linux-stable.git/net/bluetooth/cmtp, branch linux-4.4.y

Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails

2022-01-27T07:46:13+00:00

[ Upstream commit 2a7ca7459d905febf519163bd9e3eed894de6bb7 ]

I got a kernel BUG report when doing fault injection test:

------------[ cut here ]------------
kernel BUG at lib/list_debug.c:45!
...
RIP: 0010:__list_del_entry_valid.cold+0x12/0x4d
...
Call Trace:
 proto_unregister+0x83/0x220
 cmtp_cleanup_sockets+0x37/0x40 [cmtp]
 cmtp_exit+0xe/0x1f [cmtp]
 do_syscall_64+0x35/0xb0
 entry_SYSCALL_64_after_hwframe+0x44/0xae

If cmtp_init_sockets() in cmtp_init() fails, cmtp_init() still returns
success. This will cause a kernel bug when accessing uncreated ctmp
related data when the module exits.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Hulk Robot 
Signed-off-by: Wang Hai 
Signed-off-by: Marcel Holtmann 
Signed-off-by: Sasha Levin

Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow

2021-09-22T09:41:20+00:00

[ Upstream commit 713baf3dae8f45dc8ada4ed2f5fdcbf94a5c274d ]

An earlier commit replaced using batostr to using %pMR sprintf for the
construction of session->name. Static analysis detected that this new
method can use a total of 21 characters (including the trailing '\0')
so we need to increase the BTNAMSIZ from 18 to 21 to fix potential
buffer overflows.

Addresses-Coverity: ("Out-of-bounds write")
Fixes: fcb73338ed53 ("Bluetooth: Use %pMR in sprintf/seq_printf instead of batostr")
Signed-off-by: Colin Ian King 
Signed-off-by: Marcel Holtmann 
Signed-off-by: Sasha Levin

Bluetooth: cmtp: fix file refcount when cmtp_attach_device fails

2021-06-03T06:22:06+00:00

commit 8da3a0b87f4f1c3a3bbc4bfb78cf68476e97d183 upstream.

When cmtp_attach_device fails, cmtp_add_connection returns the error value
which leads to the caller to doing fput through sockfd_put. But
cmtp_session kthread, which is stopped in this path will also call fput,
leading to a potential refcount underflow or a use-after-free.

Add a refcount before we signal the kthread to stop. The kthread will try
to grab the cmtp_session_sem mutex before doing the fput, which is held
when get_file is called, so there should be no races there.

Reported-by: Ryota Shiga
Signed-off-by: Thadeu Lima de Souza Cascardo 
Signed-off-by: Marcel Holtmann 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: cmtp: fix possible might sleep error in cmtp_session

2017-08-30T08:19:26+00:00

commit f06d977309d09253c744e54e75c5295ecc52b7b4 upstream.

It looks like cmtp_session has same pattern as the issue reported in
old rfcomm:

	while (1) {
		set_current_state(TASK_INTERRUPTIBLE);
		if (condition)
			break;
		// may call might_sleep here
		schedule();
	}
	__set_current_state(TASK_RUNNING);

Which fixed at:
	dfb2fae Bluetooth: Fix nested sleeps

So let's fix it at the same way, also follow the suggestion of:
https://lwn.net/Articles/628628/

Signed-off-by: Jeffy Chen 
Reviewed-by: Brian Norris 
Reviewed-by: AL Yu-Chen Cho 
Signed-off-by: Marcel Holtmann 
Cc: Jiri Slaby 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: cmtp: Do not use list_for_each_safe when not needed

2015-07-30T11:50:35+00:00

There is no need to use the safe version of list_for_each here.

Signed-off-by: Christophe JAILLET 
Signed-off-by: Marcel Holtmann

net: Pass kern from net_proto_family.create to sk_alloc

2015-05-11T14:50:17+00:00

In preparation for changing how struct net is refcounted
on kernel sockets pass the knowledge that we are creating
a kernel socket from sock_create_kern through to sk_alloc.

Signed-off-by: "Eric W. Biederman" 
Signed-off-by: David S. Miller

Bluetooth: cmtp: Use BIT(x) instead of (1 << x)

2015-04-04T05:50:20+00:00

Signed-off-by: Marcel Holtmann 
Signed-off-by: Johan Hedberg

Bluetooth: Restrict CMTP flags to only valid ones

2015-04-02T05:42:21+00:00

The CMTP flags should be clearly restricted to valid ones. So this puts
extra checks in place to ensure this.

Signed-off-by: Marcel Holtmann 
Signed-off-by: Johan Hedberg

Bluetooth: Remove dead code

2015-01-14T09:16:17+00:00

Variable 'controller' is assigned a value that is never used.
Identified by cppcheck tool.

Signed-off-by: Gowtham Anandha Babu 
Signed-off-by: Johan Hedberg

Bluetooth: cmtp: cmtp_add_connection() should verify that it's dealing with l2cap socket

2014-12-19T12:48:21+00:00

... rather than relying on ciptool(8) never passing it anything else.  Give
it e.g. an AF_UNIX connected socket (from socketpair(2)) and it'll oops,
trying to evaluate &l2cap_pi(sock->sk)->chan->dst...

Signed-off-by: Al Viro 
Signed-off-by: Marcel Holtmann