summaryrefslogtreecommitdiff
path: root/net/bluetooth/hci_core.c
diff options
context:
space:
mode:
authorPauli Virtanen <pav@iki.fi>2024-03-02 20:06:23 +0300
committerLuiz Augusto von Dentz <luiz.von.dentz@intel.com>2024-03-07 01:26:58 +0300
commit947ec0d002dce8577b655793dcc6fc78d67b7cb6 (patch)
tree2d73cb44bf3c9a044b8352e8cea754347712356c /net/bluetooth/hci_core.c
parentf7b94bdc1ec107c92262716b073b3e816d4784fb (diff)
downloadlinux-947ec0d002dce8577b655793dcc6fc78d67b7cb6.tar.xz
Bluetooth: fix use-after-free in accessing skb after sending it
hci_send_cmd_sync first sends skb and then tries to clone it. However, the driver may have already freed the skb at that point. Fix by cloning the sent_cmd cloned just above, instead of the original. Log: ================================================================ BUG: KASAN: slab-use-after-free in __copy_skb_header+0x1a/0x240 ... Call Trace: .. __skb_clone+0x59/0x2c0 hci_cmd_work+0x3b3/0x3d0 [bluetooth] process_one_work+0x459/0x900 ... Allocated by task 129: ... __alloc_skb+0x1ae/0x220 __hci_cmd_sync_sk+0x44c/0x7a0 [bluetooth] __hci_cmd_sync_status+0x24/0xb0 [bluetooth] set_cig_params_sync+0x778/0x7d0 [bluetooth] ... Freed by task 0: ... kmem_cache_free+0x157/0x3c0 __usb_hcd_giveback_urb+0x11e/0x1e0 usb_giveback_urb_bh+0x1ad/0x2a0 tasklet_action_common.isra.0+0x259/0x4a0 __do_softirq+0x15b/0x5a7 ================================================================ Fixes: 2615fd9a7c25 ("Bluetooth: hci_sync: Fix overwriting request callback") Signed-off-by: Pauli Virtanen <pav@iki.fi> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'net/bluetooth/hci_core.c')
-rw-r--r--net/bluetooth/hci_core.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 230d2bbb933b..1690ae57a09d 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -4217,7 +4217,7 @@ static void hci_send_cmd_sync(struct hci_dev *hdev, struct sk_buff *skb)
if (hci_req_status_pend(hdev) &&
!hci_dev_test_and_set_flag(hdev, HCI_CMD_PENDING)) {
kfree_skb(hdev->req_skb);
- hdev->req_skb = skb_clone(skb, GFP_KERNEL);
+ hdev->req_skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
}
atomic_dec(&hdev->cmd_cnt);