Zheng Wang af4d48754d Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work ...

[ Upstream commit 1e9ac114c4428fdb7ff4635b45d4f46017e8916f ]

In btsdio_probe, &data->work was bound with btsdio_work.In
btsdio_send_frame, it was started by schedule_work.

If we call btsdio_remove with an unfinished job, there may
be a race condition and cause UAF bug on hdev.

Fixes: ddbaf13e3609 ("[Bluetooth] Add generic driver for Bluetooth SDIO devices")
Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2023-04-05 11:15:35 +02:00

..

ath3k.c

Bluetooth: ath3k: fix checkpatch warning

2018-02-07 09:46:09 +01:00

bcm203x.c

Bluetooth: mark expected switch fall-throughs

2017-10-14 09:25:51 +02:00

bfusb.c

Bluetooth: bfusb: fix division by zero in send path

2022-01-27 09:04:11 +01:00

bluecard_cs.c

bluetooth: bluecard_cs: Replace GFP_ATOMIC with GFP_KERNEL in bluecard_hci_set_baud_rate()

2018-07-23 18:05:00 +02:00

bpa10x.c

bluetooth: bpa10x: Replace GFP_ATOMIC with GFP_KERNEL in bpa10x_send_frame()

2018-07-23 18:05:00 +02:00

bt3c_cs.c

Bluetooth: Use bt_dev_err and bt_dev_info when possible

2017-10-30 12:25:45 +02:00

btbcm.c

Bluetooth: btbcm: Add 2 missing models to subver tables

2020-06-22 09:05:13 +02:00

btbcm.h

Bluetooth: btbcm: Allow using btbcm_initialize() for reinit

2018-05-18 06:37:51 +02:00

btintel.c

Bluetooth: btintel: Create common function for firmware download

2018-01-25 09:28:40 +01:00

btintel.h

Bluetooth: btintel: Create common function for firmware download

2018-01-25 09:28:40 +01:00

btmrvl_debugfs.c

Bluetooth: btmrvl: Re-use kstrtol_from_user()

2018-05-30 08:16:05 +02:00

btmrvl_drv.h

Bluetooth: btmrvl: support sysfs initiated firmware coredump

2018-05-29 15:59:50 +02:00

btmrvl_main.c

Bluetooth: btmrvl: support sysfs initiated firmware coredump

2018-05-29 15:59:50 +02:00

btmrvl_sdio.c

bluetooth: btmrvl_sdio: Replace GFP_ATOMIC with GFP_KERNEL in btmrvl_sdio_card_to_host()

2018-07-23 18:05:00 +02:00

btmrvl_sdio.h

btmrvl: add platform specific wakeup interrupt support

2016-05-02 19:26:15 +02:00

btmtkuart.c

Bluetooth: mediatek: fix up an error path to restore bdev->tx_state

2019-05-08 07:21:52 +02:00

btqca.c

Bluetooth: btqca: Add a short delay before downloading the NVM

2019-09-10 10:33:43 +01:00

btqca.h

Bluetooth: hci_qca: Add support for Qualcomm Bluetooth chip wcn3990

2018-08-03 14:44:07 +02:00

btqcomsmd.c

Bluetooth: btqcomsmd: Fix command timeout after setting BD address

2023-04-05 11:15:35 +02:00

btrsi.c

Bluetooth: btrsi: fix bt tx timeout issue

2019-11-20 18:47:42 +01:00

btrtl.c

Bluetooth: btrtl: Use kvmalloc for FW allocations

2020-10-01 13:14:31 +02:00

btrtl.h

Bluetooth: btrtl: HCI reset on close for Realtek BT chip

2019-10-01 08:26:11 +02:00

btsdio.c

Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work

2023-04-05 11:15:35 +02:00

btusb.c

Bluetooth: btusb: don't call kfree_skb() under spin_lock_irqsave()

2023-01-18 11:30:20 +01:00

btwilink.c

Bluetooth: Style fix - align block comments

2017-07-22 08:39:39 +02:00

dtl1_cs.c

networking: add and use skb_put_u8()

2017-06-16 11:48:40 -04:00

h4_recv.h

Bluetooth: hci_uart: Check if socket buffer is ERR_PTR in h4_recv_buf()

2019-03-27 14:14:41 +09:00

hci_ag6xx.c

Bluetooth: hci_uart: Add diag and address support for Intel/AG6xx

2016-02-29 19:25:22 +02:00

hci_ath.c

Bluetooth: hci_uart: check for missing tty operations

2019-08-04 09:30:55 +02:00

hci_bcm.c

Bluetooth: hci_bcm: Check for error irq

2022-01-27 09:04:20 +01:00

hci_bcsp.c

Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave()

2023-01-18 11:30:20 +01:00

hci_h4.c

Bluetooth: hci_uart: Check if socket buffer is ERR_PTR in h4_recv_buf()

2019-03-27 14:14:41 +09:00

hci_h5.c

Bluetooth: hci_h5: don't call kfree_skb() under spin_lock_irqsave()

2023-01-18 11:30:20 +01:00

hci_intel.c

Bluetooth: hci_intel: Add check for platform_driver_register

2022-08-25 11:15:11 +02:00

hci_ldisc.c

Bluetooth: hci_uart: Cancel init work before unregistering

2020-10-29 09:55:05 +01:00

hci_ll.c

Bluetooth: hci_serdev: Move serdev_device_close/open into common hci_serdev code

2018-05-30 08:47:42 +02:00

hci_mrvl.c

Bluetooth: hci_uart: check for missing tty operations

2019-08-04 09:30:55 +02:00

hci_nokia.c

bluetooth: hci_nokia: Don't include linux/unaligned/le_struct.h directly.

2018-06-17 08:38:55 +09:00

hci_qca.c

Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave()

2023-01-18 11:30:20 +01:00

hci_serdev.c

Bluetooth: hci_serdev: call init_rwsem() before p->open()

2022-04-15 14:14:47 +02:00

hci_uart.h

Bluetooth: hci_uart: check for missing tty operations

2019-08-04 09:30:55 +02:00

hci_vhci.c

vfs: do bulk POLL* -> EPOLL* replacement

2018-02-11 14:34:03 -08:00

Kconfig

Bluetooth: Make BT_HCIUART_RTL configuration option depend on ACPI

2018-08-21 16:36:12 +02:00

Makefile

Bluetooth: mediatek: Add protocol support for MediaTek serial devices

2018-08-07 21:33:25 +02:00