KASAN: invalid-free in hci_req_sync_complete
bluetooth
|
22 |
syz |
|
|
179 |
379d |
453d
|
1/29 |
never |
Bluetooth: Fix double free in hci_req_sync_complete
|
KASAN: null-ptr-deref Write in l2cap_sock_resume_cb (4)
bluetooth
|
12 |
C |
|
|
8 |
12d |
12d
|
21/29 |
never |
a0075accbf0d
Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()
|
KASAN: slab-use-after-free Read in mgmt_remove_adv_monitor_complete (3)
bluetooth
|
19 |
C |
|
|
5 |
43d |
66d
|
22/29 |
never |
e6ed54e86aae
Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete
|
KASAN: slab-use-after-free Read in hci_sock_get_channel
bluetooth
|
19 |
syz |
|
|
1 |
59d |
55d
|
23/29 |
never |
6fe26f694c82
Bluetooth: MGMT: Protect mgmt_pending list with its own lock
|
BUG: corrupted list in mgmt_pending_remove
bluetooth
|
19 |
C |
error |
|
44 |
50d |
321d
|
22/29 |
never |
6fe26f694c82
Bluetooth: MGMT: Protect mgmt_pending list with its own lock
|
KASAN: slab-out-of-bounds Read in hci_cmd_sync_alloc
bluetooth
|
17 |
C |
|
|
4 |
66d |
76d
|
23/29 |
never |
03f1700b9b4d
Bluetooth: MGMT: reject malformed HCI_CMD_SYNC commands
|
KASAN: slab-use-after-free Read in skb_queue_purge_reason (3)
bluetooth
|
19 |
|
|
|
5 |
25d |
33d
|
23/29 |
never |
1d6123102e9f
Bluetooth: hci_core: Fix use-after-free in vhci_flush()
|
KASAN: vmalloc-out-of-bounds Read in hci_devcd_dump
bluetooth
|
17 |
C |
|
|
1253 |
11h43m |
110d
|
2/29 |
never |
Bluetooth: hci_devcd_dump: fix out-of-bounds via dev_coredumpv
|
general protection fault in lookup_or_create_module_kobject
usb
bluetooth
|
2 |
C |
|
|
266 |
71d |
75d
|
29/29 |
11d |
a6aeb739974e
module: ensure that kobject_put() is safe for module type kobjects
|
KASAN: slab-use-after-free Read in skb_queue_purge_reason (2)
bluetooth
|
19 |
C |
done |
|
132 |
44d |
428d
|
28/29 |
39d |
5df5dafc171b
Bluetooth: hci_uart: Fix another race during initialization
|
KASAN: slab-use-after-free Read in l2cap_send_cmd
bluetooth
|
19 |
C |
done |
|
34 |
179d |
509d
|
28/29 |
39d |
b4f82f9ed43a
Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd
|
BUG: corrupted list in hci_chan_del (2)
bluetooth
|
19 |
C |
done |
|
502 |
159d |
163d
|
28/29 |
39d |
ab4eedb790ca
Bluetooth: L2CAP: Fix corrupted list in hci_chan_del
|
KASAN: slab-use-after-free Read in sco_sock_connect
bluetooth
|
19 |
syz |
|
|
1 |
238d |
236d
|
28/29 |
74d |
ed9588554943
Bluetooth: SCO: remove the redundant sco_conn_put
|
BUG: sleeping function called from invalid context in hci_le_create_big_complete_evt
bluetooth
|
5 |
C |
done |
|
380 |
225d |
468d
|
28/29 |
74d |
4d94f0555827
Bluetooth: hci_core: Fix sleeping function called from invalid context
|
KASAN: slab-use-after-free Read in set_powered_sync
bluetooth
|
19 |
C |
done |
|
153 |
233d |
369d
|
28/29 |
74d |
0b882940665c
Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync
|
KASAN: slab-use-after-free Read in mgmt_remove_adv_monitor_sync
bluetooth
|
19 |
syz |
|
|
40 |
188d |
360d
|
