From d354bb10ec014f7fb426b3dc993e0d21815fba61 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 8 Jun 2021 10:32:28 +0200 Subject: [PATCH] 4.4-stable patches added patches: bluetooth-fix-the-erroneous-flush_work-order.patch --- ...h-fix-the-erroneous-flush_work-order.patch | 53 +++++++++++++++++++ queue-4.4/series | 1 + 2 files changed, 54 insertions(+) create mode 100644 queue-4.4/bluetooth-fix-the-erroneous-flush_work-order.patch diff --git a/queue-4.4/bluetooth-fix-the-erroneous-flush_work-order.patch b/queue-4.4/bluetooth-fix-the-erroneous-flush_work-order.patch new file mode 100644 index 00000000000..45081a0a4fc --- /dev/null +++ b/queue-4.4/bluetooth-fix-the-erroneous-flush_work-order.patch @@ -0,0 +1,53 @@ +From 6a137caec23aeb9e036cdfd8a46dd8a366460e5d Mon Sep 17 00:00:00 2001 +From: Lin Ma +Date: Tue, 25 May 2021 14:39:02 +0200 +Subject: Bluetooth: fix the erroneous flush_work() order + +From: Lin Ma + +commit 6a137caec23aeb9e036cdfd8a46dd8a366460e5d upstream. + +In the cleanup routine for failed initialization of HCI device, +the flush_work(&hdev->rx_work) need to be finished before the +flush_work(&hdev->cmd_work). Otherwise, the hci_rx_work() can +possibly invoke new cmd_work and cause a bug, like double free, +in late processings. + +This was assigned CVE-2021-3564. + +This patch reorder the flush_work() to fix this bug. + +Cc: Marcel Holtmann +Cc: Johan Hedberg +Cc: Luiz Augusto von Dentz +Cc: "David S. Miller" +Cc: Jakub Kicinski +Cc: linux-bluetooth@vger.kernel.org +Cc: netdev@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Lin Ma +Signed-off-by: Hao Xiong +Cc: stable +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman +--- + net/bluetooth/hci_core.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -1555,8 +1555,13 @@ static int hci_dev_do_open(struct hci_de + } else { + /* Init failed, cleanup */ + flush_work(&hdev->tx_work); +- flush_work(&hdev->cmd_work); ++ ++ /* Since hci_rx_work() is possible to awake new cmd_work ++ * it should be flushed first to avoid unexpected call of ++ * hci_cmd_work() ++ */ + flush_work(&hdev->rx_work); ++ flush_work(&hdev->cmd_work); + + skb_queue_purge(&hdev->cmd_q); + skb_queue_purge(&hdev->rx_q); diff --git a/queue-4.4/series b/queue-4.4/series index 3510fce8860..cf17bf38772 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -6,3 +6,4 @@ hid-pidff-fix-error-return-code-in-hid_pidff_init.patch netfilter-nfnetlink_cthelper-hit-ebusy-on-updates-if.patch ieee802154-fix-error-return-code-in-ieee802154_add_i.patch ieee802154-fix-error-return-code-in-ieee802154_llsec.patch +bluetooth-fix-the-erroneous-flush_work-order.patch -- 2.47.3