Ignat Korchagin 3945c799f1 Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() ...

bt_sock_alloc() attaches allocated sk object to the provided sock object.
If rfcomm_dlc_alloc() fails, we release the sk object, but leave the
dangling pointer in the sock object, which may cause use-after-free.

Fix this by swapping calls to bt_sock_alloc() and rfcomm_dlc_alloc().

Signed-off-by: Ignat Korchagin <ignat@cloudflare.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20241014153808.51894-4-ignat@cloudflare.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

2024-10-15 18:43:08 -07:00

..

bnep

move asm/unaligned.h to linux/unaligned.h

2024-10-02 17:23:23 -04:00

cmtp

Bluetooth: CMTP: Mark BT_CMTP as DEPRECATED

2024-09-10 13:07:08 -04:00

hidp

Bluetooth: Init sk_peer_* on bt_sock_alloc

2023-08-11 11:37:22 -07:00

rfcomm

Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc()

2024-10-15 18:43:08 -07:00

6lowpan.c

ipv6: introduce dst_rt6_info() helper

2024-04-29 13:32:01 +01:00

af_bluetooth.c

Bluetooth: af_bluetooth: Fix deadlock

2024-03-06 17:26:25 -05:00

aosp.c

Bluetooth: Fix null pointer deref on unexpected status event

2022-08-08 17:04:37 -07:00

aosp.h

Bluetooth: aosp: Support AOSP Bluetooth Quality Report

2021-11-02 19:37:52 +01:00

coredump.c

move asm/unaligned.h to linux/unaligned.h

2024-10-02 17:23:23 -04:00

ecdh_helper.c

Bluetooth: Use crypto_wait_req

2023-02-13 18:34:48 +08:00

ecdh_helper.h

Fix misc new gcc warnings

2021-04-27 17:05:53 -07:00

eir.c

Bluetooth: Fix eir name length

2024-03-08 10:22:17 -05:00

eir.h

move asm/unaligned.h to linux/unaligned.h

2024-10-02 17:23:23 -04:00

hci_codec.c

Bluetooth: Fix support for Read Local Supported Codecs V2

2022-12-02 13:09:31 -08:00

hci_codec.h

Bluetooth: Add support for Read Local Supported Codecs V2

2021-09-07 14:09:18 -07:00

hci_conn.c

Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync

2024-10-04 16:54:17 -04:00

hci_core.c

Merge tag 'net-6.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2024-10-03 09:44:00 -07:00

hci_debugfs.c

Bluetooth: Remove hci_request.{c,h}

2024-07-15 10:11:35 -04:00

hci_debugfs.h

Bluetooth: hci_core: Move all debugfs handling to hci_debugfs.c

2021-09-22 16:17:13 +02:00

hci_event.c

Merge tag 'net-6.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2024-10-03 09:44:00 -07:00

hci_sock.c

move asm/unaligned.h to linux/unaligned.h

2024-10-02 17:23:23 -04:00

hci_sync.c

Bluetooth: hci_sync: Ignore errors from HCI_OP_REMOTE_NAME_REQ_CANCEL

2024-09-10 13:07:24 -04:00

hci_sysfs.c

Bluetooth: Fix double free in hci_conn_cleanup

2023-10-23 11:05:11 -07:00

iso.c

Bluetooth: iso: remove unused struct 'iso_list_data'

2024-07-14 21:34:31 -04:00

Kconfig

Bluetooth: Remove BT_HS

2024-03-06 17:22:39 -05:00

l2cap_core.c

Bluetooth: L2CAP: Fix uaf in l2cap_connect

2024-09-27 10:52:18 -04:00

l2cap_sock.c

Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()

2024-10-15 18:43:07 -07:00

leds.c

Bluetooth: Use led_set_brightness() in LED trigger activate() callback

2024-09-10 13:06:11 -04:00

leds.h

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500

2019-06-19 17:09:55 +02:00

lib.c

Bluetooth: Add documentation to exported functions in lib

2023-12-22 12:54:55 -05:00

Makefile

Bluetooth: Remove hci_request.{c,h}

2024-07-15 10:11:35 -04:00

mgmt_config.c

Bluetooth: mgmt: Use the correct print format

2021-06-26 07:12:42 +02:00

mgmt_config.h

Bluetooth: mgmt: Add commands for runtime configuration

2020-06-18 13:11:03 +03:00

mgmt_util.c

move asm/unaligned.h to linux/unaligned.h

2024-10-02 17:23:23 -04:00

mgmt_util.h

Bluetooth: Fix a buffer overflow in mgmt_mesh_add()

2023-01-17 15:50:10 -08:00

mgmt.c

Merge tag 'net-6.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2024-10-03 09:44:00 -07:00

msft.c

Bluetooth: Remove hci_request.{c,h}

2024-07-15 10:11:35 -04:00

msft.h

Bluetooth: msft: fix slab-use-after-free in msft_do_close()

2024-05-03 13:05:28 -04:00

sco.c

Merge tag 'net-accept-more-20240515' of git://git.kernel.dk/linux

2024-05-18 10:32:39 -07:00

selftest.c

crypto: ecdh - move curve_id of ECDH from the key to algorithm name

2021-03-13 00:04:03 +11:00

selftest.h

…

smp.c

Revert "Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE"

2024-08-30 17:56:53 -04:00

smp.h

Bluetooth: use inclusive language in SMP

2021-06-26 07:12:37 +02:00