From patchwork Mon May 21 00:58:19 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Minho Ban X-Patchwork-Id: 160301 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id EB307B6FA1 for ; Mon, 21 May 2012 10:58:40 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754744Ab2EUA6W (ORCPT ); Sun, 20 May 2012 20:58:22 -0400 Received: from mailout1.samsung.com ([203.254.224.24]:63511 "EHLO mailout1.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753460Ab2EUA6V (ORCPT ); Sun, 20 May 2012 20:58:21 -0400 Received: from epcpsbgm1.samsung.com (mailout1.samsung.com [203.254.224.24]) by mailout1.samsung.com (Oracle Communications Messaging Server 7u4-24.01(7.0.4.24.0) 64bit (built Nov 17 2011)) with ESMTP id <0M4C00A8QLD8KH00@mailout1.samsung.com>; Mon, 21 May 2012 09:58:20 +0900 (KST) X-AuditID: cbfee61a-b7fe76d0000023f5-3d-4fb9932cb25a Received: from epmmp1.local.host ( [203.254.227.16]) by epcpsbgm1.samsung.com (EPCPMTA) with SMTP id 5F.9E.09205.C2399BF4; Mon, 21 May 2012 09:58:20 +0900 (KST) Received: from [165.213.208.172] by mmp1.samsung.com (Oracle Communications Messaging Server 7u4-24.01(7.0.4.24.0) 64bit (built Nov 17 2011)) with ESMTPA id <0M4C00A2ELD73880@mmp1.samsung.com>; Mon, 21 May 2012 09:58:19 +0900 (KST) Message-id: <4FB9932B.9070101@samsung.com> Date: Mon, 21 May 2012 09:58:19 +0900 From: Minho Ban User-Agent: Mozilla/5.0 (X11; Linux i686; rv:12.0) Gecko/20120430 Thunderbird/12.0.1 MIME-version: 1.0 To: Gustavo Padovan Cc: Marcel Holtmann , Johan Hedberg , "David S. Miller" , linux-bluetooth@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] Bluetooth: Fix null pointer dereference in l2cap_chan_send Content-type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 7bit X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprNLMWRmVeSWpSXmKPExsVy+t9jAV2dyTv9DXrOclnMudbHbHF51xw2 i2MLxByYPT5vkgtgjOKySUnNySxLLdK3S+DK2LppO1PBPtGKeUuXsDcwvhTsYuTkkBAwkfh/ +DwzhC0mceHeerYuRi4OIYFFjBL39p8ESwgJvGWU2NfjDGLzCmhJXHz3lB3EZhFQldh0egIb iM0moCxx99ktVhBbVCBM4vWUQywQ9YISPybfA7NFBDQlpp7aAraAWeAGo8Sab6/AEsIC3hJn rywEW8YsoCOxv3UaG4QtL7F5zVvmCYx8s5DMmoWkbBaSsgWMzKsYRVMLkguKk9JzDfWKE3OL S/PS9ZLzczcxgoPsmdQOxpUNFocYBTgYlXh4yxfv8BdiTSwrrsw9xCjBwawkwiudBRTiTUms rEotyo8vKs1JLT7EKM3BoiTOawdSLZCeWJKanZpakFoEk2Xi4JRqYFRo/L+D+1rv/UVO+aa7 QiYtzr7z9OrRV49nZZRuc1f89HZN3hHOOiPB3eInLnrs/zxdL173HP91pWnaQr1SUheFvaTl FPreiySsl5NYn1o9MdY3wCYkzfPt+0yFCxnqjlI7nV6z/GJ3POPsajtFbr/0kay2L1Pjpr5s WvJ6WdhHlVmxFgd+LlJiKc5INNRiLipOBAD1avGZLgIAAA== X-TM-AS-MML: No Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org If l2cap_chan_send is called will null conn it will cause kernel Oops. This patch checks if conn is valid before entering l2cap_chan_send. 2871 [ 177.271861] Unable to handle kernel NULL pointer dereference at virtual address 00000010 2872 [ 177.271867] pgd = eadc0000 2873 [ 177.271870] [00000010] *pgd=6ad03831, *pte=00000000, *ppte=00000000 2874 [ 177.271884] Internal error: Oops: 17 [#1] PREEMPT SMP 2875 [ 177.271891] Modules linked in: 2876 [ 177.271900] CPU: 3 Not tainted (3.0.15-00019-g097836e #36) 2877 [ 177.271925] PC is at l2cap_chan_send+0x8c/0x6f8 2878 [ 177.271933] LR is at 0xc089d59c 2879 [ 177.271940] pc : [] lr : [] psr: 80000013 2880 [ 177.271943] sp : ddda1d50 ip : 0000035c fp : ddda1dac 2881 [ 177.271948] r10: 0000035c r9 : 00000000 r8 : ddda1f3c 2882 [ 177.271954] r7 : ed67ec00 r6 : 00000006 r5 : ed67ec00 r4 : 00000003 2883 [ 177.271959] r3 : ddda1d7c r2 : 0000035c r1 : 00000000 r0 : ed67ec00 2884 [ 177.271967] Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user 2885 [ 177.271973] Control: 10c5387d Table: 6adc004a DAC: 00000015 ~~~ snip ~~~~~ 3000 [ 177.272989] Backtrace: 3001 [ 177.273001] [] (l2cap_chan_send+0x0/0x6f8) from [] (l2cap_sock_sendmsg+0xc0/0x15c) 3002 [ 177.273023] [] (l2cap_sock_sendmsg+0x0/0x15c) from [] (sock_sendmsg+0xcc/0xd4) 3003 [ 177.273035] [] (sock_sendmsg+0x0/0xd4) from [] (sys_sendto+0xb8/0xdc) 3004 [ 177.273041] r9:ddda0000 r8:00004040 r7:00000000 r6:ebdf9d40 r5:0004fb00 3005 [ 177.273050] r4:0000035c 3006 [ 177.273059] [] (sys_sendto+0x0/0xdc) from [] (sys_send+0x20/0x28) 3007 [ 177.273077] [] (sys_send+0x0/0x28) from [] (ret_fast_syscall+0x0/0x30) 3008 [ 177.273087] Code: e5901004 e24b3030 e51ba050 e590e21c (e5914010) 3009 [ 177.273096] ---[ end trace 29a418305c9cffba ]--- Signed-off-by: Minho Ban --- net/bluetooth/l2cap_sock.c | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c index 3bb1611..98d4541 100644 --- a/net/bluetooth/l2cap_sock.c +++ b/net/bluetooth/l2cap_sock.c @@ -727,10 +727,12 @@ static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct ms if (msg->msg_flags & MSG_OOB) return -EOPNOTSUPP; - if (sk->sk_state != BT_CONNECTED) + l2cap_chan_lock(chan); + if (sk->sk_state != BT_CONNECTED || !chan->conn) { + l2cap_chan_unlock(chan); return -ENOTCONN; + } - l2cap_chan_lock(chan); err = l2cap_chan_send(chan, msg, len, sk->sk_priority); l2cap_chan_unlock(chan);