Re: [PATCH] bluetooth: 6lowpan: fix use after free in chan_suspend/resume

From	Marcel Holtmann <marcel@holtmann.org>
Newsgroups	linux.kernel
Subject	Re: [PATCH] bluetooth: 6lowpan: fix use after free in chan_suspend/resume
Date	2017-03-31 12:20 +0200
Message-ID	<tr1OV-3i8-5@gated-at.bofh.it> (permalink)
References	<tqf7z-2RD-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

Hi Michael,

> A status field in the skb_cb struct was storing a channel status
> based on channel suspend/resume events.  This stored status was
> then used to return EAGAIN if there were packet sending issues
> in snd_pkt().
> 
> The issue is that the skb has been freed by the time the callback
> to 6lowpan's suspend/resume was called.  So, this generates a
> "use after free" issue that was noticed while running kernel tests
> with KASAN debug enabled.
> 
> Let's eliminate the status field entirely as we can use the channel
> tx_credits to indicate whether we should return EAGAIN when handling
> packets.
> 
> Signed-off-by: Michael Scott <michael.scott@linaro.org>
> ---
> net/bluetooth/6lowpan.c | 21 +++------------------
> 1 file changed, 3 insertions(+), 18 deletions(-)

patch has been applied to bluetooth-next tree.

Regards

Marcel

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

[PATCH] bluetooth: 6lowpan: fix use after free in chan_suspend/resume Michael Scott <michael.scott@linaro.org> - 2017-03-29 08:20 +0200
  Re: [PATCH] bluetooth: 6lowpan: fix use after free in chan_suspend/resume Luiz Augusto von Dentz <luiz.dentz@gmail.com> - 2017-03-31 10:40 +0200
  Re: [PATCH] bluetooth: 6lowpan: fix use after free in  chan_suspend/resume Jukka Rissanen <jukka.rissanen@linux.intel.com> - 2017-03-31 11:40 +0200
  Re: [PATCH] bluetooth: 6lowpan: fix use after free in  chan_suspend/resume Marcel Holtmann <marcel@holtmann.org> - 2017-03-31 12:20 +0200

csiph-web