Myungho Jung
4b39051363
Bluetooth: Fix decrementing reference count twice in releasing socket ...
commit e20a2e9c42c9e4002d9e338d74e7819e88d77162 upstream.
When releasing socket, it is possible to enter hci_sock_release() and
hci_sock_dev_event(HCI_DEV_UNREG) at the same time in different thread.
The reference count of hdev should be decremented only once from one of
them but if storing hdev to local variable in hci_sock_release() before
detached from socket and setting to NULL in hci_sock_dev_event(),
hci_dev_put(hdev) is unexpectedly called twice. This is resolved by
referencing hdev from socket after bt_sock_unlink() in
hci_sock_release().
Reported-by: syzbot+fdc00003f4efff43bc5b@syzkaller.appspotmail.com
Signed-off-by: Myungho Jung <mhjungk@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-27 14:14:42 +09:00
net: remove sock_no_poll
2018-05-26 09:16:44 +02:00
Merge branch 'work.aio-1' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2018-06-04 13:57:43 -07:00
Bluetooth: hidp: buffer overflow in hidp_process_report
2018-08-01 09:12:35 +02:00
Bluetooth: Fix locking in bt_accept_enqueue() for BH context
2019-03-10 07:17:21 +01:00
6lowpan: fix set not used warning
2017-07-25 12:31:37 -07:00
Bluetooth: Use bt_dev_err and bt_dev_info when possible
2017-10-30 12:25:45 +02:00
Bluetooth: Add BT_HS config option
2015-07-30 13:31:59 +02:00
Bluetooth: Fix locking in bt_accept_enqueue() for BH context
2019-03-10 07:17:21 +01:00
Bluetooth: Use bt_dev_err and bt_dev_info when possible
2017-10-30 12:25:45 +02:00
Bluetooth: Add BT_HS config option
2015-07-30 13:31:59 +02:00
Bluetooth: let the crypto subsystem generate the ecc privkey
2017-10-06 20:35:47 +02:00
Bluetooth: let the crypto subsystem generate the ecc privkey
2017-10-06 20:35:47 +02:00
Bluetooth: Implement Set ADV set random address
2018-07-30 13:44:53 +02:00
Bluetooth: Add new quirk for non-persistent setup settings
2018-07-30 14:00:15 +02:00
Bluetooth: Store Resolv list size
2018-07-06 12:40:08 +02:00
Bluetooth: Provide option to enable/disable debugfs information
2015-02-15 18:54:13 +02:00
Bluetooth: Fix unnecessary error message for HCI request completion
2019-01-26 09:32:44 +01:00
Bluetooth: Implement secondary advertising on different PHYs
2018-07-30 13:44:53 +02:00
Bluetooth: Implement Set ADV set random address
2018-07-30 13:44:53 +02:00
Bluetooth: Fix decrementing reference count twice in releasing socket
2019-03-27 14:14:42 +09:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2017-11-04 09:26:51 +09:00
Revert "Bluetooth: Add option for disabling legacy ioctl interfaces"
2017-09-28 13:20:32 -07:00
treewide: kmalloc() -> kmalloc_array()
2018-06-12 16:19:22 -07:00
Bluetooth: Fix locking in bt_accept_enqueue() for BH context
2019-03-10 07:17:21 +01:00
leds: triggers: let struct led_trigger::activate() return an error code
2018-07-05 23:21:10 +02:00
Bluetooth: Add combined LED trigger for controller power
2016-09-19 20:19:34 +02:00
Bluetooth: make baswap src const
2017-09-01 22:49:47 +02:00
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
Bluetooth: SMP: fix crash in unpairing
2018-09-26 12:39:32 +03:00
networking: make skb_push & __skb_push return void pointers
2017-06-16 11:48:40 -04:00
Bluetooth: Add generic mgmt helper API
2015-03-17 18:03:08 +01:00
Bluetooth: Fix locking in bt_accept_enqueue() for BH context
2019-03-10 07:17:21 +01:00
Bluetooth: Fix compiler warning with selftest duration calculation
2017-10-06 21:49:13 +03:00
Bluetooth: Add support for self testing framework
2014-12-30 08:53:55 +02:00
Bluetooth: SMP: fix crash in unpairing
2018-09-26 12:39:32 +03:00
Bluetooth: SMP: fix crash in unpairing
2018-09-26 12:39:32 +03:00
4b39051363