netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Johan Hovold <jhovold-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
To: Marcel Holtmann <marcel-kz+m5ild9QBg9hUCZPvPmw@public.gmane.org>,
	"Gustavo F. Padovan"
	<padovan-Y3ZbgMPKUGA34EUeqzHoZw@public.gmane.org>
Cc: "David S. Miller" <davem-fT/PcQaiUtIeIZ0/mPfg9Q@public.gmane.org>,
	linux-bluetooth-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
	linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
	netdev-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
	David Herrmann
	<dh.herrmann-gM/Ye1E23mwN+BqQ9rBEUg@public.gmane.org>,
	Greg KH
	<gregkh-hQyY1W1yCW8ekmWlsbkhG0B+6BGkLq7r@public.gmane.org>,
	Johan Hovold <jhovold-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
Subject: bluetooth: bug fixes for bluetooth-next
Date: Thu, 15 Mar 2012 14:47:35 +0100	[thread overview]
Message-ID: <20120315134735.GA19821@localhost> (raw)
In-Reply-To: <1331749014.14217.112.camel@aeonflux>

On Wed, Mar 14, 2012 at 11:16:54AM -0700, Marcel Holtmann wrote:
> > > This is a revised series which also contains a minimal fix to the memory leak
> > > discovered by David Hermann upon which the first NULL-pointer-dereference fix
> > > also depends.
> > > 
> > > These patches need to get to Linus ASAP as the problems are present in 3.3-rc6
> > > as well as earlier kernels and thus should be backported to the stable trees as
> > > well.
> > 
> > Any chance to get these into 3.3? Otherwise, is it possible to rebase
> > bluetooth-next on top of these so that Greg can get them into 3.3.1 (and
> > the other stable trees) once bluetooth-next is merged?
> > 
> > All three bugs can be used to crash any kernel with HCI-UART support and
> > can probably be used for exploits as they are extremely easy to trigger
> > reliably.
> 
> only if you have access to the TTY device node in the first place. If
> you do not have access to that device node, you can not crash the
> kernel.
> 
> Can you resend a clean set of patches for bluetooth-next and once we
> have that merged, we can talk on how to backport this to 3.3 and also
> -stable.

I'll respond to this mail with the two NULL-deref fixes against
bluetooth-next of today (44e612b3e6566f0b).

As I've mentioned before, a fix for the memory leak is already in
bluetooth-next and my first patch depends on it. Unfortunately, the
memory-leak fix in bluetooth-next is not a minimal fix but a more
invasive one:

	797fe796c4335b3 ("Bluetooth: uart-ldisc: Fix memory leak and
			  remove destruct cb")
	
and it also depends on a second commit (from bluetooth-next):

	010666a126fce7b ("Bluetooth: Make hci-destruct callback
			  optional")

Neither is marked for stable (and at least the latter probably shouldn't
be).

Please make sure that the memory leak fix also gets backported to
stable. A minimal (2-line) fix can be found here:

	http://marc.info/?l=linux-bluetooth&m=133130797428708&w=2

Thanks,
Johan

  reply	other threads:[~2012-03-15 13:47 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2012-03-09 15:43 [PATCH 0/3] bluetooth: bug fixes for 3.3 Johan Hovold
2012-03-09 15:43 ` [PATCH 1/3] bluetooth: hci_ldisc: fix memory leak on tty_close Johan Hovold
2012-03-09 15:43 ` [PATCH 2/3] bluetooth: hci_ldisc: fix NULL-pointer dereference " Johan Hovold
2012-03-09 15:50   ` Johan Hovold
2012-03-09 15:43 ` [PATCH 3/3] bluetooth: hci_core: fix NULL-pointer dereference at unregister Johan Hovold
2012-03-14 11:25 ` [PATCH 0/3] bluetooth: bug fixes for 3.3 Johan Hovold
2012-03-14 18:16   ` Marcel Holtmann
2012-03-15 13:47     ` Johan Hovold [this message]
2012-03-15 13:48       ` [PATCH 1/2] bluetooth: hci_ldisc: fix NULL-pointer dereference on tty_close Johan Hovold
     [not found]         ` <1331819321-13018-1-git-send-email-jhovold-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2012-03-15 13:48           ` [PATCH 2/2] bluetooth: hci_core: fix NULL-pointer dereference at unregister Johan Hovold
2012-03-15 15:23             ` Marcel Holtmann
2012-03-15 15:21         ` [PATCH 1/2] bluetooth: hci_ldisc: fix NULL-pointer dereference on tty_close Marcel Holtmann
2012-03-16 16:03           ` Johan Hedberg

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20120315134735.GA19821@localhost \
    --to=jhovold-re5jqeeqqe8avxtiumwx3w@public.gmane.org \
    --cc=davem-fT/PcQaiUtIeIZ0/mPfg9Q@public.gmane.org \
    --cc=dh.herrmann-gM/Ye1E23mwN+BqQ9rBEUg@public.gmane.org \
    --cc=gregkh-hQyY1W1yCW8ekmWlsbkhG0B+6BGkLq7r@public.gmane.org \
    --cc=linux-bluetooth-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
    --cc=linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
    --cc=marcel-kz+m5ild9QBg9hUCZPvPmw@public.gmane.org \
    --cc=netdev-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
    --cc=padovan-Y3ZbgMPKUGA34EUeqzHoZw@public.gmane.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).