lkml.org 
[lkml]   [2012]   [Mar]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: use-after-free in bluetooth (hci_conn_hash_flush)
Hi Dave,

On Tue, Mar 06, 2012 at 10:22:15AM -0500, Dave Jones wrote:
> On Tue, Mar 06, 2012 at 10:53:44AM +0200, Andrei Emeltchenko wrote:
>
> > On Mon, Mar 05, 2012 at 05:12:42PM -0500, Dave Jones wrote:
> > > We had a user report this, which looks like a use after free
> > > in hci_conn_hash_flush(). Probably related to bf4c63252490ba78fb833cc7acf1a5b1900c970f
> >
> > Yes most probably this is the reason.
> >
> > > Full report is at https://bugzilla.redhat.com/show_bug.cgi?id=797590
> >
> > Could you try following commit?
> >
> > commit 3c4e0df028935618d052235ba85bc7079be13394
> > Author: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
> > Date: Thu Feb 2 10:32:17 2012 +0200
> >
> > Bluetooth: Use list _safe deleting from conn_hash_list
>
> Could you attach the patch ? I'll throw it into a Fedora build for
> the user who saw this to test.

Please check those related patches here:

http://git.kernel.org/?p=linux/kernel/git/next/linux-next.git;a=patch;h=2a5a5ec620a29d4ba07743c3151cdf0a417c8f8c
http://git.kernel.org/?p=linux/kernel/git/next/linux-next.git;a=patch;h=3c4e0df028935618d052235ba85bc7079be13394

Best regards
Andrei Emeltchenko



\
 
 \ /
  Last update: 2012-03-07 09:39    [W:0.167 / U:0.740 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site