* [PATCH] net: bluetooth: cmtp: fix file refcount when cmtp_attach_device fails
@ 2021-04-13 16:21 Thadeu Lima de Souza Cascardo
2021-04-13 17:50 ` bluez.test.bot
2021-04-13 18:40 ` [PATCH] " Marcel Holtmann
0 siblings, 2 replies; 3+ messages in thread
From: Thadeu Lima de Souza Cascardo @ 2021-04-13 16:21 UTC (permalink / raw)
To: linux-bluetooth
Cc: netdev, kuba, davem, isdn, marcel, johan.hedberg, luiz.dentz,
Thadeu Lima de Souza Cascardo
When cmtp_attach_device fails, cmtp_add_connection returns the error value
which leads to the caller to doing fput through sockfd_put. But
cmtp_session kthread, which is stopped in this path will also call fput,
leading to a potential refcount underflow or a use-after-free.
Add a refcount before we signal the kthread to stop. The kthread will try
to grab the cmtp_session_sem mutex before doing the fput, which is held
when get_file is called, so there should be no races there.
Reported-by: Ryota Shiga
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
---
net/bluetooth/cmtp/core.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c
index 07cfa3249f83..0a2d78e811cf 100644
--- a/net/bluetooth/cmtp/core.c
+++ b/net/bluetooth/cmtp/core.c
@@ -392,6 +392,11 @@ int cmtp_add_connection(struct cmtp_connadd_req *req, struct socket *sock)
if (!(session->flags & BIT(CMTP_LOOPBACK))) {
err = cmtp_attach_device(session);
if (err < 0) {
+ /* Caller will call fput in case of failure, and so
+ * will cmtp_session kthread.
+ */
+ get_file(session->sock->file);
+
atomic_inc(&session->terminate);
wake_up_interruptible(sk_sleep(session->sock->sk));
up_write(&cmtp_session_sem);
--
2.27.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* RE: net: bluetooth: cmtp: fix file refcount when cmtp_attach_device fails
2021-04-13 16:21 [PATCH] net: bluetooth: cmtp: fix file refcount when cmtp_attach_device fails Thadeu Lima de Souza Cascardo
@ 2021-04-13 17:50 ` bluez.test.bot
2021-04-13 18:40 ` [PATCH] " Marcel Holtmann
1 sibling, 0 replies; 3+ messages in thread
From: bluez.test.bot @ 2021-04-13 17:50 UTC (permalink / raw)
To: linux-bluetooth, cascardo
[-- Attachment #1: Type: text/plain, Size: 2034 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=466489
---Test result---
##############################
Test: CheckPatch - FAIL
net: bluetooth: cmtp: fix file refcount when cmtp_attach_device fails
ERROR: Unrecognized email address: 'Ryota Shiga'
#16:
Reported-by: Ryota Shiga
total: 1 errors, 0 warnings, 0 checks, 11 lines checked
NOTE: For some of the reported defects, checkpatch may be able to
mechanically convert to the typical style using --fix or --fix-inplace.
"[PATCH] net: bluetooth: cmtp: fix file refcount when" has style problems, please review.
NOTE: If any of the errors are false positives, please report
them to the maintainer, see CHECKPATCH in MAINTAINERS.
##############################
Test: CheckGitLint - PASS
##############################
Test: CheckBuildK - PASS
##############################
Test: CheckTestRunner: Setup - PASS
##############################
Test: CheckTestRunner: l2cap-tester - PASS
Total: 40, Passed: 34 (85.0%), Failed: 0, Not Run: 6
##############################
Test: CheckTestRunner: bnep-tester - PASS
Total: 1, Passed: 1 (100.0%), Failed: 0, Not Run: 0
##############################
Test: CheckTestRunner: mgmt-tester - PASS
Total: 416, Passed: 402 (96.6%), Failed: 0, Not Run: 14
##############################
Test: CheckTestRunner: rfcomm-tester - PASS
Total: 9, Passed: 9 (100.0%), Failed: 0, Not Run: 0
##############################
Test: CheckTestRunner: sco-tester - PASS
Total: 8, Passed: 8 (100.0%), Failed: 0, Not Run: 0
##############################
Test: CheckTestRunner: smp-tester - PASS
Total: 8, Passed: 8 (100.0%), Failed: 0, Not Run: 0
##############################
Test: CheckTestRunner: userchan-tester - PASS
Total: 3, Passed: 3 (100.0%), Failed: 0, Not Run: 0
---
Regards,
Linux Bluetooth
[-- Attachment #2: l2cap-tester.log --]
[-- Type: application/octet-stream, Size: 43346 bytes --]
[-- Attachment #3: bnep-tester.log --]
[-- Type: application/octet-stream, Size: 3536 bytes --]
[-- Attachment #4: mgmt-tester.log --]
[-- Type: application/octet-stream, Size: 546684 bytes --]
[-- Attachment #5: rfcomm-tester.log --]
[-- Type: application/octet-stream, Size: 11657 bytes --]
[-- Attachment #6: sco-tester.log --]
[-- Type: application/octet-stream, Size: 9892 bytes --]
[-- Attachment #7: smp-tester.log --]
[-- Type: application/octet-stream, Size: 11803 bytes --]
[-- Attachment #8: userchan-tester.log --]
[-- Type: application/octet-stream, Size: 5433 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] net: bluetooth: cmtp: fix file refcount when cmtp_attach_device fails
2021-04-13 16:21 [PATCH] net: bluetooth: cmtp: fix file refcount when cmtp_attach_device fails Thadeu Lima de Souza Cascardo
2021-04-13 17:50 ` bluez.test.bot
@ 2021-04-13 18:40 ` Marcel Holtmann
1 sibling, 0 replies; 3+ messages in thread
From: Marcel Holtmann @ 2021-04-13 18:40 UTC (permalink / raw)
To: Thadeu Lima de Souza Cascardo
Cc: open list:BLUETOOTH DRIVERS, netdev, Jakub Kicinski,
David S. Miller, isdn, Johan Hedberg, Luiz Augusto von Dentz
Hi Thadeu,
> When cmtp_attach_device fails, cmtp_add_connection returns the error value
> which leads to the caller to doing fput through sockfd_put. But
> cmtp_session kthread, which is stopped in this path will also call fput,
> leading to a potential refcount underflow or a use-after-free.
>
> Add a refcount before we signal the kthread to stop. The kthread will try
> to grab the cmtp_session_sem mutex before doing the fput, which is held
> when get_file is called, so there should be no races there.
>
> Reported-by: Ryota Shiga
> Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
> ---
> net/bluetooth/cmtp/core.c | 5 +++++
> 1 file changed, 5 insertions(+)
Patch has been applied to bluetooth-next tree.
Regards
Marcel
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-04-13 18:40 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-04-13 16:21 [PATCH] net: bluetooth: cmtp: fix file refcount when cmtp_attach_device fails Thadeu Lima de Souza Cascardo
2021-04-13 17:50 ` bluez.test.bot
2021-04-13 18:40 ` [PATCH] " Marcel Holtmann
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.