From: Steven Rostedt <rostedt@goodmis.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Anderson Lizardo <anderson.lizardo@openbossa.org>,
Gustavo Padovan <gustavo.padovan@collabora.co.uk>,
"John W. Linville" <linville@tuxdriver.com>
Subject: [41/88] Bluetooth: Fix crash in l2cap_build_cmd() with small MTU
Date: Tue, 13 Aug 2013 11:57:35 -0400 [thread overview]
Message-ID: <20130813155830.050999814@goodmis.org> (raw)
In-Reply-To: 20130813155654.069291373@goodmis.org
[-- Attachment #1: 0041-Bluetooth-Fix-crash-in-l2cap_build_cmd-with-small-MT.patch --]
[-- Type: text/plain, Size: 4819 bytes --]
3.6.11.7-rc1 stable review patch.
If anyone has any objections, please let me know.
------------------
From: Anderson Lizardo <anderson.lizardo@openbossa.org>
[ Upstream commit 300b962e5244a1ea010df7e88595faa0085b461d ]
If a too small MTU value is set with ioctl(HCISETACLMTU) or by a bogus
controller, memory corruption happens due to a memcpy() call with
negative length.
Fix this crash on either incoming or outgoing connections with a MTU
smaller than L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE:
[ 46.885433] BUG: unable to handle kernel paging request at f56ad000
[ 46.888037] IP: [<c03d94cd>] memcpy+0x1d/0x40
[ 46.888037] *pdpt = 0000000000ac3001 *pde = 00000000373f8067 *pte = 80000000356ad060
[ 46.888037] Oops: 0002 [#1] SMP DEBUG_PAGEALLOC
[ 46.888037] Modules linked in: hci_vhci bluetooth virtio_balloon i2c_piix4 uhci_hcd usbcore usb_common
[ 46.888037] CPU: 0 PID: 1044 Comm: kworker/u3:0 Not tainted 3.10.0-rc1+ #12
[ 46.888037] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007
[ 46.888037] Workqueue: hci0 hci_rx_work [bluetooth]
[ 46.888037] task: f59b15b0 ti: f55c4000 task.ti: f55c4000
[ 46.888037] EIP: 0060:[<c03d94cd>] EFLAGS: 00010212 CPU: 0
[ 46.888037] EIP is at memcpy+0x1d/0x40
[ 46.888037] EAX: f56ac1c0 EBX: fffffff8 ECX: 3ffffc6e EDX: f55c5cf2
[ 46.888037] ESI: f55c6b32 EDI: f56ad000 EBP: f55c5c68 ESP: f55c5c5c
[ 46.888037] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
[ 46.888037] CR0: 8005003b CR2: f56ad000 CR3: 3557d000 CR4: 000006f0
[ 46.888037] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[ 46.888037] DR6: ffff0ff0 DR7: 00000400
[ 46.888037] Stack:
[ 46.888037] fffffff8 00000010 00000003 f55c5cac f8c6a54c ffffffff f8c69eb2 00000000
[ 46.888037] f4783cdc f57f0070 f759c590 1001c580 00000003 0200000a 00000000 f5a88560
[ 46.888037] f5ba2600 f5a88560 00000041 00000000 f55c5d90 f8c6f4c7 00000008 f55c5cf2
[ 46.888037] Call Trace:
[ 46.888037] [<f8c6a54c>] l2cap_send_cmd+0x1cc/0x230 [bluetooth]
[ 46.888037] [<f8c69eb2>] ? l2cap_global_chan_by_psm+0x152/0x1a0 [bluetooth]
[ 46.888037] [<f8c6f4c7>] l2cap_connect+0x3f7/0x540 [bluetooth]
[ 46.888037] [<c019b37b>] ? trace_hardirqs_off+0xb/0x10
[ 46.888037] [<c01a0ff8>] ? mark_held_locks+0x68/0x110
[ 46.888037] [<c064ad20>] ? mutex_lock_nested+0x280/0x360
[ 46.888037] [<c064b9d9>] ? __mutex_unlock_slowpath+0xa9/0x150
[ 46.888037] [<c01a118c>] ? trace_hardirqs_on_caller+0xec/0x1b0
[ 46.888037] [<c064ad08>] ? mutex_lock_nested+0x268/0x360
[ 46.888037] [<c01a125b>] ? trace_hardirqs_on+0xb/0x10
[ 46.888037] [<f8c72f8d>] l2cap_recv_frame+0xb2d/0x1d30 [bluetooth]
[ 46.888037] [<c01a0ff8>] ? mark_held_locks+0x68/0x110
[ 46.888037] [<c064b9d9>] ? __mutex_unlock_slowpath+0xa9/0x150
[ 46.888037] [<c01a118c>] ? trace_hardirqs_on_caller+0xec/0x1b0
[ 46.888037] [<f8c754f1>] l2cap_recv_acldata+0x2a1/0x320 [bluetooth]
[ 46.888037] [<f8c491d8>] hci_rx_work+0x518/0x810 [bluetooth]
[ 46.888037] [<f8c48df2>] ? hci_rx_work+0x132/0x810 [bluetooth]
