Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-24 05:02:12 +00:00
Code Issues Packages Projects Releases Wiki Activity
acf91ec384
linux/drivers/bluetooth
History
Laura Abbott acf91ec384 Bluetooth: btwilink: Save the packet type before sending 
Running with KASAN produces some messages:

BUG: KASAN: use-after-free in ti_st_send_frame+0x9c/0x16c at addr
ffffffc064868fe8
Read of size 1 by task kworker/u17:1/1266

<KASAN output trimmed>

Hardware name: HiKey Development Board (DT)
Workqueue: hci0 hci_cmd_work
Call trace:
[<ffffffc00008c00c>] dump_backtrace+0x0/0x178
[<ffffffc00008c1a4>] show_stack+0x20/0x28
[<ffffffc00067da38>] dump_stack+0xa8/0xe0
[<ffffffc000288430>] print_trailer+0x110/0x174
[<ffffffc00028aedc>] object_err+0x4c/0x5c
[<ffffffc00028f714>] kasan_report_error+0x254/0x54c
[<ffffffc00028fa70>] kasan_report+0x64/0x70
[<ffffffc00028eb8c>] __asan_load1+0x4c/0x54
[<ffffffc000b59b24>] ti_st_send_frame+0x9c/0x16c
[<ffffffc000ee8dcc>] hci_send_frame+0xb4/0x118
[<ffffffc000ee8efc>] hci_cmd_work+0xcc/0x154
[<ffffffc0000f6c48>] process_one_work+0x26c/0x7a4
[<ffffffc0000f721c>] worker_thread+0x9c/0x73c
[<ffffffc000100250>] kthread+0x138/0x154
[<ffffffc000085c50>] ret_from_fork+0x10/0x40

The packet is being accessed for statistics after it has been freed.
Save the packet type before sending for statistics afterwards.

Signed-off-by: Laura Abbott <labbott@redhat.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2016-09-22 22:18:59 +02:00
..
ath3k.c Bluetooth: Add support of 13d3:3490 AR3012 device 2016-07-12 00:36:39 +02:00
bcm203x.c Bluetooth: bcm203x: don't print error when allocating urb fails 2016-09-19 20:19:34 +02:00
bfusb.c Bluetooth: bfusb: Fix the return error code 2015-12-22 15:25:33 +01:00
bluecard_cs.c Bluetooth: Use new hci_skb_pkt_* wrappers for drivers 2015-11-19 17:50:27 +01:00
bpa10x.c Bluetooth: bpa10x: Add support for hci_set_fw_info 2016-07-18 09:33:56 +03:00
bt3c_cs.c Bluetooth: Use new hci_skb_pkt_* wrappers for drivers 2015-11-19 17:50:27 +01:00
btbcm.c Bluetooth: btbcm: Fix handling of firmware not found 2016-02-23 20:29:37 +01:00
btbcm.h Bluetooth: btbcm: Support the BCM4354 Bluetooth UART device 2015-06-17 18:56:53 +02:00
btintel.c Bluetooth: btintel: Create common Intel Version Read function 2015-12-10 00:51:51 +01:00
btintel.h Bluetooth: btintel: Create common Intel Version Read function 2015-12-10 00:51:51 +01:00
btmrvl_debugfs.c Bluetooth: btmrvl add firmware dump support 2014-12-03 17:35:51 +01:00
btmrvl_drv.h btmrvl: add platform specific wakeup interrupt support 2016-05-02 19:26:15 +02:00
btmrvl_main.c Bluetooth: Rename HCI_BREDR into HCI_PRIMARY 2016-07-09 21:37:13 +03:00
btmrvl_sdio.c Bluetooth: btmrvl: reset is_suspending flag in failure path 2016-07-18 10:13:02 +02:00
btmrvl_sdio.h btmrvl: add platform specific wakeup interrupt support 2016-05-02 19:26:15 +02:00
btqca.c Bluetooth: btqca: remove null checks on edl->data as it is an array 2016-09-19 20:19:34 +02:00
btqca.h Bluetooth: btqca: Introduce generic QCA ROME support 2015-08-10 23:52:20 +02:00
btqcomsmd.c Bluetooth: Introduce Qualcomm WCNSS SMD based HCI driver 2016-09-19 20:19:34 +02:00
btrtl.c Bluetooth: btrtl: Add RTL8822BE Bluetooth device 2016-09-19 20:19:34 +02:00
btrtl.h Bluetooth: btrtl: Create separate module for Realtek BT driver 2015-05-14 12:04:12 +02:00
btsdio.c Bluetooth: Rename HCI_BREDR into HCI_PRIMARY 2016-07-09 21:37:13 +03:00
btuart_cs.c Bluetooth: Use new hci_skb_pkt_* wrappers for drivers 2015-11-19 17:50:27 +01:00
btusb.c Bluetooth: Add a new 04ca:3011 QCA_ROME device 2016-09-22 17:40:28 +02:00
btwilink.c Bluetooth: btwilink: Save the packet type before sending 2016-09-22 22:18:59 +02:00
dtl1_cs.c Bluetooth: Use new hci_skb_pkt_* wrappers for drivers 2015-11-19 17:50:27 +01:00
hci_ag6xx.c Bluetooth: hci_uart: Add diag and address support for Intel/AG6xx 2016-02-29 19:25:22 +02:00
hci_ath.c Bluetooth: Use new hci_skb_pkt_* wrappers for drivers 2015-11-19 17:50:27 +01:00
hci_bcm.c Bluetooth: hci_bcm: Change protocol name 2016-09-19 20:25:37 +02:00
hci_bcsp.c Bluetooth: hci_bcsp: fix code style 2016-04-08 23:01:36 +02:00
hci_h4.c Bluetooth: Use new hci_skb_pkt_* wrappers for drivers 2015-11-19 17:50:27 +01:00
hci_h5.c Bluetooth: h5: Do not initialize Configuration field 2015-12-10 19:19:17 +01:00
hci_intel.c Bluetooth: btusb, hci_intel: Fix wait_on_bit_timeout() return value checks 2016-09-19 20:19:34 +02:00
hci_ldisc.c Bluetooth: hci_uart: Add Marvell support 2016-09-19 20:32:03 +02:00
hci_ll.c Bluetooth: Use new hci_skb_pkt_* wrappers for drivers 2015-11-19 17:50:27 +01:00
hci_mrvl.c Bluetooth: hci_uart: Add Marvell support 2016-09-19 20:32:03 +02:00
hci_qca.c Bluetooth: Remove deprecated create_singlethread_workqueue 2016-09-19 20:19:34 +02:00
hci_uart.h Bluetooth: hci_uart: Add Marvell support 2016-09-19 20:32:03 +02:00
hci_vhci.c Bluetooth: Rename HCI_BREDR into HCI_PRIMARY 2016-07-09 21:37:13 +03:00
Kconfig Bluetooth: hci_uart: Add Marvell support 2016-09-19 20:32:03 +02:00
Makefile Bluetooth: hci_uart: Add Marvell support 2016-09-19 20:32:03 +02:00