Andre Guedes
61a0cfb008
Bluetooth: Fix use-after-free bug in SMP
If SMP fails, we should always cancel security_timer delayed work.
Otherwise, security_timer function may run after l2cap_conn object
has been freed.
This patch fixes the following warning reported by ODEBUG:
WARNING: at lib/debugobjects.c:261 debug_print_object+0x7c/0x8d()
Hardware name: Bochs
ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x27
Modules linked in: btusb bluetooth
Pid: 440, comm: kworker/u:2 Not tainted 3.5.0-rc1+ #4
Call Trace:
[<ffffffff81174600>] ? free_obj_work+0x4a/0x7f
[<ffffffff81023eb8>] warn_slowpath_common+0x7e/0x97
[<ffffffff81023f65>] warn_slowpath_fmt+0x41/0x43
[<ffffffff811746b1>] debug_print_object+0x7c/0x8d
[<ffffffff810394f0>] ? __queue_work+0x241/0x241
[<ffffffff81174fdd>] debug_check_no_obj_freed+0x92/0x159
[<ffffffff810ac08e>] slab_free_hook+0x6f/0x77
[<ffffffffa0019145>] ? l2cap_conn_del+0x148/0x157 [bluetooth]
[<ffffffff810ae408>] kfree+0x59/0xac
[<ffffffffa0019145>] l2cap_conn_del+0x148/0x157 [bluetooth]
[<ffffffffa001b9a2>] l2cap_recv_frame+0xa77/0xfa4 [bluetooth]
[<ffffffff810592f9>] ? trace_hardirqs_on_caller+0x112/0x1ad
[<ffffffffa001c86c>] l2cap_recv_acldata+0xe2/0x264 [bluetooth]
[<ffffffffa0002b2f>] hci_rx_work+0x235/0x33c [bluetooth]
[<ffffffff81038dc3>] ? process_one_work+0x126/0x2fe
[<ffffffff81038e22>] process_one_work+0x185/0x2fe
[<ffffffff81038dc3>] ? process_one_work+0x126/0x2fe
[<ffffffff81059f2e>] ? lock_acquired+0x1b5/0x1cf
[<ffffffffa00028fa>] ? le_scan_work+0x11d/0x11d [bluetooth]
[<ffffffff81036fb6>] ? spin_lock_irq+0x9/0xb
[<ffffffff81039209>] worker_thread+0xcf/0x175
[<ffffffff8103913a>] ? rescuer_thread+0x175/0x175
[<ffffffff8103cfe0>] kthread+0x95/0x9d
[<ffffffff812c5054>] kernel_threadi_helper+0x4/0x10
[<ffffffff812c36b0>] ? retint_restore_args+0x13/0x13
[<ffffffff8103cf4b>] ? flush_kthread_worker+0xdb/0xdb
[<ffffffff812c5050>] ? gs_change+0x13/0x13
This bug can be reproduced using hctool lecc or l2test tools and
bluetoothd not running.
Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2012-08-15 01:06:23 -03:00
..
2012-07-10 23:13:45 -07:00
2012-05-15 20:23:16 -04:00
2012-07-17 09:02:36 -07:00
2012-07-10 23:13:45 -07:00
2012-06-04 11:45:11 -04:00
2012-07-19 11:17:30 -07:00
2012-07-10 23:56:33 -07:00
2012-08-15 01:06:23 -03:00
2012-07-30 14:53:22 -07:00
2012-07-31 18:42:47 -07:00
2012-07-10 22:36:17 +02:00
2012-07-31 14:35:28 -07:00
2012-08-02 00:19:17 -07:00
2012-07-10 23:13:45 -07:00
2012-07-23 16:36:26 -07:00
2012-07-31 14:41:38 -07:00
2012-05-21 20:27:36 -07:00
2012-05-09 20:49:19 -04:00
2012-07-19 10:48:00 -07:00
2012-07-16 22:52:02 -07:00
2012-08-02 02:54:43 -07:00
2012-07-31 19:25:39 -07:00
2012-07-19 10:48:00 -07:00
2012-07-16 23:23:52 -07:00
2012-06-15 15:30:15 -07:00
2012-06-29 00:52:32 -07:00
2012-05-17 18:45:20 -04:00
2012-07-10 23:13:45 -07:00
2012-08-02 13:49:38 -04:00
2012-07-12 07:54:45 -07:00
2012-07-19 11:17:30 -07:00
2012-07-24 00:01:30 -07:00
2012-04-20 21:22:30 -04:00
2012-07-20 12:30:48 -04:00
2012-07-27 13:45:51 -07:00
2012-06-27 15:42:24 -07:00
2012-06-17 16:29:38 -07:00
2012-07-23 01:01:44 -07:00
2012-06-06 15:18:17 -04:00
2012-04-20 21:22:30 -04:00
2012-07-10 23:56:33 -07:00
2012-07-23 16:36:26 -07:00
2012-07-31 18:42:47 -07:00
2012-07-31 19:25:39 -07:00
2012-07-13 19:34:43 -04:00
2012-08-01 10:26:23 -07:00
2012-07-24 13:55:21 -07:00
2012-08-06 14:29:58 -04:00
2012-07-10 23:13:45 -07:00
2012-08-02 00:19:17 -07:00
2012-07-22 17:50:49 -07:00
2012-05-21 12:50:12 -07:00
2012-05-18 01:35:08 -04:00
2012-07-22 12:44:01 -07:00
2012-05-15 20:14:35 -04:00