averello/linux-stable-mirror
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2026-08-09 06:14:34 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
5fb210754ed66ce2dbd3ccffd508df769ff0bcdc
linux-stable-mirror/include/net
T
History
Pauli VirtanenandLuiz Augusto von Dentz af24e338bf Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero 
hci_conn::iso_data is accessed and modified without lock or RCU.
This leads to a race

    [Task hdev->workqueue]                 	[Task 2]
    iso_recv                                    iso_conn_put(conn)
      conn = LOAD hcon->iso_data                  iso_conn_free(conn)
      iso_conn_hold_unless_zero(conn)               hcon->iso_data = NULL
                                                    kfree(conn)
        kref_get_unless_zero(&conn->ref) /* UAF */

and also to races in iso_conn_add() vs. iso_conn_free().

Fix by adding spinlock hci_conn::proto_lock and using it to guard
hci_conn::iso_data.

Fixes: dc26097bdb ("Bluetooth: ISO: Use kref to track lifetime of iso_conn")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-07-28 16:13:12 -04:00
..
9p
9p: Cache negative dentries for lookup performance
2026-06-21 05:22:56 +00:00
bluetooth
Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero
2026-07-28 16:13:12 -04:00
iucv
treewide: Replace kmalloc with kmalloc_obj for non-scalar types
2026-02-21 01:02:28 -08:00
libeth
libeth, idpf: use truesize as XDP RxQ info frag_size
2026-03-05 08:02:05 -08:00
mana
net: mana: Sync page pool RX frags for CPU
2026-07-09 10:36:14 +02:00
netfilter
netfilter: nf_tables: make nft_object rhltable per table
2026-07-23 17:59:30 +02:00
netns
ip6mr: Define net->ipv6.{ip6mr_notifier_ops,ipmr_seq} under CONFIG_IPV6_MROUTE.
2026-06-08 17:06:24 -07:00
nfc
nfc: nci: Fix race between rfkill and nci_unregister_device().
2026-01-28 19:32:26 -08:00
page_pool
net: make page_pool_get_stats() void
2026-05-28 18:10:03 -07:00
phonet
…
phy
net: phy: realtek: add dummy PHY driver for RTL8127ATF
2026-01-12 19:29:11 -08:00
psp
psp: add new netlink cmd for dev-assoc and dev-disassoc
2026-06-12 18:31:32 -07:00
sctp
sctp: fix auth_hmacs array size in struct sctp_cookie
2026-07-17 12:27:53 +02:00
tc_act
net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload
2026-07-06 12:52:01 +02:00
6lowpan.h
…
act_api.h
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2026-06-04 15:29:04 -07:00
addrconf.h
ipv6: mcast: Fix potential UAF in MLD delayed work
2026-07-08 14:41:01 +02:00
af_ieee802154.h
…
af_rxrpc.h
…
af_unix.h
…
af_vsock.h
vsock: introduce vsock_pending_to_accept() helper
2026-06-13 10:38:27 -07:00
ah.h
…
aligned_data.h
…
amt.h
amt: Store struct sock in struct amt_dev.
2026-05-05 17:47:05 -07:00
arp.h
…
ax25.h
net: remove ax25 and amateur radio (hamradio) subsystem
2026-04-23 10:24:02 -07:00
ax88796.h
…
bareudp.h
…
bond_3ad.h
bonding: 3ad: implement proper RCU rules for port->aggregator
2026-04-29 18:32:02 -07:00
bond_alb.h
…
bond_options.h
bonding: 3ad: add lacp_strict configuration knob
2026-06-10 07:53:26 -07:00
bonding.h
bonding: 3ad: add lacp_strict configuration knob
2026-06-10 07:53:26 -07:00
bpf_sk_storage.h
…
busy_poll.h
…
calipso.h
…
can.h
can: add CAN skb extension infrastructure
2026-02-05 11:58:39 +01:00
cfg80211-wext.h
…
cfg80211.h
wifi: cfg80211: use wiphy work for socket owner autodisconnect
2026-07-07 09:27:42 +02:00
cfg802154.h
…
checksum.h
…
cipso_ipv4.h
…
cls_cgroup.h
net/cls_cgroup: Fix task_get_classid() during qdisc run
2025-09-14 11:55:04 -07:00
codel_impl.h
codel: annotate data-races in codel_dump_stats()
2026-04-08 19:18:52 -07:00
codel_qdisc.h
…
codel.h
…
compat.h
…
datalink.h
…
dcbevent.h
…
dcbnl.h
…
devlink.h
devlink: Implement devlink param multi attribute nested data values
2026-06-13 16:16:58 -07:00
dropreason-core.h
ipv6: Implement limits on extension header parsing
2026-04-30 17:21:45 -07:00
dropreason-qdisc.h
net: sched: sch_dualpi2: use qdisc_dequeue_drop() for dequeue drops
2026-02-28 15:31:35 -08:00
dropreason.h
net: sched: introduce qdisc-specific drop reason tracing
2026-02-28 15:31:34 -08:00
dsa_stubs.h
…
dsa.h
net: dsa: add NETC switch tag support
2026-05-21 13:04:42 +02:00
dscp.h
…
dsfield.h
…
dst_cache.h
…
dst_metadata.h
net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone
2026-06-21 14:33:05 -07:00
dst_ops.h
…
dst.h
inet: add dst4_mtu() and dst6_mtu() helpers
2026-02-02 17:49:29 -08:00
eee.h
…
erspan.h
…
esp.h
…
espintcp.h
…
ethoc.h
…
failover.h
…
fib_notifier.h
…
fib_rules.h
net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().
