lisa/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bluetooth: fix init and cleanup of sco_conn.timeout_work

Browse Source 
[ Upstream commit 49d8a5606428ca0962d09050a5af81461ff90fbb ]

Before freeing struct sco_conn, all delayed timeout work should be
cancelled. Otherwise, sco_sock_timeout could potentially use the
sco_conn after it has been freed.

Additionally, sco_conn.timeout_work should be initialized when the
connection is allocated, not when the channel is added. This is
because an sco_conn can create channels with multiple sockets over its
lifetime, which happens if sockets are released but the connection
isn't deleted.

Fixes: ba316be1b6a0 ("Bluetooth: schedule SCO timeouts with delayed_work")
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Desmond Cheong Zhi Xi 2021-09-02 23:13:06 -04:00 committed by Greg Kroah-Hartman
parent 28c1d96562
commit 6237a1685c
1 changed files with 4 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
net/bluetooth/sco.c
View File

@ -133,6 +133,7 @@ static struct sco_conn *sco_conn_add(struct hci_conn *hcon)
return NULL; return NULL;
spin_lock_init(&conn->lock); spin_lock_init(&conn->lock);
INIT_DELAYED_WORK(&conn->timeout_work, sco_sock_timeout);
hcon->sco_data = conn; hcon->sco_data = conn;
conn->hcon = hcon; conn->hcon = hcon;
@ -196,11 +197,11 @@ static void sco_conn_del(struct hci_conn *hcon, int err)
sco_chan_del(sk, err); sco_chan_del(sk, err);
bh_unlock_sock(sk); bh_unlock_sock(sk);
sock_put(sk); sock_put(sk);
/* Ensure no more work items will run before freeing conn. */
cancel_delayed_work_sync(&conn->timeout_work);
} }
/* Ensure no more work items will run before freeing conn. */
cancel_delayed_work_sync(&conn->timeout_work);
hcon->sco_data = NULL; hcon->sco_data = NULL;
kfree(conn); kfree(conn);
} }
@ -213,8 +214,6 @@ static void __sco_chan_add(struct sco_conn *conn, struct sock *sk,
sco_pi(sk)->conn = conn; sco_pi(sk)->conn = conn;
conn->sk = sk; conn->sk = sk;
INIT_DELAYED_WORK(&conn->timeout_work, sco_sock_timeout);
if (parent) if (parent)
bt_accept_enqueue(parent, sk, true); bt_accept_enqueue(parent, sk, true);
} }