Hyunwoo Kim 2b16d960c7 Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg ...

[ Upstream commit 2e07e8348e ]

This can cause a race with bt_sock_ioctl() because
bt_sock_recvmsg() gets the skb from sk->sk_receive_queue
and then frees it without holding lock_sock.
A use-after-free for a skb occurs with the following flow.
```
bt_sock_recvmsg() -> skb_recv_datagram() -> skb_free_datagram()
bt_sock_ioctl() -> skb_peek()
```
Add lock_sock to bt_sock_recvmsg() to fix this issue.

Cc: stable@vger.kernel.org
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Hyunwoo Kim <v4bel@theori.io>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2024-01-05 15:13:39 +01:00

..

bnep

…

cmtp

…

hidp

Bluetooth: Fix race condition in hidp_session_thread

2023-04-20 12:13:52 +02:00

rfcomm

Bluetooth: Fix possible deadlock in rfcomm_sk_state_change

2023-02-01 08:27:11 +01:00

6lowpan.c

Bluetooth: 6LoWPAN: add missing hci_dev_put() in get_l2cap_conn()

2022-12-14 11:37:24 +01:00

a2mp.c

…

a2mp.h

…

af_bluetooth.c

Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg

2024-01-05 15:13:39 +01:00

amp.c

…

amp.h

…

aosp.c

…

aosp.h

…

ecdh_helper.c

…

ecdh_helper.h

…

hci_conn.c

Bluetooth: Fix double free in hci_conn_cleanup

2023-11-28 16:56:16 +00:00

hci_core.c

Bluetooth: hci_core: Fix build warnings

2023-10-25 11:59:00 +02:00

hci_debugfs.c

…

hci_debugfs.h

…

hci_event.c

Bluetooth: hci_event: Fix not checking if HCI_OP_INQUIRY has been sent

2024-01-05 15:13:33 +01:00

hci_request.c

…

hci_request.h

…

hci_sock.c

Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name

2023-10-25 11:59:04 +02:00

hci_sysfs.c

Bluetooth: Fix double free in hci_conn_cleanup

2023-11-28 16:56:16 +00:00

Kconfig

…

l2cap_core.c

Bluetooth: L2CAP: Send reject on command corrupted request

2024-01-05 15:13:34 +01:00

l2cap_sock.c

Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb

2023-08-11 15:13:58 +02:00

leds.c

…

leds.h

…

lib.c

…

Makefile

…

mgmt_config.c

…

mgmt_config.h

…

mgmt_util.c

…

mgmt_util.h

…

mgmt.c

Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE

2024-01-05 15:13:34 +01:00

msft.c

…

msft.h

…

sco.c

…

selftest.c

…

selftest.h

…

smp.c

Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE

2024-01-05 15:13:34 +01:00

smp.h

…