28/29 |
74d |
26fbd3494a7d
Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync
|
KMSAN: uninit-value in hci_rx_work
bluetooth
|
7 |
C |
|
|
29 |
242d |
361d
|
28/29 |
215d |
3fe288a8214e
Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet
|
WARNING in hci_conn_timeout
bluetooth
|
-1 |
C |
done |
|
6022 |
215d |
1813d
|
28/29 |
215d |
2b0f2fc9ed62
Bluetooth: hci_conn: Use disable_delayed_work_sync
|
KASAN: slab-use-after-free Write in sco_sock_timeout
bluetooth
|
24 |
C |
done |
|
275 |
267d |
611d
|
28/29 |
235d |
1bf4470a3939
Bluetooth: SCO: Fix UAF on sco_sock_timeout
|
possible deadlock in rfcomm_sk_state_change
bluetooth
|
4 |
C |
done |
|
22650 |
277d |
1405d
|
28/29 |
249d |
08d1914293da
Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
|
KASAN: slab-use-after-free Read in l2cap_connect (2)
bluetooth
|
19 |
C |
done |
|
8 |
301d |
390d
|
28/29 |
249d |
333b4fd11e89
Bluetooth: L2CAP: Fix uaf in l2cap_connect
|
BUG: workqueue leaked atomic, lock or RCU: kworker/u33:NUM[NUM]
bluetooth
|
-1 |
C |
|
|
13 |
345d |
358d
|
28/29 |
289d |
c531e63871c0
Bluetooth: l2cap: always unlock channel in l2cap_conless_channel()
|
WARNING in __hci_cmd_sync_sk
bluetooth
|
-1 |
syz |
|
|
36 |
360d |
375d
|
27/29 |
336d |
f1a8f402f13f
Bluetooth: L2CAP: Fix deadlock
|
WARNING in btusb_submit_intr_urb/usb_submit_urb
usb
bluetooth
|
-1 |
C |
error |
|
2 |
378d |
388d
|
27/29 |
339d |
a368ecde8a50
USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor
|
general protection fault in l2cap_sock_recv_cb
bluetooth
|
8 |
C |
inconclusive |
|
8 |
381d |
407d
|
26/29 |
347d |
89e856e124f9
bluetooth/l2cap: sync sock recv cb and release
|
possible deadlock in __flush_workqueue
bluetooth
|
4 |
|
|
|
1456 |
350d |
549d
|
26/29 |
347d |
0d151a103775
Bluetooth: hci_core: cancel all works upon hci_unregister_dev()
|
WARNING in hci_conn_del
bluetooth
|
-1 |
C |
done |
|
10497 |
376d |
507d
|
26/29 |
347d |
015d79c96d62
Bluetooth: Ignore too large handle values in BIG
1cc18c2ab2e8
bluetooth/hci: disallow setting handle bigger than HCI_CONN_HANDLE_MAX
|
BUG: soft lockup in hci_cmd_timeout
bluetooth
usb
|
1 |
C |
|
|
1 |
406d |
402d
|
26/29 |
375d |
22f008128625
USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
|
general protection fault in btintel_read_version
bluetooth
|
2 |
C |
error |
|
5 |
538d |
549d
|
25/29 |
465d |
b79e04091010
Bluetooth: btintel: Fix null ptr deref in btintel_read_version
|
KASAN: slab-use-after-free Write in __hci_acl_create_connection_sync
bluetooth
|
24 |
C |
done |
|
87 |
516d |
527d
|
25/29 |
465d |
5f641f03abcc
Bluetooth: hci_conn: Fix UAF Write in __hci_acl_create_connection_sync
|
memory leak in corrupted
bluetooth
|
3 |
syz |
|
|
536 |
478d |
550d
|
25/29 |
478d |
0a186b49bba5
batman-adv: mcast: fix memory leak on deleting a batman-adv interface
|
KASAN: null-ptr-deref Read in ida_free (4)
bluetooth
|
11 |
C |
done |
done |
29 |
574d |
613d
|
25/29 |
521d |
af73483f4e8b
