Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6dea44f5 authored by Michael Scott's avatar Michael Scott Committed by Marcel Holtmann
Browse files

Bluetooth: 6lowpan: fix use after free in chan_suspend/resume 



A status field in the skb_cb struct was storing a channel status
based on channel suspend/resume events.  This stored status was
then used to return EAGAIN if there were packet sending issues
in snd_pkt().

The issue is that the skb has been freed by the time the callback
to 6lowpan's suspend/resume was called.  So, this generates a
"use after free" issue that was noticed while running kernel tests
with KASAN debug enabled.

Let's eliminate the status field entirely as we can use the channel
tx_credits to indicate whether we should return EAGAIN when handling
packets.

Signed-off-by: default avatarMichael Scott <michael.scott@linaro.org>
Acked-by: default avatarJukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
parent d2891c4d

net/bluetooth/6lowpan.c

+3 −18
Original line number Diff line number Diff line
@@ -38,7 +38,6 @@ struct skb_cb { 
	struct in6_addr addr;

	struct in6_addr gw;

	struct l2cap_chan *chan;

	int status;

};

#define lowpan_cb(skb) ((struct skb_cb *)((skb)->cb))
@@ -485,7 +484,7 @@ static int send_pkt(struct l2cap_chan *chan, struct sk_buff *skb, 
	}



	if (!err)

		err = lowpan_cb(skb)->status;

		err = (!chan->tx_credits ? -EAGAIN : 0);



	if (err < 0) {

		if (err == -EAGAIN)
@@ -880,26 +879,12 @@ static struct sk_buff *chan_alloc_skb_cb(struct l2cap_chan *chan, 


static void chan_suspend_cb(struct l2cap_chan *chan)

{

	struct sk_buff *skb = chan->data;



	BT_DBG("chan %p conn %p skb %p", chan, chan->conn, skb);



	if (!skb)

		return;



	lowpan_cb(skb)->status = -EAGAIN;

	BT_DBG("chan %p suspend", chan);

}



static void chan_resume_cb(struct l2cap_chan *chan)

{

	struct sk_buff *skb = chan->data;



	BT_DBG("chan %p conn %p skb %p", chan, chan->conn, skb);



	if (!skb)

		return;



	lowpan_cb(skb)->status = 0;

	BT_DBG("chan %p resume", chan);

}



static long chan_get_sndtimeo_cb(struct l2cap_chan *chan)