Raphael Pinsonneault-Thibeault 95b9b98c93 Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF ...

[ Upstream commit 23d22f2f71 ]

There is a KASAN: slab-use-after-free read in btusb_disconnect().
Calling "usb_driver_release_interface(&btusb_driver, data->intf)" will
free the btusb data associated with the interface. The same data is
then used later in the function, hence the UAF.

Fix by moving the accesses to btusb data to before the data is free'd.

Reported-by: syzbot+2fc81b50a4f8263a159b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2fc81b50a4f8263a159b
Tested-by: syzbot+2fc81b50a4f8263a159b@syzkaller.appspotmail.com
Fixes: fd913ef7ce ("Bluetooth: btusb: Add out-of-band wakeup support")
Signed-off-by: Raphael Pinsonneault-Thibeault <rpthibeault@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2025-11-24 10:35:50 +01:00

..

ath3k.c

…

bcm203x.c

…

bfusb.c

…

bluecard_cs.c

…

bpa10x.c

…

bt3c_cs.c

…

btbcm.c

…

btbcm.h

…

btintel_pcie.c

Bluetooth: btintel_pcie: Reduce driver buffer posting to prevent race condition

2025-06-19 15:32:25 +02:00

btintel_pcie.h

Bluetooth: btintel_pcie: Increase the tx and rx descriptor count

2025-06-19 15:32:24 +02:00

btintel.c

Bluetooth: btintel: Add DSBR support for BlazarIW, BlazarU and GaP

2025-10-29 14:09:00 +01:00

btintel.h

Bluetooth: btintel: Add DSBR support for BlazarIW, BlazarU and GaP

2025-10-29 14:09:00 +01:00

btmrvl_debugfs.c

…

btmrvl_drv.h

…

btmrvl_main.c

…

btmrvl_sdio.c

…

btmrvl_sdio.h

…

btmtk.c

Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown

2025-08-28 16:31:13 +02:00

btmtk.h

…

btmtksdio.c

Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset

2025-11-13 15:33:58 -05:00

btmtkuart.c

…

btnxpuart.c

Bluetooth: btnxpuart: Fix kernel panic during FW release

2025-05-22 14:29:53 +02:00

btqca.c

…

btqca.h

…

btqcomsmd.c

…

btrsi.c

…

btrtl.c

Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2()

2025-11-13 15:34:37 -05:00

btrtl.h

…

btsdio.c

…

btusb.c

Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF

2025-11-24 10:35:50 +01:00

dtl1_cs.c

…

h4_recv.h

…

hci_ag6xx.c

…

hci_aml.c

…

hci_ath.c

…

hci_bcm4377.c

…

hci_bcm.c

…

hci_bcsp.c

Bluetooth: bcsp: receive data only if registered

2025-11-13 15:34:31 -05:00

hci_h4.c

…

hci_h5.c

…

hci_intel.c

…

hci_ldisc.c

Bluetooth: hci_uart: Fix another race during initialization

2025-04-20 10:16:02 +02:00

hci_ll.c

…

hci_mrvl.c

…

hci_nokia.c

…

hci_qca.c

driver: bluetooth: hci_qca:fix unable to load the BT driver

2025-07-17 18:37:22 +02:00

hci_serdev.c

…

hci_uart.h

Bluetooth: hci_uart: Fix another race during initialization

2025-04-20 10:16:02 +02:00

hci_vhci.c

Bluetooth: vhci: Prevent use-after-free by removing debugfs files early

2025-09-09 18:58:07 +02:00

Kconfig

…

Makefile

…

virtio_bt.c

…