ida: Fix crash in ida_free when the bitmap is empty
|
possible deadlock in hci_rfkill_set_block
bluetooth
|
4 |
C |
done |
|
3391 |
562d |
634d
|
25/29 |
530d |
769bf60e17ee
Bluetooth: Fix deadlock in vhci_send_frame
|
KASAN: slab-out-of-bounds Read in create_monitor_event
bluetooth
|
17 |
C |
done |
|
952 |
635d |
649d
|
25/29 |
576d |
18f547f3fc07
Bluetooth: hci_sock: fix slab oob read in create_monitor_event
|
BUG: sleeping function called from invalid context in __hci_cmd_sync_sk
bluetooth
|
5 |
C |
done |
|
34 |
646d |
763d
|
25/29 |
576d |
acab8ff29a2a
Bluetooth: ISO: Fix invalid context error
|
general protection fault in sco_conn_add
bluetooth
|
2 |
C |
done |
|
4 |
732d |
741d
|
23/29 |
646d |
b4066eb04bb6
Bluetooth: hci_conn: return ERR_PTR instead of NULL when there is no link
|
KASAN: slab-use-after-free Write in sco_chan_del
bluetooth
|
24 |
C |
done |
|
19 |
662d |
796d
|
23/29 |
646d |
3344d318337d
Bluetooth: hci_conn: fail SCO/ISO via hci_conn_failed if ACL gone early
|
INFO: rcu detected stall in hci_cmd_timeout
bluetooth
|
1 |
|
|
|
1 |
709d |
709d
|
23/29 |
646d |
8c21ab1bae94
net/sched: fq_pie: avoid stalls in fq_pie_timer()
|
KASAN: slab-use-after-free Read in hci_conn_del
bluetooth
|
19 |
|
|
|
7 |
786d |
809d
|
22/29 |
749d |
ca1fd42e7dbf
Bluetooth: Fix potential double free caused by hci_conn_unlink
|
possible deadlock in sco_conn_del
bluetooth
|
4 |
C |
done |
done |
279 |
795d |
1199d
|
22/29 |
749d |
a2ac591cb4d8
Bluetooth: Fix UAF in hci_conn_hash_flush again
|
KASAN: slab-use-after-free Read in hci_conn_hash_flush
bluetooth
|
24 |
C |
error |
|
3511 |
775d |
868d
|
22/29 |
749d |
a2ac591cb4d8
Bluetooth: Fix UAF in hci_conn_hash_flush again
ca1fd42e7dbf
Bluetooth: Fix potential double free caused by hci_conn_unlink
|
INFO: task hung in rfcomm_process_sessions (2)
bluetooth
|
1 |
C |
error |
done |
14 |
934d |
1207d
|
22/29 |
772d |
1d80d57ffcb5
Bluetooth: Fix possible deadlock in rfcomm_sk_state_change
|
WARNING: bad unlock balance in l2cap_recv_frame
bluetooth
|
4 |
|
|
|
75 |
814d |
826d
|
22/29 |
772d |
25e97f7b1866
Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp
|
KASAN: use-after-free Read in mgmt_pending_remove
bluetooth
|
19 |
C |
unreliable |
|
9 |
1047d |
1067d
|
22/29 |
876d |
3cfbc6ac22d6
Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor()
Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor()
|
WARNING: ODEBUG bug in mgmt_index_removed
bluetooth
|
-1 |
|
|
|
1 |
1049d |
1045d
|
22/29 |
876d |
f74ca25d6d66
Bluetooth: avoid hci_dev_test_and_set_flag() in mgmt_init_hdev()
|
KASAN: use-after-free Write in sco_sock_timeout
bluetooth
|
24 |
C |
done |
|
272 |
1151d |
1423d
|
22/29 |
876d |
7aa1e7d15f8a
Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout
|
INFO: task hung in hci_dev_close_sync
bluetooth
|
1 |
C |
unreliable |
|
2366 |
1017d |
1173d
|
22/29 |
876d |
e36bea6e78ab
Bluetooth: core: Fix deadlock on hci_power_on_sync.
