diff mbox series

Bluetooth: Fix crash when using new BT_PHY option

Message ID 20200220010328.10132-1-luiz.dentz@gmail.com (mailing list archive)
State Changes Requested
Delegated to: Marcel Holtmann
Headers show
Series Bluetooth: Fix crash when using new BT_PHY option | expand

Commit Message

Luiz Augusto von Dentz Feb. 20, 2020, 1:03 a.m. UTC
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

This fixes the invalid check for connected socket which causes the
following trace due to sco_pi(sk)->conn being NULL:

RIP: 0010:sco_sock_getsockopt+0x2ff/0x800 net/bluetooth/sco.c:966

L2CAP has also been fixed since it has the same problem.

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
 net/bluetooth/l2cap_sock.c | 2 +-
 net/bluetooth/sco.c        | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

Comments

Marcel Holtmann Feb. 20, 2020, 6:26 a.m. UTC | #1
Hi Luiz,

> This fixes the invalid check for connected socket which causes the
> following trace due to sco_pi(sk)->conn being NULL:
> 
> RIP: 0010:sco_sock_getsockopt+0x2ff/0x800 net/bluetooth/sco.c:966
> 
> L2CAP has also been fixed since it has the same problem.
> 
> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> ---
> net/bluetooth/l2cap_sock.c | 2 +-
> net/bluetooth/sco.c        | 2 +-
> 2 files changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
> index 9fb47b2b13c9..305710446e66 100644
> --- a/net/bluetooth/l2cap_sock.c
> +++ b/net/bluetooth/l2cap_sock.c
> @@ -605,7 +605,7 @@ static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
> 		break;
> 
> 	case BT_PHY:
> -		if (sk->sk_state == BT_CONNECTED) {
> +		if (sk->sk_state != BT_CONNECTED) {
> 			err = -ENOTCONN;
> 			break;
> 		}
> diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
> index 29ab3e12fb46..c8c3d38cdc7b 100644
> --- a/net/bluetooth/sco.c
> +++ b/net/bluetooth/sco.c
> @@ -958,7 +958,7 @@ static int sco_sock_getsockopt(struct socket *sock, int level, int optname,
> 		break;
> 
> 	case BT_PHY:
> -		if (sk->sk_state == BT_CONNECTED) {
> +		if (sk->sk_state != BT_CONNECTED) {
> 			err = -ENOTCONN;
> 			break;
> 		}

is there something wrong with your mailer? I have this patch 3 times and already applied one of them to bluetooth-next. Is the one incorrect?

Regards

Marcel
Luiz Augusto von Dentz Feb. 20, 2020, 8:01 a.m. UTC | #2
Hi Marcel,

On Wed, Feb 19, 2020 at 10:26 PM Marcel Holtmann <marcel@holtmann.org> wrote:
>
> Hi Luiz,
>
> > This fixes the invalid check for connected socket which causes the
> > following trace due to sco_pi(sk)->conn being NULL:
> >
> > RIP: 0010:sco_sock_getsockopt+0x2ff/0x800 net/bluetooth/sco.c:966
> >
> > L2CAP has also been fixed since it has the same problem.
> >
> > Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> > ---
> > net/bluetooth/l2cap_sock.c | 2 +-
> > net/bluetooth/sco.c        | 2 +-
> > 2 files changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
> > index 9fb47b2b13c9..305710446e66 100644
> > --- a/net/bluetooth/l2cap_sock.c
> > +++ b/net/bluetooth/l2cap_sock.c
> > @@ -605,7 +605,7 @@ static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
> >               break;
> >
> >       case BT_PHY:
> > -             if (sk->sk_state == BT_CONNECTED) {
> > +             if (sk->sk_state != BT_CONNECTED) {
> >                       err = -ENOTCONN;
> >                       break;
> >               }
> > diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
> > index 29ab3e12fb46..c8c3d38cdc7b 100644
> > --- a/net/bluetooth/sco.c
> > +++ b/net/bluetooth/sco.c
> > @@ -958,7 +958,7 @@ static int sco_sock_getsockopt(struct socket *sock, int level, int optname,
> >               break;
> >
> >       case BT_PHY:
> > -             if (sk->sk_state == BT_CONNECTED) {
> > +             if (sk->sk_state != BT_CONNECTED) {
> >                       err = -ENOTCONN;
> >                       break;
> >               }
>
> is there something wrong with your mailer? I have this patch 3 times and already applied one of them to bluetooth-next. Is the one incorrect?

It appears my outbox had the same patch multiple times, sorry about
that the intention was to to send the RFCOMM change and these got in
the way, so please disregard this one.
diff mbox series

Patch

diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 9fb47b2b13c9..305710446e66 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -605,7 +605,7 @@  static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
 		break;
 
 	case BT_PHY:
-		if (sk->sk_state == BT_CONNECTED) {
+		if (sk->sk_state != BT_CONNECTED) {
 			err = -ENOTCONN;
 			break;
 		}
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 29ab3e12fb46..c8c3d38cdc7b 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -958,7 +958,7 @@  static int sco_sock_getsockopt(struct socket *sock, int level, int optname,
 		break;
 
 	case BT_PHY:
-		if (sk->sk_state == BT_CONNECTED) {
+		if (sk->sk_state != BT_CONNECTED) {
 			err = -ENOTCONN;
 			break;
 		}