Niels Dossche 8ace1e6355 Bluetooth: use hdev lock for accept_list and reject_list in conn req ...

[ Upstream commit fb048cae51 ]

All accesses (both reads and modifications) to
hdev->{accept,reject}_list are protected by hdev lock,
except the ones in hci_conn_request_evt. This can cause a race
condition in the form of a list corruption.
The solution is to protect these lists in hci_conn_request_evt as well.

I was unable to find the exact commit that introduced the issue for the
reject list, I was only able to find it for the accept list.

Fixes: a55bd29d52 ("Bluetooth: Add white list lookup for incoming connection requests")
Signed-off-by: Niels Dossche <dossche.niels@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2022-06-09 10:21:09 +02:00

..

6lowpan

6lowpan: iphc: Fix an off-by-one check of array index

2021-09-15 09:50:34 +02:00

9p

xen/9p: use alloc/free_pages_exact()

2022-03-11 12:11:54 +01:00

802

net/802/garp: fix memleak in garp_request_join()

2021-07-31 08:16:11 +02:00

8021q

net: vlan: fix underflow for the real_dev refcnt

2021-12-01 09:19:08 +01:00

appletalk

appletalk: Fix skb allocation size in loopback case

2021-04-07 15:00:08 +02:00

atm

net: atm: fix update of position index in lec_seq_next

2020-10-31 12:26:30 -07:00

ax25

ax25: Fix UAF bugs in ax25 timers

2022-04-20 09:23:32 +02:00

batman-adv

batman-adv: Don't skb_split skbuffs with frag_list

2022-05-18 10:23:42 +02:00

bluetooth

Bluetooth: use hdev lock for accept_list and reject_list in conn req

2022-06-09 10:21:09 +02:00

bpf

bpf, test, cgroup: Use sk_{alloc,free} for test cases

2021-10-27 09:56:56 +02:00

bpfilter

bpfilter: Specify the log level for the kmsg message

2021-07-14 16:56:29 +02:00

bridge

net: bridge: Clear offload_fwd_mark when passing frame up bridge interface.

2022-05-25 09:17:59 +02:00

caif

net-caif: avoid user-triggerable WARN_ON(1)

2021-09-22 12:27:56 +02:00

can

can: isotp: remove re-binding of bound socket

2022-05-12 12:25:35 +02:00

ceph

libceph: fix potential use-after-free on linger ping and resends

2022-05-25 09:17:56 +02:00

core

net: remove two BUG() from skb_checksum_help()

2022-06-09 10:20:54 +02:00

dcb

net: dcb: disable softirqs in dcbnl_flush_dev()

