Arek Lichwa dd7e39bbfc Bluetooth: Fix NULL pointer dereference in mgmt context ... Adds missing callback assignment to cmd_complete in pending management command context. Dump path involves security procedure performed on legacy (pre-SSP) devices with service security requirements set to HIGH (16digits PIN). It fails when shorter PIN is delivered by user. [ 1.517950] Bluetooth: PIN code is not 16 bytes long [ 1.518491] BUG: unable to handle kernel NULL pointer dereference at (null) [ 1.518584] IP: [< (null)>] (null) [ 1.518584] PGD 9e08067 PUD 9fdf067 PMD 0 [ 1.518584] Oops: 0010 [#1] SMP [ 1.518584] Modules linked in: [ 1.518584] CPU: 0 PID: 1002 Comm: kworker/u3:2 Not tainted 4.8.0-rc6-354649-gaf4168c #16 [ 1.518584] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.9.3-20160701_074356-anatol 04/01/2014 [ 1.518584] Workqueue: hci0 hci_rx_work [ 1.518584] task: ffff880009ce14c0 task.stack: ffff880009e10000 [ 1.518584] RIP: 0010:[<0000000000000000>] [< (null)>] (null) [ 1.518584] RSP: 0018:ffff880009e13bc8 EFLAGS: 00010293 [ 1.518584] RAX: 0000000000000000 RBX: ffff880009eed100 RCX: 0000000000000006 [ 1.518584] RDX: ffff880009ddc000 RSI: 0000000000000000 RDI: ffff880009eed100 [ 1.518584] RBP: ffff880009e13be0 R08: 0000000000000000 R09: 0000000000000001 [ 1.518584] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 1.518584] R13: ffff880009e13ccd R14: ffff880009ddc000 R15: ffff880009ddc010 [ 1.518584] FS: 0000000000000000(0000) GS:ffff88000bc00000(0000) knlGS:0000000000000000 [ 1.518584] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1.518584] CR2: 0000000000000000 CR3: 0000000009fdd000 CR4: 00000000000006f0 [ 1.518584] Stack: [ 1.518584] ffffffff81909808 ffff880009e13cce ffff880009e0d40b ffff880009e13c68 [ 1.518584] ffffffff818f428d 00000000024000c0 ffff880009e13c08 ffffffff810ca903 [ 1.518584] ffff880009e13c48 ffffffff811ade34 ffffffff8178c31f ffff880009ee6200 [ 1.518584] Call Trace: [ 1.518584] [<ffffffff81909808>] ? mgmt_pin_code_neg_reply_complete+0x38/0x60 [ 1.518584] [<ffffffff818f428d>] hci_cmd_complete_evt+0x69d/0x3200 [ 1.518584] [<ffffffff810ca903>] ? rcu_read_lock_sched_held+0x53/0x60 [ 1.518584] [<ffffffff811ade34>] ? kmem_cache_alloc+0x1a4/0x200 [ 1.518584] [<ffffffff8178c31f>] ? skb_clone+0x4f/0xa0 [ 1.518584] [<ffffffff818f9d81>] hci_event_packet+0x8e1/0x28e0 [ 1.518584] [<ffffffff81a421f1>] ? _raw_spin_unlock_irqrestore+0x31/0x50 [ 1.518584] [<ffffffff810aea3e>] ? trace_hardirqs_on_caller+0xee/0x1b0 [ 1.518584] [<ffffffff818e6bd1>] hci_rx_work+0x1e1/0x5b0 [ 1.518584] [<ffffffff8107e4bd>] ? process_one_work+0x1ed/0x6b0 [ 1.518584] [<ffffffff8107e538>] process_one_work+0x268/0x6b0 [ 1.518584] [<ffffffff8107e4bd>] ? process_one_work+0x1ed/0x6b0 [ 1.518584] [<ffffffff8107e9c3>] worker_thread+0x43/0x4e0 [ 1.518584] [<ffffffff8107e980>] ? process_one_work+0x6b0/0x6b0 [ 1.518584] [<ffffffff8107e980>] ? process_one_work+0x6b0/0x6b0 [ 1.518584] [<ffffffff8108505f>] kthread+0xdf/0x100 [ 1.518584] [<ffffffff81a4297f>] ret_from_fork+0x1f/0x40 [ 1.518584] [<ffffffff81084f80>] ? kthread_create_on_node+0x210/0x210 Signed-off-by: Arek Lichwa <arek.lichwa@gmail.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>		2016-09-22 17:37:21 +02:00
..
