Wei Yongjun 6013c99742 Bluetooth: sco: Fix crash when using BT_SNDMTU/BT_RCVMTU option ... [ Upstream commit f6b8c6b5543983e9de29dc14716bfa4eb3f157c4 ] This commit add the invalid check for connected socket, without it will causes the following crash due to sco_pi(sk)->conn being NULL: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] CPU: 3 PID: 4284 Comm: test_sco Not tainted 5.10.0-rc3+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1 04/01/2014 RIP: 0010:sco_sock_getsockopt+0x45d/0x8e0 Code: 48 c1 ea 03 80 3c 02 00 0f 85 ca 03 00 00 49 8b 9d f8 04 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 50 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e b5 03 00 00 8b 43 50 48 8b 0c RSP: 0018:ffff88801bb17d88 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff83a4ecdf RDX: 000000000000000a RSI: ffffc90002fce000 RDI: 0000000000000050 RBP: 1ffff11003762fb4 R08: 0000000000000001 R09: ffff88810e1008c0 R10: ffffffffbd695dcf R11: fffffbfff7ad2bb9 R12: 0000000000000000 R13: ffff888018ff1000 R14: dffffc0000000000 R15: 000000000000000d FS: 00007fb4f76c1700(0000) GS:ffff88811af80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005555e3b7a938 CR3: 00000001117be001 CR4: 0000000000770ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: ? sco_skb_put_cmsg+0x80/0x80 ? sco_skb_put_cmsg+0x80/0x80 __sys_getsockopt+0x12a/0x220 ? __ia32_sys_setsockopt+0x150/0x150 ? syscall_enter_from_user_mode+0x18/0x50 ? rcu_read_lock_bh_held+0xb0/0xb0 __x64_sys_getsockopt+0xba/0x150 ? syscall_enter_from_user_mode+0x1d/0x50 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fixes: 0fc1a726f8 ("Bluetooth: sco: new getsockopt options BT_SNDMTU/BT_RCVMTU") Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com> Reviewed-by: Luiz Augusto Von Dentz <luiz.von.dentz@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2020-12-30 11:53:40 +01:00
..
6lowpan
9p	net: 9p: initialize sun_server.sun_path to have addr's value only when addr is valid	2020-10-12 10:05:47 +02:00
802
8021q	net: vlan: Fixed signedness in vlan_group_prealloc_vid()	2020-09-28 00:51:39 -07:00
appletalk	appletalk: Fix atalk_proc_init() return path	2020-08-03 15:48:32 -07:00
atm	net: atm: fix update of position index in lec_seq_next	2020-10-31 12:26:30 -07:00
ax25	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-07-25 17:49:04 -07:00
batman-adv	batman-adv: Don't always reallocate the fragmentation skb head	2020-11-27 08:02:55 +01:00
bluetooth	Bluetooth: sco: Fix crash when using BT_SNDMTU/BT_RCVMTU option	2020-12-30 11:53:40 +01:00
bpf	bpf: fix raw_tp test run in preempt kernel	2020-09-30 08:34:08 -07:00
bpfilter	Revert "bpfilter: Fix build error with CONFIG_BPFILTER_UMH"	2020-10-15 12:33:24 -07:00
bridge	bridge: Fix a deadlock when enabling multicast snooping	2020-12-07 17:14:43 -08:00
caif	caif: Remove duplicate macro SRVL_CTRL_PKT_SIZE	2020-09-05 15:57:05 -07:00
can	can: isotp: isotp_setsockopt(): block setsockopt on bound sockets	2020-12-09 08:44:15 -08:00
ceph	libceph: clear con->out_msg on Policy::stateful_server faults	2020-10-12 15:29:27 +02:00
core	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf	2020-12-10 14:29:30 -08:00
dcb	net: DCB: Validate DCB_ATTR_DCB_BUFFER argument	2020-09-10 15:09:08 -07:00
dccp	tcp: fix race condition when creating child sockets from syncookies	2020-11-23 16:32:33 -08:00
decnet	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
dns_resolver
dsa	net: dsa: tag_ksz: KSZ8795 and KSZ9477 also use tail tags	2020-10-19 17:32:50 -07:00
ethernet
ethtool	ethtool: fix stack overflow in ethnl_parse_bitset()	2020-12-09 15:50:38 -08:00
hsr	genetlink: move to smaller ops wherever possible	2020-10-02 19:11:11 -07:00
ieee802154	genetlink: move to smaller ops wherever possible	2020-10-02 19:11:11 -07:00
ife
ipv4	net: ipconfig: Avoid spurious blank lines in boot log	2020-12-26 16:02:38 +01:00
