linux-kernel - [PATCH] work around for l2cap NULL dereference in l2cap_conn

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20110221043601.GB22204@spacedout.fries.net>
Date:	Sun, 20 Feb 2011 22:36:01 -0600
From:	David Fries <david@...es.net>
To:	Andrei Warkentin <andreiw@...orola.com>
Cc:	"Gustavo F. Padovan" <padovan@...fusion.mobi>,
	linux-bluetooth@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH] work around for l2cap NULL dereference in l2cap_conn_start

bt_sk(sk)->parent can be NULL in l2cap_conn_start in state BT_CONNECT2
at least when a headset device pairs and the play button was pressed
right before pairing.

Signed-off-by: David Fries <david@...es.net>
---
I removed the printk, can this be merged to the bluetooth next tree?

On Mon, Feb 14, 2011 at 03:40:46PM -0600, Andrei Warkentin wrote:
> FWIW still need it in 2.6.36.

Andrei, I'm curious, what's your hardware hardware and bluetooth
device that's trigginer the crash?

> On Mon, Feb 14, 2011 at 8:56 AM, Gustavo F. Padovan
> <padovan@...fusion.mobi> wrote:
> > Hi David,
> >
> > * David Fries <david@...es.net> [2011-02-10 21:53:09 -0600]:
> >
> >> Here's a patch to avoid a very repeatable crash in the N900.  If I
> >> take a Motorola S305 bluetooth headset that was previously paried with
> >> the N900, turn it on, and press the play button before the headphones
> >> automatically pair with the cell phone, the N900 will crash (and
> >> reboot) in pairing.  If I wait until after they have paired there
> >> isn't any problem.  The patch is against the kernel-power
> >> 2.6.28-maemo46 by Thomas Tanner, the stock Nokia PR1.2 oops looked
> >> the same, I just haven't gone back to that kernel.
> >
> > This is a very old kernel. You need to check this issue against
> > bluetooth-next-2.6.

 net/bluetooth/l2cap.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index ed83c1f..a7aa4d9 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -408,7 +408,8 @@ static void l2cap_conn_start(struct l2cap_conn *conn)
 					struct sock *parent = bt_sk(sk)->parent;
 					rsp.result = cpu_to_le16(L2CAP_CR_PEND);
 					rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
-					parent->sk_data_ready(parent, 0);
+					if(parent)
+						parent->sk_data_ready(parent,0);
 
 				} else {
 					sk->sk_state = BT_CONFIG;
-- 
1.7.2.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/