From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org,
"John W. Linville" <linville@tuxdriver.com>,
"Anderson Lizardo" <anderson.lizardo@openbossa.org>,
"Gustavo Padovan" <gustavo.padovan@collabora.co.uk>
Subject: [21/85] Bluetooth: Fix crash in l2cap_build_cmd() with small MTU
Date: Wed, 24 Jul 2013 15:02:45 +0100 [thread overview]
Message-ID: <lsq.1374674565.441252761@decadent.org.uk> (raw)
In-Reply-To: <lsq.1374674564.753305150@decadent.org.uk>
3.2.49-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Anderson Lizardo <anderson.lizardo@openbossa.org>
commit 300b962e5244a1ea010df7e88595faa0085b461d upstream.
If a too small MTU value is set with ioctl(HCISETACLMTU) or by a bogus
controller, memory corruption happens due to a memcpy() call with
negative length.
Fix this crash on either incoming or outgoing connections with a MTU
smaller than L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE:
[ 46.885433] BUG: unable to handle kernel paging request at f56ad000
[ 46.888037] IP: [<c03d94cd>] memcpy+0x1d/0x40
[ 46.888037] *pdpt = 0000000000ac3001 *pde = 00000000373f8067 *pte = 80000000356ad060
[ 46.888037] Oops: 0002 [#1] SMP DEBUG_PAGEALLOC
[ 46.888037] Modules linked in: hci_vhci bluetooth virtio_balloon i2c_piix4 uhci_hcd usbcore usb_common
[ 46.888037] CPU: 0 PID: 1044 Comm: kworker/u3:0 Not tainted 3.10.0-rc1+ #12
[ 46.888037] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007
[ 46.888037] Workqueue: hci0 hci_rx_work [bluetooth]
[ 46.888037] task: f59b15b0 ti: f55c4000 task.ti: f55c4000
[ 46.888037] EIP: 0060:[<c03d94cd>] EFLAGS: 00010212 CPU: 0
[ 46.888037] EIP is at memcpy+0x1d/0x40
[ 46.888037] EAX: f56ac1c0 EBX: fffffff8 ECX: 3ffffc6e EDX: f55c5cf2
[ 46.888037] ESI: f55c6b32 EDI: f56ad000 EBP: f55c5c68 ESP: f55c5c5c
[ 46.888037] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
[ 46.888037] CR0: 8005003b CR2: f56ad000 CR3: 3557d000 CR4: 000006f0
[ 46.888037] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[ 46.888037] DR6: ffff0ff0 DR7: 00000400
[ 46.888037] Stack:
[ 46.888037] fffffff8 00000010 00000003 f55c5cac f8c6a54c ffffffff f8c69eb2 00000000
[ 46.888037] f4783cdc f57f0070 f759c590 1001c580 00000003 0200000a 00000000 f5a88560
[ 46.888037] f5ba2600 f5a88560 00000041 00000000 f55c5d90 f8c6f4c7 00000008 f55c5cf2
[ 46.888037] Call Trace:
[ 46.888037] [<f8c6a54c>] l2cap_send_cmd+0x1cc/0x230 [bluetooth]
[ 46.888037] [<f8c69eb2>] ? l2cap_global_chan_by_psm+0x152/0x1a0 [bluetooth]
[ 46.888037] [<f8c6f4c7>] l2cap_connect+0x3f7/0x540 [bluetooth]
[ 46.888037] [<c019b37b>] ? trace_hardirqs_off+0xb/0x10
[ 46.888037] [<c01a0ff8>] ? mark_held_locks+0x68/0x110
[ 46.888037] [<c064ad20>] ? mutex_lock_nested+0x280/0x360
[ 46.888037] [<c064b9d9>] ? __mutex_unlock_slowpath+0xa9/0x150
[ 46.888037] [<c01a118c>] ? trace_hardirqs_on_caller+0xec/0x1b0
[ 46.888037] [<c064ad08>] ? mutex_lock_nested+0x268/0x360
[ 46.888037] [<c01a125b>] ? trace_hardirqs_on+0xb/0x10
[ 46.888037] [<f8c72f8d>] l2cap_recv_frame+0xb2d/0x1d30 [bluetooth]
[ 46.888037] [<c01a0ff8>] ? mark_held_locks+0x68/0x110
[ 46.888037] [<c064b9d9>] ? __mutex_unlock_slowpath+0xa9/0x150
[ 46.888037] [<c01a118c>] ? trace_hardirqs_on_caller+0xec/0x1b0
[ 46.888037] [<f8c754f1>] l2cap_recv_acldata+0x2a1/0x320 [bluetooth]
[ 46.888037] [<f8c491d8>] hci_rx_work+0x518/0x810 [bluetooth]
[ 46.888037] [<f8c48df2>] ? hci_rx_work+0x132/0x810 [bluetooth]
[ 46.888037] [<c0158979>] process_one_work+0x1a9/0x600
[ 46.888037] [<c01588fb>] ? process_one_work+0x12b/0x600