ipv6	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf	2020-12-09 18:55:46 -08:00
iucv	net/af_iucv: set correct sk_protocol for child sockets	2020-11-21 14:43:45 -08:00
kcm	net: pass a sockptr_t into ->setsockopt	2020-07-24 15:41:54 -07:00
key	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-08-02 01:02:12 -07:00
l2tp	genetlink: move to smaller ops wherever possible	2020-10-02 19:11:11 -07:00
l3mdev	net: Fix some comments	2020-08-27 07:55:59 -07:00
lapb
llc	net: pass a sockptr_t into ->setsockopt	2020-07-24 15:41:54 -07:00
mac80211	mac80211: mesh: fix mesh_pathtbl_init() error path	2020-12-04 17:34:25 -08:00
mac802154	Merge tag 'ieee802154-for-davem-2020-09-08' of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan	2020-09-08 20:12:58 -07:00
mpls	mpls: load mpls_gso after mpls_iptunnel	2020-10-20 21:16:45 -07:00
mptcp	mptcp: print new line in mptcp_seq_show() if mptcp isn't in use	2020-12-07 17:45:29 -08:00
ncsi	net/ncsi: Fix netlink registration	2020-11-12 17:00:13 -08:00
netfilter	netfilter: nft_ct: Remove confirmation check for NFT_CT_ID	2020-12-09 10:31:58 +01:00
netlabel	netlabel: fix an uninitialized warning in netlbl_unlabel_staticlist()	2020-11-14 12:07:57 -08:00
netlink	netlink: export policy in extended ACK	2020-10-09 20:22:32 -07:00
netrom	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
nfc	nfc: Ensure presence of NFC_ATTR_FIRMWARE_NAME attribute in nfc_genl_fw_download()	2020-10-20 17:06:22 -07:00
nsh
openvswitch	openvswitch: fix error return code in validate_and_copy_dec_ttl()	2020-12-04 15:43:14 -08:00
packet	net/packet: fix packet receive on L3 devices without visible hard header	2020-11-23 17:29:36 -08:00
phonet	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
psample	genetlink: move to smaller ops wherever possible	2020-10-02 19:11:11 -07:00
qrtr	net: qrtr: ns: Fix the incorrect usage of rcu_read_lock()	2020-10-06 06:01:35 -07:00
rds	RDMA: Add rdma_connect_locked()	2020-10-28 09:14:49 -03:00
rfkill	rfkill: Fix use-after-free in rfkill_resume()	2020-11-12 09:18:06 +01:00
rose	rose: Fix Null pointer dereference in rose_send_frame()	2020-11-20 10:04:58 -08:00
rxrpc	rxrpc: Fix loss of final ack on shutdown	2020-10-15 13:28:00 +01:00
sched	net: sched: Fix dump of MPLS_OPT_LSE_LABEL attribute in cls_flower	2020-12-09 20:39:38 -08:00
sctp	sctp: change to hold/put transport for proto_unreach_timer	2020-11-14 11:57:12 -08:00
smc	net/smc: fix direct access to ib_gid_addr->ndev in smc_ib_determine_gid()	2020-11-19 10:59:19 -08:00
strparser
sunrpc	net: sunrpc: Fix 'snprintf' return value check in 'do_xprt_debugfs'	2020-12-30 11:53:30 +01:00
switchdev	net: switchdev: Fixed kerneldoc warning	2020-09-23 17:46:31 -07:00
tipc	net: tipc: prevent possible null deref of link	2020-12-08 15:53:41 -08:00
tls	net/tls: Protect from calling tls_dev_del for TLS RX twice	2020-11-25 17:31:06 -08:00
unix	networking changes for the 5.10 merge window	2020-10-15 18:42:13 -07:00
vmw_vsock	vsock/virtio: discard packets only when socket is really closed	2020-11-23 16:36:29 -08:00
wimax	genetlink: move to smaller ops wherever possible	2020-10-02 19:11:11 -07:00
wireless	nl80211/cfg80211: fix potential infinite loop	2020-12-30 11:53:03 +01:00
x25	net/x25: prevent a couple of overflows	2020-12-02 17:26:36 -08:00
xdp	xsk: Return error code if force_zc is set	2020-12-04 16:48:31 +01:00
xfrm	net: xfrm: fix memory leak in xfrm_user_policy()	2020-11-10 09:14:25 +01:00
compat.c	iov_iter: transparently handle compat iovecs in import_iovec	2020-10-03 00:02:13 -04:00
devres.c	net: devres: rename the release callback of devm_register_netdev()	2020-06-30 15:57:34 -07:00
Kconfig	drop_monitor: Convert to using devlink tracepoint	2020-09-30 18:01:26 -07:00
Makefile
socket.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-10-05 18:40:01 -07:00
sysctl_net.c