stable.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org,
	syzbot+899a33dc0fa0dbaf06a6@syzkaller.appspotmail.com,
	Kefeng Wang <wangkefeng.wang@huawei.com>,
	Jeremy Cline <jcline@redhat.com>,
	Marcel Holtmann <marcel@holtmann.org>
Subject: [PATCH 4.19 33/45] Bluetooth: hci_ldisc: Postpone HCI_UART_PROTO_READY bit set in hci_uart_set_proto()
Date: Tue, 26 Mar 2019 15:30:16 +0900	[thread overview]
Message-ID: <20190326042704.404278904@linuxfoundation.org> (raw)
In-Reply-To: <20190326042702.565683325@linuxfoundation.org>

4.19-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kefeng Wang <wangkefeng.wang@huawei.com>

commit 56897b217a1d0a91c9920cb418d6b3fe922f590a upstream.

task A:                                task B:
hci_uart_set_proto                     flush_to_ldisc
 - p->open(hu) -> h5_open  //alloc h5  - receive_buf
 - set_bit HCI_UART_PROTO_READY         - tty_port_default_receive_buf
 - hci_uart_register_dev                 - tty_ldisc_receive_buf
                                          - hci_uart_tty_receive
				           - test_bit HCI_UART_PROTO_READY
				            - h5_recv
 - clear_bit HCI_UART_PROTO_READY             while() {
 - p->open(hu) -> h5_close //free h5
				              - h5_rx_3wire_hdr
				               - h5_reset()  //use-after-free
                                              }

It could use ioctl to set hci uart proto, but there is
a use-after-free issue when hci_uart_register_dev() fail in
hci_uart_set_proto(), see stack above, fix this by setting
HCI_UART_PROTO_READY bit only when hci_uart_register_dev()
return success.

Reported-by: syzbot+899a33dc0fa0dbaf06a6@syzkaller.appspotmail.com
Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
Reviewed-by: Jeremy Cline <jcline@redhat.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/bluetooth/hci_ldisc.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -696,14 +696,13 @@ static int hci_uart_set_proto(struct hci
 		return -EPROTONOSUPPORT;
 
 	hu->proto = p;
-	set_bit(HCI_UART_PROTO_READY, &hu->flags);
 
 	err = hci_uart_register_dev(hu);
 	if (err) {
-		clear_bit(HCI_UART_PROTO_READY, &hu->flags);
 		return err;
 	}
 
+	set_bit(HCI_UART_PROTO_READY, &hu->flags);
 	return 0;
 }
 



  parent reply	other threads:[~2019-03-26  6:36 UTC|newest]

Thread overview: 51+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-03-26  6:29 [PATCH 4.19 00/45] 4.19.32-stable review Greg Kroah-Hartman
2019-03-26  6:29 ` [PATCH 4.19 01/45] ALSA: hda - add Lenovo IdeaCentre B550 to the power_save_blacklist Greg Kroah-Hartman
2019-03-26  6:29 ` [PATCH 4.19 02/45] ALSA: firewire-motu: use version field of unit directory to identify model Greg Kroah-Hartman
2019-03-26  6:29 ` [PATCH 4.19 03/45] mmc: pxamci: fix enum type confusion Greg Kroah-Hartman
2019-03-26  6:29 ` [PATCH 4.19 04/45] mmc: mxcmmc: "Revert mmc: mxcmmc: handle highmem pages" Greg Kroah-Hartman
2019-03-26  6:29 ` [PATCH 4.19 05/45] mmc: renesas_sdhi: limit block count to 16 bit for old revisions Greg Kroah-Hartman
2019-03-26  6:29 ` [PATCH 4.19 06/45] drm/vmwgfx: Dont double-free the mode stored in par->set_mode Greg Kroah-Hartman
2019-03-26  6:29 ` [PATCH 4.19 07/45] drm/vmwgfx: Return 0 when gmrid::get_node runs out of IDs Greg Kroah-Hartman
2019-03-26  6:29 ` [PATCH 4.19 08/45] iommu/amd: fix sg->dma_address for sg->offset bigger than PAGE_SIZE Greg Kroah-Hartman
2019-03-26  6:29 ` [PATCH 4.19 09/45] libceph: wait for latest osdmap in ceph_monc_blacklist_add() Greg Kroah-Hartman
2019-03-26  6:29 ` [PATCH 4.19 10/45] udf: Fix crash on IO error during truncate Greg Kroah-Hartman
2019-03-26  6:29 ` [PATCH 4.19 11/45] mips: loongson64: lemote-2f: Add IRQF_NO_SUSPEND to "cascade" irqaction Greg Kroah-Hartman
2019-03-26  6:29 ` [PATCH 4.19 12/45] MIPS: Ensure ELF appended dtb is relocated Greg Kroah-Hartman
2019-03-26  6:29 ` [PATCH 4.19 13/45] MIPS: Fix kernel crash for R6 in jump label branch function Greg Kroah-Hartman
2019-03-26  6:29 ` [PATCH 4.19 14/45] powerpc/vdso64: Fix CLOCK_MONOTONIC inconsistencies across Y2038 Greg Kroah-Hartman
2019-03-26  6:29 ` [PATCH 4.19 15/45] scsi: ibmvscsi: Protect ibmvscsi_head from concurrent modificaiton Greg Kroah-Hartman
2019-03-26  6:29 ` [PATCH 4.19 16/45] scsi: ibmvscsi: Fix empty event pool access during host removal Greg Kroah-Hartman
2019-03-26  6:30 ` [PATCH 4.19 17/45] futex: Ensure that futex address is aligned in handle_futex_death() Greg Kroah-Hartman
2019-03-26  6:30 ` [PATCH 4.19 18/45] cifs: allow guest mounts to work for smb3.11 Greg Kroah-Hartman
2019-03-26  6:30 ` [PATCH 4.19 19/45] perf probe: Fix getting the kernel map Greg Kroah-Hartman
2019-03-26  6:30 ` [PATCH 4.19 20/45] objtool: Move objtool_file struct off the stack Greg Kroah-Hartman
2019-03-26  6:30 ` [PATCH 4.19 21/45] irqchip/gic-v3-its: Fix comparison logic in lpi_range_cmp Greg Kroah-Hartman
2019-03-26  6:30 ` [PATCH 4.19 22/45] SMB3: Fix SMB3.1.1 guest mounts to Samba Greg Kroah-Hartman
2019-03-26  6:30 ` [PATCH 4.19 23/45] ALSA: x86: Fix runtime PM for hdmi-lpe-audio Greg Kroah-Hartman
2019-03-26  6:30 ` [PATCH 4.19 24/45] ALSA: hda/ca0132 - make pci_iounmap() call conditional Greg Kroah-Hartman
2019-03-26  6:30 ` [PATCH 4.19 25/45] ALSA: ac97: Fix of-node refcount unbalance Greg Kroah-Hartman
2019-03-26  6:30 ` [PATCH 4.19 26/45] ext4: fix NULL pointer dereference while journal is aborted Greg Kroah-Hartman
2019-03-26  6:30 ` [PATCH 4.19 27/45] ext4: fix data corruption caused by unaligned direct AIO Greg Kroah-Hartman
2019-03-26  6:30 ` [PATCH 4.19 28/45] ext4: brelse all indirect buffer in ext4_ind_remove_space() Greg Kroah-Hartman
2019-03-26  6:30 ` [PATCH 4.19 29/45] media: v4l2-ctrls.c/uvc: zero v4l2_event Greg Kroah-Hartman
2019-03-26  6:30 ` [PATCH 4.19 30/45] Bluetooth: hci_uart: Check if socket buffer is ERR_PTR in h4_recv_buf() Greg Kroah-Hartman
2019-03-26  6:30 ` [PATCH 4.19 31/45] Bluetooth: Fix decrementing reference count twice in releasing socket Greg Kroah-Hartman
2019-03-26  6:30 ` [PATCH 4.19 32/45] Bluetooth: hci_ldisc: Initialize hci_dev before open() Greg Kroah-Hartman
2019-03-26  6:30 ` Greg Kroah-Hartman [this message]
2019-03-26  6:30 ` [PATCH 4.19 34/45] drm: Reorder set_property_atomic to avoid returning with an active ww_ctx Greg Kroah-Hartman
2019-03-26  6:30 ` [PATCH 4.19 35/45] RDMA/cma: Rollback source IP address if failing to acquire device Greg Kroah-Hartman
2019-03-26  6:30 ` [PATCH 4.19 36/45] f2fs: fix to avoid deadlock of atomic file operations Greg Kroah-Hartman
2019-03-26  6:30 ` [PATCH 4.19 37/45] netfilter: ebtables: remove BUGPRINT messages Greg Kroah-Hartman
2019-03-26  6:30 ` [PATCH 4.19 38/45] loop: access lo_backing_file only when the loop device is Lo_bound Greg Kroah-Hartman
2019-03-26  6:30 ` [PATCH 4.19 39/45] x86/unwind: Handle NULL pointer calls better in frame unwinder Greg Kroah-Hartman
2019-03-26  6:30 ` [PATCH 4.19 40/45] x86/unwind: Add hardcoded ORC entry for NULL Greg Kroah-Hartman
2019-03-26  6:30 ` [PATCH 4.19 41/45] locking/lockdep: Add debug_locks check in __lock_downgrade() Greg Kroah-Hartman
2019-03-26  6:30 ` [PATCH 4.19 42/45] mm, mempolicy: fix uninit memory access Greg Kroah-Hartman
2019-03-26  6:30 ` [PATCH 4.19 43/45] ALSA: hda - Record the current power state before suspend/resume calls Greg Kroah-Hartman
2019-03-26  6:30 ` [PATCH 4.19 44/45] ALSA: hda - Enforces runtime_resume after S3 and S4 for each codec Greg Kroah-Hartman
2019-03-26  6:30 ` [PATCH 4.19 45/45] power: supply: charger-manager: Fix incorrect return value Greg Kroah-Hartman
2019-03-26 10:23 ` [PATCH 4.19 00/45] 4.19.32-stable review kernelci.org bot
2019-03-26 15:19 ` Jon Hunter
2019-03-26 17:49 ` Guenter Roeck
2019-03-26 23:17 ` shuah
2019-03-27  4:04 ` Naresh Kamboju

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190326042704.404278904@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=jcline@redhat.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=marcel@holtmann.org \
    --cc=stable@vger.kernel.org \
    --cc=syzbot+899a33dc0fa0dbaf06a6@syzkaller.appspotmail.com \
    --cc=wangkefeng.wang@huawei.com \
    --subject='Re: [PATCH 4.19 33/45] Bluetooth: hci_ldisc: Postpone HCI_UART_PROTO_READY bit set in hci_uart_set_proto()' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).