2026-06-11 15:14:03 -07:00
firewire.h
…
flow_dissector.h
…
flow_offload.h
net: dsa: eliminate local type for tc policers
2026-02-10 15:30:11 +01:00
flow.h
…
fou.h
…
fq_impl.h
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
fq.h
…
garp.h
…
gen_stats.h
net/sched: add const qualifiers to gnet_stats helpers
2026-05-11 18:28:08 -07:00
genetlink.h
genetlink: free the skb on 'group >= family->n_mcgrps'
2026-05-08 15:43:29 -07:00
geneve.h
…
gre.h
…
gro_cells.h
…
gro.h
gro: inline tcp6_gro_complete()
2026-01-21 19:28:32 -08:00
gso.h
…
gtp.h
…
gue.h
gue: validate REMCSUM private option length
2026-07-03 09:34:53 +01:00
handshake.h
…
hotdata.h
net-sysfs: use rps_tag_ptr and remove metadata from rps_sock_flow_table
2026-03-04 16:54:09 -08:00
hwbm.h
…
icmp.h
ipv4: icmp: Pass IPv4 control block structure as an argument to __icmp_send()
2025-09-11 12:22:38 +02:00
ieee8021q.h
…
ieee80211_radiotap.h
wifi: mac80211: add RX flag to report radiotap VHT information
2025-10-30 08:38:51 +01:00
ieee802154_netdev.h
…
if_inet6.h
…
ife.h
…
inet6_connection_sock.h
tcp: move inet6_csk_update_pmtu() to tcp_ipv6.c
2026-02-24 17:47:27 -08:00
inet6_hashtables.h
tcp: Initialise ehash secrets during connect() and listen().
2026-03-05 18:50:05 -08:00
inet_common.h
net: remove addr_len argument of recvmsg() handlers
2026-03-02 18:17:17 -08:00
inet_connection_sock.h
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2026-02-26 10:23:00 -08:00
inet_dscp.h
…
inet_ecn.h
tcp: ECT_1_NEGOTIATION and NEEDS_ACCECN identifiers
2026-02-03 15:13:24 +01:00
inet_frag.h
inet: frags: flush pending skbs in fqdir_pre_exit()
2025-12-10 01:15:27 -08:00
inet_hashtables.h
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2026-03-26 12:09:57 -07:00
inet_sock.h
ipv6: colocate inet6_cork in inet_cork_full
2026-02-02 17:49:30 -08:00
inet_timewait_sock.h
tcp: Update bind bucket state on port release
2025-09-23 10:12:15 +02:00
inetpeer.h
…
ioam6.h
ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()
2026-02-13 12:24:05 -08:00
ip6_checksum.h
udp: move udp6_csum_init() back to net/ipv6/udp.c
2026-02-24 16:30:40 -08:00
ip6_fib.h
ipv6: remove ipv6_stub infrastructure completely
2026-03-29 11:21:24 -07:00
ip6_route.h
ipv6: prepare headers for ipv6_stub removal
2026-03-29 11:21:23 -07:00
ip6_tunnel.h
net: dropreason: add SKB_DROP_REASON_RECURSION_LIMIT
2026-03-14 08:38:06 -07:00
ip_fib.h
ipv4: fib: Don't ignore error route in local/main tables.
