lkml.org 
[lkml]   [2014]   [Sep]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.10 46/71] Bluetooth: Avoid use of session socket after the session gets freed
    Date
    3.10-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Vignesh Raman <Vignesh_Raman@mentor.com>

    commit 32333edb82fb2009980eefc5518100068147ab82 upstream.

    The commits 08c30aca9e698faddebd34f81e1196295f9dc063 "Bluetooth: Remove
    RFCOMM session refcnt" and 8ff52f7d04d9cc31f1e81dcf9a2ba6335ed34905
    "Bluetooth: Return RFCOMM session ptrs to avoid freed session"
    allow rfcomm_recv_ua and rfcomm_session_close to delete the session
    (and free the corresponding socket) and propagate NULL session pointer
    to the upper callers.

    Additional fix is required to terminate the loop in rfcomm_process_rx
    function to avoid use of freed 'sk' memory.

    The issue is only reproducible with kernel option CONFIG_PAGE_POISONING
    enabled making freed memory being changed and filled up with fixed char
    value used to unmask use-after-free issues.

    Signed-off-by: Vignesh Raman <Vignesh_Raman@mentor.com>
    Signed-off-by: Vitaly Kuzmichev <Vitaly_Kuzmichev@mentor.com>
    Acked-by: Dean Jenkins <Dean_Jenkins@mentor.com>
    Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    net/bluetooth/rfcomm/core.c | 7 +++++--
    1 file changed, 5 insertions(+), 2 deletions(-)

    --- a/net/bluetooth/rfcomm/core.c
    +++ b/net/bluetooth/rfcomm/core.c
    @@ -1857,10 +1857,13 @@ static struct rfcomm_session *rfcomm_pro
    /* Get data directly from socket receive queue without copying it. */
    while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
    skb_orphan(skb);
    - if (!skb_linearize(skb))
    + if (!skb_linearize(skb)) {
    s = rfcomm_recv_frame(s, skb);
    - else
    + if (!s)
    + break;
    + } else {
    kfree_skb(skb);
    + }
    }

    if (s && (sk->sk_state == BT_CLOSED))



    \
     
     \ /
      Last update: 2014-09-15 22:21    [W:4.138 / U:0.096 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site