Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 960603a5 authored by Peter Hurley's avatar Peter Hurley Committed by Marcel Holtmann
Browse files

Bluetooth: Exclude released devices from RFCOMMGETDEVLIST ioctl 



When enumerating RFCOMM devices in the rfcomm_dev_list, holding
the rfcomm_dev_lock only guarantees the existence of the enumerated
rfcomm_dev in memory, and not safe access to its state. Testing
the device state (such as RFCOMM_TTY_RELEASED) does not guarantee
the device will remain in that state for the subsequent access
to the rfcomm_dev's fields, nor guarantee that teardown has not
commenced.

Obtain an rfcomm_dev reference for the duration of rfcomm_dev
access.

Signed-off-by: default avatarPeter Hurley <peter@hurleysoftware.com>
Tested-By: default avatarAlexander Holler <holler@ahsoftware.de>
Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
parent 082a1532

net/bluetooth/rfcomm/tty.c

+2 −1
Original line number Diff line number Diff line
@@ -468,7 +468,7 @@ static int rfcomm_get_dev_list(void __user *arg) 
	spin_lock(&rfcomm_dev_lock);



	list_for_each_entry(dev, &rfcomm_dev_list, list) {

		if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags))

		if (!tty_port_get(&dev->port))

			continue;

		(di + n)->id      = dev->id;

		(di + n)->flags   = dev->flags;
@@ -476,6 +476,7 @@ static int rfcomm_get_dev_list(void __user *arg) 
		(di + n)->channel = dev->channel;

		bacpy(&(di + n)->src, &dev->src);

		bacpy(&(di + n)->dst, &dev->dst);

		tty_port_put(&dev->port);

		if (++n >= dev_num)

			break;

	}