summaryrefslogtreecommitdiff
path: root/net/bluetooth
diff options
context:
space:
mode:
authorMichael Scott <michael.scott@linaro.org>2017-03-28 23:10:18 -0700
committerMarcel Holtmann <marcel@holtmann.org>2017-04-12 22:02:39 +0200
commit6dea44f5acc3d63fbaa992146e92252329d9a2be (patch)
tree2799559d5b5ca84e0fb82fdf4e52efbe62d7436f /net/bluetooth
parentd2891c4d071d807f01cc911dc42a68f4568d65cf (diff)
Bluetooth: 6lowpan: fix use after free in chan_suspend/resume
A status field in the skb_cb struct was storing a channel status based on channel suspend/resume events. This stored status was then used to return EAGAIN if there were packet sending issues in snd_pkt(). The issue is that the skb has been freed by the time the callback to 6lowpan's suspend/resume was called. So, this generates a "use after free" issue that was noticed while running kernel tests with KASAN debug enabled. Let's eliminate the status field entirely as we can use the channel tx_credits to indicate whether we should return EAGAIN when handling packets. Signed-off-by: Michael Scott <michael.scott@linaro.org> Acked-by: Jukka Rissanen <jukka.rissanen@linux.intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Diffstat (limited to 'net/bluetooth')
-rw-r--r--net/bluetooth/6lowpan.c21
1 files changed, 3 insertions, 18 deletions
diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index 6ae51e840af1..b39da8d36aa9 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -38,7 +38,6 @@ struct skb_cb {
struct in6_addr addr;
struct in6_addr gw;
struct l2cap_chan *chan;
- int status;
};
#define lowpan_cb(skb) ((struct skb_cb *)((skb)->cb))
@@ -485,7 +484,7 @@ static int send_pkt(struct l2cap_chan *chan, struct sk_buff *skb,
}
if (!err)
- err = lowpan_cb(skb)->status;
+ err = (!chan->tx_credits ? -EAGAIN : 0);
if (err < 0) {
if (err == -EAGAIN)
@@ -880,26 +879,12 @@ static struct sk_buff *chan_alloc_skb_cb(struct l2cap_chan *chan,
static void chan_suspend_cb(struct l2cap_chan *chan)
{
- struct sk_buff *skb = chan->data;
-
- BT_DBG("chan %p conn %p skb %p", chan, chan->conn, skb);
-
- if (!skb)
- return;
-
- lowpan_cb(skb)->status = -EAGAIN;
+ BT_DBG("chan %p suspend", chan);
}
static void chan_resume_cb(struct l2cap_chan *chan)
{
- struct sk_buff *skb = chan->data;
-
- BT_DBG("chan %p conn %p skb %p", chan, chan->conn, skb);
-
- if (!skb)
- return;
-
- lowpan_cb(skb)->status = 0;
+ BT_DBG("chan %p resume", chan);
}
static long chan_get_sndtimeo_cb(struct l2cap_chan *chan)