[ 46.888037] [<c0158979>] process_one_work+0x1a9/0x600
[ 46.888037] [<c01588fb>] ? process_one_work+0x12b/0x600
[ 46.888037] [<c015922e>] ? worker_thread+0x19e/0x320
[ 46.888037] [<c015922e>] ? worker_thread+0x19e/0x320
[ 46.888037] [<c0159187>] worker_thread+0xf7/0x320
[ 46.888037] [<c0159090>] ? rescuer_thread+0x290/0x290
[ 46.888037] [<c01602f8>] kthread+0xa8/0xb0
[ 46.888037] [<c0656777>] ret_from_kernel_thread+0x1b/0x28
[ 46.888037] [<c0160250>] ? flush_kthread_worker+0x120/0x120
[ 46.888037] Code: c3 90 8d 74 26 00 e8 63 fc ff ff eb e8 90 55 89 e5 83 ec 0c 89 5d f4 89 75 f8 89 7d fc 3e 8d 74 26 00 89 cb 89 c7 c1 e9 02 89 d6 <f3> a5 89 d9 83 e1 03 74 02 f3 a4 8b 5d f4 8b 75 f8 8b 7d fc 89
[ 46.888037] EIP: [<c03d94cd>] memcpy+0x1d/0x40 SS:ESP 0068:f55c5c5c
[ 46.888037] CR2: 00000000f56ad000
[ 46.888037] ---[ end trace 0217c1f4d78714a9 ]---
Signed-off-by: Anderson Lizardo <anderson.lizardo@openbossa.org>
Cc: stable@vger.kernel.org
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
---
net/bluetooth/l2cap_core.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 38c00f1..bca5c33 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -2548,6 +2548,9 @@ static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, u8 code,
BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %u",
conn, code, ident, dlen);
+ if (conn->mtu < L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE)
+ return NULL;
+
len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
count = min_t(unsigned int, conn->mtu, len);
--
1.7.10.4
next prev parent reply other threads:[~2013-08-13 16:01 UTC|newest]
Thread overview: 92+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-08-13 15:56 [00/88] 3.6.11.7-rc1-stable review Steven Rostedt
2013-08-13 15:56 ` [01/88] ALSA: usb-audio: Fix invalid volume resolution for Logitech HD Webcam c310 Steven Rostedt
2013-08-13 15:56 ` [02/88] ALSA: usb-audio: work around Android accessory firmware bug Steven Rostedt
2013-08-13 15:56 ` [03/88] clk: remove notifier from list before freeing it Steven Rostedt
2013-08-13 15:56 ` [04/88] tilepro: work around module link error with gcc 4.7 Steven Rostedt
2013-08-13 15:56 ` [05/88] carl9170: fix frame drop and WARN due to minstrel_ht change Steven Rostedt
2013-08-13 17:15 ` Luis Henriques
2013-08-13 20:00 ` Steven Rostedt
2013-08-13 15:57 ` [06/88] KVM: x86: remove vcpus CPL check in host-invoked XCR set Steven Rostedt
2013-08-13 15:57 ` [07/88] drm/radeon: prevent crash in the ring space allocation Steven Rostedt
2013-08-13 15:57 ` [08/88] drm/radeon: update lockup tracking when scheduling in empty ring Steven Rostedt
2013-08-13 15:57 ` [09/88] x86: fix build error and kconfig for ia32_emulation and binfmt Steven Rostedt
2013-08-13 15:57 ` [10/88] tcp: fix tcp_md5_hash_skb_data() Steven Rostedt
2013-08-13 15:57 ` [11/88] gianfar: add missing iounmap() on error in gianfar_ptp_probe() Steven Rostedt
2013-08-13 15:57 ` [12/88] ipv6: fix possible crashes in ip6_cork_release() Steven Rostedt
2013-08-13 15:57 ` [13/88] netlabel: improve domain mapping validation Steven Rostedt
2013-08-13 15:57 ` [14/88] 8139cp: reset BQL when ring tx ring cleared Steven Rostedt
2013-08-13 15:57 ` [15/88] tcp: bug fix in proportional rate reduction Steven Rostedt
2013-08-13 15:57 ` [16/88] tcp: xps: fix reordering issues Steven Rostedt
2013-08-13 15:57 ` [17/88] ip_tunnel: fix kernel panic with icmp_dest_unreach Steven Rostedt
2013-08-13 15:57 ` [18/88] net: phy: fix a bug when verify the EEE support Steven Rostedt
