[lkml]   [2017]   [Mar]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH] bluetooth: 6lowpan: fix use after free in chan_suspend/resume
Hi Michael,

> A status field in the skb_cb struct was storing a channel status
> based on channel suspend/resume events. This stored status was
> then used to return EAGAIN if there were packet sending issues
> in snd_pkt().
> The issue is that the skb has been freed by the time the callback
> to 6lowpan's suspend/resume was called. So, this generates a
> "use after free" issue that was noticed while running kernel tests
> with KASAN debug enabled.
> Let's eliminate the status field entirely as we can use the channel
> tx_credits to indicate whether we should return EAGAIN when handling
> packets.
> Signed-off-by: Michael Scott <>
> ---
> net/bluetooth/6lowpan.c | 21 +++------------------
> 1 file changed, 3 insertions(+), 18 deletions(-)

patch has been applied to bluetooth-next tree.



 \ /
  Last update: 2017-03-31 12:11    [W:0.061 / U:0.216 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site