5.3-stable patches

added patches:
	bluetooth-fix-invalid-free-in-bcsp_close.patch

diff --git a/queue-5.3/bluetooth-fix-invalid-free-in-bcsp_close.patch b/queue-5.3/bluetooth-fix-invalid-free-in-bcsp_close.patch
new file mode 100644 (file)
index 0000000..ee77944
--- /dev/null
+++ b/queue-5.3/bluetooth-fix-invalid-free-in-bcsp_close.patch
@@ -0,0 +1,50 @@
+From cf94da6f502d8caecabd56b194541c873c8a7a3c Mon Sep 17 00:00:00 2001
+From: Tomas Bortoli <tomasbortoli@gmail.com>
+Date: Fri, 1 Nov 2019 21:42:44 +0100
+Subject: Bluetooth: Fix invalid-free in bcsp_close()
+
+From: Tomas Bortoli <tomasbortoli@gmail.com>
+
+commit cf94da6f502d8caecabd56b194541c873c8a7a3c upstream.
+
+Syzbot reported an invalid-free that I introduced fixing a memleak.
+
+bcsp_recv() also frees bcsp->rx_skb but never nullifies its value.
+Nullify bcsp->rx_skb every time it is freed.
+
+Signed-off-by: Tomas Bortoli <tomasbortoli@gmail.com>
+Reported-by: syzbot+a0d209a4676664613e76@syzkaller.appspotmail.com
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Cc: Alexander Potapenko <glider@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/bluetooth/hci_bcsp.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/bluetooth/hci_bcsp.c
++++ b/drivers/bluetooth/hci_bcsp.c
+@@ -591,6 +591,7 @@ static int bcsp_recv(struct hci_uart *hu
+                       if (*ptr == 0xc0) {
+                               BT_ERR("Short BCSP packet");
+                               kfree_skb(bcsp->rx_skb);
++                              bcsp->rx_skb = NULL;
+                               bcsp->rx_state = BCSP_W4_PKT_START;
+                               bcsp->rx_count = 0;
+                       } else
+@@ -606,6 +607,7 @@ static int bcsp_recv(struct hci_uart *hu
+                           bcsp->rx_skb->data[2])) != bcsp->rx_skb->data[3]) {
+                               BT_ERR("Error in BCSP hdr checksum");
+                               kfree_skb(bcsp->rx_skb);
++                              bcsp->rx_skb = NULL;
+                               bcsp->rx_state = BCSP_W4_PKT_DELIMITER;
+                               bcsp->rx_count = 0;
+                               continue;
+@@ -630,6 +632,7 @@ static int bcsp_recv(struct hci_uart *hu
+                                      bscp_get_crc(bcsp));
+ 
+                               kfree_skb(bcsp->rx_skb);
++                              bcsp->rx_skb = NULL;
+                               bcsp->rx_state = BCSP_W4_PKT_DELIMITER;
+                               bcsp->rx_count = 0;
+                               continue;

diff --git a/queue-5.3/series b/queue-5.3/series
index 0a559fbb40b0e01013b9bfb8b31e691d8ff0679f..1941af8c932fda1cd1792dd0749f706f0476be0b 100644 (file)
--- a/queue-5.3/series
+++ b/queue-5.3/series
@@ -34,3 +34,4 @@ drm-amd-powerplay-issue-no-ppsmc_msg_getcurrpkgpwr-on-unsupported-asics.patch
 drm-i915-don-t-oops-in-dumb_create-ioctl-if-we-have-no-crtcs.patch
 drm-i915-pmu-frequency-is-reported-as-accumulated-cycles.patch
 drm-i915-userptr-try-to-acquire-the-page-lock-around-set_page_dirty.patch
+bluetooth-fix-invalid-free-in-bcsp_close.patch