[ 46.888037] [<c015922e>] ? worker_thread+0x19e/0x320
[ 46.888037] [<c015922e>] ? worker_thread+0x19e/0x320
[ 46.888037] [<c0159187>] worker_thread+0xf7/0x320
[ 46.888037] [<c0159090>] ? rescuer_thread+0x290/0x290
[ 46.888037] [<c01602f8>] kthread+0xa8/0xb0
[ 46.888037] [<c0656777>] ret_from_kernel_thread+0x1b/0x28
[ 46.888037] [<c0160250>] ? flush_kthread_worker+0x120/0x120
[ 46.888037] Code: c3 90 8d 74 26 00 e8 63 fc ff ff eb e8 90 55 89 e5 83 ec 0c 89 5d f4 89 75 f8 89 7d fc 3e 8d 74 26 00 89 cb 89 c7 c1 e9 02 89 d6 <f3> a5 89 d9 83 e1 03 74 02 f3 a4 8b 5d f4 8b 75 f8 8b 7d fc 89
[ 46.888037] EIP: [<c03d94cd>] memcpy+0x1d/0x40 SS:ESP 0068:f55c5c5c
[ 46.888037] CR2: 00000000f56ad000
[ 46.888037] ---[ end trace 0217c1f4d78714a9 ]---
Signed-off-by: Anderson Lizardo <anderson.lizardo@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/bluetooth/l2cap_core.c | 3 +++
1 file changed, 3 insertions(+)
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1737,6 +1737,9 @@ static struct sk_buff *l2cap_build_cmd(s
BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %d",
conn, code, ident, dlen);
+ if (conn->mtu < L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE)
+ return NULL;
+
len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
count = min_t(unsigned int, conn->mtu, len);
next prev parent reply other threads:[~2013-07-24 14:15 UTC|newest]
Thread overview: 100+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-07-24 14:02 [00/85] 3.2.49-rc1 review Ben Hutchings
2013-07-24 14:02 ` Ben Hutchings [this message]
2013-07-24 14:02 ` [42/85] perf: Disable monitoring on setuid processes for regular users Ben Hutchings
2013-07-24 14:02 ` [38/85] USB: option,qcserial: move Novatel Gobi1K IDs to qcserial Ben Hutchings
2013-07-24 14:02 ` [40/85] net/tg3: Avoid delay during MMIO access Ben Hutchings
2013-07-24 16:42 ` Luis Henriques
2013-07-24 19:45 ` David Miller
2013-07-24 21:09 ` David Miller
2013-07-25 4:16 ` Ben Hutchings
2013-07-25 21:03 ` Greg KH
2013-07-25 4:15 ` Ben Hutchings
2013-07-24 14:02 ` [30/85] ata_piix: IDE-mode SATA patch for Intel Coleto Creek DeviceIDs Ben Hutchings
2013-07-24 14:02 ` [79/85] perf: Fix mmap() accounting hole Ben Hutchings
2013-07-24 14:02 ` [76/85] perf: Fix perf_lock_task_context() vs RCU Ben Hutchings
2013-07-24 14:02 ` [13/85] ahci: remove pmp link online check in FBS EH Ben Hutchings
2013-07-24 14:02 ` [17/85] ath9k_hw: Assign default xlna config for AR9485 Ben Hutchings
2013-07-24 14:02 ` [05/85] [SCSI] zfcp: status read buffers on first adapter open with link down Ben Hutchings
2013-07-24 14:02 ` [63/85] Input: bcm5974 - add support for the 2013 MacBook Air Ben Hutchings
2013-07-25 6:48 ` rydberg
2013-07-24 14:02 ` [61/85] HID: Add support for the MacBook Pro 10,2 keyboard / touchpad Ben Hutchings
2013-07-24 14:02 ` [74/85] perf: Clone child context from parent context pmu Ben Hutchings
2013-07-24 14:02 ` [23/85] rtlwifi: rtl8192cu: Add new USB ID for TP-Link TL-WN8200ND Ben Hutchings
2013-07-24 14:02 ` [69/85] drivers/rtc/rtc-rv3029c2.c: fix disabling AIE irq Ben Hutchings
2013-07-24 14:02 ` [68/85] crypto: sanitize argument for format string Ben Hutchings
2013-07-24 14:02 ` [65/85] drivers/dma/pl330.c: fix locking in pl330_free_chan_resources() Ben Hutchings
2013-07-24 14:02 ` [14/85] usb: gadget: f_mass_storage: add missing memory barrier for thread_wakeup_needed Ben Hutchings
2013-07-24 14:02 ` [11/85] zram: avoid access beyond the zram device Ben Hutchings
