Gitweb:
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1c39858b5dd46004b12c5acd26d8df346bef8a10
Commit: 1c39858b5dd46004b12c5acd26d8df346bef8a10
Parent: d23cf676d0e9d1fdc066d2dcb7f8bc0e2d4c75bd
Author: David Woodhouse <[EMAIL PROTECTED]>
AuthorDate: Sat Jul 7 14:58:39 2007 -0400
Committer: Linus Torvalds <[EMAIL PROTECTED]>
CommitDate: Sat Jul 7 12:22:37 2007 -0700
Fix use-after-free oops in Bluetooth HID.
When cleaning up HIDP sessions, we currently close the ACL connection
before deregistering the input device. Closing the ACL connection
schedules a workqueue to remove the associated objects from sysfs, but
the input device still refers to them -- and if the workqueue happens to
run before the input device removal, the kernel will oops when trying to
look up PHYSDEVPATH for the removed input device.
Fix this by deregistering the input device before closing the
connections.
Signed-off-by: David Woodhouse <[EMAIL PROTECTED]>
Acked-by: Marcel Holtmann <[EMAIL PROTECTED]>
Signed-off-by: Linus Torvalds <[EMAIL PROTECTED]>
---
net/bluetooth/hidp/core.c | 18 +++++++++---------
1 files changed, 9 insertions(+), 9 deletions(-)
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index ceadfcf..450eb02 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -581,15 +581,6 @@ static int hidp_session(void *arg)
hidp_del_timer(session);
- fput(session->intr_sock->file);
-
- wait_event_timeout(*(ctrl_sk->sk_sleep),
- (ctrl_sk->sk_state == BT_CLOSED), msecs_to_jiffies(500));
-
- fput(session->ctrl_sock->file);
-
- __hidp_unlink_session(session);
-
if (session->input) {
input_unregister_device(session->input);
session->input = NULL;
@@ -601,6 +592,15 @@ static int hidp_session(void *arg)
hid_free_device(session->hid);
}
+ fput(session->intr_sock->file);
+
+ wait_event_timeout(*(ctrl_sk->sk_sleep),
+ (ctrl_sk->sk_state == BT_CLOSED), msecs_to_jiffies(500));
+
+ fput(session->ctrl_sock->file);
+
+ __hidp_unlink_session(session);
+
up_write(&hidp_session_sem);
kfree(session);
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
