Pavel Skripkin 0687bf2829 Bluetooth: add timeout sanity check to hci_inquiry ...

[ Upstream commit f41a4b2b5e ]

Syzbot hit "task hung" bug in hci_req_sync(). The problem was in
unreasonable huge inquiry timeout passed from userspace.
Fix it by adding sanity check for timeout value to hci_inquiry().

Since hci_inquiry() is the only user of hci_req_sync() with user
controlled timeout value, it makes sense to check timeout value in
hci_inquiry() and don't touch hci_req_sync().

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-and-tested-by: syzbot+be2baed593ea56c6a84c@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2021-09-22 11:43:01 +02:00

..

bnep

Bluetooth: bnep: fix possible might sleep error in bnep_session

2017-08-30 10:21:52 +02:00

cmtp

Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow

2021-09-22 11:43:00 +02:00

hidp

Bluetooth: hidp: use correct wait queue when removing ctrl_wait

2021-08-26 08:37:27 -04:00

rfcomm

Bluetooth: RFCOMM: fix ODEBUG bug in rfcomm_dev_ioctl

2020-04-13 10:32:57 +02:00

6lowpan.c

Bluetooth: add a mutex lock to avoid UAF in do_enale_set

2020-08-21 11:01:57 +02:00

a2mp.c

Bluetooth: drop HCI device reference before return

2021-03-03 17:44:32 +01:00

a2mp.h

…

af_bluetooth.c

Bluetooth: Avoid bt_accept_unlink() double unlinking

2018-03-22 09:17:52 +01:00

amp.c

Bluetooth: Fix null pointer dereference in amp_read_loc_assoc_final_data

2021-03-07 11:25:57 +01:00

amp.h

…

ecc.c

…

ecc.h

…

hci_conn.c

Bluetooth: Disconnect if E0 is used for Level 4

2020-10-17 11:02:19 +02:00

hci_core.c

Bluetooth: add timeout sanity check to hci_inquiry

2021-09-22 11:43:01 +02:00

hci_debugfs.c

Bluetooth: Add debugfs fields for hardware and firmware info

2016-07-18 09:33:28 +03:00

hci_debugfs.h

…

hci_event.c

Bluetooth: verify AMP hci_chan before amp_destroy

2021-05-22 10:40:20 +02:00

hci_request.c

bluetooth: eliminate the potential race condition when removing the HCI controller

2021-05-22 10:40:20 +02:00

hci_request.h

Bluetooth: Fix append max 11 bytes of name to scan rsp data

2016-10-19 18:42:37 +02:00

hci_sock.c

Bluetooth: defer cleanup of resources in hci_unregister_dev()

2021-08-15 13:01:02 +02:00

hci_sysfs.c

Bluetooth: defer cleanup of resources in hci_unregister_dev()

2021-08-15 13:01:02 +02:00

Kconfig

Bluetooth: add LED trigger for indicating HCI is powered up

2016-02-23 20:29:35 +01:00

l2cap_core.c

Bluetooth: initialize skb_queue_head at l2cap_chan_create()

2021-05-22 10:40:29 +02:00

l2cap_sock.c

Bluetooth: Only mark socket zapped after unlocking

2020-10-29 09:05:44 +01:00

leds.c

Bluetooth: Add combined LED trigger for controller power

2016-09-19 20:19:34 +02:00

leds.h

Bluetooth: Add combined LED trigger for controller power

2016-09-19 20:19:34 +02:00

lib.c

…

Makefile

Bluetooth: add LED trigger for indicating HCI is powered up

2016-02-23 20:29:35 +01:00

mgmt_util.c

Bluetooth: Add support for sending MGMT commands and events to monitor

2016-09-19 20:19:34 +02:00

mgmt_util.h

…

mgmt.c

Bluetooth: Fix the HCI to MGMT status conversion table

2021-07-20 16:21:08 +02:00

sco.c

Bluetooth: fix repeated calls to sco_sock_kill

2021-09-22 11:43:00 +02:00

selftest.c

…

selftest.h

…

smp.c

Bluetooth: SMP: Fail if remote and local public keys are identical

2021-05-26 11:29:09 +02:00

smp.h

Bluetooth: SMP: fix crash in unpairing

2018-11-10 07:42:42 -08:00