projects
/
platform
/
kernel
/
linux-rpi.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
046182d
)
Bluetooth: sco: Fix crash when using BT_SNDMTU/BT_RCVMTU option
author
Wei Yongjun
<weiyongjun1@huawei.com>
Mon, 16 Nov 2020 13:24:21 +0000
(21:24 +0800)
committer
Greg Kroah-Hartman
<gregkh@linuxfoundation.org>
Wed, 30 Dec 2020 10:53:40 +0000
(11:53 +0100)
[ Upstream commit
f6b8c6b5543983e9de29dc14716bfa4eb3f157c4
]
This commit add the invalid check for connected socket, without it will
causes the following crash due to sco_pi(sk)->conn being NULL:
KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057]
CPU: 3 PID: 4284 Comm: test_sco Not tainted 5.10.0-rc3+ #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1 04/01/2014
RIP: 0010:sco_sock_getsockopt+0x45d/0x8e0
Code: 48 c1 ea 03 80 3c 02 00 0f 85 ca 03 00 00 49 8b 9d f8 04 00 00 48 b8 00
00 00 00 00 fc ff df 48 8d 7b 50 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84
c0 74 08 3c 03 0f 8e b5 03 00 00 8b 43 50 48 8b 0c
RSP: 0018:
ffff88801bb17d88
EFLAGS:
00010206
RAX:
dffffc0000000000
RBX:
0000000000000000
RCX:
ffffffff83a4ecdf
RDX:
000000000000000a
RSI:
ffffc90002fce000
RDI:
0000000000000050
RBP:
1ffff11003762fb4
R08:
0000000000000001
R09:
ffff88810e1008c0
R10:
ffffffffbd695dcf
R11:
fffffbfff7ad2bb9
R12:
0000000000000000
R13:
ffff888018ff1000
R14:
dffffc0000000000
R15:
000000000000000d
FS:
00007fb4f76c1700
(0000) GS:
ffff88811af80000
(0000) knlGS:
0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033
CR2:
00005555e3b7a938
CR3:
00000001117be001
CR4:
0000000000770ee0
DR0:
0000000000000000
DR1:
0000000000000000
DR2:
0000000000000000
DR3:
0000000000000000
DR6:
00000000fffe0ff0
DR7:
0000000000000400
PKRU:
55555554
Call Trace:
? sco_skb_put_cmsg+0x80/0x80
? sco_skb_put_cmsg+0x80/0x80
__sys_getsockopt+0x12a/0x220
? __ia32_sys_setsockopt+0x150/0x150
? syscall_enter_from_user_mode+0x18/0x50
? rcu_read_lock_bh_held+0xb0/0xb0
__x64_sys_getsockopt+0xba/0x150
? syscall_enter_from_user_mode+0x1d/0x50
do_syscall_64+0x33/0x40
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Fixes:
0fc1a726f897
("Bluetooth: sco: new getsockopt options BT_SNDMTU/BT_RCVMTU")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Reviewed-by: Luiz Augusto Von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/bluetooth/sco.c
patch
|
blob
|
history
diff --git
a/net/bluetooth/sco.c
b/net/bluetooth/sco.c
index
79ffcde
..
22a110f
100644
(file)
--- a/
net/bluetooth/sco.c
+++ b/
net/bluetooth/sco.c
@@
-1003,6
+1003,11
@@
static int sco_sock_getsockopt(struct socket *sock, int level, int optname,
case BT_SNDMTU:
case BT_RCVMTU:
+ if (sk->sk_state != BT_CONNECTED) {
+ err = -ENOTCONN;
+ break;
+ }
+
if (put_user(sco_pi(sk)->conn->mtu, (u32 __user *)optval))
err = -EFAULT;
break;