lkml.org 
[lkml]   [2014]   [Feb]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 18/24] Bluetooth: Serialize RFCOMMCREATEDEV and RFCOMMRELEASEDEV ioctls
    Date
    At least two different race conditions exist with multiple concurrent
    RFCOMMCREATEDEV and RFCOMMRELEASEDEV ioctls:
    * Multiple concurrent RFCOMMCREATEDEVs with RFCOMM_REUSE_DLC can
    mistakenly share the same DLC.
    * RFCOMMRELEASEDEV can destruct the rfcomm_dev still being
    constructed by RFCOMMCREATEDEV.

    Introduce rfcomm_ioctl_mutex to serialize these add/remove operations.

    Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
    ---
    net/bluetooth/rfcomm/tty.c | 27 +++++++++++++++++++++++++--
    1 file changed, 25 insertions(+), 2 deletions(-)

    diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
    index 4a38b54..ef27695 100644
    --- a/net/bluetooth/rfcomm/tty.c
    +++ b/net/bluetooth/rfcomm/tty.c
    @@ -40,6 +40,7 @@
    #define RFCOMM_TTY_MAJOR 216 /* device node major id of the usb/bluetooth.c driver */
    #define RFCOMM_TTY_MINOR 0

    +static DEFINE_MUTEX(rfcomm_ioctl_mutex);
    static struct tty_driver *rfcomm_tty_driver;

    struct rfcomm_dev {
    @@ -373,7 +374,7 @@ static struct sk_buff *rfcomm_wmalloc(struct rfcomm_dev *dev, unsigned long size

    #define NOCAP_FLAGS ((1 << RFCOMM_REUSE_DLC) | (1 << RFCOMM_RELEASE_ONHUP))

    -static int rfcomm_create_dev(struct sock *sk, void __user *arg)
    +static int __rfcomm_create_dev(struct sock *sk, void __user *arg)
    {
    struct rfcomm_dev_req req;
    struct rfcomm_dlc *dlc;
    @@ -423,7 +424,7 @@ static int rfcomm_create_dev(struct sock *sk, void __user *arg)
    return id;
    }

    -static int rfcomm_release_dev(void __user *arg)
    +static int __rfcomm_release_dev(void __user *arg)
    {
    struct rfcomm_dev_req req;
    struct rfcomm_dev *dev;
    @@ -466,6 +467,28 @@ static int rfcomm_release_dev(void __user *arg)
    return 0;
    }

    +static int rfcomm_create_dev(struct sock *sk, void __user *arg)
    +{
    + int ret;
    +
    + mutex_lock(&rfcomm_ioctl_mutex);
    + ret = __rfcomm_create_dev(sk, arg);
    + mutex_unlock(&rfcomm_ioctl_mutex);
    +
    + return ret;
    +}
    +
    +static int rfcomm_release_dev(void __user *arg)
    +{
    + int ret;
    +
    + mutex_lock(&rfcomm_ioctl_mutex);
    + ret = __rfcomm_release_dev(arg);
    + mutex_unlock(&rfcomm_ioctl_mutex);
    +
    + return ret;
    +}
    +
    static int rfcomm_get_dev_list(void __user *arg)
    {
    struct rfcomm_dev *dev;
    --
    1.8.1.2


    \
     
     \ /
      Last update: 2014-02-10 04:01    [W:4.056 / U:0.192 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site