Unverified Commit 1c1825ed authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!14801 CVE-2024-53237 

Merge Pull Request from: @ci-robot 
 
PR sync from: Guo Mengqi <guomengqi3@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/Y5W7QXO3EKEGY2EXGSGQK6242FUPBWSC/ 
CVE-2024-53237

Andy Shevchenko (1):
  driver core: Introduce device_find_any_child() helper

Dmitry Antipov (1):
  Bluetooth: fix use-after-free in device_for_each_child()


-- 
2.22.0
 
https://gitee.com/src-openeuler/kernel/issues/IBEADX 
 
Link:https://gitee.com/openeuler/kernel/pulls/14801

 

Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Reviewed-by: default avatarLi Nan <linan122@huawei.com>
Signed-off-by: default avatarLi Nan <linan122@huawei.com>
parents b51b2737 34403e3d

drivers/base/core.c

+20 −0
Original line number Diff line number Diff line
@@ -3427,6 +3427,26 @@ struct device *device_find_child_by_name(struct device *parent, 
}

EXPORT_SYMBOL_GPL(device_find_child_by_name);



static int match_any(struct device *dev, void *unused)

{

	return 1;

}



/**

 * device_find_any_child - device iterator for locating a child device, if any.

 * @parent: parent struct device

 *

 * This is similar to the device_find_child() function above, but it

 * returns a reference to a child device, if any.

 *

 * NOTE: you will need to drop the reference with put_device() after use.

 */

struct device *device_find_any_child(struct device *parent)

{

	return device_find_child(parent, NULL, match_any);

}

EXPORT_SYMBOL_GPL(device_find_any_child);



int __init devices_init(void)

{

	devices_kset = kset_create_and_add("devices", &device_uevent_ops, NULL);

include/linux/device.h

+2 −0
Original line number Diff line number Diff line
@@ -831,6 +831,8 @@ struct device *device_find_child(struct device *dev, void *data, 
				 int (*match)(struct device *dev, void *data));

struct device *device_find_child_by_name(struct device *parent,

					 const char *name);

struct device *device_find_any_child(struct device *parent);



int device_rename(struct device *dev, const char *new_name);

int device_move(struct device *dev, struct device *new_parent,

		enum dpm_order dpm_order);

net/bluetooth/hci_sysfs.c

+4 −11
Original line number Diff line number Diff line
@@ -19,16 +19,6 @@ static const struct device_type bt_link = { 
	.release = bt_link_release,

};



/*

 * The rfcomm tty device will possibly retain even when conn

 * is down, and sysfs doesn't support move zombie device,

 * so we should move the device before conn device is destroyed.

 */

static int __match_tty(struct device *dev, void *data)

{

	return !strncmp(dev_name(dev), "rfcomm", 6);

}



void hci_conn_init_sysfs(struct hci_conn *conn)

{

	struct hci_dev *hdev = conn->hdev;
@@ -71,10 +61,13 @@ void hci_conn_del_sysfs(struct hci_conn *conn) 
		return;

	}



	/* If there are devices using the connection as parent reset it to NULL

	 * before unregistering the device.

	 */

	while (1) {

		struct device *dev;



		dev = device_find_child(&conn->dev, NULL, __match_tty);

		dev = device_find_any_child(&conn->dev);

		if (!dev)

			break;

		device_move(dev, NULL, DPM_ORDER_DEV_LAST);