2013-08-13 15:57 ` [19/88] ipv4: fix redirect handling for TCP packets Steven Rostedt
2013-08-13 15:57 ` [20/88] net: Block MSG_CMSG_COMPAT in send(m)msg and recv(m)msg Steven Rostedt
2013-08-13 15:57 ` [21/88] net: Unbreak compat_sys_{send,recv}msg Steven Rostedt
2013-08-13 15:57 ` [22/88] net/core/sock.c: add missing VSOCK string in af_family_*_key_strings Steven Rostedt
2013-08-13 15:57 ` [23/88] net: force a reload of first item in hlist_nulls_for_each_entry_rcu Steven Rostedt
2013-08-13 15:57 ` [24/88] ipv6: assign rt6_info to inet6_ifaddr in init_loopback Steven Rostedt
2013-08-13 15:57 ` [25/88] net: sctp: fix NULL pointer dereference in socket destruction Steven Rostedt
2013-08-13 15:57 ` [26/88] team: check return value of team_get_port_by_index_rcu() for NULL Steven Rostedt
2013-08-13 15:57 ` [27/88] team: move add to port list before port enablement Steven Rostedt
2013-08-13 15:57 ` [28/88] packet: packet_getname_spkt: make sure string is always 0-terminated Steven Rostedt
2013-08-13 15:57 ` [29/88] l2tp: Fix PPP header erasure and memory leak Steven Rostedt
2013-08-13 15:57 ` [30/88] l2tp: Fix sendmsg() return value Steven Rostedt
2013-08-13 15:57 ` [31/88] sctp: fully initialize sctp_outq in sctp_outq_init Steven Rostedt
2013-08-13 15:57 ` [32/88] net: sh_eth: fix incorrect RX length error if R8A7740 Steven Rostedt
2013-08-13 15:57 ` [33/88] Input: cyttsp - fix memcpy size param Steven Rostedt
2013-08-13 15:57 ` [34/88] USB: serial: ti_usb_3410_5052: new device id for Abbot strip port cable Steven Rostedt
2013-08-13 15:57 ` [35/88] tcm_qla2xxx: Fix residual for underrun commands that fail Steven Rostedt
2013-08-13 15:57 ` [36/88] target/iscsi: dont corrupt bh_count in iscsit_stop_time2retain_timer() Steven Rostedt
2013-08-13 15:57 ` [37/88] perf: Fix perf mmap bugs Steven Rostedt
2013-08-13 15:57 ` [38/88] perf: Fix mmap() accounting hole Steven Rostedt
2013-08-13 15:57 ` [39/88] ARM: 7755/1: handle user space mapped pages in flush_kernel_dcache_page Steven Rostedt
2013-08-13 15:57 ` [40/88] ARM: 7772/1: Fix missing flush_kernel_dcache_page() for noMMU Steven Rostedt
2013-08-13 15:57 ` Steven Rostedt [this message]
2013-08-13 15:57 ` [42/88] hw_breakpoint: Use cpu_possible_mask in {reserve,release}_bp_slot() Steven Rostedt
2013-08-13 15:57 ` [43/88] ath9k_htc: Handle IDLE state transition properly Steven Rostedt
2013-08-13 15:57 ` [44/88] iwlwifi: dvm: fix chain noise calibration Steven Rostedt
2013-08-13 15:57 ` [45/88] dlci: acquire rtnl_lock before calling __dev_get_by_name() Steven Rostedt
2013-08-13 15:57 ` [46/88] dlci: validate the net device in dlci_del() Steven Rostedt
2013-08-13 15:57 ` [47/88] iommu/vt-d: add quirk for broken interrupt remapping on 55XX chipsets Steven Rostedt
2013-08-13 15:57 ` [48/88] perf: Disable monitoring on setuid processes for regular users Steven Rostedt
2013-08-13 15:57 ` [49/88] crypto: algboss - Hold ref count on larval Steven Rostedt
2013-08-13 15:57 ` [50/88] UBIFS: prepare to fix a horrid bug Steven Rostedt
2013-08-13 15:57 ` [51/88] UBIFS: " Steven Rostedt
2013-08-13 15:57 ` [52/88] libata-acpi: add back ACPI based hotplug functionality Steven Rostedt
2013-08-13 15:57 ` [53/88] libceph: Fix NULL pointer dereference in auth client code Steven Rostedt
2013-08-13 15:57 ` [54/88] drivers/cdrom/cdrom.c: use kzalloc() for failing hardware Steven Rostedt
2013-08-13 15:57 ` [55/88] charger-manager: Ensure event is not used as format string Steven Rostedt
2013-08-13 15:57 ` [56/88] hpfs: better test for errors Steven Rostedt
