From patchwork Mon Oct 8 20:48:32 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sasha Levin X-Patchwork-Id: 190122 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 70F5F2C00C6 for ; Tue, 9 Oct 2012 07:51:25 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754818Ab2JHUu5 (ORCPT ); Mon, 8 Oct 2012 16:50:57 -0400 Received: from rcsinet15.oracle.com ([148.87.113.117]:51714 "EHLO rcsinet15.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754126Ab2JHUu4 (ORCPT ); Mon, 8 Oct 2012 16:50:56 -0400 Received: from acsinet21.oracle.com (acsinet21.oracle.com [141.146.126.237]) by rcsinet15.oracle.com (Sentrion-MTA-4.2.2/Sentrion-MTA-4.2.2) with ESMTP id q98KojmT012274 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Mon, 8 Oct 2012 20:50:46 GMT Received: from acsmt358.oracle.com (acsmt358.oracle.com [141.146.40.158]) by acsinet21.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id q98KoilH022472 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 8 Oct 2012 20:50:45 GMT Received: from abhmt118.oracle.com (abhmt118.oracle.com [141.146.116.70]) by acsmt358.oracle.com (8.12.11.20060308/8.12.11) with ESMTP id q98Kmh7d001280; Mon, 8 Oct 2012 15:48:43 -0500 Received: from localhost.localdomain (/50.145.165.141) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 08 Oct 2012 13:48:42 -0700 From: Sasha Levin To: marcel@holtmann.org, gustavo@padovan.org, johan.hedberg@gmail.com, davem@davemloft.net Cc: linux-bluetooth@vger.kernel.org, davej@redhat.com, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, levinsasha928@gmail.com, Sasha Levin Subject: [PATCH resend] net, bluetooth: don't attempt to free a channel that wasn't created Date: Mon, 8 Oct 2012 16:48:32 -0400 Message-Id: <1349729312-14259-1-git-send-email-sasha.levin@oracle.com> X-Mailer: git-send-email 1.7.12 X-Source-IP: acsinet21.oracle.com [141.146.126.237] Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org We may currently attempt to free a channel which wasn't created due to an error in the initialization path, this would cause a NULL ptr deref. This would cause the following oops: [ 12.919073] BUG: unable to handle kernel NULL pointer dereference at 0000000000000010 [ 12.919131] IP: [] l2cap_chan_put+0x34/0x50 [ 12.919135] PGD 0 [ 12.919138] Oops: 0002 [#1] PREEMPT SMP DEBUG_PAGEALLOC [ 12.919193] Dumping ftrace buffer: [ 12.919242] (ftrace buffer empty) [ 12.919314] Modules linked in: [ 12.919318] CPU 1 [ 12.919319] Pid: 6210, comm: krfcommd Tainted: G W 3.6.0-next-20121004-sasha-00005-gb010653-dirty #30 [ 12.919374] RIP: 0010:[] [] l2cap_chan_put+0x34/0x50 [ 12.919377] RSP: 0000:ffff880066933c38 EFLAGS: 00010246 [ 12.919378] RAX: ffffffff8366c780 RBX: 0000000000000000 RCX: 6666666666666667 [ 12.919379] RDX: 0000000000000fa0 RSI: ffffffff84d3f79e RDI: 0000000000000010 [ 12.919381] RBP: ffff880066933c48 R08: ffffffff859989f8 R09: 0000000000000001 [ 12.919382] R10: 0000000000000000 R11: 7fffffffffffffff R12: 0000000000000000 [ 12.919383] R13: ffff88009b00a200 R14: ffff88009b00a200 R15: 0000000000000001 [ 12.919385] FS: 0000000000000000(0000) GS:ffff880033600000(0000) knlGS:0000000000000000 [ 12.919437] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 12.919440] CR2: 0000000000000010 CR3: 0000000005026000 CR4: 00000000000406e0 [ 12.919446] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 12.919451] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 12.919504] Process krfcommd (pid: 6210, threadinfo ffff880066932000, task ffff880065c4b000) [ 12.919506] Stack: [ 12.919510] ffff88009b00a200 ffff880032084000 ffff880066933c68 ffffffff8366c7bc [ 12.919513] 7fffffffffffffff ffff880032084000 ffff880066933c98 ffffffff833ae0ae [ 12.919516] ffff880066933ca8 0000000000000000 0000000000000000 ffff88009b00a200 [ 12.919517] Call Trace: [ 12.919522] [] l2cap_sock_destruct+0x3c/0x80 [ 12.919527] [] __sk_free+0x1e/0x1f0 [ 12.919530] [] sk_free+0x17/0x20 [ 12.919585] [] l2cap_sock_alloc.constprop.5+0x9e/0xd0 [ 12.919591] [] l2cap_sock_create+0x7e/0x100 [ 12.919652] [] ? _raw_read_lock+0x6a/0x80 [ 12.919658] [] ? bt_sock_create+0x74/0x110 [ 12.919660] [] bt_sock_create+0xb8/0x110 [ 12.919664] [] __sock_create+0x282/0x3b0 [ 12.919720] [] ? __sock_create+0x100/0x3b0 [ 12.919725] [] ? rfcomm_process_sessions+0x17e0/0x17e0 [ 12.919779] [] sock_create_kern+0x1f/0x30 [ 12.919784] [] rfcomm_l2sock_create+0x44/0x70 [ 12.919787] [] ? rfcomm_process_sessions+0x17e0/0x17e0 [ 12.919790] [] rfcomm_run+0x4e/0x1f0 [ 12.919846] [] ? rfcomm_process_sessions+0x17e0/0x17e0 [ 12.919852] [] kthread+0xe3/0xf0 [ 12.919908] [] ? put_lock_stats.isra.14+0xe/0x40 [ 12.919914] [] ? flush_kthread_work+0x1f0/0x1f0 [ 12.919968] [] ret_from_fork+0x7c/0x90 [ 12.919973] [] ? flush_kthread_work+0x1f0/0x1f0 [ 12.920161] Code: 83 ec 08 f6 05 ff 58 44 02 04 74 1b 8b 4f 10 48 89 fa 48 c7 c6 d9 d7 d4 84 48 c7 c7 80 9e aa 85 31 c0 e8 80 ac 3a fe 48 8d 7b 10 83 6b 10 01 0f 94 c0 84 c0 74 05 e8 8b e0 ff ff 48 83 c4 08 [ 12.920165] RIP [] l2cap_chan_put+0x34/0x50 [ 12.920166] RSP [ 12.920167] CR2: 0000000000000010 [ 12.920417] ---[ end trace 5a9114e8a158ab84 ]--- Introduced in commit 61d6ef3e ("Bluetooth: Make better use of l2cap_chan reference counting"). Signed-off-by: Sasha Levin --- net/bluetooth/l2cap_sock.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c index 083f2bf..66c295a 100644 --- a/net/bluetooth/l2cap_sock.c +++ b/net/bluetooth/l2cap_sock.c @@ -1083,7 +1083,8 @@ static void l2cap_sock_destruct(struct sock *sk) { BT_DBG("sk %p", sk); - l2cap_chan_put(l2cap_pi(sk)->chan); + if (l2cap_pi(sk)->chan) + l2cap_chan_put(l2cap_pi(sk)->chan); if (l2cap_pi(sk)->rx_busy_skb) { kfree_skb(l2cap_pi(sk)->rx_busy_skb); l2cap_pi(sk)->rx_busy_skb = NULL;