|
BUG: corrupted list in hci_conn_add_sysfs
bluetooth
|
19 |
C |
error |
done |
9 |
1030d |
1030d
|
22/29 |
876d |
448a496f7606
Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times
|
WARNING: ODEBUG bug in __cancel_work
bluetooth
|
-1 |
C |
inconclusive |
|
1 |
1069d |
1065d
|
22/29 |
876d |
2d2cb3066f2c
Bluetooth: L2CAP: initialize delayed works at l2cap_chan_create()
|
upstream test error: WARNING: ODEBUG bug in mgmt_index_removed
bluetooth
|
-1 |
|
|
|
551 |
1073d |
1080d
|
22/29 |
876d |
3f2893d3c142
Bluetooth: don't try to cancel uninitialized works at mgmt_index_removed()
|
memory leak in vhci_write
bluetooth
|
3 |
C |
|
|
1 |
1068d |
1064d
|
22/29 |
876d |
7c9524d92964
Bluetooth: L2CAP: Fix memory leak in vhci_write
|
INFO: trying to register non-static key in hci_uart_flush (2)
bluetooth
|
-1 |
syz |
error |
error |
37 |
1004d |
2146d
|
22/29 |
876d |
3124d320c22f
Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure
|
WARNING: ODEBUG bug in bt_host_release
bluetooth
|
-1 |
syz |
done |
done |
7 |
1558d |
1812d
|
22/29 |
1033d |
e2cb6b891ad2
bluetooth: eliminate the potential race condition when removing the HCI controller
|
general protection fault in hci_inquiry_result_with_rssi_evt
bluetooth
|
2 |
C |
done |
|
17 |
1289d |
1314d
|
20/29 |
1157d |
72279d17df54
Bluetooth: hci_event: Rework hci_inquiry_result_with_rssi_evt
|
KASAN: slab-out-of-bounds Read in add_adv_patterns_monitor
bluetooth
|
17 |
C |
error |
done |
5 |
1612d |
1633d
|
20/29 |
1164d |
b4a221ea8a1f
Bluetooth: advmon offload MSFT add rssi support
|
INFO: trying to register non-static key in l2cap_sock_teardown_cb
bluetooth
|
-1 |
C |
done |
done |
88 |
1357d |
1660d
|
20/29 |
1229d |
1bff51ea59a9
Bluetooth: fix use-after-free error in lock_sock_nested()
|
KASAN: null-ptr-deref Write in l2cap_chan_put
bluetooth
|
23 |
syz |
done |
done |
7 |
1361d |
1806d
|
20/29 |
1229d |
1bff51ea59a9
Bluetooth: fix use-after-free error in lock_sock_nested()
|
memory leak in mgmt_cmd_complete
bluetooth
|
3 |
C |
|
|
3 |
1424d |
1524d
|
20/29 |
1229d |
709fca500067
Bluetooth: hci_sock: purge socket queues in the destruct() callback
|
KASAN: slab-out-of-bounds Read in hci_le_meta_evt (2)
bluetooth
|
17 |
C |
inconclusive |
|
2 |
1357d |
1357d
|
20/29 |
1229d |
3a56ef719f0b
Bluetooth: stop proccessing malicious adv data
|
BUG: sleeping function called from invalid context in lock_sock_nested (2)
bluetooth
|
5 |
C |
done |
error |
19391 |
1438d |
1974d
|
20/29 |
1347d |
e04480920d1e
Bluetooth: defer cleanup of resources in hci_unregister_dev()
Bluetooth: defer cleanup of resources in hci_unregister_dev()
|
INFO: trying to register non-static key in l2cap_chan_del
bluetooth
|
-1 |
syz |
inconclusive |
|
73 |
1590d |
1809d
|
20/29 |
1347d |
3af70b39fa2d
Bluetooth: check for zapped sk before connecting
|
