• Ye Bin's avatar
    Bluetooth: bnep: fix wild-memory-access in proto_unregister · 64a90991
    Ye Bin authored
    There's issue as follows:
      KASAN: maybe wild-memory-access in range [0xdead...108-0xdead...10f]
      CPU: 3 UID: 0 PID: 2805 Comm: rmmod Tainted: G        W
      RIP: 0010:proto_unregister+0xee/0x400
      Call Trace:
       <TASK>
       __do_sys_delete_module+0x318/0x580
       do_syscall_64+0xc1/0x1d0
       entry_SYSCALL_64_after_hwframe+0x77/0x7f
    
    As bnep_init() ignore bnep_sock_init()'s return value, and bnep_sock_init()
    will cleanup all resource. Then when remove bnep module will call
    bnep_sock_cleanup() to cleanup sock's resource.
    To solve above issue just return bnep_sock_init()'s return value in
    bnep_exit().
    
    Fixes: 1da177e4 ("Linux-2.6.12-rc2")
    Signed-off-by: default avatarYe Bin <yebin10@huawei.com>
    Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
    64a90991
core.c 16.7 KB