Messages in this thread | | | Subject | Re: [PATCH] bluetooth: 6lowpan: fix use after free in chan_suspend/resume | From | Marcel Holtmann <> | Date | Fri, 31 Mar 2017 12:10:27 +0200 |
| |
Hi Michael,
> A status field in the skb_cb struct was storing a channel status > based on channel suspend/resume events. This stored status was > then used to return EAGAIN if there were packet sending issues > in snd_pkt(). > > The issue is that the skb has been freed by the time the callback > to 6lowpan's suspend/resume was called. So, this generates a > "use after free" issue that was noticed while running kernel tests > with KASAN debug enabled. > > Let's eliminate the status field entirely as we can use the channel > tx_credits to indicate whether we should return EAGAIN when handling > packets. > > Signed-off-by: Michael Scott <michael.scott@linaro.org> > --- > net/bluetooth/6lowpan.c | 21 +++------------------ > 1 file changed, 3 insertions(+), 18 deletions(-)
patch has been applied to bluetooth-next tree.
Regards
Marcel
| |