No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Raphael Pinsonneault-Thibeault 297dbf8798 Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
[ Upstream commit 23d22f2f71768034d6ef86168213843fc49bf550 ]

There is a KASAN: slab-use-after-free read in btusb_disconnect().
Calling "usb_driver_release_interface(&btusb_driver, data->intf)" will
free the btusb data associated with the interface. The same data is
then used later in the function, hence the UAF.

Fix by moving the accesses to btusb data to before the data is free'd.

Reported-by: syzbot+2fc81b50a4f8263a159b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2fc81b50a4f8263a159b
Tested-by: syzbot+2fc81b50a4f8263a159b@syzkaller.appspotmail.com
Fixes: fd913ef7ce ("Bluetooth: btusb: Add out-of-band wakeup support")
Signed-off-by: Raphael Pinsonneault-Thibeault <rpthibeault@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-12-03 12:45:16 +01:00
arch sparc/module: Add R_SPARC_UA64 relocation handling 2025-12-03 12:45:13 +01:00
block block: use int to store blk_stack_limits() return value 2025-10-29 13:59:46 +01:00
certs
crypto crypto: essiv - Check ssize for decryption and in-place encryption 2025-10-29 13:59:52 +01:00
Documentation arm64: errata: Apply workarounds for Neoverse-V3AE 2025-10-29 14:00:00 +01:00
drivers Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF 2025-12-03 12:45:16 +01:00
fs NFS4: Fix state renewals missing after boot 2025-12-03 12:45:16 +01:00
include compiler_types: Move unused static inline functions warning to W=2 2025-12-03 12:45:16 +01:00
init
ipc
kernel tracing: Fix memory leaks in create_field_var() 2025-12-03 12:45:16 +01:00
lib lib/genalloc: fix device leak in of_gen_pool_get() 2025-10-29 13:59:53 +01:00
LICENSES
mm mm: hugetlb: avoid soft lockup when mprotect to large memory area 2025-10-29 13:59:50 +01:00
net sctp: Prevent TOCTOU out-of-bounds write 2025-12-03 12:45:15 +01:00
samples
scripts randstruct: gcc-plugin: Fix attribute addition 2025-09-09 18:44:01 +02:00
security KEYS: trusted_tpm1: Compare HMAC values in constant time 2025-10-29 14:00:01 +01:00
sound ASoC: max98090/91: fixed max98091 ALSA widget powering up/down 2025-12-03 12:45:16 +01:00
tools selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency 2025-12-03 12:45:12 +01:00
usr
virt
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile Linux 5.4.301 2025-10-29 14:00:02 +01:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.