Fedor Pchelkin
a9a7672fc1
Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc ...
commit 5f397409f8ee5bc82901eeaf799e1cbc4f8edcf1 upstream.
A NULL sock pointer is passed into l2cap_sock_alloc() when it is called
from l2cap_sock_new_connection_cb() and the error handling paths should
also be aware of it.
Seemingly a more elegant solution would be to swap bt_sock_alloc() and
l2cap_chan_create() calls since they are not interdependent to that moment
but then l2cap_chan_create() adds the soon to be deallocated and still
dummy-initialized channel to the global list accessible by many L2CAP
paths. The channel would be removed from the list in short period of time
but be a bit more straight-forward here and just check for NULL instead of
changing the order of function calls.
Found by Linux Verification Center (linuxtesting.org) with SVACE static
analysis tool.
Fixes: 7c4f78cdb8e7 ("Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()")
Cc: stable@vger.kernel.org
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-03-13 12:43:07 +01:00
9p/xen: fix release of IRQ
2024-12-14 19:44:41 +01:00
net: 802: LLC+SNAP OID:PID lookup on start of skb data
2025-02-01 18:18:45 +01:00
batman-adv: Do not let TT changes list grows indefinitely
2024-12-19 18:05:03 +01:00
Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc
2025-03-13 12:43:07 +01:00
netfilter: Replace zero-length array with flexible-array member
2025-01-09 13:23:35 +01:00
net: af_can: do not leave a dangling sk pointer in can_create()
2024-12-14 19:44:51 +01:00
libceph: fix race between delayed_work() and ceph_monc_stop()
2024-07-18 11:40:55 +02:00
net: let net.core.dev_weight always be non-zero
2025-03-13 12:42:55 +01:00
net: fix data-races around sk->sk_forward_alloc
2025-02-01 18:18:52 +01:00
ethernet: Add helper for assigning packet type when dest address does not match device address
2024-05-02 16:18:36 +02:00
hsr: Handle failures in module init
2024-03-26 18:22:25 -04:00
net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
2024-12-14 19:44:51 +01:00
udp: gso: do not drop small packets when PMTU reduces
2025-03-13 12:43:06 +01:00
udp: gso: do not drop small packets when PMTU reduces
2025-03-13 12:43:06 +01:00
s390/iucv: fix receive buffer virtual vs physical address confusion
2024-09-04 13:14:57 +02:00
kcm: Serialise kcm_sendmsg() for the same socket.
2024-09-04 13:14:59 +02:00
genetlink: hold RCU in genlmsg_mcast()
2024-11-08 16:20:50 +01:00
net: llc: reset skb->transport_header
2025-01-09 13:23:35 +01:00
wifi: mac80211: wake the queues in case of failure in resume
2025-01-09 13:23:35 +01:00
mac802154: check local interfaces before deleting sdata list
2025-02-01 18:18:50 +01:00
netfilter: Replace zero-length array with flexible-array member
2025-01-09 13:23:35 +01:00
netlink: terminate outstanding dump on socket close
2024-12-14 19:44:18 +01:00
netrom: check buffer length before accessing it
2025-01-09 13:23:35 +01:00
nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()
2024-06-16 13:28:46 +02:00
nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().
2024-05-17 11:43:49 +02:00
openvswitch: Set the skbuff pkt_type for proper pmtud support.
2024-06-16 13:28:45 +02:00
af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK
2025-01-09 13:23:35 +01:00
phonet: fix rtm_phonet_notify() skb allocation
2024-05-17 11:43:54 +02:00
net: qrtr: Update packets cloning when broadcasting
2024-11-08 16:20:33 +01:00
net:rds: Fix possible deadlock in rds_message_put
2024-09-04 13:15:03 +02:00
net: rfkill: gpio: Add check for clk_enable()
2024-12-14 19:44:27 +01:00
net: rose: lock the socket in rose_bind()
2025-03-13 12:43:06 +01:00
netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()
2025-03-13 12:43:06 +01:00
sctp: sysctl: rto_min/max: avoid using current->nsproxy
2025-02-01 18:18:49 +01:00
net/smc: check sndbuf_space again after NOSPACE flag is set in smc_poll
2025-01-09 13:23:27 +01:00
sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport
2024-12-14 19:44:42 +01:00
tipc: fix NULL deref in cleanup_bearer()
2024-12-19 18:05:03 +01:00
tls: Fix tls_sw_sendmsg error handling
2025-02-01 18:18:45 +01:00
af_unix: Remove put_pid()/put_cred() in copy_peercred().
2024-09-12 11:03:52 +02:00
vsock: Allow retrying on connect() failure
2025-03-13 12:43:00 +01:00
genetlink: hold RCU in genlmsg_mcast()
2024-11-08 16:20:50 +01:00
xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
2024-06-16 13:28:52 +02:00
xfrm: validate new SA's prefixlen using SA family when sel.family is unset
2024-11-08 16:20:52 +01:00
a9a7672fc1