diff options
author | Michael Scott <michael.scott@linaro.org> | 2017-03-28 23:10:18 -0700 |
---|---|---|
committer | Marcel Holtmann <marcel@holtmann.org> | 2017-04-12 22:02:39 +0200 |
commit | 6dea44f5acc3d63fbaa992146e92252329d9a2be (patch) | |
tree | 2799559d5b5ca84e0fb82fdf4e52efbe62d7436f /drivers/bluetooth | |
parent | d2891c4d071d807f01cc911dc42a68f4568d65cf (diff) |
Bluetooth: 6lowpan: fix use after free in chan_suspend/resume
A status field in the skb_cb struct was storing a channel status
based on channel suspend/resume events. This stored status was
then used to return EAGAIN if there were packet sending issues
in snd_pkt().
The issue is that the skb has been freed by the time the callback
to 6lowpan's suspend/resume was called. So, this generates a
"use after free" issue that was noticed while running kernel tests
with KASAN debug enabled.
Let's eliminate the status field entirely as we can use the channel
tx_credits to indicate whether we should return EAGAIN when handling
packets.
Signed-off-by: Michael Scott <michael.scott@linaro.org>
Acked-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Diffstat (limited to 'drivers/bluetooth')
0 files changed, 0 insertions, 0 deletions