6lowpan	6lowpan: ndisc: no overreact if no short address is available	2016-09-19 20:19:34 +02:00
9p	9p/trans_virtio: use kvfree() for iov_iter_get_pages_alloc()	2016-08-09 13:42:36 +03:00
802
8021q	net: remove type_check from dev_get_nest_level()	2016-08-13 15:15:54 -07:00
appletalk	appletalk: use IS_ENABLED() instead of checking for built-in or module	2016-09-10 21:19:10 -07:00
atm	lec: use IS_ENABLED() instead of checking for built-in or module	2016-09-10 21:19:10 -07:00
ax25	AX.25: Close socket connection on session completion	2016-06-18 20:55:34 -07:00
batman-adv	batman: make netlink attributes const	2016-09-01 14:09:00 -07:00
bluetooth	Bluetooth: Fix NULL pointer dereference in mgmt context	2016-09-22 17:37:21 +02:00
bridge	net: bridge: add helper to call /sbin/bridge-stp	2016-09-13 11:21:31 -04:00
caif	caif: Remove unneeded header file	2016-06-28 05:26:14 -04:00
can	can: only call can_stat_update with procfs	2016-06-23 11:23:49 +02:00
ceph	libceph: using kfree_rcu() to simplify the code	2016-08-08 21:41:42 +02:00
core	net: skbuff: Coding: Use eth_type_vlan() instead of open coding it	2016-09-22 01:35:57 -04:00
dcb
dccp	Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2016-07-29 17:38:46 -07:00
decnet	net: fix decnet rtnexthop parsing	2016-07-05 14:08:47 -07:00
dns_resolver
dsa	net-next: dsa: make the set_addr() operation optional	2016-09-20 04:47:44 -04:00
ethernet
hsr
ieee802154	ieee802154: 6lowpan: fix intra pan id check	2016-07-08 13:23:12 +02:00
ipv4	tcp: implement TSQ for retransmits	2016-09-22 02:44:16 -04:00
ipv6	gso: Support partial splitting at the frag_list pointer	2016-09-19 20:59:34 -04:00
ipx
irda	net/irda: remove pointless assignment/check	2016-08-19 18:07:24 -07:00
iucv	Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2016-07-29 17:38:46 -07:00
kcm	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2016-09-12 15:52:44 -07:00
key
l2tp	l2tp: constify net_device_ops structures	2016-09-17 10:07:23 -04:00
l3mdev	net: ipv6: Remove l3mdev_get_saddr6	2016-09-10 23:12:53 -07:00
lapb	net/lapb: tuse %*ph to dump buffers	2016-05-29 22:33:25 -07:00
llc	llc: switch type to bool as the timeout is only tested versus 0	2016-09-17 10:05:05 -04:00
mac80211	mac80211: Use rhltable instead of rhashtable	2016-09-20 04:43:36 -04:00
mac802154	mac802154: use rate limited warnings for malformed frames	2016-09-19 20:19:34 +02:00
mpls	mpls: get rid of trivial returns	2016-09-01 10:13:15 -07:00
ncsi	net/ncsi: avoid maybe-uninitialized warning	2016-07-25 10:32:59 -07:00
netfilter	sctp: rename WORD_TRUNC/ROUND macros	2016-09-22 03:13:26 -04:00
netlabel	netlabel: Implement CALIPSO config functions for SMACK.	2016-06-27 15:06:18 -04:00
netlink	netlink: don't forget to release a rhashtable_iter structure	2016-09-07 17:29:38 -07:00
netrom
nfc	NFC: digital: Fix RTOX supervisor PDU handling	2016-07-11 02:02:03 +02:00
openvswitch	openvswitch: avoid resetting flow key while installing new flow.	2016-09-20 22:54:35 -04:00
packet	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2016-07-24 00:53:32 -04:00
phonet
qrtr
rds	RDS: add __printf format attribute to error reporting functions	2016-08-08 16:16:21 -07:00
rfkill
rose	rose: limit sk_filter trim to payload	2016-07-13 11:53:40 -07:00
rxrpc	rxrpc: Add config to inject packet loss	2016-09-17 11:24:04 +01:00
sched	net/sched: act_vlan: Introduce TCA_VLAN_ACT_MODIFY vlan action	2016-09-22 01:34:20 -04:00
sctp	sctp: make use of SCTP_TRUNC4 macro	2016-09-22 03:13:26 -04:00
strparser	kcm: Remove TCP specific references from kcm and strparser	2016-08-28 23:32:41 -04:00
sunrpc	SUNRPC: Silence WARN_ON when NFSv4.1 over RDMA is in use	2016-08-24 22:32:55 -04:00
switchdev	rtnetlink: fdb dump: optimize by saving last interface markers	2016-09-01 16:56:15 -07:00
tipc	tipc: fix possible memory leak in tipc_udp_enable()	2016-09-13 11:28:32 -04:00
unix	af_unix: split 'u->readlock' into two: 'iolock' and 'bindlock'	2016-09-04 13:29:29 -07:00
vmw_vsock	vhost/vsock: drop space available check for TX vq	2016-08-15 05:05:21 +03:00
wimax
wireless	This time we have various things - all across the board:	2016-09-18 22:29:08 -04:00
x25	net: x25: remove null checks on arrays calling_ae and called_ae	2016-09-09 18:13:30 -07:00
xfrm	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2016-09-12 15:52:44 -07:00
compat.c	packet: compat support for sock_fprog	2016-06-09 23:41:03 -07:00
Kconfig	strparser: Stream parser for messages	2016-08-17 19:36:23 -04:00
Makefile	strparser: Stream parser for messages	2016-08-17 19:36:23 -04:00
socket.c
sysctl_net.c	net: make net namespace sysctls belong to container's owner	2016-08-14 21:08:58 -07:00