* [PATCH] Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails
@ 2021-10-22 3:44 Wang Hai
2021-10-22 4:48 ` Marcel Holtmann
0 siblings, 1 reply; 3+ messages in thread
From: Wang Hai @ 2021-10-22 3:44 UTC (permalink / raw)
To: isdn, marcel, johan.hedberg, luiz.dentz, davem, kuba, cascardo
Cc: netdev, linux-bluetooth, linux-kernel
I got a kernel BUG report when doing fault injection test:
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:45!
...
RIP: 0010:__list_del_entry_valid.cold+0x12/0x4d
...
Call Trace:
proto_unregister+0x83/0x220
cmtp_cleanup_sockets+0x37/0x40 [cmtp]
cmtp_exit+0xe/0x1f [cmtp]
do_syscall_64+0x35/0xb0
entry_SYSCALL_64_after_hwframe+0x44/0xae
If cmtp_init_sockets() in cmtp_init() fails, cmtp_init() still returns
success. This will cause a kernel bug when accessing uncreated ctmp
related data when the module exits.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
---
net/bluetooth/cmtp/core.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c
index 0a2d78e811cf..ccf48f50afdf 100644
--- a/net/bluetooth/cmtp/core.c
+++ b/net/bluetooth/cmtp/core.c
@@ -499,11 +499,13 @@ int cmtp_get_conninfo(struct cmtp_conninfo *ci)
static int __init cmtp_init(void)
{
+ int err;
+
BT_INFO("CMTP (CAPI Emulation) ver %s", VERSION);
- cmtp_init_sockets();
+ err = cmtp_init_sockets();
- return 0;
+ return err;
}
static void __exit cmtp_exit(void)
--
2.25.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails
2021-10-22 3:44 [PATCH] Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails Wang Hai
@ 2021-10-22 4:48 ` Marcel Holtmann
2021-10-22 8:43 ` wanghai (M)
0 siblings, 1 reply; 3+ messages in thread
From: Marcel Holtmann @ 2021-10-22 4:48 UTC (permalink / raw)
To: Wang Hai
Cc: Karsten Keil, Johan Hedberg, Luiz Augusto von Dentz,
David S. Miller, Jakub Kicinski, Thadeu Lima de Souza Cascardo,
open list:NETWORKING [GENERAL],
linux-bluetooth, linux-kernel
Hi Wang,
> I got a kernel BUG report when doing fault injection test:
>
> ------------[ cut here ]------------
> kernel BUG at lib/list_debug.c:45!
> ...
> RIP: 0010:__list_del_entry_valid.cold+0x12/0x4d
> ...
> Call Trace:
> proto_unregister+0x83/0x220
> cmtp_cleanup_sockets+0x37/0x40 [cmtp]
> cmtp_exit+0xe/0x1f [cmtp]
> do_syscall_64+0x35/0xb0
> entry_SYSCALL_64_after_hwframe+0x44/0xae
>
> If cmtp_init_sockets() in cmtp_init() fails, cmtp_init() still returns
> success. This will cause a kernel bug when accessing uncreated ctmp
> related data when the module exits.
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: Hulk Robot <hulkci@huawei.com>
> Signed-off-by: Wang Hai <wanghai38@huawei.com>
> ---
> net/bluetooth/cmtp/core.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c
> index 0a2d78e811cf..ccf48f50afdf 100644
> --- a/net/bluetooth/cmtp/core.c
> +++ b/net/bluetooth/cmtp/core.c
> @@ -499,11 +499,13 @@ int cmtp_get_conninfo(struct cmtp_conninfo *ci)
>
> static int __init cmtp_init(void)
> {
> + int err;
> +
> BT_INFO("CMTP (CAPI Emulation) ver %s", VERSION);
>
> - cmtp_init_sockets();
> + err = cmtp_init_sockets();
>
> - return 0;
> + return err;
> }
just do return cmtp_init_sockets();
Regards
Marcel
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails
2021-10-22 4:48 ` Marcel Holtmann
@ 2021-10-22 8:43 ` wanghai (M)
0 siblings, 0 replies; 3+ messages in thread
From: wanghai (M) @ 2021-10-22 8:43 UTC (permalink / raw)
To: Marcel Holtmann
Cc: Karsten Keil, Johan Hedberg, Luiz Augusto von Dentz,
David S. Miller, Jakub Kicinski, Thadeu Lima de Souza Cascardo,
open list:NETWORKING [GENERAL],
linux-bluetooth, linux-kernel
在 2021/10/22 12:48, Marcel Holtmann 写道:
> Hi Wang,
>
>> I got a kernel BUG report when doing fault injection test:
>>
>> ------------[ cut here ]------------
>> kernel BUG at lib/list_debug.c:45!
>> ...
>> RIP: 0010:__list_del_entry_valid.cold+0x12/0x4d
>> ...
>> Call Trace:
>> proto_unregister+0x83/0x220
>> cmtp_cleanup_sockets+0x37/0x40 [cmtp]
>> cmtp_exit+0xe/0x1f [cmtp]
>> do_syscall_64+0x35/0xb0
>> entry_SYSCALL_64_after_hwframe+0x44/0xae
>>
>> If cmtp_init_sockets() in cmtp_init() fails, cmtp_init() still returns
>> success. This will cause a kernel bug when accessing uncreated ctmp
>> related data when the module exits.
>>
>> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
>> Reported-by: Hulk Robot <hulkci@huawei.com>
>> Signed-off-by: Wang Hai <wanghai38@huawei.com>
>> ---
>> net/bluetooth/cmtp/core.c | 6 ++++--
>> 1 file changed, 4 insertions(+), 2 deletions(-)
>>
>> diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c
>> index 0a2d78e811cf..ccf48f50afdf 100644
>> --- a/net/bluetooth/cmtp/core.c
>> +++ b/net/bluetooth/cmtp/core.c
>> @@ -499,11 +499,13 @@ int cmtp_get_conninfo(struct cmtp_conninfo *ci)
>>
>> static int __init cmtp_init(void)
>> {
>> + int err;
>> +
>> BT_INFO("CMTP (CAPI Emulation) ver %s", VERSION);
>>
>> - cmtp_init_sockets();
>> + err = cmtp_init_sockets();
>>
>> - return 0;
>> + return err;
>> }
> just do return cmtp_init_sockets();
>
> Regards
>
> Marcel
Ok, I will send v2
> .
>
--
Wang Hai
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-10-22 8:44 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-10-22 3:44 [PATCH] Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails Wang Hai
2021-10-22 4:48 ` Marcel Holtmann
2021-10-22 8:43 ` wanghai (M)
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).