channel in l2cap_conless_channel()

2024-08-14 13:52:44 +02:00

l2cap_sock.c

Bluetooth: L2CAP: Fix deadlock

2024-07-25 09:49:20 +02:00

leds.c

…

leds.h

…

lib.c

…

Makefile

…

mgmt_config.c

…

mgmt_config.h

…

mgmt_util.c

…

mgmt_util.h

…

mgmt.c

Bluetooth: hci_core: Fix sending MGMT_EV_CONNECT_FAILED

2024-10-17 15:20:42 +02:00

msft.c

Bluetooth: msft: fix slab-use-after-free in msft_do_close()

2024-05-17 11:56:11 +02:00

msft.h

Bluetooth: msft: fix slab-use-after-free in msft_do_close()

2024-05-17 11:56:11 +02:00

sco.c

Bluetooth: SCO: Fix UAF on sco_sock_timeout

2024-11-01 01:56:05 +01:00

selftest.c

…

selftest.h

…

smp.c

Revert "Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE"

2024-09-12 11:10:17 +02:00

smp.h

…