From: Sergei Shtylyov <sergei.shtylyov@cogentembedded•com>
To: Dean Jenkins <Dean_Jenkins@mentor•com>
Cc: davem@davemloft•net, netdev@vger•kernel.org
Subject: Re: [PATCH 1/5] Bluetooth: Add RFCOMM TTY write return error codes
Date: Wed, 19 Jun 2013 22:01:59 +0400 [thread overview]
Message-ID: <51C1F217.6050808@cogentembedded.com> (raw)
In-Reply-To: <1371656071-27754-2-git-send-email-Dean_Jenkins@mentor.com>
On 06/19/2013 07:34 PM, Dean Jenkins wrote:
> It appears that rfcomm_tty_write() does not check that the
> passed in TTY device_data is not NULL and also does not check
> that the RFCOMM DLC serial data link pointer is not NULL.
> A kernel crash was observed whilst SLIP was bound to /dev/rfcomm0
> but the /dev/rfcomm0 had subsequently disconnected. Unfortunately,
> SLIP attempted to write to the now non-existant RFCOMM TTY device
> which caused a NULL pointer dereference because the device_data
> no longer existed.
> Therefore, add NULL pointer checks for the dev and dlc pointers
> and output kernel error debug to show that NULL had been detected.
> Signed-off-by: Dean Jenkins <Dean_Jenkins@mentor•com>
> ---
> net/bluetooth/rfcomm/tty.c | 14 +++++++++++++-
> 1 file changed, 13 insertions(+), 1 deletion(-)
> diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
> index b6e44ad..56d28d1 100644
> --- a/net/bluetooth/rfcomm/tty.c
> +++ b/net/bluetooth/rfcomm/tty.c
> @@ -761,12 +761,24 @@ static void rfcomm_tty_close(struct tty_struct *tty, struct file *filp)
> static int rfcomm_tty_write(struct tty_struct *tty, const unsigned char *buf, int count)
> {
> struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
> - struct rfcomm_dlc *dlc = dev->dlc;
> + struct rfcomm_dlc *dlc;
> struct sk_buff *skb;
> int err = 0, sent = 0, size;
>
> BT_DBG("tty %p count %d", tty, count);
>
> + if (!dev) {
> + BT_ERR("RFCOMM TTY device data structure does not exist");
> + return -ENODEV;
> + }
> +
> + dlc = dev->dlc;
> +
I don't think empty line is needed here.
> + if (!dlc) {
> + BT_ERR("RFCOMM serial data link does not exist");
> + return -ENOLINK;
> + }
> +
WBR, Sergei
next prev parent reply other threads:[~2013-06-19 18:01 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-06-19 15:34 [PATCH 0/5] SLIP SLIP-Improve robustness to crashing Dean Jenkins
2013-06-19 15:34 ` [PATCH 1/5] Bluetooth: Add RFCOMM TTY write return error codes Dean Jenkins
2013-06-19 18:01 ` Sergei Shtylyov [this message]
2013-06-19 15:34 ` [PATCH 2/5] SLIP: Handle error codes from the TTY layer Dean Jenkins
2013-06-19 18:00 ` Sergei Shtylyov
2013-06-19 15:34 ` [PATCH 3/5] SLIP: Prevent recursion stack overflow and scheduler crash Dean Jenkins
2013-06-19 15:34 ` [PATCH 4/5] SLIP: Add error message for xleft non-zero Dean Jenkins
2013-06-19 15:34 ` [PATCH 5/5] SLIP: Fix transmission segmentation mechanism Dean Jenkins
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=51C1F217.6050808@cogentembedded.com \
--to=sergei.shtylyov@cogentembedded$(echo .)com \
--cc=Dean_Jenkins@mentor$(echo .)com \
--cc=davem@davemloft$(echo .)net \
--cc=netdev@vger$(echo .)kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox