leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
61a0cfb008
linux/net/bluetooth
History
Andre Guedes 61a0cfb008 Bluetooth: Fix use-after-free bug in SMP 
If SMP fails, we should always cancel security_timer delayed work.
Otherwise, security_timer function may run after l2cap_conn object
has been freed.

This patch fixes the following warning reported by ODEBUG:

WARNING: at lib/debugobjects.c:261 debug_print_object+0x7c/0x8d()
Hardware name: Bochs
ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x27
Modules linked in: btusb bluetooth
Pid: 440, comm: kworker/u:2 Not tainted 3.5.0-rc1+ #4
Call Trace:
 [<ffffffff81174600>] ? free_obj_work+0x4a/0x7f
 [<ffffffff81023eb8>] warn_slowpath_common+0x7e/0x97
 [<ffffffff81023f65>] warn_slowpath_fmt+0x41/0x43
 [<ffffffff811746b1>] debug_print_object+0x7c/0x8d
 [<ffffffff810394f0>] ? __queue_work+0x241/0x241
 [<ffffffff81174fdd>] debug_check_no_obj_freed+0x92/0x159
 [<ffffffff810ac08e>] slab_free_hook+0x6f/0x77
 [<ffffffffa0019145>] ? l2cap_conn_del+0x148/0x157 [bluetooth]
 [<ffffffff810ae408>] kfree+0x59/0xac
 [<ffffffffa0019145>] l2cap_conn_del+0x148/0x157 [bluetooth]
 [<ffffffffa001b9a2>] l2cap_recv_frame+0xa77/0xfa4 [bluetooth]
 [<ffffffff810592f9>] ? trace_hardirqs_on_caller+0x112/0x1ad
 [<ffffffffa001c86c>] l2cap_recv_acldata+0xe2/0x264 [bluetooth]
 [<ffffffffa0002b2f>] hci_rx_work+0x235/0x33c [bluetooth]
 [<ffffffff81038dc3>] ? process_one_work+0x126/0x2fe
 [<ffffffff81038e22>] process_one_work+0x185/0x2fe
 [<ffffffff81038dc3>] ? process_one_work+0x126/0x2fe
 [<ffffffff81059f2e>] ? lock_acquired+0x1b5/0x1cf
 [<ffffffffa00028fa>] ? le_scan_work+0x11d/0x11d [bluetooth]
 [<ffffffff81036fb6>] ? spin_lock_irq+0x9/0xb
 [<ffffffff81039209>] worker_thread+0xcf/0x175
 [<ffffffff8103913a>] ? rescuer_thread+0x175/0x175
 [<ffffffff8103cfe0>] kthread+0x95/0x9d
 [<ffffffff812c5054>] kernel_threadi_helper+0x4/0x10
 [<ffffffff812c36b0>] ? retint_restore_args+0x13/0x13
 [<ffffffff8103cf4b>] ? flush_kthread_worker+0xdb/0xdb
 [<ffffffff812c5050>] ? gs_change+0x13/0x13

This bug can be reproduced using hctool lecc or l2test tools and
bluetoothd not running.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2012-08-15 01:06:23 -03:00
..
bnep Bluetooth: Remove unnecessary headers include 2012-06-05 06:34:08 +03:00
cmtp Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
hidp Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2012-06-28 17:37:00 -07:00
rfcomm Bluetooth: Remove unnecessary headers include 2012-06-05 06:34:08 +03:00
a2mp.c Bluetooth: debug: Print amp_mgr refcnt 2012-07-11 10:09:37 -03:00
af_bluetooth.c Bluetooth: Fix checking the wrong flag when accepting a socket 2012-06-05 06:34:16 +03:00
hci_conn.c Bluetooth: Route traffic only through BR/EDR controller 2012-06-30 12:15:32 -03:00
hci_core.c Bluetooth: debug: Add printing num of cmds queued 2012-07-10 15:35:27 -03:00
hci_event.c Bluetooth: Set name_state to unknown when entry name is empty 2012-08-06 15:19:36 -03:00
hci_sock.c Bluetooth: Remove unnecessary headers include 2012-06-05 06:34:08 +03:00
hci_sysfs.c Bluetooth: Remove unnecessary headers include 2012-06-05 06:34:08 +03:00
Kconfig Bluetooth: Fix Kconfig help description 2012-02-29 18:50:25 +02:00
l2cap_core.c Bluetooth: Fix legacy pairing with some devices 2012-08-06 15:19:36 -03:00
l2cap_sock.c Bluetooth: Fix socket not getting freed if l2cap channel create fails 2012-08-06 15:19:37 -03:00
lib.c Bluetooth: Remove unnecessary headers include 2012-06-05 06:34:08 +03:00
Makefile Bluetooth: A2MP: Create A2MP channel 2012-06-05 06:34:11 +03:00
mgmt.c Bluetooth: Change page scan interval in fast connectable mode 2012-07-16 10:50:11 -03:00
sco.c Bluetooth: Fix possible deadlock in SCO code 2012-08-06 15:19:36 -03:00
smp.c Bluetooth: Fix use-after-free bug in SMP 2012-08-15 01:06:23 -03:00