From: David Woodhouse Date: Sat, 7 Jul 2007 18:58:39 +0000 (-0400) Subject: Fix use-after-free oops in Bluetooth HID. X-Git-Tag: v2.6.22~7 X-Git-Url: http://pilppa.com/gitweb/?a=commitdiff_plain;h=1c39858b5dd46004b12c5acd26d8df346bef8a10;p=linux-2.6-omap-h63xx.git Fix use-after-free oops in Bluetooth HID. When cleaning up HIDP sessions, we currently close the ACL connection before deregistering the input device. Closing the ACL connection schedules a workqueue to remove the associated objects from sysfs, but the input device still refers to them -- and if the workqueue happens to run before the input device removal, the kernel will oops when trying to look up PHYSDEVPATH for the removed input device. Fix this by deregistering the input device before closing the connections. Signed-off-by: David Woodhouse Acked-by: Marcel Holtmann Signed-off-by: Linus Torvalds --- diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c index ceadfcf457c..450eb0244bb 100644 --- a/net/bluetooth/hidp/core.c +++ b/net/bluetooth/hidp/core.c @@ -581,15 +581,6 @@ static int hidp_session(void *arg) hidp_del_timer(session); - fput(session->intr_sock->file); - - wait_event_timeout(*(ctrl_sk->sk_sleep), - (ctrl_sk->sk_state == BT_CLOSED), msecs_to_jiffies(500)); - - fput(session->ctrl_sock->file); - - __hidp_unlink_session(session); - if (session->input) { input_unregister_device(session->input); session->input = NULL; @@ -601,6 +592,15 @@ static int hidp_session(void *arg) hid_free_device(session->hid); } + fput(session->intr_sock->file); + + wait_event_timeout(*(ctrl_sk->sk_sleep), + (ctrl_sk->sk_state == BT_CLOSED), msecs_to_jiffies(500)); + + fput(session->ctrl_sock->file); + + __hidp_unlink_session(session); + up_write(&hidp_session_sem); kfree(session);