mirror of
https://github.com/followmsi/android_kernel_google_msm.git
synced 2024-09-22 04:32:41 +00:00
Fix use-after-free oops in Bluetooth HID.
When cleaning up HIDP sessions, we currently close the ACL connection before deregistering the input device. Closing the ACL connection schedules a workqueue to remove the associated objects from sysfs, but the input device still refers to them -- and if the workqueue happens to run before the input device removal, the kernel will oops when trying to look up PHYSDEVPATH for the removed input device. Fix this by deregistering the input device before closing the connections. Signed-off-by: David Woodhouse <dwmw2@infradead.org> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
parent
d23cf676d0
commit
1c39858b5d
1 changed files with 9 additions and 9 deletions
|
@ -581,15 +581,6 @@ static int hidp_session(void *arg)
|
|||
|
||||
hidp_del_timer(session);
|
||||
|
||||
fput(session->intr_sock->file);
|
||||
|
||||
wait_event_timeout(*(ctrl_sk->sk_sleep),
|
||||
(ctrl_sk->sk_state == BT_CLOSED), msecs_to_jiffies(500));
|
||||
|
||||
fput(session->ctrl_sock->file);
|
||||
|
||||
__hidp_unlink_session(session);
|
||||
|
||||
if (session->input) {
|
||||
input_unregister_device(session->input);
|
||||
session->input = NULL;
|
||||
|
@ -601,6 +592,15 @@ static int hidp_session(void *arg)
|
|||
hid_free_device(session->hid);
|
||||
}
|
||||
|
||||
fput(session->intr_sock->file);
|
||||
|
||||
wait_event_timeout(*(ctrl_sk->sk_sleep),
|
||||
(ctrl_sk->sk_state == BT_CLOSED), msecs_to_jiffies(500));
|
||||
|
||||
fput(session->ctrl_sock->file);
|
||||
|
||||
__hidp_unlink_session(session);
|
||||
|
||||
up_write(&hidp_session_sem);
|
||||
|
||||
kfree(session);
|
||||
|
|
Loading…
Reference in a new issue