netdev - Re: Bluetooth: oops in rfcomm_sock_getsockopt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <alpine.LNX.2.00.1311211528520.22082@pobox.suse.cz>
Date:	Thu, 21 Nov 2013 15:29:05 +0100 (CET)
From:	Jiri Kosina <jkosina@...e.cz>
To:	Johan Hedberg <johan.hedberg@...el.com>
Cc:	Marcel Holtmann <marcel@...tmann.org>,
	Gustavo Padovan <gustavo@...ovan.org>, netdev@...r.kernel.org,
	linux-bluetooth@...r.kernel.org
Subject: Re: Bluetooth: oops in rfcomm_sock_getsockopt_old

On Wed, 20 Nov 2013, Johan Hedberg wrote:

> >  BUG: unable to handle kernel paging request at 000000234df5351a
> >  IP: [<ffffffffa05e95b9>] rfcomm_sock_getsockopt_old+0x39/0x190 [rfcomm]
> >  PGD 0 
> >  Oops: 0000 [#1] SMP 
> >  Modules linked in: rfcomm bnep cpufreq_conservative cpufreq_userspace cpufreq_powersa
> > CO_vendor_support kvm_intel snd_hda_codec_conexant kvm iwldvm mac80211 btusb bluetooth
> > d_hda_intel snd_hda_codec snd_hwdep cfg80211 thinkpad_acpi snd_seq pcspkr snd_pcm i2c_i801 lpc_ich mfd_core rfkill e1000e ehci_pci snd_timer snd_page_alloc snd_seq_device ptp pps_core wmi snd tpm_tis soundcore battery ac tpm tpm_bios acpi_cpufreq autofs4 uhci_hcd ehci_hcd i915 usbcore usb_common drm_kms_helper drm i2c_algo_bit button video edd fan processor ata_generic thermal thermal_sys
> >  CPU: 0 PID: 1024 Comm: bluetoothd Not tainted 3.11.0-07976-g8d6083f #1
> >  Hardware name: LENOVO 7470BN2/7470BN2, BIOS 6DET38WW (2.02 ) 12/19/2008
> >  task: ffff880076c0e000 ti: ffff880036f94000 task.ti: ffff880036f94000
> >  RIP: 0010:[<ffffffffa05e95b9>]  [<ffffffffa05e95b9>] rfcomm_sock_getsockopt_old+0x39/0x190 [rfcomm]
> >  RSP: 0018:ffff880036f95e78  EFLAGS: 00010246
> >  RAX: 000000234df53512 RBX: 00007fff5ebe9e9c RCX: 00007fff5ebe9e9c
> >  RDX: 00007fff5ebe9e98 RSI: 0000000000000003 RDI: ffff8800784eb480
> >  RBP: ffff880036f95ec8 R08: ffff880076c1e000 R09: 00007fff5ebea148
> >  R10: 00007fff5ebe9e98 R11: 0000000000000202 R12: ffff880076c1e000
> >  R13: 0000000000000003 R14: 00007fff5ebe9e9c R15: 00007fff5ebe9e98
> >  FS:  00007fd5d7655700(0000) GS:ffff88007c200000(0000) knlGS:0000000000000000
> >  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> >  CR2: 000000234df5351a CR3: 0000000037b06000 CR4: 00000000000007f0
> >  Stack:
> >   0000000000000004 00007fff5ebe9e98 ffff880036f95ea8 ffffffff81582e8f
> >   ffffffff8148e61b ffff8800784eb480 0000000000000012 0000000000000003
> >   00007fff5ebe9e9c 00007fff5ebe9e98 ffff880036f95f28 ffffffffa05e9763
> >  Call Trace:
> >   [<ffffffff81582e8f>] ? _raw_spin_unlock_bh+0x3f/0x50
> >   [<ffffffff8148e61b>] ? release_sock+0x2b/0xa0
> >   [<ffffffffa05e9763>] rfcomm_sock_getsockopt+0x53/0x190 [rfcomm]
> >   [<ffffffff8158b737>] ? sysret_check+0x1b/0x56
> >   [<ffffffff81486933>] SyS_getsockopt+0x73/0xe0
> >   [<ffffffff8158b712>] system_call_fastpath+0x16/0x1b
> >  Code: 04 48 89 5d d8 4c 89 6d e8 48 89 cb 4c 89 65 e0 4c 89 75 f0 41 89 f5 4c 89 7d f8 48 89 55 b8 4c 8b 67 20 49 8b 84 24 50 04 00 00 <4c> 8b 78 08 0f 85 27 01 00 00 e8 e8 83 b6 e0 48 89 d8 e8 60 40 
> >  RIP  [<ffffffffa05e95b9>] rfcomm_sock_getsockopt_old+0x39/0x190 [rfcomm]
> >   RSP <ffff880036f95e78>
> >  CR2: 000000234df5351a
> >  ---[ end trace d84df5c733bb1019 ]---
> > 
> > 
> > I have bisected this to 94a86df01. I don't immediately see how this could 
> > be causing the issue directly, hence sending out this as a heads-up, and 
> > will continue looking into this eventually.
> > 
> > It seems to be very reliably reproducible, so I expect the bisection to be 
> > correct (to be verified still).
> 
> The issue is already fixed in the bluetooth and wireless trees but
> the patch hasn't yet made it to the net or Linus' tree.

Tested-by: Jiri Kosina <jkosina@...e.cz>

Thanks,

-- 
Jiri Kosina
SUSE Labs
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html