Re: bluetooth: use-after-free in vhci_send_frame

From	Jiri Slaby <jslaby@suse.cz>
Newsgroups	linux.kernel
Subject	Re: bluetooth: use-after-free in vhci_send_frame
Date	2016-03-18 18:00 +0100
Message-ID	<re5UK-2fQ-7@gated-at.bofh.it> (permalink)
References	(1 earlier) <r8U3U-4v0-19@gated-at.bofh.it> <ra6cI-5dM-53@gated-at.bofh.it> <ra9Nf-7Bg-15@gated-at.bofh.it> <ra9Ng-7Bg-23@gated-at.bofh.it> <rauI2-4Kx-19@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On 03/08/2016, 07:32 PM, Marcel Holtmann wrote:
> that means very little to me actually. So is the real issue caused by opening /dev/vhci or is that theoretical one via some internal kernel compile time feature.

Hi, what do you think about this one?

--- a/drivers/bluetooth/hci_vhci.c
+++ b/drivers/bluetooth/hci_vhci.c
@@ -196,6 +196,11 @@ static inline ssize_t vhci_get_user(stru

                cancel_delayed_work_sync(&data->open_timeout);

+               if (data->hdev) {
+                       kfree_skb(skb);
+                       return -EBADFD;
+               }
+
                opcode = *((__u8 *) skb->data);
                skb_pull(skb, 1);


open_timeout could be in progress (raced with us) and _sync cancel
waited for vhci_create_device to actually finish and create the device
the second time.

thanks,
-- 
js
suse labs

Back to linux.kernel | Previous | Next | Find similar | Unroll thread

Thread

Re: bluetooth: use-after-free in vhci_send_frame Jiri Slaby <jslaby@suse.cz> - 2016-03-18 18:00 +0100

csiph-web