michael/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
Files
linux-5.4.y
linux/drivers/bluetooth
History
Raphael Pinsonneault-Thibeault 297dbf8798 Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF 
[ Upstream commit 23d22f2f71 ]

There is a KASAN: slab-use-after-free read in btusb_disconnect().
Calling "usb_driver_release_interface(&btusb_driver, data->intf)" will
free the btusb data associated with the interface. The same data is
then used later in the function, hence the UAF.

Fix by moving the accesses to btusb data to before the data is free'd.

Reported-by: syzbot+2fc81b50a4f8263a159b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2fc81b50a4f8263a159b
Tested-by: syzbot+2fc81b50a4f8263a159b@syzkaller.appspotmail.com
Fixes: fd913ef7ce ("Bluetooth: btusb: Add out-of-band wakeup support")
Signed-off-by: Raphael Pinsonneault-Thibeault <rpthibeault@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-12-03 12:45:16 +01:00
..
ath3k.c
Bluetooth: ath3k: Fix multiple issues reported by checkpatch.pl
2024-07-05 09:08:21 +02:00
bcm203x.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156
2019-05-30 11:26:35 -07:00
bfusb.c
Bluetooth: bfusb: fix division by zero in send path
2022-01-16 09:15:38 +01:00
bluecard_cs.c
bluetooth: bluecard_cs: Replace GFP_ATOMIC with GFP_KERNEL in bluecard_hci_set_baud_rate()
2018-07-23 18:05:00 +02:00
bpa10x.c
Bluetooth: bpa10x: change return value
2019-09-04 16:11:46 +02:00
bt3c_cs.c
Bluetooth: bt3c_cs: Fix obsolete function
2018-09-27 12:57:39 +02:00
btbcm.c
Bluetooth: btbcm: Add 2 missing models to subver tables
2020-06-22 09:30:59 +02:00
btbcm.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156
2019-05-30 11:26:35 -07:00
btintel.c
Bluetooth: btintel: Fixe build regression
2024-04-13 12:51:40 +02:00
btintel.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156
2019-05-30 11:26:35 -07:00
btmrvl_debugfs.c
Bluetooth: btmrvl: Re-use kstrtol_from_user()
2018-05-30 08:16:05 +02:00
btmrvl_drv.h
Bluetooth: btmrvl: Drop unused GPIO includes
2019-01-22 09:51:20 +01:00
btmrvl_main.c
Bluetooth: btmrvl: support sysfs initiated firmware coredump
2018-05-29 15:59:50 +02:00
btmrvl_sdio.c
Bluetooth: btmrvl: Use IRQF_NO_AUTOEN flag in request_irq()
2024-11-08 16:20:36 +01:00
btmrvl_sdio.h
…
btmtksdio.c
Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt
2022-04-15 14:18:16 +02:00
btmtkuart.c
Bluetooth: btmtkuart: fix recv_buf() return value
2024-01-25 14:34:26 -08:00
btqca.c
Bluetooth: hci_qca: wait for Pre shutdown complete event before sending the Power off pulse
2019-09-05 17:27:22 +02:00
btqca.h
Bluetooth: hci_qca: Send VS pre shutdown command.
2019-08-12 18:23:50 +02:00
btqcomsmd.c
Bluetooth: btqcomsmd: Fix command timeout after setting BD address
2023-04-05 11:16:38 +02:00
btrsi.c
Bluetooth: btrsi: fix bt tx timeout issue
2018-09-27 12:53:40 +02:00
btrtl.c
Bluetooth: btrtl: Prevent potential NULL dereference
2025-05-02 07:39:19 +02:00
btrtl.h
Bluetooth: btrtl: HCI reset on close for Realtek BT chip
2019-07-06 12:32:50 +02:00
btsdio.c
Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition
2023-09-23 10:59:37 +02:00
btusb.c
Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
2025-12-03 12:45:16 +01:00
btwilink.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 333
2019-06-05 17:37:06 +02:00
dtl1_cs.c
networking: add and use skb_put_u8()
2017-06-16 11:48:40 -04:00
h4_recv.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156
2019-05-30 11:26:35 -07:00
hci_ag6xx.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156
2019-05-30 11:26:35 -07:00
hci_ath.c
Bluetooth: hci_uart: check for missing tty operations
2019-07-31 13:17:33 -07:00
hci_bcm.c
Bluetooth: hci_bcm: Check for error irq
2022-01-27 09:19:36 +01:00
hci_bcsp.c
Bluetooth: bcsp: receive data only if registered
2025-12-03 12:45:14 +01:00
hci_h4.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156
2019-05-30 11:26:35 -07:00
hci_h5.c
Bluetooth: hci_h5: don't call kfree_skb() under spin_lock_irqsave()
2023-01-18 11:41:16 +01:00
hci_intel.c
Bluetooth: hci_intel: Add check for platform_driver_register
2022-08-25 11:17:47 +02:00
hci_ldisc.c
Bluetooth: hci_uart: Fix another race during initialization
2025-05-02 07:39:18 +02:00
hci_ll.c
Bluetooth: hci_ll: don't call kfree_skb() under spin_lock_irqsave()
2023-01-18 11:41:16 +01:00
hci_mrvl.c
Bluetooth: hci_uart: check for missing tty operations
2019-07-31 13:17:33 -07:00
hci_nokia.c
Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe()
2023-09-23 10:59:42 +02:00
hci_qca.c
Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave()
2023-01-18 11:41:16 +01:00
hci_serdev.c
Bluetooth: hci_serdev: call init_rwsem() before p->open()
2022-04-15 14:18:10 +02:00
hci_uart.h
Bluetooth: hci_uart: Fix another race during initialization
2025-05-02 07:39:18 +02:00
hci_vhci.c
Bluetooth: vhci: Fix race when opening vhci device
2023-10-25 11:53:20 +02:00
Kconfig
Bluetooth: btusb: Add protocol support for MediaTek MT7668U USB devices
2019-07-06 21:44:25 +02:00
Makefile
Bluetooth: mediatek: add support for MediaTek MT7663S and MT7668S SDIO devices
2019-04-23 18:09:07 +02:00