2026-06-22 18:37:36 -07:00
ip_tunnels.h
net: increase IP_TUNNEL_RECURSION_LIMIT to 5
2026-04-03 15:52:10 -07:00
ip_vs.h
ipvs: do not mangle ICMP replies for non-first fragments
2026-07-23 18:08:22 +02:00
ip.h
net: remove EXPORT_IPV6_MOD() and EXPORT_IPV6_MOD_GPL() macros
2026-03-29 11:21:22 -07:00
ipcomp.h
…
ipconfig.h
…
ipv6_frag.h
inet: frags: flush pending skbs in fqdir_pre_exit()
2025-12-10 01:15:27 -08:00
ipv6.h
tcp: rehash onto different local ECMP path on retransmit timeout
2026-06-15 15:57:31 -07:00
iw_handler.h
…
kcm.h
…
l3mdev.h
net: l3mdev: use skb_dst_dev_rcu() in l3mdev_l3_out()
2026-02-02 17:09:11 -08:00
lag.h
…
lapb.h
…
llc_c_ac.h
llc: Add SPDX id lines to llc header files
2026-05-26 17:27:14 -07:00
llc_c_ev.h
llc: Add SPDX id lines to llc header files
2026-05-26 17:27:14 -07:00
llc_c_st.h
llc: Add SPDX id lines to llc header files
2026-05-26 17:27:14 -07:00
llc_conn.h
llc: Add SPDX id lines to llc header files
2026-05-26 17:27:14 -07:00
llc_if.h
llc: Add SPDX id lines to llc header files
2026-05-26 17:27:14 -07:00
llc_pdu.h
llc: Add SPDX id lines to llc header files
2026-05-26 17:27:14 -07:00
llc_s_ac.h
llc: Add SPDX id lines to llc header files
2026-05-26 17:27:14 -07:00
llc_s_ev.h
llc: Add SPDX id lines to llc header files
2026-05-26 17:27:14 -07:00
llc_s_st.h
llc: Add SPDX id lines to llc header files
2026-05-26 17:27:14 -07:00
llc_sap.h
llc: Add SPDX id lines to llc header files
2026-05-26 17:27:14 -07:00
llc.h
llc: Add SPDX id lines to some llc source files
2026-05-26 17:26:57 -07:00
lwtunnel.h
…
mac80211.h
wifi: mac80211: Add 802.3 multicast encapsulation offload support
2026-06-05 16:12:26 +02:00
mac802154.h
…
macsec.h
macsec: use rcu_work to defer TX SA crypto cleanup out of softirq
2026-05-13 19:03:05 -07:00
mctp.h
net: mctp: fix don't require received header reserved bits to be zero
2026-04-20 11:46:57 -07:00
mctpdevice.h
…
mip6.h
…
mld.h
ipv6: mld: encode multicast exponential fields
2026-05-04 19:09:41 -07:00
mpls_iptunnel.h
…
mpls.h
…
mptcp.h
tcp: allow mptcp to drop TS for some packets
2026-06-11 15:33:37 -07:00
mrp.h
…
ncsi.h
net: ncsi: Set ncsi_stop_dev() to inline while NET_NCSI not enabled
2026-06-09 17:18:51 -07:00
ndisc.h
ipv6: remove ipv6_stub infrastructure completely
2026-03-29 11:21:24 -07:00
neighbour_tables.h
…
neighbour.h
netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge()
2026-05-16 13:22:50 +02:00
net_debug.h
…
net_failover.h
…
net_namespace.h
kernfs: pass struct ns_common instead of const void * for namespace tags
2026-04-09 14:36:52 +02:00
net_ratelimit.h
…
net_shaper.h
net: shaper: rework the VALID marking (again)
2026-05-20 16:34:20 -07:00
net_trackers.h
…
netdev_lock.h
net: ethtool: make dev->hwprov ops-protected
2026-06-09 10:13:04 -07:00
netdev_netlink.h
…
netdev_queues.h
net: Proxy netdev_queue_get_dma_dev for leased queues
2026-04-09 18:21:46 -07:00
netdev_rx_queue.h
net: remove the netif_get_rx_queue_lease_locked() helpers
2026-04-09 18:26:28 -07:00
netevent.h
…
netkit.h
…
netlabel.h
…
netlink.h
netlink: add one debug check in nla_nest_end()
2026-05-14 16:49:26 -07:00
netmem.h
Revert "mm: introduce a new page type for page pool in page type"
2026-05-21 19:06:13 -07:00
netprio_cgroup.h
…
nexthop.h
…
nl802154.h
nl802154: fix some kernel-doc warnings
2025-10-20 17:13:40 -07:00
nsh.h
net: nsh: fix incorrect header length macros
2026-05-08 15:32:59 -07:00
pfcp.h
…
pie.h
net/sched: sch_pie: annotate data-races in pie_dump_stats()
2026-04-22 21:12:47 -07:00
ping.h
net: remove addr_len argument of recvmsg() handlers
2026-03-02 18:17:17 -08:00
pkt_cls.h
net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains
2026-07-20 18:16:43 -07:00
pkt_sched.h
net/sched: don't use dynamic lockdep keys with clsact/ingress/noqueue
2026-02-05 09:32:45 -08:00
pptp.h
…
proto_memory.h
net: Allow opt-out from global protocol memory accounting.
