Kefeng Wang
3858f013de
Bluetooth: hci_ldisc: Postpone HCI_UART_PROTO_READY bit set in hci_uart_set_proto()
commit 56897b217a1d0a91c9920cb418d6b3fe922f590a upstream.
task A: task B:
hci_uart_set_proto flush_to_ldisc
- p->open(hu) -> h5_open //alloc h5 - receive_buf
- set_bit HCI_UART_PROTO_READY - tty_port_default_receive_buf
- hci_uart_register_dev - tty_ldisc_receive_buf
- hci_uart_tty_receive
- test_bit HCI_UART_PROTO_READY
- h5_recv
- clear_bit HCI_UART_PROTO_READY while() {
- p->open(hu) -> h5_close //free h5
- h5_rx_3wire_hdr
- h5_reset() //use-after-free
}
It could use ioctl to set hci uart proto, but there is
a use-after-free issue when hci_uart_register_dev() fail in
hci_uart_set_proto(), see stack above, fix this by setting
HCI_UART_PROTO_READY bit only when hci_uart_register_dev()
return success.
Reported-by: syzbot+899a33dc0fa0dbaf06a6@syzkaller.appspotmail.com
Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
Reviewed-by: Jeremy Cline <jcline@redhat.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
2019-11-16 10:29:34 +01:00 |
| .. |
|
ath3k.c
|
Bluetooth: Add another AR3012 04ca:3018 device
|
2017-03-15 10:02:40 +08:00 |
|
bcm203x.c
|
bluetooth: bcm203x: don't print error when allocating urb fails
|
2016-09-27 12:20:17 +02:00 |
|
bfusb.c
|
Bluetooth: bfusb: Fix the return error code
|
2015-12-22 15:25:33 +01:00 |
|
bluecard_cs.c
|
Bluetooth: Use new hci_skb_pkt_* wrappers for drivers
|
2015-11-19 17:50:27 +01:00 |
|
bpa10x.c
|
Bluetooth: bpa10x: Add support for hci_set_fw_info
|
2016-07-18 09:33:56 +03:00 |
|
bt3c_cs.c
|
Bluetooth: Use new hci_skb_pkt_* wrappers for drivers
|
2015-11-19 17:50:27 +01:00 |
|
btbcm.c
|
Bluetooth: btbcm: Add entry for BCM4335C0 UART bluetooth
|
2018-11-13 11:16:50 -08:00 |
|
btbcm.h
|
Bluetooth: btbcm: Support the BCM4354 Bluetooth UART device
|
2015-06-17 18:56:53 +02:00 |
|
btintel.c
|
Bluetooth: btintel: Create common Intel Version Read function
|
2015-12-10 00:51:51 +01:00 |
|
btintel.h
|
Bluetooth: btintel: Create common Intel Version Read function
|
2015-12-10 00:51:51 +01:00 |
|
btmrvl_debugfs.c
|
Bluetooth: btmrvl add firmware dump support
|
2014-12-03 17:35:51 +01:00 |
|
btmrvl_drv.h
|
btmrvl: add platform specific wakeup interrupt support
|
2016-05-02 19:26:15 +02:00 |
|
btmrvl_main.c
|
Bluetooth: Rename HCI_BREDR into HCI_PRIMARY
|
2016-07-09 21:37:13 +03:00 |
|
btmrvl_sdio.c
|
btmrvl: avoid double-disable_irq() race
|
2017-10-21 17:21:38 +02:00 |
|
btmrvl_sdio.h
|
btmrvl: add platform specific wakeup interrupt support
|
2016-05-02 19:26:15 +02:00 |
|
btqca.c
|
Bluetooth: btqca: Add a short delay before downloading the NVM
|
2019-09-10 10:31:00 +01:00 |
|
btqca.h
|
Bluetooth: btqca: Introduce generic QCA ROME support
|
2015-08-10 23:52:20 +02:00 |
|
btqcomsmd.c
|
Bluetooth: btqcomsmd: Fix skb double free corruption
|
2018-03-24 11:00:22 +01:00 |
|
btrtl.c
|
Bluetooth: btrtl: Add RTL8822BE Bluetooth device
|
2016-09-19 20:19:34 +02:00 |
|
btrtl.h
|
Bluetooth: btrtl: Create separate module for Realtek BT driver
|
2015-05-14 12:04:12 +02:00 |
|
btsdio.c
|
Bluetooth: btsdio: Do not bind to non-removable BCM43341
|
2018-02-17 13:21:18 +01:00 |
|
btuart_cs.c
|
Bluetooth: Use new hci_skb_pkt_* wrappers for drivers
|
2015-11-19 17:50:27 +01:00 |
|
btusb.c
|
Bluetooth: btrtl: Additional Realtek 8822CE Bluetooth devices
|
2019-10-05 12:30:12 +02:00 |
|
btwilink.c
|
Bluetooth: btwilink: Fix probe return value
|
2016-10-20 10:14:49 +02:00 |
|
dtl1_cs.c
|
Bluetooth: Use new hci_skb_pkt_* wrappers for drivers
|
2015-11-19 17:50:27 +01:00 |
|
hci_ag6xx.c
|
Bluetooth: hci_uart: Add diag and address support for Intel/AG6xx
|
2016-02-29 19:25:22 +02:00 |
|
hci_ath.c
|
Bluetooth: hci_uart: check for missing tty operations
|
2019-08-04 09:33:44 +02:00 |
|
hci_bcm.c
|
Bluetooth: hci_uart: check for missing tty operations
|
2019-08-04 09:33:44 +02:00 |
|
hci_bcsp.c
|
Bluetooth: hci_bcsp: Fix memory leak in rx_skb
|
2019-08-04 09:33:24 +02:00 |
|
hci_h4.c
|
Bluetooth: Use new hci_skb_pkt_* wrappers for drivers
|
2015-11-19 17:50:27 +01:00 |
|
hci_h5.c
|
Bluetooth: h5: Do not initialize Configuration field
|
2015-12-10 19:19:17 +01:00 |
|
hci_intel.c
|
Bluetooth: hci_uart: check for missing tty operations
|
2019-08-04 09:33:44 +02:00 |
|
hci_ldisc.c
|
Bluetooth: hci_ldisc: Postpone HCI_UART_PROTO_READY bit set in hci_uart_set_proto()
|
2019-11-16 10:29:34 +01:00 |
|
hci_ll.c
|
Bluetooth: Use new hci_skb_pkt_* wrappers for drivers
|
2015-11-19 17:50:27 +01:00 |
|
hci_mrvl.c
|
Bluetooth: hci_uart: check for missing tty operations
|
2019-08-04 09:33:44 +02:00 |
|
hci_qca.c
|
Bluetooth: hci_qca: Fix "Sleep inside atomic section" warning
|
2018-08-03 07:55:15 +02:00 |
|
hci_uart.h
|
Bluetooth: hci_uart: check for missing tty operations
|
2019-08-04 09:33:44 +02:00 |
|
hci_vhci.c
|
miscdevice: Use module_misc_device() macro
|
2016-08-31 14:12:35 +02:00 |
|
Kconfig
|
Revert "Bluetooth: h5: Fix missing dependency on BT_HCIUART_SERDEV"
|
2018-11-27 16:09:40 +01:00 |
|
Makefile
|
Bluetooth: hci_uart: Add Marvell support
|
2016-09-19 20:32:03 +02:00 |