mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-28 08:44:29 -04:00
Code Issues Packages Projects Releases Wiki Activity
Files
b640ff9af3c809ff5ea2077fbba17df1594ec1e4
linux/net
History
Pauli Virtanen af24e338bf Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero 
hci_conn::iso_data is accessed and modified without lock or RCU.
This leads to a race

    [Task hdev->workqueue]                 	[Task 2]
    iso_recv                                    iso_conn_put(conn)
      conn = LOAD hcon->iso_data                  iso_conn_free(conn)
      iso_conn_hold_unless_zero(conn)               hcon->iso_data = NULL
                                                    kfree(conn)
        kref_get_unless_zero(&conn->ref) /* UAF */

and also to races in iso_conn_add() vs. iso_conn_free().

Fix by adding spinlock hci_conn::proto_lock and using it to guard
hci_conn::iso_data.

Fixes: dc26097bdb ("Bluetooth: ISO: Use kref to track lifetime of iso_conn")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-07-28 16:13:12 -04:00
..
6lowpan
6lowpan: fix NHC entry use-after-free on error path
2026-06-11 15:27:07 -07:00
9p
9p: Add missing read barrier in virtio zero-copy path
2026-06-21 05:22:57 +00:00
802
appletalk: move the protocol out of tree
2026-06-16 14:37:06 -07:00
8021q
vlan: defer real device state propagation to netdev_work
2026-06-25 10:18:40 -07:00
atm
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2026-06-16 14:59:58 -07:00
batman-adv
batman-adv: dat: fix tie-break for candidate selection
2026-07-06 07:18:59 +02:00
bluetooth
Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero
2026-07-28 16:13:12 -04:00
bpf
bpf: Fix partial copy of non-linear test_run output
2026-06-21 17:55:06 -07:00
bridge
net: bridge: mrp: fix Option TLV length in MRP_Test frames
2026-07-27 15:56:55 -07:00
can
can: isotp: serialize TX state transitions under so->rx_lock
2026-07-16 10:11:12 +02:00
ceph
libceph: Fix potential null-ptr-deref in decode_choose_args()
2026-05-12 21:00:59 +02:00
core
bpf: lwt: Fix dst reference leak on reroute failure
2026-07-28 13:22:11 +02:00
dcb
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
devlink
devlink: Fix parent ref leak on tc-bw failure
2026-06-18 18:02:29 -07:00
dns_resolver
net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query
2026-06-04 18:39:29 -07:00
dsa
net: dsa: Fix skb ownership in taggers
2026-06-27 15:44:12 -07:00
ethernet
bonding: prevent potential infinite loop in bond_header_parse()
2026-03-16 19:29:45 -07:00
ethtool
ethtool: rss: Fix hfunc and input_xfrm parsing on big endian
2026-07-09 11:38:30 +02:00
handshake
handshake: Require admin permission for DONE command
2026-06-12 15:45:44 -07:00
hsr
net: hsr: fix memory leak on slave unregistration by removing synced VLANs
2026-07-22 10:24:44 -07:00
ieee802154
ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation
2026-06-19 23:02:42 +02:00
ife
net: ife: require ETH_HLEN to be pullable in ife_decode()
2026-06-13 17:34:39 -07:00
ipv4
net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()
2026-07-28 13:32:34 +02:00
ipv6
net: ipv6: clear suppressed fib6 rule result
2026-07-27 15:20:01 -07:00
iucv
net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()
2026-07-21 13:36:35 -07:00
kcm
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2026-06-16 14:59:58 -07:00
key
Merge tag 'ipsec-2026-06-22' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec
2026-06-23 16:22:24 -07:00
l2tp
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2026-06-04 15:29:04 -07:00
l3mdev
…
lapb
