tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Fix use-after-free oops in Bluetooth HID.

When cleaning up HIDP sessions, we currently close the ACL connection
before deregistering the input device. Closing the ACL connection
schedules a workqueue to remove the associated objects from sysfs, but
the input device still refers to them -- and if the workqueue happens to
run before the input device removal, the kernel will oops when trying to
look up PHYSDEVPATH for the removed input device.

Fix this by deregistering the input device before closing the
connections.

Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

authored by

David Woodhouse and committed by
Linus Torvalds 1c39858b d23cf676

+9 -9
+9 -9
net/bluetooth/hidp/core.c
··· 581 581 582 582 hidp_del_timer(session); 583 583 584 - fput(session->intr_sock->file); 585 - 586 - wait_event_timeout(*(ctrl_sk->sk_sleep), 587 - (ctrl_sk->sk_state == BT_CLOSED), msecs_to_jiffies(500)); 588 - 589 - fput(session->ctrl_sock->file); 590 - 591 - __hidp_unlink_session(session); 592 - 593 584 if (session->input) { 594 585 input_unregister_device(session->input); 595 586 session->input = NULL; ··· 591 600 hidinput_disconnect(session->hid); 592 601 hid_free_device(session->hid); 593 602 } 603 + 604 + fput(session->intr_sock->file); 605 + 606 + wait_event_timeout(*(ctrl_sk->sk_sleep), 607 + (ctrl_sk->sk_state == BT_CLOSED), msecs_to_jiffies(500)); 608 + 609 + fput(session->ctrl_sock->file); 610 + 611 + __hidp_unlink_session(session); 594 612 595 613 up_write(&hidp_session_sem); 596 614