Commit 1c39858b authored by David Woodhouse's avatar David Woodhouse Committed by Linus Torvalds

Fix use-after-free oops in Bluetooth HID.

When cleaning up HIDP sessions, we currently close the ACL connection
before deregistering the input device. Closing the ACL connection
schedules a workqueue to remove the associated objects from sysfs, but
the input device still refers to them -- and if the workqueue happens to
run before the input device removal, the kernel will oops when trying to
look up PHYSDEVPATH for the removed input device.

Fix this by deregistering the input device before closing the
connections.
Signed-off-by: default avatarDavid Woodhouse <dwmw2@infradead.org>
Acked-by: default avatarMarcel Holtmann <marcel@holtmann.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent d23cf676
...@@ -581,15 +581,6 @@ static int hidp_session(void *arg) ...@@ -581,15 +581,6 @@ static int hidp_session(void *arg)
hidp_del_timer(session); hidp_del_timer(session);
fput(session->intr_sock->file);
wait_event_timeout(*(ctrl_sk->sk_sleep),
(ctrl_sk->sk_state == BT_CLOSED), msecs_to_jiffies(500));
fput(session->ctrl_sock->file);
__hidp_unlink_session(session);
if (session->input) { if (session->input) {
input_unregister_device(session->input); input_unregister_device(session->input);
session->input = NULL; session->input = NULL;
...@@ -601,6 +592,15 @@ static int hidp_session(void *arg) ...@@ -601,6 +592,15 @@ static int hidp_session(void *arg)
hid_free_device(session->hid); hid_free_device(session->hid);
} }
fput(session->intr_sock->file);
wait_event_timeout(*(ctrl_sk->sk_sleep),
(ctrl_sk->sk_state == BT_CLOSED), msecs_to_jiffies(500));
fput(session->ctrl_sock->file);
__hidp_unlink_session(session);
up_write(&hidp_session_sem); up_write(&hidp_session_sem);
kfree(session); kfree(session);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment