leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity
6dea44f5ac
linux/net/bluetooth
History
Michael Scott 6dea44f5ac Bluetooth: 6lowpan: fix use after free in chan_suspend/resume 
A status field in the skb_cb struct was storing a channel status
based on channel suspend/resume events.  This stored status was
then used to return EAGAIN if there were packet sending issues
in snd_pkt().

The issue is that the skb has been freed by the time the callback
to 6lowpan's suspend/resume was called.  So, this generates a
"use after free" issue that was noticed while running kernel tests
with KASAN debug enabled.

Let's eliminate the status field entirely as we can use the channel
tx_credits to indicate whether we should return EAGAIN when handling
packets.

Signed-off-by: Michael Scott <michael.scott@linaro.org>
Acked-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2017-04-12 22:02:39 +02:00
..
bnep net: remove MTU limits on a few ether_setup callers 2016-10-21 13:57:50 -04:00
cmtp sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h> 2017-03-02 08:42:32 +01:00
hidp Bluetooth: hidp: fix device disconnect on idle timeout 2015-10-21 00:49:23 +02:00
rfcomm Bluetooth: convert rfcomm_dlc.refcnt from atomic_t to refcount_t 2017-04-12 22:02:36 +02:00
6lowpan.c Bluetooth: 6lowpan: fix use after free in chan_suspend/resume 2017-04-12 22:02:39 +02:00
a2mp.c locking/atomic, kref: Add kref_read() 2017-01-14 11:37:18 +01:00
a2mp.h Bluetooth: Add BT_HS config option 2015-07-30 13:31:59 +02:00
af_bluetooth.c Bluetooth: Avoid bt_accept_unlink() double unlinking 2017-04-12 22:02:37 +02:00
amp.c Bluetooth: fix assignments on error variable err 2017-04-12 22:02:38 +02:00
amp.h Bluetooth: Add BT_HS config option 2015-07-30 13:31:59 +02:00
ecc.c Bluetooth: Add ECC library for LE Secure Connections 2014-12-03 16:51:16 +01:00
ecc.h Bluetooth: Add ECC library for LE Secure Connections 2014-12-03 16:51:16 +01:00
hci_conn.c Bluetooth: Fix using the correct source address type 2016-11-22 22:50:46 +01:00
hci_core.c Bluetooth: Change initial min and max interval 2017-04-12 22:02:38 +02:00
hci_debugfs.c Bluetooth: Add debugfs fields for hardware and firmware info 2016-07-18 09:33:28 +03:00
hci_debugfs.h Bluetooth: Provide option to enable/disable debugfs information 2015-02-15 18:54:13 +02:00
hci_event.c Bluetooth: fix spelling mistake: "advetising" -> "advertising" 2017-02-16 17:39:35 +01:00
hci_request.c sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h> 2017-03-02 08:42:32 +01:00
hci_request.h Bluetooth: Fix append max 11 bytes of name to scan rsp data 2016-10-19 18:42:37 +02:00
hci_sock.c scripts/spelling.txt: add "an user" pattern and fix typo instances 2017-02-27 18:43:46 -08:00
hci_sysfs.c Bluetooth: Remove controller device attributes 2016-07-09 21:37:11 +03:00
Kconfig Bluetooth: add LED trigger for indicating HCI is powered up 2016-02-23 20:29:35 +01:00
l2cap_core.c locking/atomic, kref: Add kref_read() 2017-01-14 11:37:18 +01:00
l2cap_sock.c net: Work around lockdep limitation in sockets that use sockets 2017-03-09 18:23:27 -08:00
leds.c Bluetooth: Add combined LED trigger for controller power 2016-09-19 20:19:34 +02:00
leds.h Bluetooth: Add combined LED trigger for controller power 2016-09-19 20:19:34 +02:00
lib.c Bluetooth: Add BT_WARN and bt_dev_warn logging macros 2015-09-24 16:25:44 +02:00
Makefile Makefile: drop -D__CHECK_ENDIAN__ from cflags 2016-12-16 00:13:43 +02:00
mgmt_util.c Bluetooth: Add support for sending MGMT commands and events to monitor 2016-09-19 20:19:34 +02:00
mgmt_util.h Bluetooth: Add generic mgmt helper API 2015-03-17 18:03:08 +01:00
mgmt.c Bluetooth: Fix append max 11 bytes of name to scan rsp data 2016-10-19 18:42:37 +02:00
sco.c net: Work around lockdep limitation in sockets that use sockets 2017-03-09 18:23:27 -08:00
selftest.c Bluetooth: Export ECDH selftest result in debugfs 2015-04-02 08:47:38 +03:00
selftest.h Bluetooth: Add support for self testing framework 2014-12-30 08:53:55 +02:00
smp.c Bluetooth: SMP: Add support for H7 crypto function and CT2 auth flag 2016-12-08 07:50:24 +01:00
smp.h Bluetooth: SMP: Add support for H7 crypto function and CT2 auth flag 2016-12-08 07:50:24 +01:00