2022-03-08 19:09:37 +01:00

dccp

tcp: switch orphan_count to bare per-cpu counters

2021-11-18 14:04:08 +01:00

decnet

net: decnet: Fix sleeping inside in af_decnet

2021-07-28 14:35:38 +02:00

dns_resolver

docs: networking: convert dns_resolver.txt to ReST

2020-04-28 14:39:46 -07:00

dsa

net: dsa: Add missing of_node_put() in dsa_port_link_register_of

2022-05-09 09:05:02 +02:00

ethernet

net: move devres helpers into a separate source file

2020-05-23 16:56:17 -07:00

ethtool

ethtool: do not perform operations on net devices being unregistered

2021-12-17 10:14:41 +01:00

hsr

net: hsr: fix mac_len checks

2021-06-03 09:00:50 +02:00

ieee802154

net: ieee802154: Return meaningful error codes from the netlink helpers

2022-02-08 18:30:37 +01:00

ife

net: Fix Kconfig indentation

2019-09-26 08:56:17 +02:00

ipv4

secure_seq: use the 64 bits of the siphash for port offset calculation

2022-05-30 09:33:23 +02:00

ipv6

ipv6: Don't send rs packets to the interface of ARPHRD_TUNNEL

2022-06-09 10:20:53 +02:00

iucv

net/af_iucv: remove WARN_ONCE on malformed RX packets

2021-03-07 12:34:05 +01:00

kcm

net: pass a sockptr_t into ->setsockopt

2020-07-24 15:41:54 -07:00

key

net: af_key: check encryption module availability consistency

2022-06-06 08:42:40 +02:00

l2tp

net/l2tp: Fix reference count leak in l2tp_udp_recv_core

2021-09-22 12:27:56 +02:00

l3mdev

l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu

2022-04-27 13:53:50 +02:00

lapb

net: lapb: Copy the skb before sending a packet

2021-02-10 09:29:14 +01:00

llc

llc: only change llc->dev when bind() succeeds

2022-03-28 09:57:10 +02:00

mac80211

mac80211: fix rx reordering with non explicit / psmp ack policy

2022-05-25 09:18:00 +02:00

mac802154

net: mac802154: Fix general protection fault

2021-04-14 08:42:13 +02:00

mpls

net: mpls: Fix notifications when deleting a device

2021-12-08 09:03:23 +01:00

mptcp

mptcp: clear 'kern' flag from fallback sockets

2021-12-22 09:30:54 +01:00

ncsi

net/ncsi: check for error return from call to nla_put_u32

2022-01-05 12:40:32 +01:00

netfilter

netfilter: nf_tables: sanitize nft_set_desc_concat_parse()

2022-06-06 08:42:42 +02:00

netlabel

netlabel: fix out-of-bounds memory accesses

2022-04-13 21:01:00 +02:00

netlink

netlink: do not reset transport header in netlink_recvmsg()

2022-05-18 10:23:43 +02:00

netrom

netrom: fix api breakage in nr_setsockopt()

2022-01-27 10:54:03 +01:00

nfc

NFC: NULL out the dev->rfkill to prevent UAF

2022-06-09 10:21:01 +02:00

nsh

treewide: replace '---help---' in Kconfig files with 'help'

2020-06-14 01:57:21 +09:00

openvswitch

openvswitch: fix OOB access in reserve_sfa_size()

2022-04-27 13:53:55 +02:00

packet

net/packet: fix packet_sock xmit return value checking

2022-04-27 13:53:50 +02:00

phonet

phonet: refcount leak in pep_sock_accep

2022-01-11 15:25:01 +01:00

psample

net: psample: Fix netlink skb length with tunnel info

2021-03-07 12:34:07 +01:00

qrtr

net: qrtr: fix another OOB Read in qrtr_endpoint_post

2021-09-03 10:09:21 +02:00

rds

rds: memory leak in __rds_conn_create()

2021-12-22 09:30:54 +01:00

rfkill

rfkill: Fix use-after-free in rfkill_resume()

2020-11-12 09:18:06 +01:00

rose

rose: Fix Null pointer dereference in rose_send_frame()

2020-11-20 10:04:58 -08:00

rxrpc

rxrpc, afs: Fix selection of abort codes

2022-06-09 10:20:56 +02:00

sched

net/sched: act_pedit: sanitize shift argument before usage

2022-05-25 09:17:58 +02:00

sctp

sctp: check asoc strreset_chunk in sctp_generate_reconf_event

2022-05-09 09:05:03 +02:00

smc

net/smc: non blocking recvmsg() return -EAGAIN when no data and signal_pending

2022-05-18 10:23:44 +02:00

strparser

bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding

2021-11-18 14:04:27 +01:00

sunrpc

SUNRPC: Fix fall-through warnings for Clang

2022-05-18 10:23:49 +02:00

switchdev

net: switchdev: don't set port_obj_info->handled true when -EOPNOTSUPP

2021-02-07 15:37:12 +01:00

tipc

tipc: fix the timer expires after interval 100ms

2022-04-08 14:40:23 +02:00

tls

tls: Fix context leak on tls_device_down

2022-05-18 10:23:45 +02:00

unix

af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress

2022-01-27 10:54:31 +01:00

vmw_vsock

vsock: each transport cycles only on its own sockets

2022-03-23 09:13:27 +01:00

wimax

genetlink: move to smaller ops wherever possible

2020-10-02 19:11:11 -07:00

wireless

nl80211: show SSID for P2P_GO interfaces

2022-06-09 10:21:01 +02:00

x25

net/x25: Fix null-ptr-deref caused by x25_disconnect

2022-04-08 14:40:30 +02:00

xdp

Revert "xsk: Do not sleep in poll() when need_wakeup set"

2021-12-22 09:30:59 +01:00

xfrm

xfrm: rework default policy structure

2022-05-25 09:17:58 +02:00

compat.c

net: Return the correct errno code

2021-06-18 10:00:06 +02:00

devres.c

net: devres: rename the release callback of devm_register_netdev()

2020-06-30 15:57:34 -07:00

Kconfig

drop_monitor: Convert to using devlink tracepoint

2020-09-30 18:01:26 -07:00

Makefile

net: move devres helpers into a separate source file

2020-05-23 16:56:17 -07:00

socket.c

ethtool: improve compat ioctl handling

2021-09-18 13:40:21 +02:00

sysctl_net.c

treewide: Add SPDX license identifier for missed files

2019-05-21 10:50:45 +02:00