linux.git/net/bluetooth/rfcomm/core.c, branch v3.18

Bluetooth: Avoid use of session socket after the session gets freed

2014-07-22T14:07:31+00:00

The commits 08c30aca9e698faddebd34f81e1196295f9dc063 "Bluetooth: Remove
RFCOMM session refcnt" and 8ff52f7d04d9cc31f1e81dcf9a2ba6335ed34905
"Bluetooth: Return RFCOMM session ptrs to avoid freed session"
allow rfcomm_recv_ua and rfcomm_session_close to delete the session
(and free the corresponding socket) and propagate NULL session pointer
to the upper callers.

Additional fix is required to terminate the loop in rfcomm_process_rx
function to avoid use of freed 'sk' memory.

The issue is only reproducible with kernel option CONFIG_PAGE_POISONING
enabled making freed memory being changed and filled up with fixed char
value used to unmask use-after-free issues.

Signed-off-by: Vignesh Raman 
Signed-off-by: Vitaly Kuzmichev 
Acked-by: Dean Jenkins 
Signed-off-by: Marcel Holtmann 
Cc: stable@vger.kernel.org

Bluetooth: Pass initiator/acceptor information to hci_conn_security()

2014-07-17T12:39:39+00:00

We're interested in whether an authentication request is because of a
remote or local action. So far hci_conn_security() has been used both
for incoming and outgoing actions (e.g. RFCOMM or L2CAP connect
requests) so without some modifications it cannot know which peer is
responsible for requesting authentication.

This patch adds a new "bool initiator" parameter to hci_conn_security()
to indicate which side is responsible for the request and updates the
current users to pass this information correspondingly.

Signed-off-by: Johan Hedberg 
Signed-off-by: Marcel Holtmann

Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next

2014-05-29T17:03:47+00:00

Conflicts:
	drivers/bluetooth/btusb.c

Bluetooth: Convert RFCOMM spinlocks into mutexes

2014-05-06T02:25:06+00:00

Enabling CONFIG_DEBUG_ATOMIC_SLEEP has shown that some rfcomm functions
acquiring spinlocks call sleeping locks further in the chain.  Converting
the offending spinlocks into mutexes makes sleeping safe.

Signed-off-by: Libor Pechacek 
Signed-off-by: Marcel Holtmann

net: Fix use after free by removing length arg from sk_data_ready callbacks.

2014-04-11T20:15:36+00:00

Several spots in the kernel perform a sequence like:

	skb_queue_tail(&sk->s_receive_queue, skb);
	sk->sk_data_ready(sk, skb->len);

But at the moment we place the SKB onto the socket receive queue it
can be consumed and freed up.  So this skb->len access is potentially
to freed up memory.

Furthermore, the skb->len can be modified by the consumer so it is
possible that the value isn't accurate.

And finally, no actual implementation of this callback actually uses
the length argument.  And since nobody actually cared about it's
value, lots of call sites pass arbitrary values in such as '0' and
even '1'.

So just remove the length argument from the callback, that way there
is no confusion whatsoever and all of these use-after-free cases get
fixed as a side effect.

Based upon a patch by Eric Dumazet and his suggestion to audit this
issue tree-wide.

Signed-off-by: David S. Miller

Bluetooth: Convert uses of __constant_ to

2014-03-12T18:10:17+00:00

The use of __constant_ has been unnecessary for quite awhile now.

Make these uses consistent with the rest of the kernel.

Signed-off-by: Joe Perches 
Signed-off-by: Marcel Holtmann

Bluetooth: Don't fail RFCOMM tty writes

2014-02-14T21:39:32+00:00

The tty driver api design prefers no-fail writes if the driver
write_room() method has previously indicated space is available
to accept writes. Since this is trivially possible for the
RFCOMM tty driver, do so.

Introduce rfcomm_dlc_send_noerror(), which queues but does not
schedule the krfcomm thread if the dlc is not yet connected
(and thus does not error based on the connection state).
The mtu size test is also unnecessary since the caller already
chunks the written data into mtu size.

Signed-off-by: Peter Hurley 
Tested-By: Alexander Holler 
Signed-off-by: Marcel Holtmann

Bluetooth: Directly close dlc for not yet started RFCOMM session

2014-02-14T21:39:31+00:00

If the RFCOMM session has not yet been started (ie., session is
still in BT_BOUND state) when a dlc is closed, directly close and
unlink the dlc rather than sending a DISC frame that is never
sent.

This allows the dlci to be immediately reused rather than waiting
for a 20 second timeout.

Signed-off-by: Peter Hurley 
Tested-By: Alexander Holler 
Signed-off-by: Marcel Holtmann

Bluetooth: Refactor dlc disconnect logic in rfcomm_dlc_close()

2014-02-14T21:39:30+00:00

Prepare for directly closing dlc if the RFCOMM session has not
yet been started; refactor the dlc disconnect logic into a separate
local function, __rfcomm_dlc_disconn(). Retains functional
equivalence.

Signed-off-by: Peter Hurley 
Tested-By: Alexander Holler 
Signed-off-by: Marcel Holtmann

Bluetooth: Refactor deferred setup test in rfcomm_dlc_close()

2014-02-14T21:39:30+00:00

Prepare for directly closing dlc if the RFCOMM session has not
yet been started; refactor the deferred setup test for only those
dlc states to which the test applies. Retains functional
equivalence.

Signed-off-by: Peter Hurley 
Tested-By: Alexander Holler 
Signed-off-by: Marcel Holtmann