2025-10-16 12:04:47 -07:00
protocol.h
…
psample.h
…
psnap.h
…
psp.h
psp: base PSP device support
2025-09-18 12:32:06 +02:00
raw.h
net: use NUMA drop counters for softnet_data.dropped
2025-09-14 11:35:17 -07:00
rawv6.h
…
red.h
…
regulatory.h
…
request_sock.h
tcp: move __reqsk_free() out of line
2026-02-05 09:23:06 -08:00
rose.h
net: remove ax25 and amateur radio (hamradio) subsystem
2026-04-23 10:24:02 -07:00
route.h
…
rpl.h
…
rps-types.h
net: add rps_tag_ptr type and helpers
2026-03-04 16:54:09 -08:00
rps.h
net-sysfs: use rps_tag_ptr and remove metadata from rps_dev_flow_table
2026-03-04 16:54:10 -08:00
rsi_91x.h
…
rstreason.h
…
rtnetlink.h
net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
2026-06-17 16:01:52 -07:00
rtnh.h
…
sch_generic.h
net/sched: Update function name in TCQ_F_NOPARENT comment
2026-06-09 12:08:31 +02:00
sch_priv.h
net/sched: Export mq functions for reuse
2026-01-13 11:54:29 +01:00
scm.h
…
secure_seq.h
tcp: secure_seq: add back ports to TS offset
2026-03-04 17:44:35 -08:00
seg6_hmac.h
…
seg6_local.h
…
seg6.h
…
selftests.h
net: selftests: export packet creation helpers for driver use
2025-11-06 13:38:11 +01:00
slhc_vj.h
…
smc.h
smc: Use flexible array for SMCD connections
2026-05-20 17:13:18 -07:00
snmp.h
…
sock_reuseport.h
…
sock.h
tcp: rehash onto different local ECMP path on retransmit timeout
2026-06-15 15:57:31 -07:00
stp.h
…
strparser.h
…
switchdev.h
bridge: No DEV_PATH_BR_VLAN_UNTAG_HW for dsa foreign
2026-03-19 13:14:00 +01:00
tc_wrapper.h
net/sched: refine indirect call mitigation in tc_wrapper.h
2026-03-09 19:31:41 -07:00
tcp_ao.h
tcp: restore RCU grace period in tcp_ao_destroy_sock
2026-06-29 18:14:30 -07:00
tcp_ecn.h
tcp: annotate data-races around tp->delivered and tp->delivered_ce
2026-04-18 11:10:12 -07:00
tcp_states.h
…
tcp.h
tcp: challenge ACK for non-exact RST in SYN-RECEIVED
2026-07-23 08:27:22 -07:00
tcx.h
…
timewait_sock.h
…
tipc.h
…
tls_prot.h
…
tls.h
tls: remove tls_toe and the related driver
2026-06-12 16:43:10 -07:00
transp_v6.h
ipv6: Retire UDP-Lite.
2026-03-13 18:57:44 -07:00
tso.h
net: tso: Introduce tso_dma_map and helpers
2026-04-12 10:54:31 -07:00
tun_proto.h
…
udp_tunnel.h
udp_tunnel: Pass struct sock to udp_tunnel_notify_{add,del}_rx_port().
2026-05-05 17:47:04 -07:00
udp.h
udp: Don't pass udptable to IPv4 socket lookup functions.
2026-03-13 18:57:46 -07:00
vsock_addr.h
net: Convert proto_ops connect() callbacks to use sockaddr_unsized
2025-11-04 19:10:32 -08:00
vxlan.h
vxlan: Free vxlan_sock with kfree_rcu().
2026-05-05 17:47:05 -07:00
wext.h
…
x25.h
…
x25device.h
…
xdp_priv.h
…
xdp_sock_drv.h
xsk: respect tailroom for ZC setups
2026-04-06 18:43:51 -07:00
xdp_sock.h
xsk: drain continuation descs after overflow in xsk_build_skb()
2026-07-24 15:12:14 -07:00
xdp.h
Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next
2025-09-24 10:22:37 -07:00
xfrm.h
xfrm: cache the offload ifindex for netlink dumps
2026-07-02 09:12:58 +02:00
xsk_buff_pool.h
xsk: reclaim invalid Tx descriptors in ZC batch path
2026-07-24 15:12:14 -07:00