TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bluetooth: hci_sock: purge socket queues in the destruct() callback

Browse Source 
commit 709fca5000 upstream.

The receive path may take the socket right before hci_sock_release(),
but it may enqueue the packets to the socket queues after the call to
skb_queue_purge(), therefore the socket can be destroyed without clear
its queues completely.

Moving these skb_queue_purge() to the hci_sock_destruct() will fix this
issue, because nothing is referencing the socket at this point.

Signed-off-by: Nguyen Dinh Phi <phind.uet@gmail.com>
Reported-by: syzbot+4c4ffd1e1094dae61035@syzkaller.appspotmail.com
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Nguyen Dinh Phi
2021-10-08 03:04:24 +08:00
committed by Greg Kroah-Hartman
parent d90967f850
commit 7474be26b0
1 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/bluetooth/hci_sock.c
+7 -4
View File
@@ -888,10 +888,6 @@ static int hci_sock_release(struct socket *sock)
} }
sock_orphan(sk); sock_orphan(sk);
skb_queue_purge(&sk->sk_receive_queue);
skb_queue_purge(&sk->sk_write_queue);
release_sock(sk); release_sock(sk);
sock_put(sk); sock_put(sk);
return 0; return 0;
@@ -2012,6 +2008,12 @@ done:
return err; return err;
} }
static void hci_sock_destruct(struct sock *sk)
{
skb_queue_purge(&sk->sk_receive_queue);
skb_queue_purge(&sk->sk_write_queue);
}
static const struct proto_ops hci_sock_ops = { static const struct proto_ops hci_sock_ops = {
.family = PF_BLUETOOTH, .family = PF_BLUETOOTH,
.owner = THIS_MODULE, .owner = THIS_MODULE,
@@ -2065,6 +2067,7 @@ static int hci_sock_create(struct net *net, struct socket *sock, int protocol,
sock->state = SS_UNCONNECTED; sock->state = SS_UNCONNECTED;
sk->sk_state = BT_OPEN; sk->sk_state = BT_OPEN;
sk->sk_destruct = hci_sock_destruct;
bt_sock_link(&hci_sk_list, sk); bt_sock_link(&hci_sk_list, sk);
return 0; return 0;