Pavel Skripkin c52204af39 Bluetooth: add timeout sanity check to hci_inquiry ...

[ Upstream commit f41a4b2b5e ]

Syzbot hit "task hung" bug in hci_req_sync(). The problem was in
unreasonable huge inquiry timeout passed from userspace.
Fix it by adding sanity check for timeout value to hci_inquiry().

Since hci_inquiry() is the only user of hci_req_sync() with user
controlled timeout value, it makes sense to check timeout value in
hci_inquiry() and don't touch hci_req_sync().

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-and-tested-by: syzbot+be2baed593ea56c6a84c@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2021-09-22 11:47:54 +02:00

..

bnep

net: remove sock_no_poll

2018-05-26 09:16:44 +02:00

cmtp

Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow

2021-09-22 11:47:53 +02:00

hidp

Bluetooth: hidp: use correct wait queue when removing ctrl_wait

2021-08-26 08:36:45 -04:00

rfcomm

Bluetooth: RFCOMM: fix ODEBUG bug in rfcomm_dev_ioctl

2020-04-13 10:45:14 +02:00

6lowpan.c

Bluetooth: add a mutex lock to avoid UAF in do_enale_set

2020-08-19 08:14:50 +02:00

a2mp.c

Bluetooth: drop HCI device reference before return

2021-03-04 09:39:34 +01:00

a2mp.h

Bluetooth: Add BT_HS config option

2015-07-30 13:31:59 +02:00

af_bluetooth.c

net: use skb_queue_empty_lockless() in poll() handlers

2019-11-10 11:27:48 +01:00

amp.c

Bluetooth: Fix null pointer dereference in amp_read_loc_assoc_final_data

2021-03-07 12:18:58 +01:00

amp.h

Bluetooth: Add BT_HS config option

2015-07-30 13:31:59 +02:00

ecdh_helper.c

Bluetooth: let the crypto subsystem generate the ecc privkey

2017-10-06 20:35:47 +02:00

ecdh_helper.h

Fix misc new gcc warnings

2021-05-22 10:59:21 +02:00

hci_conn.c

Bluetooth: Disconnect if E0 is used for Level 4

2020-10-17 10:12:57 +02:00

hci_core.c

Bluetooth: add timeout sanity check to hci_inquiry

2021-09-22 11:47:54 +02:00

hci_debugfs.c

Bluetooth: Store Resolv list size

2018-07-06 12:40:08 +02:00

hci_debugfs.h

Bluetooth: Provide option to enable/disable debugfs information

2015-02-15 18:54:13 +02:00

hci_event.c

Bluetooth: Fix handling of HCI_LE_Advertising_Set_Terminated event

2021-07-20 16:15:52 +02:00

hci_request.c

bluetooth: eliminate the potential race condition when removing the HCI controller

2021-05-22 10:59:24 +02:00

hci_request.h

Bluetooth: Ignore CC events not matching the last HCI command

2019-05-31 06:46:09 -07:00

hci_sock.c

Bluetooth: defer cleanup of resources in hci_unregister_dev()

2021-08-12 13:19:40 +02:00

hci_sysfs.c

Bluetooth: defer cleanup of resources in hci_unregister_dev()

2021-08-12 13:19:40 +02:00

Kconfig

Revert "Bluetooth: Add option for disabling legacy ioctl interfaces"

2017-09-28 13:20:32 -07:00

l2cap_core.c

Bluetooth: initialize skb_queue_head at l2cap_chan_create()

2021-05-22 10:59:40 +02:00

l2cap_sock.c

Bluetooth: check for zapped sk before connecting

2021-05-22 10:59:40 +02:00

leds.c

leds: triggers: let struct led_trigger::activate() return an error code

2018-07-05 23:21:10 +02:00

leds.h

Bluetooth: Add combined LED trigger for controller power

2016-09-19 20:19:34 +02:00

lib.c

Bluetooth: make baswap src const

2017-09-01 22:49:47 +02:00

Makefile

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

mgmt_util.c

networking: make skb_push & __skb_push return void pointers

2017-06-16 11:48:40 -04:00

mgmt_util.h

Bluetooth: Add generic mgmt helper API

2015-03-17 18:03:08 +01:00

mgmt.c

Bluetooth: Fix the HCI to MGMT status conversion table

2021-07-20 16:16:02 +02:00

sco.c

Bluetooth: fix repeated calls to sco_sock_kill

2021-09-22 11:47:53 +02:00

selftest.c

Bluetooth: Fix compiler warning with selftest duration calculation

2017-10-06 21:49:13 +03:00

selftest.h

Bluetooth: Add support for self testing framework

2014-12-30 08:53:55 +02:00

smp.c

Bluetooth: SMP: Fail if remote and local public keys are identical

2021-05-26 11:48:36 +02:00

smp.h

Bluetooth: SMP: fix crash in unpairing

2018-09-26 12:39:32 +03:00