* Re: [PATCH] Bluetooth: Do not dereference zero sk
2012-02-14 13:12 [PATCH] Bluetooth: Do not dereference zero sk Emeltchenko Andrei
@ 2012-02-14 13:12 ` Marcel Holtmann
2012-02-14 13:27 ` Szymon Janc
2012-02-16 13:17 ` Johan Hedberg
0 siblings, 2 replies; 4+ messages in thread
From: Marcel Holtmann @ 2012-02-14 13:12 UTC (permalink / raw)
To: Emeltchenko Andrei; +Cc: linux-bluetooth
Hi Andrei,
> Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
> ---
> net/bluetooth/l2cap_sock.c | 4 +++-
> 1 files changed, 3 insertions(+), 1 deletions(-)
>
> diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
> index 1636029..138fe34 100644
> --- a/net/bluetooth/l2cap_sock.c
> +++ b/net/bluetooth/l2cap_sock.c
> @@ -795,7 +795,7 @@ static void l2cap_sock_kill(struct sock *sk)
> static int l2cap_sock_shutdown(struct socket *sock, int how)
> {
> struct sock *sk = sock->sk;
> - struct l2cap_chan *chan = l2cap_pi(sk)->chan;
> + struct l2cap_chan *chan;
> int err = 0;
>
> BT_DBG("sock %p, sk %p", sock, sk);
> @@ -803,6 +803,8 @@ static int l2cap_sock_shutdown(struct socket *sock, int how)
> if (!sk)
> return 0;
>
> + chan = l2cap_pi(sk)->chan;
> +
funny that this never caused any problems so far.
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Regards
Marcel
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH] Bluetooth: Do not dereference zero sk
@ 2012-02-14 13:12 Emeltchenko Andrei
2012-02-14 13:12 ` Marcel Holtmann
0 siblings, 1 reply; 4+ messages in thread
From: Emeltchenko Andrei @ 2012-02-14 13:12 UTC (permalink / raw)
To: linux-bluetooth
From: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
---
net/bluetooth/l2cap_sock.c | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 1636029..138fe34 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -795,7 +795,7 @@ static void l2cap_sock_kill(struct sock *sk)
static int l2cap_sock_shutdown(struct socket *sock, int how)
{
struct sock *sk = sock->sk;
- struct l2cap_chan *chan = l2cap_pi(sk)->chan;
+ struct l2cap_chan *chan;
int err = 0;
BT_DBG("sock %p, sk %p", sock, sk);
@@ -803,6 +803,8 @@ static int l2cap_sock_shutdown(struct socket *sock, int how)
if (!sk)
return 0;
+ chan = l2cap_pi(sk)->chan;
+
lock_sock(sk);
if (!sk->sk_shutdown) {
if (chan->mode == L2CAP_MODE_ERTM)
--
1.7.8.3
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] Bluetooth: Do not dereference zero sk
2012-02-14 13:12 ` Marcel Holtmann
@ 2012-02-14 13:27 ` Szymon Janc
2012-02-16 13:17 ` Johan Hedberg
1 sibling, 0 replies; 4+ messages in thread
From: Szymon Janc @ 2012-02-14 13:27 UTC (permalink / raw)
To: Marcel Holtmann; +Cc: Emeltchenko Andrei, linux-bluetooth@vger.kernel.org
Hi,
> > @@ -795,7 +795,7 @@ static void l2cap_sock_kill(struct sock *sk)
> > static int l2cap_sock_shutdown(struct socket *sock, int how)
> > {
> > struct sock *sk = sock->sk;
> > - struct l2cap_chan *chan = l2cap_pi(sk)->chan;
> > + struct l2cap_chan *chan;
> > int err = 0;
> >
> > BT_DBG("sock %p, sk %p", sock, sk);
> > @@ -803,6 +803,8 @@ static int l2cap_sock_shutdown(struct socket *sock, int how)
> > if (!sk)
> > return 0;
> >
> > + chan = l2cap_pi(sk)->chan;
> > +
>
> funny that this never caused any problems so far.
It didn't because chan is a pointer so only offset is added to sk pointer and
stored in chan. And kernel is compiled with option that prevents gcc to remove
NULL checks even if pointer was already dereferenced.
--
BR
Szymon Janc
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] Bluetooth: Do not dereference zero sk
2012-02-14 13:12 ` Marcel Holtmann
2012-02-14 13:27 ` Szymon Janc
@ 2012-02-16 13:17 ` Johan Hedberg
1 sibling, 0 replies; 4+ messages in thread
From: Johan Hedberg @ 2012-02-16 13:17 UTC (permalink / raw)
To: Marcel Holtmann; +Cc: Emeltchenko Andrei, linux-bluetooth
Hi,
On Tue, Feb 14, 2012, Marcel Holtmann wrote:
> > Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
> > ---
> > net/bluetooth/l2cap_sock.c | 4 +++-
> > 1 files changed, 3 insertions(+), 1 deletions(-)
> >
> > diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
> > index 1636029..138fe34 100644
> > --- a/net/bluetooth/l2cap_sock.c
> > +++ b/net/bluetooth/l2cap_sock.c
> > @@ -795,7 +795,7 @@ static void l2cap_sock_kill(struct sock *sk)
> > static int l2cap_sock_shutdown(struct socket *sock, int how)
> > {
> > struct sock *sk = sock->sk;
> > - struct l2cap_chan *chan = l2cap_pi(sk)->chan;
> > + struct l2cap_chan *chan;
> > int err = 0;
> >
> > BT_DBG("sock %p, sk %p", sock, sk);
> > @@ -803,6 +803,8 @@ static int l2cap_sock_shutdown(struct socket *sock, int how)
> > if (!sk)
> > return 0;
> >
> > + chan = l2cap_pi(sk)->chan;
> > +
>
> funny that this never caused any problems so far.
>
> Acked-by: Marcel Holtmann <marcel@holtmann.org>
Applied to my bluetooth-next tree. Thanks.
Johan
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2012-02-16 13:17 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-02-14 13:12 [PATCH] Bluetooth: Do not dereference zero sk Emeltchenko Andrei
2012-02-14 13:12 ` Marcel Holtmann
2012-02-14 13:27 ` Szymon Janc
2012-02-16 13:17 ` Johan Hedberg
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox