From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
syzbot+257790c15bcdef6fe00c@syzkaller.appspotmail.com,
Jeremy Cline <jcline@redhat.com>,
Marcel Holtmann <marcel@holtmann.org>
Subject: [PATCH 5.0 39/52] Bluetooth: hci_ldisc: Initialize hci_dev before open()
Date: Tue, 26 Mar 2019 15:30:26 +0900 [thread overview]
Message-ID: <20190326042703.053632903@linuxfoundation.org> (raw)
In-Reply-To: <20190326042700.963224437@linuxfoundation.org>
5.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeremy Cline <jcline@redhat.com>
commit 32a7b4cbe93b0a0ef7e63d31ca69ce54736c4412 upstream.
The hci_dev struct hdev is referenced in work queues and timers started
by open() in some protocols. This creates a race between the
initialization function and the work or timer which can result hdev
being dereferenced while it is still null.
The syzbot report contains a reliable reproducer which causes a null
pointer dereference of hdev in hci_uart_write_work() by making the
memory allocation for hdev fail.
To fix this, ensure hdev is valid from before calling a protocol's
open() until after calling a protocol's close().
Reported-by: syzbot+257790c15bcdef6fe00c@syzkaller.appspotmail.com
Signed-off-by: Jeremy Cline <jcline@redhat.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bluetooth/hci_ldisc.c | 21 ++++++++++++++-------
1 file changed, 14 insertions(+), 7 deletions(-)
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -207,11 +207,11 @@ void hci_uart_init_work(struct work_stru
err = hci_register_dev(hu->hdev);
if (err < 0) {
BT_ERR("Can't register HCI device");
+ clear_bit(HCI_UART_PROTO_READY, &hu->flags);
+ hu->proto->close(hu);
hdev = hu->hdev;
hu->hdev = NULL;
hci_free_dev(hdev);
- clear_bit(HCI_UART_PROTO_READY, &hu->flags);
- hu->proto->close(hu);
return;
}
@@ -616,6 +616,7 @@ static void hci_uart_tty_receive(struct
static int hci_uart_register_dev(struct hci_uart *hu)
{
struct hci_dev *hdev;
+ int err;
BT_DBG("");
@@ -659,11 +660,22 @@ static int hci_uart_register_dev(struct
else
hdev->dev_type = HCI_PRIMARY;
+ /* Only call open() for the protocol after hdev is fully initialized as
+ * open() (or a timer/workqueue it starts) may attempt to reference it.
+ */
+ err = hu->proto->open(hu);
+ if (err) {
+ hu->hdev = NULL;
+ hci_free_dev(hdev);
+ return err;
+ }
+
if (test_bit(HCI_UART_INIT_PENDING, &hu->hdev_flags))
return 0;
if (hci_register_dev(hdev) < 0) {
BT_ERR("Can't register HCI device");
+ hu->proto->close(hu);
hu->hdev = NULL;
hci_free_dev(hdev);
return -ENODEV;
@@ -683,17 +695,12 @@ static int hci_uart_set_proto(struct hci
if (!p)
return -EPROTONOSUPPORT;
- err = p->open(hu);
- if (err)
- return err;
-
hu->proto = p;
set_bit(HCI_UART_PROTO_READY, &hu->flags);
err = hci_uart_register_dev(hu);
if (err) {
clear_bit(HCI_UART_PROTO_READY, &hu->flags);
- p->close(hu);
return err;
}
next prev parent reply other threads:[~2019-03-26 6:40 UTC|newest]
Thread overview: 61+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-03-26 6:29 [PATCH 5.0 00/52] 5.0.5-stable review Greg Kroah-Hartman
2019-03-26 6:29 ` [PATCH 5.0 01/52] ALSA: hda - add Lenovo IdeaCentre B550 to the power_save_blacklist Greg Kroah-Hartman
2019-03-26 6:29 ` [PATCH 5.0 02/52] ALSA: firewire-motu: use version field of unit directory to identify model Greg Kroah-Hartman
2019-03-26 6:29 ` [PATCH 5.0 03/52] mmc: pxamci: fix enum type confusion Greg Kroah-Hartman
2019-03-26 6:29 ` [PATCH 5.0 04/52] mmc: alcor: fix DMA reads Greg Kroah-Hartman
2019-03-26 6:29 ` [PATCH 5.0 05/52] mmc: mxcmmc: "Revert mmc: mxcmmc: handle highmem pages" Greg Kroah-Hartman
2019-03-26 6:29 ` [PATCH 5.0 06/52] mmc: renesas_sdhi: limit block count to 16 bit for old revisions Greg Kroah-Hartman
2019-03-26 6:29 ` [PATCH 5.0 07/52] drm/amdgpu: fix invalid use of change_bit Greg Kroah-Hartman
2019-03-26 6:29 ` [PATCH 5.0 08/52] drm/vmwgfx: Dont double-free the mode stored in par->set_mode Greg Kroah-Hartman
2019-03-26 6:29 ` [PATCH 5.0 09/52] drm/vmwgfx: Return 0 when gmrid::get_node runs out of IDs Greg Kroah-Hartman
2019-03-26 6:29 ` [PATCH 5.0 10/52] iommu/amd: fix sg->dma_address for sg->offset bigger than PAGE_SIZE Greg Kroah-Hartman
2019-03-26 6:29 ` [PATCH 5.0 11/52] iommu/iova: Fix tracking of recently failed iova address Greg Kroah-Hartman