inconsistent lock state in sco_sock_timeout
bluetooth
|
4 |
C |
done |
|
16 |
1452d |
1797d
|
20/29 |
1347d |
ba316be1b6a0
Bluetooth: schedule SCO timeouts with delayed_work
|
general protection fault in hci_release_dev
bluetooth
|
2 |
C |
done |
|
41 |
1426d |
1447d
|
20/29 |
1347d |
e04480920d1e
Bluetooth: defer cleanup of resources in hci_unregister_dev()
|
INFO: trying to register non-static key in skb_dequeue
bluetooth
|
-1 |
C |
error |
|
28951 |
1533d |
1814d
|
20/29 |
1347d |
be8597239379
Bluetooth: initialize skb_queue_head at l2cap_chan_create()
|
BUG: corrupted list in kobject_add_internal (3)
bluetooth
|
8 |
C |
inconclusive |
|
3 |
1383d |
1488d
|
20/29 |
1347d |
92fe24a7db75
Bluetooth: skip invalid hci_sync_conn_complete_evt
|
KASAN: use-after-free Read in hci_send_acl
bluetooth
|
19 |
C |
done |
|
2 |
1601d |
1812d
|
20/29 |
1347d |
5c4c8c954409
Bluetooth: verify AMP hci_chan before amp_destroy
|
INFO: task hung in hci_req_sync
bluetooth
|
1 |
C |
inconclusive |
|
1 |
1441d |
1437d
|
20/29 |
1347d |
f41a4b2b5eb7
Bluetooth: add timeout sanity check to hci_inquiry
|
KASAN: null-ptr-deref Write in amp_read_loc_assoc_final_data
bluetooth
|
12 |
C |
done |
|
185 |
1613d |
1814d
|
20/29 |
1562d |
e8bd76ede155
Bluetooth: Fix null pointer dereference in amp_read_loc_assoc_final_data
|
KASAN: slab-out-of-bounds Read in hci_le_meta_evt
bluetooth
|
17 |
C |
error |
error |
45 |
1690d |
1811d
|
19/29 |
1592d |
f7e0e8b2f1b0
Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt()
|
memory leak in h5_rx_pkt_start
bluetooth
|
3 |
C |
|
|
5 |
1789d |
2133d
|
19/29 |
1592d |
70f259a3f427
Bluetooth: hci_h5: close serdev device and free hu in h5_close
855af2d74c87
Bluetooth: hci_h5: fix memory leak in h5_close
|
KASAN: use-after-free Write in __sco_sock_close
bluetooth
|
24 |
C |
done |
done |
10 |
1714d |
1812d
|
19/29 |
1592d |
6dfccd13db2f
Bluetooth: Fix null pointer dereference in hci_event_packet()
|
general protection fault in hci_event_packet
bluetooth
|
2 |
C |
done |
|
25 |
1759d |
1812d
|
19/29 |
1592d |
6dfccd13db2f
Bluetooth: Fix null pointer dereference in hci_event_packet()
|
BUG: corrupted list in kobject_add_internal
bluetooth
|
8 |
C |
done |
done |
9 |
1744d |
1807d
|
15/29 |
1706d |
a46b7ed4d52d
Bluetooth: Fix auto-creation of hci_conn at Conn Complete event
|
WARNING: refcount bug in do_enable_set
bluetooth
|
13 |
C |
inconclusive |
done |
8 |
1808d |
1918d
|
15/29 |
1706d |
b83764f9220a
Bluetooth: Fix kernel oops triggered by hci_adv_monitors_clear()
|
KASAN: use-after-free Write in refcount_warn_saturate
bluetooth
|
24 |
C |
inconclusive |
done |
2 |
1810d |
1968d
|
15/29 |
1706d |
b83764f9220a
Bluetooth: Fix kernel oops triggered by hci_adv_monitors_clear()
|
memory leak in read_adv_mon_features
bluetooth
|
3 |
C |
|
|
2 |
1775d |
1799d
|
15/29 |
1706d |