2013-07-24 14:02 ` [83/85] ext4: fix data offset overflow in ext4_xattr_fiemap() on 32-bit archs Ben Hutchings
2013-07-24 14:02 ` [53/85] UBIFS: prepare to fix a horrid bug Ben Hutchings
2013-07-24 14:02 ` [43/85] [SCSI] sd: fix array cache flushing bug causing performance problems Ben Hutchings
2013-07-24 14:02 ` [45/85] cgroup: fix RCU accesses to task->cgroups Ben Hutchings
2013-07-24 14:02 ` [44/85] [SCSI] sd: Fix parsing of 'temporary ' cache mode prefix Ben Hutchings
2013-07-24 14:02 ` [09/85] zram: use zram->lock to protect zram_free_page() in swap free notify path Ben Hutchings
2013-07-24 14:02 ` [34/85] ARM: 7765/1: perf: Record the user-mode PC in the call chain Ben Hutchings
2013-07-24 14:02 ` [78/85] perf: Fix perf mmap bugs Ben Hutchings
2013-07-24 14:02 ` [66/85] ocfs2: xattr: fix inlined xattr reflink Ben Hutchings
2013-07-24 14:02 ` [06/85] ahci: Add AMD CZ SATA device ID Ben Hutchings
2013-07-24 14:02 ` [07/85] i2c-piix4: Add AMD CZ SMBus " Ben Hutchings
2013-07-24 14:02 ` [81/85] drivers/cdrom/cdrom.c: use kzalloc() for failing hardware Ben Hutchings
2013-07-24 14:02 ` [54/85] UBIFS: fix a horrid bug Ben Hutchings
2013-07-24 14:02 ` [01/85] r8169: fix offloaded tx checksum for small packets Ben Hutchings
2013-07-24 14:02 ` [72/85] [SCSI] megaraid_sas: fix memory leak if SGL has zero length entries Ben Hutchings
2013-07-24 14:02 ` [48/85] dlci: validate the net device in dlci_del() Ben Hutchings
2013-07-24 14:02 ` [58/85] jbd2: fix theoretical race in jbd2__journal_restart Ben Hutchings
2013-07-24 14:02 ` [15/85] libata: skip SRST for all SIMG [34]7x port-multipliers Ben Hutchings
2013-07-24 14:02 ` [62/85] HID: apple: Add support for the 2013 Macbook Air Ben Hutchings
2013-07-25 6:50 ` rydberg
2013-07-26 2:49 ` Ben Hutchings
2013-07-24 14:02 ` [31/85] ahci: AHCI-mode SATA patch for Intel Coleto Creek DeviceIDs Ben Hutchings
2013-07-24 14:02 ` [59/85] nfsd4: fix decoding of compounds across page boundaries Ben Hutchings
2013-07-24 14:02 ` [27/85] [media] media: dmxdev: remove dvb_ringbuffer_flush() on writer side Ben Hutchings
2013-07-24 14:02 ` [02/85] printk: Fix rq->lock vs logbuf_lock unlock lock inversion Ben Hutchings
2013-07-24 14:02 ` [46/85] Handle big endianness in NTLM (ntlmv2) authentication Ben Hutchings
2013-07-24 14:02 ` [36/85] [SCSI] mpt2sas: Fix for device scan following host reset could get stuck in a infinite loop Ben Hutchings
2013-07-24 14:02 ` [75/85] perf: Remove WARN_ON_ONCE() check in __perf_event_enable() for valid scenario Ben Hutchings
2013-07-24 14:02 ` [67/85] block: do not pass disk names as format strings Ben Hutchings
2013-07-24 14:02 ` [51/85] timer: Fix jiffies wrap behavior of round_jiffies_common() Ben Hutchings
2013-07-24 14:02 ` [49/85] genirq: Fix can_request_irq() for IRQs without an action Ben Hutchings
2013-07-24 14:02 ` [18/85] ath9k: fill channel mode in caldata Ben Hutchings
2013-07-24 14:02 ` [16/85] b43: ensue that BCMA is "y" when B43 is "y" Ben Hutchings
2013-09-09 18:01 ` Steven Rostedt
2013-09-09 18:39 ` Ben Hutchings
2013-09-09 18:46 ` Steven Rostedt
2013-09-09 20:56 ` Konstantin Ryabitsev
2013-09-11 1:00 ` Ben Hutchings
2013-07-24 14:02 ` [04/85] [SCSI] zfcp: block queue limits with data router Ben Hutchings
2013-07-24 14:02 ` [22/85] ASoC: wm8962: Remove remaining direct register cache accesses Ben Hutchings
2013-07-24 14:02 ` [77/85] ceph: fix statvfs fr_size Ben Hutchings
