diff options
| author | Michael Scott <michael.scott@linaro.org> | 2017-03-29 08:10:18 +0200 |
|---|---|---|
| committer | Marcel Holtmann <marcel@holtmann.org> | 2017-04-12 22:02:39 +0200 |
| commit | 6dea44f5acc3d63fbaa992146e92252329d9a2be (patch) | |
| tree | 2799559d5b5ca84e0fb82fdf4e52efbe62d7436f /drivers/bluetooth/btmrvl_sdio.c | |
| parent | Bluetooth: 6lowpan: fix delay work init in add_peer_chan() (diff) | |
| download | linux-6dea44f5acc3d63fbaa992146e92252329d9a2be.tar.xz linux-6dea44f5acc3d63fbaa992146e92252329d9a2be.zip | |
Bluetooth: 6lowpan: fix use after free in chan_suspend/resume
A status field in the skb_cb struct was storing a channel status
based on channel suspend/resume events. This stored status was
then used to return EAGAIN if there were packet sending issues
in snd_pkt().
The issue is that the skb has been freed by the time the callback
to 6lowpan's suspend/resume was called. So, this generates a
"use after free" issue that was noticed while running kernel tests
with KASAN debug enabled.
Let's eliminate the status field entirely as we can use the channel
tx_credits to indicate whether we should return EAGAIN when handling
packets.
Signed-off-by: Michael Scott <michael.scott@linaro.org>
Acked-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Diffstat (limited to 'drivers/bluetooth/btmrvl_sdio.c')
0 files changed, 0 insertions, 0 deletions