lkml.org 
[lkml]   [2022]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.16 0093/1039] Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails
    Date
    From: Wang Hai <wanghai38@huawei.com>

    [ Upstream commit 2a7ca7459d905febf519163bd9e3eed894de6bb7 ]

    I got a kernel BUG report when doing fault injection test:

    ------------[ cut here ]------------
    kernel BUG at lib/list_debug.c:45!
    ...
    RIP: 0010:__list_del_entry_valid.cold+0x12/0x4d
    ...
    Call Trace:
    proto_unregister+0x83/0x220
    cmtp_cleanup_sockets+0x37/0x40 [cmtp]
    cmtp_exit+0xe/0x1f [cmtp]
    do_syscall_64+0x35/0xb0
    entry_SYSCALL_64_after_hwframe+0x44/0xae

    If cmtp_init_sockets() in cmtp_init() fails, cmtp_init() still returns
    success. This will cause a kernel bug when accessing uncreated ctmp
    related data when the module exits.

    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Reported-by: Hulk Robot <hulkci@huawei.com>
    Signed-off-by: Wang Hai <wanghai38@huawei.com>
    Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/bluetooth/cmtp/core.c | 4 +---
    1 file changed, 1 insertion(+), 3 deletions(-)

    diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c
    index 0a2d78e811cf5..83eb84e8e688f 100644
    --- a/net/bluetooth/cmtp/core.c
    +++ b/net/bluetooth/cmtp/core.c
    @@ -501,9 +501,7 @@ static int __init cmtp_init(void)
    {
    BT_INFO("CMTP (CAPI Emulation) ver %s", VERSION);

    - cmtp_init_sockets();
    -
    - return 0;
    + return cmtp_init_sockets();
    }

    static void __exit cmtp_exit(void)
    --
    2.34.1


    \
     
     \ /
      Last update: 2022-01-25 01:11    [W:2.908 / U:0.148 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site