2013-08-13 15:57 ` [57/88] block: do not pass disk names as format strings Steven Rostedt
2013-08-13 15:57 ` [58/88] crypto: sanitize argument for format string Steven Rostedt
2013-08-13 15:57 ` [59/88] MAINTAINERS: add stable_kernel_rules.txt to stable maintainer information Steven Rostedt
2013-08-13 15:57 ` [60/88] futex: Take hugepages into account when generating futex_key Steven Rostedt
2013-08-13 15:57 ` [61/88] nfsd4: fix decoding of compounds across page boundaries Steven Rostedt
2013-08-13 15:57 ` [62/88] sd: Fix parsing of temporary cache mode prefix Steven Rostedt
2013-08-13 15:57 ` [63/88] use sensible file nlink values if unprovided Steven Rostedt
2013-08-13 15:57 ` [64/88] rtlwifi: rtl8192cu: Fix duplicate if test Steven Rostedt
2013-08-13 15:57 ` [65/88] jbd2: move superblock checksum calculation to jbd2_write_superblock() Steven Rostedt
2013-08-13 15:58 ` [66/88] jbd2: fix theoretical race in jbd2__journal_restart Steven Rostedt
2013-08-13 15:58 ` [67/88] ext3,ext4: dont mess with dir_file->f_pos in htree_dirblock_to_tree() Steven Rostedt
2013-08-13 15:58 ` [68/88] usb: gadget: f_mass_storage: add missing memory barrier for thread_wakeup_needed Steven Rostedt
2013-08-13 15:58 ` [69/88] xhci: check for failed dma pool allocation Steven Rostedt
2013-08-13 15:58 ` [70/88] usb: host: xhci-plat: release mem region while removing module Steven Rostedt
2013-08-13 15:58 ` [71/88] drivers: hv: switch to use mb() instead of smp_mb() Steven Rostedt
2013-08-13 15:58 ` [72/88] pcmcia: at91_cf: fix gpio_get_value in at91_cf_get_status Steven Rostedt
2013-08-13 15:58 ` [73/88] cgroup: fix umount vs cgroup_event_remove() race Steven Rostedt
2013-08-13 15:58 ` [74/88] xen/time: remove blocked time accounting from xen "clockchip" Steven Rostedt
2013-08-13 15:58 ` [75/88] genirq: Fix can_request_irq() for IRQs without an action Steven Rostedt
2013-08-13 15:58 ` [76/88] drivers/rtc/rtc-rv3029c2.c: fix disabling AIE irq Steven Rostedt
2013-08-13 15:58 ` [77/88] ACPICA: Do not use extended sleep registers unless HW-reduced bit is set Steven Rostedt
2013-08-13 15:58 ` [78/88] ocfs2: xattr: fix inlined xattr reflink Steven Rostedt
2013-08-13 15:58 ` [79/88] nbd: correct disconnect behavior Steven Rostedt
2013-08-13 15:58 ` [80/88] PCI: Fix refcount issue in pci_create_root_bus() error recovery path Steven Rostedt
2013-08-13 15:58 ` [81/88] ahci: remove pmp link online check in FBS EH Steven Rostedt
2013-08-13 15:58 ` [82/88] timer: Fix jiffies wrap behavior of round_jiffies_common() Steven Rostedt
2013-08-13 15:58 ` [83/88] ext4: fix data offset overflow in ext4_xattr_fiemap() on 32-bit archs Steven Rostedt
2013-08-13 15:58 ` [84/88] ext4: fix overflow when counting used blocks on 32-bit architectures Steven Rostedt
2013-08-13 15:58 ` [85/88] ext4: dont allow ext4_free_blocks() to fail due to ENOMEM Steven Rostedt
2013-08-13 15:58 ` [86/88] drivers/dma/pl330.c: fix locking in pl330_free_chan_resources() Steven Rostedt
2013-08-13 15:58 ` [87/88] mm/memory-hotplug: fix lowmem count overflow when offline pages Steven Rostedt
2013-08-13 15:58 ` [88/88] Handle big endianness in NTLM (ntlmv2) authentication Steven Rostedt
2013-08-13 16:25 ` [00/88] 3.6.11.7-rc1-stable review Steven Rostedt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130813155830.050999814@goodmis.org \
--to=rostedt@goodmis.org \
--cc=anderson.lizardo@openbossa.org \
--cc=gustavo.padovan@collabora.co.uk \
--cc=linux-kernel@vger.kernel.org \
--cc=linville@tuxdriver.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox