diff options
| author | Jeremy Cline <jcline@redhat.com> | 2019-02-06 18:54:16 +0100 |
|---|---|---|
| committer | Marcel Holtmann <marcel@holtmann.org> | 2019-02-18 13:54:53 +0100 |
| commit | 32a7b4cbe93b0a0ef7e63d31ca69ce54736c4412 (patch) | |
| tree | 7d576c23965430a2d3b65ff5ec107e867f7e1e07 /.gitignore | |
| parent | Bluetooth: hci_qca: Disable IBS state machine and flush Tx buffer (diff) | |
| download | linux-32a7b4cbe93b0a0ef7e63d31ca69ce54736c4412.tar.xz linux-32a7b4cbe93b0a0ef7e63d31ca69ce54736c4412.zip | |
Bluetooth: hci_ldisc: Initialize hci_dev before open()
The hci_dev struct hdev is referenced in work queues and timers started
by open() in some protocols. This creates a race between the
initialization function and the work or timer which can result hdev
being dereferenced while it is still null.
The syzbot report contains a reliable reproducer which causes a null
pointer dereference of hdev in hci_uart_write_work() by making the
memory allocation for hdev fail.
To fix this, ensure hdev is valid from before calling a protocol's
open() until after calling a protocol's close().
Reported-by: syzbot+257790c15bcdef6fe00c@syzkaller.appspotmail.com
Signed-off-by: Jeremy Cline <jcline@redhat.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Diffstat (limited to '.gitignore')
0 files changed, 0 insertions, 0 deletions