diff options
| author |   Jann Horn <jannh@google.com> | 2026-05-12 22:15:39 +0200 |
|---|---|---|
| committer |   Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2026-05-20 16:35:47 -0400 |
| commit | 59e932ded949fa6f0340bf7c6d7818f962fa4fd2 (patch) | |
| tree | c0f9ed46581ce3f63cdad9918852d11836206532 /include/linux/clk/ssh:/git@git.zx2c4.com | |
| parent | Bluetooth: hci_qca: Convert timeout from jiffies to ms (diff) | |
Bluetooth: bnep: Fix UAF read of dev->name
bnep_add_connection() needs to keep holding the bnep_session_sem while
reading dev->name (just like bnep_get_connlist() does); otherwise the
bnep_session() thread can concurrently free the net_device, which can for
example be triggered by a concurrent bnep_del_connection().
(This UAF is fairly uninteresting from a security perspective;
calling bnep_add_connection() requires passing a capable(CAP_NET_ADMIN)
check. It also requires completely tearing down a netdev during a fairly
tight race window.)
Cc: stable@vger.kernel.org
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'include/linux/clk/ssh:/git@git.zx2c4.com')
0 files changed, 0 insertions, 0 deletions