From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Anderson Lizardo <anderson.lizardo@openbossa.org>,
Gustavo Padovan <gustavo.padovan@collabora.co.uk>,
"John W. Linville" <linville@tuxdriver.com>
Subject: [ 04/26] Bluetooth: Fix crash in l2cap_build_cmd() with small MTU
Date: Mon, 1 Jul 2013 13:09:59 -0700 [thread overview]
Message-ID: <20130701200730.400540904@linuxfoundation.org> (raw)
In-Reply-To: <20130701200729.872850414@linuxfoundation.org>
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anderson Lizardo <anderson.lizardo@openbossa.org>
commit 300b962e5244a1ea010df7e88595faa0085b461d upstream.
If a too small MTU value is set with ioctl(HCISETACLMTU) or by a bogus
controller, memory corruption happens due to a memcpy() call with
negative length.
Fix this crash on either incoming or outgoing connections with a MTU
smaller than L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE:
[ 46.885433] BUG: unable to handle kernel paging request at f56ad000
[ 46.888037] IP: [<c03d94cd>] memcpy+0x1d/0x40
[ 46.888037] *pdpt = 0000000000ac3001 *pde = 00000000373f8067 *pte = 80000000356ad060
[ 46.888037] Oops: 0002 [#1] SMP DEBUG_PAGEALLOC
[ 46.888037] Modules linked in: hci_vhci bluetooth virtio_balloon i2c_piix4 uhci_hcd usbcore usb_common
[ 46.888037] CPU: 0 PID: 1044 Comm: kworker/u3:0 Not tainted 3.10.0-rc1+ #12
[ 46.888037] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007
[ 46.888037] Workqueue: hci0 hci_rx_work [bluetooth]
[ 46.888037] task: f59b15b0 ti: f55c4000 task.ti: f55c4000
[ 46.888037] EIP: 0060:[<c03d94cd>] EFLAGS: 00010212 CPU: 0
[ 46.888037] EIP is at memcpy+0x1d/0x40
[ 46.888037] EAX: f56ac1c0 EBX: fffffff8 ECX: 3ffffc6e EDX: f55c5cf2
[ 46.888037] ESI: f55c6b32 EDI: f56ad000 EBP: f55c5c68 ESP: f55c5c5c
[ 46.888037] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
[ 46.888037] CR0: 8005003b CR2: f56ad000 CR3: 3557d000 CR4: 000006f0
[ 46.888037] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[ 46.888037] DR6: ffff0ff0 DR7: 00000400
[ 46.888037] Stack:
[ 46.888037] fffffff8 00000010 00000003 f55c5cac f8c6a54c ffffffff f8c69eb2 00000000
[ 46.888037] f4783cdc f57f0070 f759c590 1001c580 00000003 0200000a 00000000 f5a88560
[ 46.888037] f5ba2600 f5a88560 00000041 00000000 f55c5d90 f8c6f4c7 00000008 f55c5cf2
[ 46.888037] Call Trace:
[ 46.888037] [<f8c6a54c>] l2cap_send_cmd+0x1cc/0x230 [bluetooth]
[ 46.888037] [<f8c69eb2>] ? l2cap_global_chan_by_psm+0x152/0x1a0 [bluetooth]
[ 46.888037] [<f8c6f4c7>] l2cap_connect+0x3f7/0x540 [bluetooth]
[ 46.888037] [<c019b37b>] ? trace_hardirqs_off+0xb/0x10
[ 46.888037] [<c01a0ff8>] ? mark_held_locks+0x68/0x110
[ 46.888037] [<c064ad20>] ? mutex_lock_nested+0x280/0x360
[ 46.888037] [<c064b9d9>] ? __mutex_unlock_slowpath+0xa9/0x150
[ 46.888037] [<c01a118c>] ? trace_hardirqs_on_caller+0xec/0x1b0
[ 46.888037] [<c064ad08>] ? mutex_lock_nested+0x268/0x360
[ 46.888037] [<c01a125b>] ? trace_hardirqs_on+0xb/0x10
[ 46.888037] [<f8c72f8d>] l2cap_recv_frame+0xb2d/0x1d30 [bluetooth]
[ 46.888037] [<c01a0ff8>] ? mark_held_locks+0x68/0x110
[ 46.888037] [<c064b9d9>] ? __mutex_unlock_slowpath+0xa9/0x150
[ 46.888037] [<c01a118c>] ? trace_hardirqs_on_caller+0xec/0x1b0
[ 46.888037] [<f8c754f1>] l2cap_recv_acldata+0x2a1/0x320 [bluetooth]
[ 46.888037] [<f8c491d8>] hci_rx_work+0x518/0x810 [bluetooth]
[ 46.888037] [<f8c48df2>] ? hci_rx_work+0x132/0x810 [bluetooth]
[ 46.888037] [<c0158979>] process_one_work+0x1a9/0x600
[ 46.888037] [<c01588fb>] ? process_one_work+0x12b/0x600
[ 46.888037] [<c015922e>] ? worker_thread+0x19e/0x320
[ 46.888037] [<c015922e>] ? worker_thread+0x19e/0x320
[ 46.888037] [<c0159187>] worker_thread+0xf7/0x320
[ 46.888037] [<c0159090>] ? rescuer_thread+0x290/0x290
[ 46.888037] [<c01602f8>] kthread+0xa8/0xb0
[ 46.888037] [<c0656777>] ret_from_kernel_thread+0x1b/0x28
[ 46.888037] [<c0160250>] ? flush_kthread_worker+0x120/0x120
[ 46.888037] Code: c3 90 8d 74 26 00 e8 63 fc ff ff eb e8 90 55 89 e5 83 ec 0c 89 5d f4 89 75 f8 89 7d fc 3e 8d 74 26 00 89 cb 89 c7 c1 e9 02 89 d6 <f3> a5 89 d9 83 e1 03 74 02 f3 a4 8b 5d f4 8b 75 f8 8b 7d fc 89
