Wei Yongjun
6013c99742
Bluetooth: sco: Fix crash when using BT_SNDMTU/BT_RCVMTU option ...
[ Upstream commit f6b8c6b5543983e9de29dc14716bfa4eb3f157c4 ]
This commit add the invalid check for connected socket, without it will
causes the following crash due to sco_pi(sk)->conn being NULL:
KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057]
CPU: 3 PID: 4284 Comm: test_sco Not tainted 5.10.0-rc3+ #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1 04/01/2014
RIP: 0010:sco_sock_getsockopt+0x45d/0x8e0
Code: 48 c1 ea 03 80 3c 02 00 0f 85 ca 03 00 00 49 8b 9d f8 04 00 00 48 b8 00
00 00 00 00 fc ff df 48 8d 7b 50 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84
c0 74 08 3c 03 0f 8e b5 03 00 00 8b 43 50 48 8b 0c
RSP: 0018:ffff88801bb17d88 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff83a4ecdf
RDX: 000000000000000a RSI: ffffc90002fce000 RDI: 0000000000000050
RBP: 1ffff11003762fb4 R08: 0000000000000001 R09: ffff88810e1008c0
R10: ffffffffbd695dcf R11: fffffbfff7ad2bb9 R12: 0000000000000000
R13: ffff888018ff1000 R14: dffffc0000000000 R15: 000000000000000d
FS: 00007fb4f76c1700(0000) GS:ffff88811af80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005555e3b7a938 CR3: 00000001117be001 CR4: 0000000000770ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
? sco_skb_put_cmsg+0x80/0x80
? sco_skb_put_cmsg+0x80/0x80
__sys_getsockopt+0x12a/0x220
? __ia32_sys_setsockopt+0x150/0x150
? syscall_enter_from_user_mode+0x18/0x50
? rcu_read_lock_bh_held+0xb0/0xb0
__x64_sys_getsockopt+0xba/0x150
? syscall_enter_from_user_mode+0x1d/0x50
do_syscall_64+0x33/0x40
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Fixes: 0fc1a726f897 ("Bluetooth: sco: new getsockopt options BT_SNDMTU/BT_RCVMTU")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Reviewed-by: Luiz Augusto Von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-12-30 11:53:40 +01:00
2020-10-12 10:05:47 +02:00
2020-09-28 00:51:39 -07:00
2020-08-03 15:48:32 -07:00
2020-10-31 12:26:30 -07:00
2020-07-25 17:49:04 -07:00
2020-11-27 08:02:55 +01:00
2020-12-30 11:53:40 +01:00
2020-09-30 08:34:08 -07:00
2020-10-15 12:33:24 -07:00
2020-12-07 17:14:43 -08:00
2020-09-05 15:57:05 -07:00
2020-12-09 08:44:15 -08:00
2020-10-12 15:29:27 +02:00
2020-12-10 14:29:30 -08:00
2020-09-10 15:09:08 -07:00
2020-11-23 16:32:33 -08:00
2020-08-23 17:36:59 -05:00
2020-10-19 17:32:50 -07:00
2020-12-09 15:50:38 -08:00
2020-10-02 19:11:11 -07:00
2020-10-02 19:11:11 -07:00
2020-12-26 16:02:38 +01:00
2020-12-09 18:55:46 -08:00
2020-11-21 14:43:45 -08:00
2020-07-24 15:41:54 -07:00
2020-08-02 01:02:12 -07:00
2020-10-02 19:11:11 -07:00
2020-08-27 07:55:59 -07:00
2020-07-24 15:41:54 -07:00
2020-12-04 17:34:25 -08:00
2020-09-08 20:12:58 -07:00
2020-10-20 21:16:45 -07:00
2020-12-07 17:45:29 -08:00
2020-11-12 17:00:13 -08:00
2020-12-09 10:31:58 +01:00
2020-11-14 12:07:57 -08:00
2020-10-09 20:22:32 -07:00
2020-08-23 17:36:59 -05:00
2020-10-20 17:06:22 -07:00
2020-12-04 15:43:14 -08:00
2020-11-23 17:29:36 -08:00
2020-08-23 17:36:59 -05:00
2020-10-02 19:11:11 -07:00
2020-10-06 06:01:35 -07:00
2020-10-28 09:14:49 -03:00
2020-11-12 09:18:06 +01:00
2020-11-20 10:04:58 -08:00
2020-10-15 13:28:00 +01:00
2020-12-09 20:39:38 -08:00
2020-11-14 11:57:12 -08:00
2020-11-19 10:59:19 -08:00
2020-12-30 11:53:30 +01:00
2020-09-23 17:46:31 -07:00
2020-12-08 15:53:41 -08:00
2020-11-25 17:31:06 -08:00
2020-10-15 18:42:13 -07:00
2020-11-23 16:36:29 -08:00
2020-10-02 19:11:11 -07:00
2020-12-30 11:53:03 +01:00
2020-12-02 17:26:36 -08:00
2020-12-04 16:48:31 +01:00
2020-11-10 09:14:25 +01:00
2020-10-03 00:02:13 -04:00
2020-06-30 15:57:34 -07:00
2020-09-30 18:01:26 -07:00
2020-10-05 18:40:01 -07:00
6013c99742