2019-03-26 6:29 ` [PATCH 5.0 12/52] libceph: wait for latest osdmap in ceph_monc_blacklist_add() Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 13/52] udf: Fix crash on IO error during truncate Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 14/52] mips: loongson64: lemote-2f: Add IRQF_NO_SUSPEND to "cascade" irqaction Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 15/52] MIPS: Ensure ELF appended dtb is relocated Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 16/52] MIPS: Fix kernel crash for R6 in jump label branch function Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 17/52] powerpc/vdso64: Fix CLOCK_MONOTONIC inconsistencies across Y2038 Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 18/52] powerpc/security: Fix spectre_v2 reporting Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 19/52] net/mlx5: Fix DCT creation bad flow Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 20/52] scsi: core: Avoid that a kernel warning appears during system resume Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 21/52] scsi: qla2xxx: Fix FC-AL connection target discovery Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 22/52] scsi: ibmvscsi: Protect ibmvscsi_head from concurrent modificaiton Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 23/52] scsi: ibmvscsi: Fix empty event pool access during host removal Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 24/52] futex: Ensure that futex address is aligned in handle_futex_death() Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 25/52] cifs: allow guest mounts to work for smb3.11 Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 26/52] perf probe: Fix getting the kernel map Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 27/52] objtool: Move objtool_file struct off the stack Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 28/52] irqchip/gic-v3-its: Fix comparison logic in lpi_range_cmp Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 29/52] clocksource/drivers/riscv: Fix clocksource mask Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 30/52] SMB3: Fix SMB3.1.1 guest mounts to Samba Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 31/52] ALSA: hda - Dont trigger jackpoll_work in azx_resume Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 32/52] ALSA: ac97: Fix of-node refcount unbalance Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 33/52] ext4: fix NULL pointer dereference while journal is aborted Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 34/52] ext4: fix data corruption caused by unaligned direct AIO Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 35/52] ext4: brelse all indirect buffer in ext4_ind_remove_space() Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 36/52] media: v4l2-ctrls.c/uvc: zero v4l2_event Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 37/52] Bluetooth: hci_uart: Check if socket buffer is ERR_PTR in h4_recv_buf() Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 38/52] Bluetooth: Fix decrementing reference count twice in releasing socket Greg Kroah-Hartman
2019-03-26 6:30 ` Greg Kroah-Hartman [this message]
2019-03-26 6:30 ` [PATCH 5.0 40/52] Bluetooth: hci_ldisc: Postpone HCI_UART_PROTO_READY bit set in hci_uart_set_proto() Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 41/52] drm/vkms: Fix flush_work() without INIT_WORK() Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 42/52] RDMA/cma: Rollback source IP address if failing to acquire device Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 43/52] f2fs: fix to avoid deadlock of atomic file operations Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 44/52] aio: simplify - and fix - fget/fput for io_submit() Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 45/52] netfilter: ebtables: remove BUGPRINT messages Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 46/52] loop: access lo_backing_file only when the loop device is Lo_bound Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 47/52] x86/unwind: Handle NULL pointer calls better in frame unwinder Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 48/52] x86/unwind: Add hardcoded ORC entry for NULL Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 49/52] locking/lockdep: Add debug_locks check in __lock_downgrade() Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 50/52] mm, mempolicy: fix uninit memory access Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 51/52] ALSA: hda - Record the current power state before suspend/resume calls Greg Kroah-Hartman
2019-03-26 6:30 ` [PATCH 5.0 52/52] ALSA: hda - Enforces runtime_resume after S3 and S4 for each codec Greg Kroah-Hartman
2019-03-26 15:20 ` [PATCH 5.0 00/52] 5.0.5-stable review Jon Hunter
2019-03-27 0:56 ` Greg Kroah-Hartman
2019-03-26 17:50 ` Guenter Roeck
2019-03-27 0:59 ` Greg Kroah-Hartman
2019-03-26 23:18 ` shuah
2019-03-27 0:55 ` Greg Kroah-Hartman
2019-03-27 4:06 ` Naresh Kamboju
2019-03-27 5:06 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190326042703.053632903@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=jcline@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=marcel@holtmann.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+257790c15bcdef6fe00c@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).