diff options
| author | Yousef Alhouseen <alhouseenyousef@gmail.com> | 2026-06-28 02:23:05 +0200 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2026-06-29 14:05:53 -0400 |
| commit | a8c481ee38196ce79853ad10759e1e9a3e7b9c96 (patch) | |
| tree | 25ab7a2fa89347f420ea39a96fd915f00467f773 /include/net/bluetooth | |
| parent | d66f0661748ef0ca2c499445f971ac721ad87e4a (diff) | |
| download | linux-next-a8c481ee38196ce79853ad10759e1e9a3e7b9c96.tar.gz linux-next-a8c481ee38196ce79853ad10759e1e9a3e7b9c96.zip | |
Bluetooth: fix UAF in bt_accept_dequeue()
bt_accept_get() takes a temporary reference before dropping the accept
queue lock. bt_accept_dequeue() currently drops that reference before
bt_accept_unlink(), leaving only the queue reference.
bt_accept_unlink() drops the queue reference. The subsequent
sock_hold() therefore accesses freed memory if it was the final
reference, as observed by KASAN during listening L2CAP socket cleanup.
Retain the temporary queue-walk reference through unlink and hand it to
the caller on success. Drop it explicitly on the closed and
not-yet-connected paths.
Fixes: ab1513597c6c ("Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()")
Reported-by: syzbot+674ff7e4d7fdfd572afc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=674ff7e4d7fdfd572afc
Cc: stable@vger.kernel.org
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'include/net/bluetooth')
0 files changed, 0 insertions, 0 deletions