[ Sasha's backport helper bot ]
Hi,
✅ All tests passed successfully. No issues detected. No action required from the submitter.
The upstream commit SHA1 provided is correct: 1bf4470a3939c678fb822073e9ea77a0560bc6bb
WARNING: Author mismatch between patch and upstream commit: Backport author: Xiangyu Chenxiangyu.chen@eng.windriver.com Commit author: Luiz Augusto von Dentzluiz.von.dentz@intel.com
Status in newer kernel trees: 6.14.y | Present (exact SHA1) 6.12.y | Present (exact SHA1) 6.6.y | Present (different SHA1: d30803f6a972) 6.1.y | Present (different SHA1: 9ddda5d967e8)
Note: The patch differs from the upstream commit: --- 1: 1bf4470a3939c ! 1: 47ca818750c07 Bluetooth: SCO: Fix UAF on sco_sock_timeout @@ Metadata ## Commit message ## Bluetooth: SCO: Fix UAF on sco_sock_timeout
+ [ Upstream commit 1bf4470a3939c678fb822073e9ea77a0560bc6bb ] + conn->sk maybe have been unlinked/freed while waiting for sco_conn_lock so this checks if the conn->sk is still valid by checking if it part of sco_sk_list. @@ Commit message Closes: https://syzkaller.appspot.com/bug?extid=4c0d0c4cde787116d465 Fixes: ba316be1b6a0 ("Bluetooth: schedule SCO timeouts with delayed_work") Signed-off-by: Luiz Augusto von Dentz luiz.von.dentz@intel.com + Signed-off-by: Xiangyu Chen xiangyu.chen@windriver.com + Signed-off-by: He Zhe zhe.he@windriver.com
## include/net/bluetooth/bluetooth.h ## @@ include/net/bluetooth/bluetooth.h: int bt_sock_register(int proto, const struct net_proto_family *ops); @@ include/net/bluetooth/bluetooth.h: int bt_sock_register(int proto, const struct void bt_sock_link(struct bt_sock_list *l, struct sock *s); void bt_sock_unlink(struct bt_sock_list *l, struct sock *s); +bool bt_sock_linked(struct bt_sock_list *l, struct sock *s); - struct sock *bt_sock_alloc(struct net *net, struct socket *sock, - struct proto *prot, int proto, gfp_t prio, int kern); int bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, + int flags); + int bt_sock_stream_recvmsg(struct socket *sock, struct msghdr *msg,
## net/bluetooth/af_bluetooth.c ## @@ net/bluetooth/af_bluetooth.c: void bt_sock_unlink(struct bt_sock_list *l, struct sock *sk) @@ net/bluetooth/af_bluetooth.c: void bt_sock_unlink(struct bt_sock_list *l, struct + void bt_accept_enqueue(struct sock *parent, struct sock *sk, bool bh) { - const struct cred *old_cred; + BT_DBG("parent %p, sk %p", parent, sk);
## net/bluetooth/sco.c ## @@ net/bluetooth/sco.c: struct sco_pinfo { ---
Results of testing on various branches:
| Branch | Patch Apply | Build Test | |---------------------------|-------------|------------| | stable/linux-5.15.y | Success | Success |