Luiz Augusto von Dentz 2a7e918e22 Bluetooth: Fix use-after-free in hci_remove_ltk/hci_remove_irk ...

commit c5d2b6fa26 upstream.

Similar to commit 0f7d9b31ce ("netfilter: nf_tables: fix use-after-free
in nft_set_catchall_destroy()"). We can not access k after kfree_rcu()
call.

Cc: stable@vger.kernel.org
Signed-off-by: Min Li <lm0963hack@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2023-06-14 11:13:06 +02:00

..

bnep

…

cmtp

…

hidp

Bluetooth: Fix race condition in hidp_session_thread

2023-04-20 12:13:52 +02:00

rfcomm

Bluetooth: Fix possible deadlock in rfcomm_sk_state_change

2023-02-01 08:27:11 +01:00

6lowpan.c

Bluetooth: 6LoWPAN: add missing hci_dev_put() in get_l2cap_conn()

2022-12-14 11:37:24 +01:00

a2mp.c

…

a2mp.h

…

af_bluetooth.c

Bluetooth: Fix not cleanup led when bt_init fails

2022-12-14 11:37:24 +01:00

amp.c

…

amp.h

…

aosp.c

…

aosp.h

…

ecdh_helper.c

…

ecdh_helper.h

…

hci_conn.c

…

hci_core.c

Bluetooth: Fix use-after-free in hci_remove_ltk/hci_remove_irk

2023-06-14 11:13:06 +02:00

hci_debugfs.c

…

hci_debugfs.h

…

hci_event.c

Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt

2023-02-06 07:59:01 +01:00

hci_request.c

Bluetooth: use hdev lock in activate_scan for hci_is_adv_monitoring

2022-06-09 10:22:58 +02:00

hci_request.h

…

hci_sock.c

bluetooth: Add cmd validity checks at the start of hci_sock_ioctl()

2023-06-05 09:21:24 +02:00

hci_sysfs.c

Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times

2022-10-26 12:35:36 +02:00

Kconfig

…

l2cap_core.c

Bluetooth: L2CAP: Add missing checks for invalid DCID

2023-06-14 11:13:02 +02:00

l2cap_sock.c

Bluetooth: L2CAP: Fix potential user-after-free

2023-03-10 09:39:15 +01:00

leds.c

…

leds.h

…

lib.c

…

Makefile

…

mgmt_config.c

…

mgmt_config.h

…

mgmt_util.c

…

mgmt_util.h

…

mgmt.c

Bluetooth: MGMT: Fix error report for ADD_EXT_ADV_PARAMS

2022-12-31 13:14:20 +01:00

msft.c

…

msft.h

…

sco.c

Bluetooth: SCO: Fix sco_send_frame returning skb->len

2022-07-29 17:25:30 +02:00

selftest.c

…

selftest.h

…

smp.c

…

smp.h

…