treewide: Replace kmalloc with kmalloc_obj for non-scalar types
2026-02-21 01:02:28 -08:00
llc
llc: fix SAP refcount leak when creating incoming sockets
2026-07-17 13:17:46 +02:00
mac80211
wifi: mac80211: recalculate TIM when a station enters power save
2026-07-21 13:35:22 +02:00
mac802154
mac802154: hold an interface reference across the scan worker
2026-07-23 10:37:46 -07:00
mctp
mctp: check register_netdevice_notifier() error in mctp_device_init()
2026-07-23 09:17:36 -07:00
mpls
net: mpls: initialize rtm_tos in mpls_getroute()
2026-07-28 11:06:06 +02:00
mptcp
mptcp: fix BUILD_BUG_ON on legacy ARM config
2026-07-23 10:50:38 -07:00
ncsi
net: ncsi: fix skb leak in error paths
2026-03-06 17:34:48 -08:00
netfilter
netfilter: nft_payload: fix mask build for partial field offload
2026-07-23 18:17:55 +02:00
netlabel
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2026-06-11 14:33:35 -07:00
netlink
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2026-05-28 14:02:21 -07:00
nfc
nfc: nci: uart: Constify struct tty_ldisc_ops
2026-06-11 20:21:32 +02:00
nsh
…
openvswitch
openvswitch: fix GSO userspace truncation underflow
2026-07-21 10:25:25 +02:00
packet
net/packet: avoid fanout hook re-registration after unregister
2026-07-20 18:15:20 -07:00
phonet
phonet: check register_netdevice_notifier() error in phonet_device_init()
2026-07-23 10:28:50 -07:00
psample
net: psample: fix info leak in PSAMPLE_ATTR_DATA
2026-06-17 16:35:50 -07:00
psp
psp: add a new netdev event for dev unregister
2026-06-12 18:31:32 -07:00
qrtr
net: qrtr: restrict socket creation to the initial network namespace
2026-07-23 07:44:00 -07:00
rds
rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()
2026-07-23 14:11:37 -07:00
rfkill
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
rxrpc
rxrpc: fix io_thread race in rxrpc_wake_up_io_thread()
2026-07-21 11:52:29 +02:00
sched
net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds
2026-07-28 11:18:58 +02:00
sctp
sctp: prevent peer transport count overflow
2026-07-27 15:45:24 -07:00
shaper
net: shaper: add a note that we expect cap dumps to be tiny
2026-06-11 12:55:23 +02:00
smc
net/smc: fix socket use-after-free during link group termination
2026-07-28 11:22:43 +02:00
strparser
net: strparser: fix skb_head leak in strp_abort_strp()
2026-04-14 12:37:00 +02:00
sunrpc
SUNRPC: pin upper rpc_clnt across the TLS connect_worker
2026-07-08 14:07:19 -04:00
switchdev
bridge: No DEV_PATH_BR_VLAN_UNTAG_HW for dsa foreign
2026-03-19 13:14:00 +01:00
tipc
tipc: avoid use-after-free in poll trace queue dumps
2026-07-27 15:18:59 -07:00
tls
tls: device: push pending open record on splice EOF
2026-07-21 14:50:50 -07:00
unix
af_unix: fix listen() succeeding on sockets in the wrong state
2026-07-24 15:10:05 -07:00
vmw_vsock
vsock/virtio: collapse receive queue under memory pressure
2026-07-21 12:11:06 +02:00
wireless
wifi: cfg80211: guard optional PMSR nominal time
2026-07-21 14:12:24 +02:00
x25
net/x25: fix use-after-free in x25_kill_by_neigh()
2026-07-23 11:58:20 +02:00
xdp
xsk: reclaim invalid Tx descriptors in ZC batch path
2026-07-24 15:12:14 -07:00
xfrm
xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert
2026-07-06 08:30:02 +02:00
compat.c
net: Remove support for AIO on sockets
2026-05-29 14:05:30 +08:00
devres.c
…
Kconfig
appletalk: move the protocol out of tree
2026-06-16 14:37:06 -07:00
Kconfig.debug
…
Makefile
appletalk: move the protocol out of tree
2026-06-16 14:37:06 -07:00
socket.c
Merge tag 'net-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next
2026-06-17 08:17:00 +01:00
sysctl_net.c
…