diff options
| author | Takashi Iwai <tiwai@suse.de> | 2021-08-28 18:18:18 +0200 |
|---|---|---|
| committer | Marcel Holtmann <marcel@holtmann.org> | 2021-08-30 16:47:31 +0200 |
| commit | 99c23da0eed4fd20cae8243f2b51e10e66aa0951 (patch) | |
| tree | 7d3899f8d325e3f7f8d5cddc7b5f200142288da0 /net/tipc/msg.h | |
| parent | 927ac8da35db763fe22d338614777120fcfade70 (diff) | |
| download | linux-99c23da0eed4fd20cae8243f2b51e10e66aa0951.tar.gz linux-99c23da0eed4fd20cae8243f2b51e10e66aa0951.tar.bz2 linux-99c23da0eed4fd20cae8243f2b51e10e66aa0951.zip | |
Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg()
The sco_send_frame() also takes lock_sock() during memcpy_from_msg()
call that may be endlessly blocked by a task with userfaultd
technique, and this will result in a hung task watchdog trigger.
Just like the similar fix for hci_sock_sendmsg() in commit
92c685dc5de0 ("Bluetooth: reorganize functions..."), this patch moves
the memcpy_from_msg() out of lock_sock() for addressing the hang.
This should be the last piece for fixing CVE-2021-3640 after a few
already queued fixes.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Diffstat (limited to 'net/tipc/msg.h')
0 files changed, 0 insertions, 0 deletions