lkml.org 
[lkml]   [2019]   [Nov]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 256/306] Bluetooth: Fix invalid-free in bcsp_close()
    Date
    From: Tomas Bortoli <tomasbortoli@gmail.com>

    commit cf94da6f502d8caecabd56b194541c873c8a7a3c upstream.

    Syzbot reported an invalid-free that I introduced fixing a memleak.

    bcsp_recv() also frees bcsp->rx_skb but never nullifies its value.
    Nullify bcsp->rx_skb every time it is freed.

    Signed-off-by: Tomas Bortoli <tomasbortoli@gmail.com>
    Reported-by: syzbot+a0d209a4676664613e76@syzkaller.appspotmail.com
    Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
    Cc: Alexander Potapenko <glider@google.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/bluetooth/hci_bcsp.c | 3 +++
    1 file changed, 3 insertions(+)

    --- a/drivers/bluetooth/hci_bcsp.c
    +++ b/drivers/bluetooth/hci_bcsp.c
    @@ -606,6 +606,7 @@ static int bcsp_recv(struct hci_uart *hu
    if (*ptr == 0xc0) {
    BT_ERR("Short BCSP packet");
    kfree_skb(bcsp->rx_skb);
    + bcsp->rx_skb = NULL;
    bcsp->rx_state = BCSP_W4_PKT_START;
    bcsp->rx_count = 0;
    } else
    @@ -621,6 +622,7 @@ static int bcsp_recv(struct hci_uart *hu
    bcsp->rx_skb->data[2])) != bcsp->rx_skb->data[3]) {
    BT_ERR("Error in BCSP hdr checksum");
    kfree_skb(bcsp->rx_skb);
    + bcsp->rx_skb = NULL;
    bcsp->rx_state = BCSP_W4_PKT_DELIMITER;
    bcsp->rx_count = 0;
    continue;
    @@ -645,6 +647,7 @@ static int bcsp_recv(struct hci_uart *hu
    bscp_get_crc(bcsp));

    kfree_skb(bcsp->rx_skb);
    + bcsp->rx_skb = NULL;
    bcsp->rx_state = BCSP_W4_PKT_DELIMITER;
    bcsp->rx_count = 0;
    continue;

    \
     
     \ /
      Last update: 2019-11-27 22:23    [W:4.008 / U:0.104 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site