2013-07-24 14:02 ` [33/85] iommu/amd: Only unmap large pages from the first pte Ben Hutchings
2013-07-24 14:02 ` [70/85] nbd: correct disconnect behavior Ben Hutchings
2013-07-24 14:02 ` [85/85] MAINTAINERS: add stable_kernel_rules.txt to stable maintainer information Ben Hutchings
2013-07-24 14:02 ` [25/85] xhci: check for failed dma pool allocation Ben Hutchings
2013-07-24 14:02 ` [55/85] Revert "serial: 8250_pci: add support for another kind of NetMos Technology PCI 9835 Multi-I/O Controller" Ben Hutchings
2013-07-24 14:02 ` [71/85] hpfs: better test for errors Ben Hutchings
2013-07-24 14:02 ` [47/85] dlci: acquire rtnl_lock before calling __dev_get_by_name() Ben Hutchings
2013-07-24 14:02 ` [60/85] tracing: Fix irqs-off tag display in syscall tracing Ben Hutchings
2013-07-24 14:02 ` [29/85] hw_breakpoint: Use cpu_possible_mask in {reserve,release}_bp_slot() Ben Hutchings
2013-07-24 14:02 ` [57/85] ext3,ext4: don't mess with dir_file->f_pos in htree_dirblock_to_tree() Ben Hutchings
2013-07-24 14:02 ` [20/85] ath9k: Do not assign noise for NULL caldata Ben Hutchings
2013-07-24 14:02 ` [10/85] zram: destroy all devices on error recovery path in zram_init() Ben Hutchings
2013-07-24 14:02 ` [37/85] [SCSI] mpt2sas: fix firmware failure with wrong task attribute Ben Hutchings
2013-07-24 14:02 ` [35/85] [SCSI] mpt2sas: Fix for issue Missing delay not getting set during system bootup Ben Hutchings
2013-07-24 14:02 ` [03/85] [SCSI] zfcp: fix adapter (re)open recovery while link to SAN is down Ben Hutchings
2013-07-24 14:02 ` [52/85] xen/time: remove blocked time accounting from xen "clockchip" Ben Hutchings
2013-07-24 14:02 ` [82/85] ext4: fix overflow when counting used blocks on 32-bit architectures Ben Hutchings
2013-07-24 14:02 ` [80/85] pch_uart: fix a deadlock when pch_uart as console Ben Hutchings
2013-07-24 14:02 ` [08/85] zram: avoid invalid memory access in zram_exit() Ben Hutchings
2013-07-24 14:02 ` [26/85] drivers: hv: switch to use mb() instead of smp_mb() Ben Hutchings
2013-07-24 14:02 ` [24/85] ALSA: hda - Cache the MUX selection for generic HDMI Ben Hutchings
2013-07-24 14:02 ` [56/85] powerpc/smp: Section mismatch from smp_release_cpus to __initdata spinning_secondaries Ben Hutchings
2013-07-24 14:02 ` [84/85] MAINTAINERS: Greg's suse email address is dead Ben Hutchings
2013-07-24 14:02 ` [39/85] futex: Take hugepages into account when generating futex_key Ben Hutchings
2013-07-24 14:02 ` [64/85] libceph: Fix NULL pointer dereference in auth client code Ben Hutchings
2013-07-24 14:02 ` [19/85] ath9k: Fix noisefloor calibration Ben Hutchings
2013-07-24 14:02 ` [12/85] zram: protect sysfs handler from invalid memory access Ben Hutchings
2013-07-24 14:02 ` [73/85] iscsi-target: Fix tfc_tpg_nacl_auth_cit configfs length overflow Ben Hutchings
2013-07-24 14:02 ` [32/85] Bluetooth: Fix invalid length check in l2cap_information_rsp() Ben Hutchings
2013-07-24 14:02 ` [41/85] vgacon.c: add cond reschedule points in vgacon_do_font_op Ben Hutchings
2013-07-24 14:02 ` [50/85] writeback: Fix periodic writeback after fs mount Ben Hutchings
2013-07-24 14:11 ` [00/85] 3.2.49-rc1 review Ben Hutchings
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=lsq.1374674565.441252761@decadent.org.uk \
--to=ben@decadent.org.uk \
--cc=akpm@linux-foundation.org \
--cc=anderson.lizardo@openbossa.org \
--cc=gustavo.padovan@collabora.co.uk \
--cc=linux-kernel@vger.kernel.org \
--cc=linville@tuxdriver.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®