Ksawlii/kernel_samsung_a53x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
kernel_samsung_a53x/net/bluetooth
History
Hyunwoo Kim f4f207995f Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg 
[ Upstream commit 2e07e8348ea454615e268222ae3fc240421be768 ]

This can cause a race with bt_sock_ioctl() because
bt_sock_recvmsg() gets the skb from sk->sk_receive_queue
and then frees it without holding lock_sock.
A use-after-free for a skb occurs with the following flow.
```
bt_sock_recvmsg() -> skb_recv_datagram() -> skb_free_datagram()
bt_sock_ioctl() -> skb_peek()
```
Add lock_sock to bt_sock_recvmsg() to fix this issue.

Cc: stable@vger.kernel.org
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Hyunwoo Kim <v4bel@theori.io>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-11-18 12:12:02 +01:00
..
bnep Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cmtp Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hidp Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
rfcomm Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
6lowpan.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
a2mp.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
a2mp.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
af_bluetooth.c Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg 2024-11-18 12:12:02 +01:00
amp.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
amp.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ecdh_helper.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ecdh_helper.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hci_conn.c Bluetooth: Fix double free in hci_conn_cleanup 2024-11-18 11:43:12 +01:00
hci_core.c Bluetooth: hci_core: Fix build warnings 2024-11-08 11:26:16 +01:00
hci_debugfs.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hci_debugfs.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hci_event.c Bluetooth: hci_event: Fix not checking if HCI_OP_INQUIRY has been sent 2024-11-18 12:12:00 +01:00
hci_request.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hci_request.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hci_sock.c Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name 2024-11-08 11:26:20 +01:00
hci_sysfs.c Bluetooth: Fix double free in hci_conn_cleanup 2024-11-18 11:43:12 +01:00
Kconfig Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
l2cap_core.c Bluetooth: L2CAP: Send reject on command corrupted request 2024-11-18 12:12:01 +01:00
l2cap_sock.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
leds.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
leds.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
lib.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Makefile Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mgmt.c Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE 2024-11-18 12:12:02 +01:00
mgmt_config.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mgmt_config.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mgmt_util.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mgmt_util.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
msft.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
msft.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sco.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
selftest.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
selftest.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
smp.c Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE 2024-11-18 12:12:02 +01:00
smp.h Bluetooth: use inclusive language in SMP 2024-11-18 12:12:01 +01:00