Unverified Commit 234a8718 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!14978 CVE-2024-56604_openEuler-1.0-LTS 

Merge Pull Request from: @ci-robot 
 
PR sync from: dinglongwei <dinglongwei1@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/Y4CI3C5T6EBCDKNNCGX3FX2EN6AOQEBC/ 
CVE-2024-56604_openEuler-1.0-LTS

Ignat Korchagin (1):
  Bluetooth: RFCOMM: avoid leaving dangling sk pointer in
    rfcomm_sock_alloc()

Luiz Augusto von Dentz (1):
  Bluetooth: Consolidate code around sk_alloc into a helper function


-- 
2.22.0
 
https://gitee.com/src-openeuler/kernel/issues/IBEANI 
 
Link:https://gitee.com/openeuler/kernel/pulls/14978

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Reviewed-by: default avatarYuan Can <yuancan@huawei.com>
Signed-off-by: default avatarYuan Can <yuancan@huawei.com>
parents 88a24894 51b6a4db

include/net/bluetooth/bluetooth.h

+2 −0
Original line number Diff line number Diff line
@@ -268,6 +268,8 @@ void bt_sock_unregister(int proto); 
void bt_sock_link(struct bt_sock_list *l, struct sock *s);

void bt_sock_unlink(struct bt_sock_list *l, struct sock *s);

bool bt_sock_linked(struct bt_sock_list *l, struct sock *s);

struct sock *bt_sock_alloc(struct net *net, struct socket *sock,

			   struct proto *prot, int proto, gfp_t prio, int kern);

int  bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,

		     int flags);

int  bt_sock_stream_recvmsg(struct socket *sock, struct msghdr *msg,

net/bluetooth/af_bluetooth.c

+21 −0
Original line number Diff line number Diff line
@@ -138,6 +138,27 @@ static int bt_sock_create(struct net *net, struct socket *sock, int proto, 
	return err;

}



struct sock *bt_sock_alloc(struct net *net, struct socket *sock,

			   struct proto *prot, int proto, gfp_t prio, int kern)

{

	struct sock *sk;



	sk = sk_alloc(net, PF_BLUETOOTH, prio, prot, kern);

	if (!sk)

		return NULL;



	sock_init_data(sock, sk);

	INIT_LIST_HEAD(&bt_sk(sk)->accept_q);



	sock_reset_flag(sk, SOCK_ZAPPED);



	sk->sk_protocol = proto;

	sk->sk_state    = BT_OPEN;



	return sk;

}

EXPORT_SYMBOL(bt_sock_alloc);



void bt_sock_link(struct bt_sock_list *l, struct sock *sk)

{

	write_lock(&l->lock);

net/bluetooth/bnep/sock.c

+1 −9
Original line number Diff line number Diff line
@@ -201,21 +201,13 @@ static int bnep_sock_create(struct net *net, struct socket *sock, int protocol, 
	if (sock->type != SOCK_RAW)

		return -ESOCKTNOSUPPORT;



	sk = sk_alloc(net, PF_BLUETOOTH, GFP_ATOMIC, &bnep_proto, kern);

	sk = bt_sock_alloc(net, sock, &bnep_proto, protocol, GFP_ATOMIC, kern);

	if (!sk)

		return -ENOMEM;



	sock_init_data(sock, sk);



	sock->ops = &bnep_sock_ops;



	sock->state = SS_UNCONNECTED;



	sock_reset_flag(sk, SOCK_ZAPPED);



	sk->sk_protocol = protocol;

	sk->sk_state	= BT_OPEN;



	bt_sock_link(&bnep_sk_list, sk);

	return 0;

}

net/bluetooth/hci_sock.c

+2 −8
Original line number Diff line number Diff line
@@ -2027,18 +2027,12 @@ static int hci_sock_create(struct net *net, struct socket *sock, int protocol, 


	sock->ops = &hci_sock_ops;



	sk = sk_alloc(net, PF_BLUETOOTH, GFP_ATOMIC, &hci_sk_proto, kern);

	sk = bt_sock_alloc(net, sock, &hci_sk_proto, protocol, GFP_ATOMIC,

			   kern);

	if (!sk)

		return -ENOMEM;



	sock_init_data(sock, sk);



	sock_reset_flag(sk, SOCK_ZAPPED);



	sk->sk_protocol = protocol;



	sock->state = SS_UNCONNECTED;

	sk->sk_state = BT_OPEN;



	bt_sock_link(&hci_sk_list, sk);

	return 0;

net/bluetooth/l2cap_sock.c

+1 −9
Original line number Diff line number Diff line
@@ -1611,21 +1611,13 @@ static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, 
	struct sock *sk;

	struct l2cap_chan *chan;



	sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto, kern);

	sk = bt_sock_alloc(net, sock, &l2cap_proto, proto, prio, kern);

	if (!sk)

		return NULL;



	sock_init_data(sock, sk);

	INIT_LIST_HEAD(&bt_sk(sk)->accept_q);



	sk->sk_destruct = l2cap_sock_destruct;

	sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;



	sock_reset_flag(sk, SOCK_ZAPPED);



	sk->sk_protocol = proto;

	sk->sk_state = BT_OPEN;



	chan = l2cap_chan_create();

	if (!chan) {

		sk_free(sk);