korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-13 14:24:11 +08:00
Code Issues Packages Projects Releases Wiki Activity
1,204,923 Commits 111 Branches 5,165 Tags 3.4 GiB
C 97.6%
Assembly 1%
Shell 0.5%
Python 0.3%
Makefile 0.3%
fc666d1b47
Go to file
ZhengHan Wang fc666d1b47 Bluetooth: Fix double free in hci_conn_cleanup 
[ Upstream commit a85fb91e3d ]

syzbot reports a slab use-after-free in hci_conn_hash_flush [1].
After releasing an object using hci_conn_del_sysfs in the
hci_conn_cleanup function, releasing the same object again
using the hci_dev_put and hci_conn_put functions causes a double free.
Here's a simplified flow:

hci_conn_del_sysfs:
  hci_dev_put
    put_device
      kobject_put
        kref_put
          kobject_release
            kobject_cleanup
              kfree_const
                kfree(name)

hci_dev_put:
  ...
    kfree(name)

hci_conn_put:
  put_device
    ...
      kfree(name)

This patch drop the hci_dev_put and hci_conn_put function
call in hci_conn_cleanup function, because the object is
freed in hci_conn_del_sysfs function.

This patch also fixes the refcounting in hci_conn_add_sysfs() and
hci_conn_del_sysfs() to take into account device_add() failures.

This fixes CVE-2023-28464.

Link: https://syzkaller.appspot.com/bug?id=1bb51491ca5df96a5f724899d1dbb87afda61419 [1]

Signed-off-by: ZhengHan Wang <wzhmmmmm@gmail.com>
Co-developed-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-11-28 17:14:43 +00:00
arch x86/mm: Drop the 4 MB restriction on minimal NUMA node memory size 2023-11-28 17:14:41 +00:00
block blk-core: use pr_warn_ratelimited() in bio_check_ro() 2023-11-20 11:57:23 +01:00
certs KEYS: Add missing function documentation 2023-04-24 16:15:52 +03:00
crypto certs: Break circular dependency when selftest is modular 2023-11-20 11:57:11 +01:00
Documentation smp,csd: Throw an error if a CSD lock is stuck for too long 2023-11-28 17:14:41 +00:00
drivers Bluetooth: btusb: Add date->evt_skb is NULL check 2023-11-28 17:14:43 +00:00
fs btrfs: abort transaction on generation mismatch when marking eb as dirty 2023-11-28 17:14:40 +00:00
include vsock: read from socket's error queue 2023-11-28 17:14:43 +00:00
init x86/retpoline: Make sure there are no unconverted return thunks due to KCSAN 2023-11-28 17:14:40 +00:00
io_uring io_uring/net: ensure socket is marked connected on connect retry 2023-11-20 11:57:25 +01:00
ipc Merge branch 'work.namespace' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2023-02-24 19:20:07 -08:00
kernel bpf: Ensure proper register state printing for cond jumps 2023-11-28 17:14:43 +00:00
lib lib/generic-radix-tree.c: Don't overflow in peek() 2023-11-28 17:14:40 +00:00
LICENSES LICENSES: Add the copyleft-next-0.3.1 license 2022-11-08 15:44:01 +01:00
mm vfs: fix readahead(2) on block devices 2023-11-20 11:56:43 +01:00
net Bluetooth: Fix double free in hci_conn_cleanup 2023-11-28 17:14:43 +00:00
rust rust: types: make Opaque be !Unpin 2023-11-08 14:09:04 +01:00
samples samples/hw_breakpoint: fix building without module unloading 2023-09-23 11:14:33 +02:00
scripts x86/retpoline: Make sure there are no unconverted return thunks due to KCSAN 2023-11-28 17:14:40 +00:00
security apparmor: fix invalid reference on profile->disconnected 2023-11-20 11:57:12 +01:00
sound ALSA: hda/realtek: Add support dual speaker for Dell 2023-11-20 11:57:25 +01:00
tools selftests/lkdtm: Disable CONFIG_UBSAN_TRAP in test config 2023-11-28 17:14:40 +00:00
usr initramfs: Encode dependency on KBUILD_BUILD_TIMESTAMP 2023-06-06 17:54:49 +09:00
virt kvm/vfio: ensure kvg instance stays around in kvm_vfio_group_add() 2023-09-13 09:53:29 +02:00
.clang-format iommu: Add for_each_group_device() 2023-05-23 08:15:51 +02:00
.cocciconfig
.get_maintainer.ignore get_maintainer: add Alan to .get_maintainer.ignore 2022-08-20 15:17:44 -07:00
.gitattributes .gitattributes: set diff driver for Rust source code files 2023-05-31 17:48:25 +02:00
.gitignore Revert ".gitignore: ignore *.cover and *.mbx" 2023-07-04 15:05:12 -07:00
.mailmap mailmap: add entries for Simon Horman 2023-08-16 09:53:10 +01:00
.rustfmt.toml rust: add .rustfmt.toml 2022-09-28 09:02:20 +02:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS - Address -Wmissing-prototype warnings 2023-06-26 16:43:54 -07:00
Kbuild Kbuild updates for v6.1 2022-10-10 12:00:45 -07:00
Kconfig kbuild: ensure full rebuild when the compiler is updated 2020-05-12 13:28:33 +09:00
MAINTAINERS sound fixes for 6.5 2023-08-25 08:48:14 -07:00
Makefile Linux 6.5.12 2023-11-20 11:57:26 +01:00
README Drop all 00-INDEX files from Documentation/ 2018-09-09 15:08:58 -06:00

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.