diff options
| author | Michael Scott <michael.scott@linaro.org> | 2017-03-29 08:10:18 +0200 |
|---|---|---|
| committer | Marcel Holtmann <marcel@holtmann.org> | 2017-04-12 22:02:39 +0200 |
| commit | 6dea44f5acc3d63fbaa992146e92252329d9a2be (patch) | |
| tree | 2799559d5b5ca84e0fb82fdf4e52efbe62d7436f /net | |
| parent | Bluetooth: 6lowpan: fix delay work init in add_peer_chan() (diff) | |
| download | linux-6dea44f5acc3d63fbaa992146e92252329d9a2be.tar.xz linux-6dea44f5acc3d63fbaa992146e92252329d9a2be.zip | |
Bluetooth: 6lowpan: fix use after free in chan_suspend/resume
A status field in the skb_cb struct was storing a channel status
based on channel suspend/resume events. This stored status was
then used to return EAGAIN if there were packet sending issues
in snd_pkt().
The issue is that the skb has been freed by the time the callback
to 6lowpan's suspend/resume was called. So, this generates a
"use after free" issue that was noticed while running kernel tests
with KASAN debug enabled.
Let's eliminate the status field entirely as we can use the channel
tx_credits to indicate whether we should return EAGAIN when handling
packets.
Signed-off-by: Michael Scott <michael.scott@linaro.org>
Acked-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/bluetooth/6lowpan.c | 21 |
1 files changed, 3 insertions, 18 deletions
diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c index 6ae51e840af1..b39da8d36aa9 100644 --- a/net/bluetooth/6lowpan.c +++ b/net/bluetooth/6lowpan.c @@ -38,7 +38,6 @@ struct skb_cb { struct in6_addr addr; struct in6_addr gw; struct l2cap_chan *chan; - int status; }; #define lowpan_cb(skb) ((struct skb_cb *)((skb)->cb)) @@ -485,7 +484,7 @@ static int send_pkt(struct l2cap_chan *chan, struct sk_buff *skb, } if (!err) - err = lowpan_cb(skb)->status; + err = (!chan->tx_credits ? -EAGAIN : 0); if (err < 0) { if (err == -EAGAIN) @@ -880,26 +879,12 @@ static struct sk_buff *chan_alloc_skb_cb(struct l2cap_chan *chan, static void chan_suspend_cb(struct l2cap_chan *chan) { - struct sk_buff *skb = chan->data; - - BT_DBG("chan %p conn %p skb %p", chan, chan->conn, skb); - - if (!skb) - return; - - lowpan_cb(skb)->status = -EAGAIN; + BT_DBG("chan %p suspend", chan); } static void chan_resume_cb(struct l2cap_chan *chan) { - struct sk_buff *skb = chan->data; - - BT_DBG("chan %p conn %p skb %p", chan, chan->conn, skb); - - if (!skb) - return; - - lowpan_cb(skb)->status = 0; + BT_DBG("chan %p resume", chan); } static long chan_get_sndtimeo_cb(struct l2cap_chan *chan) |