[3.16,00/10] Fix possible crash on L2CAP socket shutdown

Message ID	20200630153641.21004-1-d.grigorev@omprussia.ru
Headers	show Return-Path: <SRS0=uVce=AL=vger.kernel.org=stable-owner@kernel.org> From: Denis Grigorev <d.grigorev@omprussia.ru> To: <stable@vger.kernel.org> CC: <ben@decadent.org.uk> Subject: [PATCH 3.16 00/10] Fix possible crash on L2CAP socket shutdown Date: Tue, 30 Jun 2020 18:36:31 +0300 Message-ID: <20200630153641.21004-1-d.grigorev@omprussia.ru> MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk
Series	Fix possible crash on L2CAP socket shutdown \| expand [3.16,00/10] Fix possible crash on L2CAP socket shutdown [3.16,03/10] Bluetooth: L2CAP ERTM shutdown protect sk and chan [3.16,05/10] Bluetooth: Add BT_DBG to l2cap_sock_shutdown() [3.16,06/10] Bluetooth: __l2cap_wait_ack() use msecs_to_jiffies() [3.16,07/10] Bluetooth: __l2cap_wait_ack() add defensive timeout [3.16,09/10] Bluetooth: Reorganize mutex lock in l2cap_sock_shutdown()

Message ID

20200630153641.21004-1-d.grigorev@omprussia.ru

Headers

From: Denis Grigorev <d.grigorev@omprussia.ru>
To: <stable@vger.kernel.org>
CC: <ben@decadent.org.uk>
Subject: [PATCH 3.16 00/10] Fix possible crash on L2CAP socket shutdown
Date: Tue, 30 Jun 2020 18:36:31 +0300
Message-ID: <20200630153641.21004-1-d.grigorev@omprussia.ru>
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8bit
Sender: stable-owner@vger.kernel.org
Precedence: bulk

Series

Fix possible crash on L2CAP socket shutdown | expand

Message

Denis Grigorev June 30, 2020, 3:36 p.m. UTC

This series of commits fixes a problem with closing l2cap connection
if socket has unACKed frames. Due an to an infinite loop in l2cap_wait_ack
the userspace process gets stuck in close() and then the kernel crashes
with the following report:

Call trace:
[<ffffffc000ace0b4>] l2cap_do_send+0x2c/0xec
[<ffffffc000acf5f8>] l2cap_send_sframe+0x178/0x260
[<ffffffc000acf740>] l2cap_send_rr_or_rnr+0x60/0x84
[<ffffffc000acf980>] l2cap_ack_timeout+0x60/0xac
[<ffffffc0000b35b8>] process_one_work+0x140/0x384
[<ffffffc0000b393c>] worker_thread+0x140/0x4e4
[<ffffffc0000b8c48>] kthread+0xdc/0xf0

All kernels below v4.3 are affected.

-------------------------

Commit log:

Alexey Dobriyan (1):
  Bluetooth: Stop sabotaging list poisoning

Dean Jenkins (8):
  Bluetooth: L2CAP ERTM shutdown protect sk and chan
  Bluetooth: Make __l2cap_wait_ack more efficient
  Bluetooth: Add BT_DBG to l2cap_sock_shutdown()
  Bluetooth: __l2cap_wait_ack() use msecs_to_jiffies()
  Bluetooth: __l2cap_wait_ack() add defensive timeout
  Bluetooth: Unwind l2cap_sock_shutdown()
  Bluetooth: Reorganize mutex lock in l2cap_sock_shutdown()
  Bluetooth: l2cap_disconnection_req priority over shutdown

Tedd Ho-Jeong An (1):
  Bluetooth: Reinitialize the list after deletion for session user list

 include/net/bluetooth/l2cap.h |  2 +
 net/bluetooth/l2cap_core.c    | 12 ++---
 net/bluetooth/l2cap_sock.c    | 94 +++++++++++++++++++++++++++--------
 3 files changed, 78 insertions(+), 30 deletions(-)