Ksawlii/kernel_samsung_a53x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
kernel_samsung_a53x/net
History
ZhengHan Wang b6f6a12162 Bluetooth: Fix double free in hci_conn_cleanup 
[ Upstream commit a85fb91e3d728bdfc80833167e8162cce8bc7004 ]

syzbot reports a slab use-after-free in hci_conn_hash_flush [1].
After releasing an object using hci_conn_del_sysfs in the
hci_conn_cleanup function, releasing the same object again
using the hci_dev_put and hci_conn_put functions causes a double free.
Here's a simplified flow:

hci_conn_del_sysfs:
  hci_dev_put
    put_device
      kobject_put
        kref_put
          kobject_release
            kobject_cleanup
              kfree_const
                kfree(name)

hci_dev_put:
  ...
    kfree(name)

hci_conn_put:
  put_device
    ...
      kfree(name)

This patch drop the hci_dev_put and hci_conn_put function
call in hci_conn_cleanup function, because the object is
freed in hci_conn_del_sysfs function.

This patch also fixes the refcounting in hci_conn_add_sysfs() and
hci_conn_del_sysfs() to take into account device_add() failures.

This fixes CVE-2023-28464.

Link: https://syzkaller.appspot.com/bug?id=1bb51491ca5df96a5f724899d1dbb87afda61419 [1]

Signed-off-by: ZhengHan Wang <wzhmmmmm@gmail.com>
Co-developed-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-11-18 11:43:12 +01:00
..
6lowpan Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
9p Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
802 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
8021q Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
appletalk Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
atm Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ax25 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
batman-adv Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
bluetooth Bluetooth: Fix double free in hci_conn_cleanup 2024-11-18 11:43:12 +01:00
bpf Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
bpfilter Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
bridge Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
caif Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
can can: isotp: isotp_sendmsg(): fix TX state detection and wait behavior 2024-11-18 10:58:47 +01:00
ceph libceph: use kernel_connect() 2024-11-08 11:25:50 +01:00
core net: annotate data-races around sk->sk_dst_pending_confirm 2024-11-18 11:43:12 +01:00
dcb Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dccp dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses. 2024-11-18 11:43:07 +01:00
decnet Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dns_resolver Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dsa Backport mac80211 patches from linux-6.1.y 2024-06-15 16:29:20 -03:00
ethernet Backport mac80211 patches from linux-6.1.y 2024-06-15 16:29:20 -03:00
ethtool Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hsr hsr: Prevent use after free in prp_create_tagged_frame() 2024-11-18 11:43:07 +01:00
ieee802154 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ife Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ipv4 net: annotate data-races around sk->sk_dst_pending_confirm 2024-11-18 11:43:12 +01:00
ipv6 dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses. 2024-11-18 11:43:07 +01:00
iucv Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kcm Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
key Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
l2tp Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
l3mdev Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
lapb Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
llc llc: verify mac len before reading mac header 2024-11-18 11:43:07 +01:00
mac80211 wifi: mac80211: don't return unset power in ieee80211_get_tx_power() 2024-11-18 11:43:12 +01:00
mac802154 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mpls Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mptcp Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ncm Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ncsi Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
netfilter netfilter: nat: fix ipv6 nat redirect with mapped and scoped addresses 2024-11-18 11:43:11 +01:00
netlabel Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
netlink Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
netrom Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
nfc nfc: nci: fix possible NULL pointer dereference in send_acknowledge() 2024-11-08 11:26:08 +01:00
nsh Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
openvswitch Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
packet Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
phonet Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
psample Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
qrtr Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
rds net: prevent address rewrite in kernel_bind() 2024-11-08 11:25:44 +01:00
rfkill net: rfkill: gpio: prevent value glitch during probe 2024-11-08 11:26:10 +01:00
rose Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
rxrpc Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sched net: sched: cls_u32: Fix allocation size in u32_init() 2024-11-18 10:58:46 +01:00
sctp Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
skb_tracer Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
smc net/smc: put sk reference if close work was canceled 2024-11-18 11:43:08 +01:00
strparser Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sunrpc Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
switchdev Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tipc tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING 2024-11-18 11:43:07 +01:00
tls Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
unix Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
vmw_vsock Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
wimax Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
wireless wifi: cfg80211: avoid leaking stack data into trace 2024-11-08 11:26:17 +01:00
x25 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
xdp Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
xfrm Revert "xfrm: fix a data-race in xfrm_gen_index()" 2024-11-17 19:38:56 +01:00
compat.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
devres.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Kconfig Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Makefile Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
socket.c net: prevent address rewrite in kernel_bind() 2024-11-08 11:25:44 +01:00
sysctl_net.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
TEST_MAPPING Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00