TencentOS
/
TencentOS-kernel
mirror of https://github.com/Tencent/TencentOS-kernel
0
0
Fork 4
Code Issues Projects Releases Wiki Activity
TencentOS-kernel/net
History
Anmol Karn bb2477b095 Bluetooth: Fix null pointer dereference in hci_event_packet() 
[ Upstream commit 6dfccd13db2ff2b709ef60a50163925d477549aa ]

AMP_MGR is getting derefernced in hci_phy_link_complete_evt(), when called
from hci_event_packet() and there is a possibility, that hcon->amp_mgr may
not be found when accessing after initialization of hcon.

- net/bluetooth/hci_event.c:4945
The bug seems to get triggered in this line:

bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;

Fix it by adding a NULL check for the hcon->amp_mgr before checking the ev-status.

Fixes: d5e911928bd8 ("Bluetooth: AMP: Process Physical Link Complete evt")
Reported-and-tested-by: syzbot+0bef568258653cff272f@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=0bef568258653cff272f
Signed-off-by: Anmol Karn <anmol.karan123@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 		2021-03-16 16:42:42 +08:00
..
6lowpan Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
9p net: 9p: initialize sun_server.sun_path to have addr's value only when addr is valid 2021-03-16 16:39:51 +08:00
802 Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
8021q Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
appletalk appletalk: Fix atalk_proc_init() return path 2021-03-16 16:33:09 +08:00
atm atm: fix a memory leak of vcc->user_back 2021-03-16 16:37:15 +08:00
ax25 AX.25: Prevent integer overflows in connect and sendmsg 2021-03-16 16:32:42 +08:00
batman-adv batman-adv: set .owner to THIS_MODULE 2021-03-16 16:41:41 +08:00
bluetooth Bluetooth: Fix null pointer dereference in hci_event_packet() 2021-03-16 16:42:42 +08:00
bpf Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
bpfilter net/bpfilter: remove superfluous testing message 2021-03-16 16:26:23 +08:00
bridge bridge: Fix a deadlock when enabling multicast snooping 2021-03-16 16:42:17 +08:00
caif Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
can can: af_can: can_rx_unregister(): remove WARN() statement from list operation sanity check 2021-03-16 16:42:06 +08:00
ceph libceph: clear con->out_msg on Policy::stateful_server faults 2021-03-16 16:40:11 +08:00
core net: skbuff: ensure LSE is pullable before decrementing the MPLS ttl 2021-03-16 16:41:57 +08:00
dcb net: DCB: Validate DCB_ATTR_DCB_BUFFER argument 2021-03-16 16:36:26 +08:00
dccp dccp: Fix possible memleak in dccp_init and dccp_fini 2021-03-16 16:29:07 +08:00
decnet Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
dns_resolver KEYS: Don't write out to userspace while holding key semaphore 2021-03-16 16:26:42 +08:00
dsa dsa: Allow forwarding of redirected IGMP traffic 2021-03-16 16:36:11 +08:00
ethernet Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
hsr hsr: check protocol version in hsr_newlink() 2021-03-16 16:26:20 +08:00
ieee802154 Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
ife Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
ipv4 netfilter: x_tables: Switch synchronization to RCU 2021-03-16 16:42:26 +08:00
ipv6 netfilter: x_tables: Switch synchronization to RCU 2021-03-16 16:42:26 +08:00
iucv net/af_iucv: set correct sk_protocol for child sockets 2021-03-16 16:41:52 +08:00
kcm Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
key af_key: pfkey_dump needs parameter validation 2021-03-16 16:36:23 +08:00
l2tp l2tp: remove skb_dst_set() from l2tp_xmit_skb() 2021-03-16 16:31:43 +08:00
l3mdev Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
lapb Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
llc net: silence data-races on sk_backlog.tail 2021-03-16 16:36:36 +08:00
mac80211 mac80211: mesh: fix mesh_pathtbl_init() error path 2021-03-16 16:42:16 +08:00
mac802154 mac802154: tx: fix use-after-free 2021-03-16 16:37:33 +08:00
mpls Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
ncsi net/ncsi: Fix netlink registration 2021-03-16 16:41:09 +08:00
netfilter netfilter: nft_ct: Remove confirmation check for NFT_CT_ID 2021-03-16 16:42:27 +08:00
netlabel netlabel: fix an uninitialized warning in netlbl_unlabel_staticlist() 2021-03-16 16:41:06 +08:00
netlink genetlink: remove genl_bind 2021-03-16 16:31:42 +08:00
netrom net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node 2021-03-16 16:26:51 +08:00
nfc nfc: Ensure presence of NFC_ATTR_FIRMWARE_NAME attribute in nfc_genl_fw_download() 2021-03-16 16:38:18 +08:00
nsh Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
openvswitch net: openvswitch: ensure LSE is pullable before reading it 2021-03-16 16:41:57 +08:00
packet af_packet: TPACKET_V3: fix fill status rwlock imbalance 2021-03-16 16:33:48 +08:00
phonet Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
psample Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
qrtr net: qrtr: check skb_put_padto() return value 2021-03-16 16:36:30 +08:00
rds rds: Prevent kernel-infoleak in rds_notify_queue_get() 2021-03-16 16:32:48 +08:00
rfkill rfkill: Fix use-after-free in rfkill_resume() 2021-03-16 16:41:16 +08:00
rose rose: Fix Null pointer dereference in rose_send_frame() 2021-03-16 16:41:52 +08:00
rxrpc rxrpc: Fix server keyring leak 2021-03-16 16:38:05 +08:00
sched net/sched: act_mpls: ensure LSE is pullable before reading it 2021-03-16 16:41:57 +08:00
sctp sctp: change to hold/put transport for proto_unreach_timer 2021-03-16 16:41:08 +08:00
smc net/smc: fix direct access to ib_gid_addr->ndev in smc_ib_determine_gid() 2021-03-16 16:41:07 +08:00
strparser Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
sunrpc SUNRPC: Mitigate cond_resched() in xprt_transmit() 2021-03-16 16:39:47 +08:00
switchdev Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
tipc tipc: fix a deadlock when flushing scheduled work 2021-03-16 16:42:07 +08:00
tls net/tls: Protect from calling tls_dev_del for TLS RX twice 2021-03-16 16:41:52 +08:00
toa Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
unix skbuff: fix a data race in skb_queue_len() 2021-03-16 16:36:50 +08:00
vmw_vsock vsock: use ns_capable_noaudit() on socket create 2021-03-16 16:40:26 +08:00
wimax Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
wireless cfg80211: regulatory: Fix inconsistent format argument 2021-03-16 16:40:44 +08:00
x25 net/x25: prevent a couple of overflows 2021-03-16 16:41:56 +08:00
xdp xsk: Replace datagram_poll by sock_poll_wait 2021-03-16 16:42:25 +08:00
xfrm net: xfrm: fix a race condition during allocing spi 2021-03-16 16:40:34 +08:00
Kconfig Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
Makefile Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
compat.c net/compat: Add missing sock updates for SCM_RIGHTS 2021-03-16 16:34:05 +08:00
socket.c net: Set fput_needed iff FDPUT_FPUT is set 2021-03-16 16:33:49 +08:00
sysctl_net.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00