lkml.org 
[lkml]   [2021]   [Nov]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.14 341/849] Bluetooth: fix init and cleanup of sco_conn.timeout_work
    Date
    From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>

    [ Upstream commit 49d8a5606428ca0962d09050a5af81461ff90fbb ]

    Before freeing struct sco_conn, all delayed timeout work should be
    cancelled. Otherwise, sco_sock_timeout could potentially use the
    sco_conn after it has been freed.

    Additionally, sco_conn.timeout_work should be initialized when the
    connection is allocated, not when the channel is added. This is
    because an sco_conn can create channels with multiple sockets over its
    lifetime, which happens if sockets are released but the connection
    isn't deleted.

    Fixes: ba316be1b6a0 ("Bluetooth: schedule SCO timeouts with delayed_work")
    Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/bluetooth/sco.c | 9 ++++-----
    1 file changed, 4 insertions(+), 5 deletions(-)

    diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
    index 2766faf95c534..2e251ac89da58 100644
    --- a/net/bluetooth/sco.c
    +++ b/net/bluetooth/sco.c
    @@ -134,6 +134,7 @@ static struct sco_conn *sco_conn_add(struct hci_conn *hcon)
    return NULL;

    spin_lock_init(&conn->lock);
    + INIT_DELAYED_WORK(&conn->timeout_work, sco_sock_timeout);

    hcon->sco_data = conn;
    conn->hcon = hcon;
    @@ -197,11 +198,11 @@ static void sco_conn_del(struct hci_conn *hcon, int err)
    sco_chan_del(sk, err);
    bh_unlock_sock(sk);
    sock_put(sk);
    -
    - /* Ensure no more work items will run before freeing conn. */
    - cancel_delayed_work_sync(&conn->timeout_work);
    }

    + /* Ensure no more work items will run before freeing conn. */
    + cancel_delayed_work_sync(&conn->timeout_work);
    +
    hcon->sco_data = NULL;
    kfree(conn);
    }
    @@ -214,8 +215,6 @@ static void __sco_chan_add(struct sco_conn *conn, struct sock *sk,
    sco_pi(sk)->conn = conn;
    conn->sk = sk;

    - INIT_DELAYED_WORK(&conn->timeout_work, sco_sock_timeout);
    -
    if (parent)
    bt_accept_enqueue(parent, sk, true);
    }
    --
    2.33.0


    \
     
     \ /
      Last update: 2021-11-16 00:10    [W:3.384 / U:1.460 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site