[ 46.888037] EIP: [<c03d94cd>] memcpy+0x1d/0x40 SS:ESP 0068:f55c5c5c
[ 46.888037] CR2: 00000000f56ad000
[ 46.888037] ---[ end trace 0217c1f4d78714a9 ]---
Signed-off-by: Anderson Lizardo <anderson.lizardo@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/l2cap_core.c | 3 +++
1 file changed, 3 insertions(+)
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -2743,6 +2743,9 @@ static struct sk_buff *l2cap_build_cmd(s
BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %u",
conn, code, ident, dlen);
+ if (conn->mtu < L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE)
+ return NULL;
+
len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
count = min_t(unsigned int, conn->mtu, len);
next prev parent reply other threads:[~2013-07-01 20:23 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-07-01 20:09 [ 00/26] 3.9.9-stable review Greg Kroah-Hartman
2013-07-01 20:09 ` [ 01/26] s390/ipl: Fix FCP WWPN and LUN format strings for read Greg Kroah-Hartman
2013-07-01 20:09 ` [ 02/26] ARM: 7755/1: handle user space mapped pages in flush_kernel_dcache_page Greg Kroah-Hartman
2013-07-01 20:09 ` [ 03/26] ARM: 7772/1: Fix missing flush_kernel_dcache_page() for noMMU Greg Kroah-Hartman
2013-07-01 20:09 ` Greg Kroah-Hartman [this message]
2013-07-01 20:10 ` [ 05/26] Bluetooth: Fix invalid length check in l2cap_information_rsp() Greg Kroah-Hartman
2013-07-01 20:10 ` [ 06/26] hw_breakpoint: Fix cpu check in task_bp_pinned(cpu) Greg Kroah-Hartman
2013-07-01 20:10 ` [ 07/26] hw_breakpoint: Use cpu_possible_mask in {reserve,release}_bp_slot() Greg Kroah-Hartman
2013-07-01 20:10 ` [ 08/26] ath9k_htc: Handle IDLE state transition properly Greg Kroah-Hartman
2013-07-01 20:10 ` [ 09/26] iwlwifi: dvm: fix chain noise calibration Greg Kroah-Hartman
2013-07-01 20:10 ` [ 10/26] s390/pci: Implement IRQ functions if !PCI Greg Kroah-Hartman
2013-07-01 20:10 ` [ 11/26] s390/irq: Only define synchronize_irq() on SMP Greg Kroah-Hartman
2013-07-01 20:10 ` [ 12/26] dlci: acquire rtnl_lock before calling __dev_get_by_name() Greg Kroah-Hartman
2013-07-01 20:10 ` [ 13/26] dlci: validate the net device in dlci_del() Greg Kroah-Hartman
2013-07-01 20:10 ` [ 14/26] net/tg3: Avoid delay during MMIO access Greg Kroah-Hartman
2013-07-01 20:10 ` [ 15/26] rt2800: fix RT5390 & RT3290 TX power settings regression Greg Kroah-Hartman
2013-07-01 20:10 ` [ 16/26] iommu/vt-d: add quirk for broken interrupt remapping on 55XX chipsets Greg Kroah-Hartman
2013-07-01 20:10 ` [ 17/26] perf: Disable monitoring on setuid processes for regular users Greg Kroah-Hartman
2013-07-01 20:10 ` [ 18/26] crypto: algboss - Hold ref count on larval Greg Kroah-Hartman
2013-07-01 20:10 ` Greg Kroah-Hartman
2013-07-01 20:10 ` [ 19/26] powerpc/eeh: Fix fetching bus for single-dev-PE Greg Kroah-Hartman
2013-07-01 20:10 ` [ 20/26] UBIFS: prepare to fix a horrid bug Greg Kroah-Hartman
2013-07-01 20:10 ` [ 21/26] UBIFS: " Greg Kroah-Hartman
2013-07-01 20:10 ` [ 22/26] libata-acpi: add back ACPI based hotplug functionality Greg Kroah-Hartman
2013-07-01 20:10 ` [ 23/26] of/base: release the node correctly in of_parse_phandle_with_args() Greg Kroah-Hartman
2013-07-01 20:10 ` [ 24/26] can: usb_8dev: unregister netdev before free()ing Greg Kroah-Hartman
2013-07-01 20:10 ` [ 25/26] mac80211: work around broken APs not including HT info Greg Kroah-Hartman
2013-07-01 20:10 ` [ 26/26] netfilter: nf_conntrack_ipv6: Plug sk_buff leak in fragment handling Greg Kroah-Hartman
2013-07-02 18:31 ` [ 00/26] 3.9.9-stable review Guenter Roeck
2013-07-02 18:57 ` Greg Kroah-Hartman
2013-07-02 18:47 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130701200730.400540904@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=anderson.lizardo@openbossa.org \
--cc=gustavo.padovan@collabora.co.uk \
--cc=linux-kernel@vger.kernel.org \
--cc=linville@tuxdriver.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.