cafd472a10ff
Bluetooth: Fix memory leak in read_adv_mon_features()
|
KASAN: slab-out-of-bounds Read in hci_extended_inquiry_result_evt
bluetooth
|
17 |
C |
|
|
16 |
1810d |
1837d
|
15/29 |
1767d |
51c19bf3d5cf
Bluetooth: Fix slab-out-of-bounds read in hci_extended_inquiry_result_evt()
|
KASAN: slab-out-of-bounds Read in hci_inquiry_result_with_rssi_evt
bluetooth
|
17 |
C |
error |
|
9 |
1812d |
1832d
|
15/29 |
1767d |
629b49c848ee
Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_with_rssi_evt()
|
WARNING: ODEBUG bug in rfcomm_dev_ioctl
bluetooth
|
-1 |
|
|
|
1 |
1960d |
1960d
|
15/29 |
1896d |
71811cac8532
Bluetooth: RFCOMM: fix ODEBUG bug in rfcomm_dev_ioctl
|
linux-next test error: KASAN: use-after-free Read in l2cap_sock_release
bluetooth
|
-1 |
|
|
|
12 |
1991d |
1993d
|
15/29 |
1896d |
2a154903cec2
Bluetooth: prefetch channel before killing sock
|
KASAN: use-after-free Write in hci_sock_bind
bluetooth
|
24 |
|
|
|
4 |
1980d |
2012d
|
15/29 |
1978d |
11eb85ec42dc
Bluetooth: Fix race condition in hci_release_sock()
|
KMSAN: use-after-free in kfree_skb
bluetooth
|
18 |
syz |
|
|
34 |
2062d |
2111d
|
15/29 |
2045d |
cf94da6f502d
Bluetooth: Fix invalid-free in bcsp_close()
|
KMSAN: use-after-free in skb_dequeue
bluetooth
|
18 |
C |
|
|
1 |
2105d |
2105d
|
15/29 |
2045d |
cf94da6f502d
Bluetooth: Fix invalid-free in bcsp_close()
|
KASAN: invalid-free in skb_free_head
bluetooth
|
22 |
C |
done |
|
1 |
2087d |
2087d
|
15/29 |
2045d |
cf94da6f502d
Bluetooth: Fix invalid-free in bcsp_close()
|
general protection fault in qca_setup
bluetooth
|
2 |
C |
done |
done |
6 |
2350d |
2350d
|
13/29 |
2079d |
b36a1552d731
Bluetooth: hci_uart: check for missing tty operations
|
BUG: unable to handle kernel NULL pointer dereference in hci_uart_set_flow_control
bluetooth
|
10 |
C |
done |
|
7 |
2312d |
2312d
|
12/29 |
2166d |
b36a1552d731
Bluetooth: hci_uart: check for missing tty operations
|
memory leak in bcsp_recv
bluetooth
|
3 |
C |
|
|
3 |
2220d |
2247d
|
12/29 |
2175d |
4ce9146e0370
Bluetooth: hci_bcsp: Fix memory leak in rx_skb
|
WARNING in lockdep_unregister_key
bluetooth
|
-1 |
C |
done |
|
214 |
2308d |
2322d
|
11/29 |
2301d |
82efcab3b9f3
workqueue: Only unregister a registered lockdep key
|
general protection fault in hci_uart_write_work
bluetooth
|
2 |
C |
|
|
84 |
2329d |
2378d
|
11/29 |
2305d |
32a7b4cbe93b
Bluetooth: hci_ldisc: Initialize hci_dev before open()
|
KASAN: use-after-free Read in h5_reset_rx
bluetooth
|
19 |
|
|
|
2 |
2336d |
2341d
|
11/29 |
2305d |
56897b217a1d
Bluetooth: hci_ldisc: Postpone HCI_UART_PROTO_READY bit set in hci_uart_set_proto()
|
BUG: unable to handle kernel paging request in h4_recv_buf
bluetooth
|
8 |
C |
|
|
203 |
2328d |
2390d
|
11/29 |
2305d |
1dc2d785156c
Bluetooth: hci_uart: Check if socket buffer is ERR_PTR in h4_recv_buf()
|