| Message ID | 20230309181251.479447-2-pchelkin@ispras.ru (mailing list archive) |
|---|---|
| State | Not Applicable |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | Bluetooth: hci_sock: purge socket queues in the destruct() callback | expand |
| Context | Check | Description |
|---|---|---|
| netdev/tree_selection | success | Guessing tree name failed - patch did not apply |
On Thu, Mar 09, 2023 at 09:12:51PM +0300, Fedor Pchelkin wrote: > From: Nguyen Dinh Phi <phind.uet@gmail.com> > > commit 709fca500067524381e28a5f481882930eebac88 upstream. > > The receive path may take the socket right before hci_sock_release(), > but it may enqueue the packets to the socket queues after the call to > skb_queue_purge(), therefore the socket can be destroyed without clear > its queues completely. > > Moving these skb_queue_purge() to the hci_sock_destruct() will fix this > issue, because nothing is referencing the socket at this point. > > Signed-off-by: Nguyen Dinh Phi <phind.uet@gmail.com> > Reported-by: syzbot+4c4ffd1e1094dae61035@syzkaller.appspotmail.com > Signed-off-by: Marcel Holtmann <marcel@holtmann.org> > Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru> > --- > net/bluetooth/hci_sock.c | 11 +++++++---- > 1 file changed, 7 insertions(+), 4 deletions(-) > > diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c > index f1128c2134f0..3f92a21cabe8 100644 > --- a/net/bluetooth/hci_sock.c > +++ b/net/bluetooth/hci_sock.c > @@ -888,10 +888,6 @@ static int hci_sock_release(struct socket *sock) > } > > sock_orphan(sk); > - > - skb_queue_purge(&sk->sk_receive_queue); > - skb_queue_purge(&sk->sk_write_queue); > - > release_sock(sk); > sock_put(sk); > return 0; > @@ -2012,6 +2008,12 @@ static int hci_sock_getsockopt(struct socket *sock, int level, int optname, > return err; > } > > +static void hci_sock_destruct(struct sock *sk) > +{ > + skb_queue_purge(&sk->sk_receive_queue); > + skb_queue_purge(&sk->sk_write_queue); > +} > + > static const struct proto_ops hci_sock_ops = { > .family = PF_BLUETOOTH, > .owner = THIS_MODULE, > @@ -2065,6 +2067,7 @@ static int hci_sock_create(struct net *net, struct socket *sock, int protocol, > > sock->state = SS_UNCONNECTED; > sk->sk_state = BT_OPEN; > + sk->sk_destruct = hci_sock_destruct; > > bt_sock_link(&hci_sk_list, sk); > return 0; > -- > 2.34.1 > Now queued up, thanks. greg k-h
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c index f1128c2134f0..3f92a21cabe8 100644 --- a/net/bluetooth/hci_sock.c +++ b/net/bluetooth/hci_sock.c @@ -888,10 +888,6 @@ static int hci_sock_release(struct socket *sock) } sock_orphan(sk); - - skb_queue_purge(&sk->sk_receive_queue); - skb_queue_purge(&sk->sk_write_queue); - release_sock(sk); sock_put(sk); return 0; @@ -2012,6 +2008,12 @@ static int hci_sock_getsockopt(struct socket *sock, int level, int optname, return err; } +static void hci_sock_destruct(struct sock *sk) +{ + skb_queue_purge(&sk->sk_receive_queue); + skb_queue_purge(&sk->sk_write_queue); +} + static const struct proto_ops hci_sock_ops = { .family = PF_BLUETOOTH, .owner = THIS_MODULE, @@ -2065,6 +2067,7 @@ static int hci_sock_create(struct net *net, struct socket *sock, int protocol, sock->state = SS_UNCONNECTED; sk->sk_state = BT_OPEN; + sk->sk_destruct = hci_sock_destruct; bt_sock_link(&hci_sk_list, sk); return 0;