From: patchwork-bot+bluetooth@kernel.org
To: Pauli Virtanen <pav@iki.fi>
Cc: linux-bluetooth@vger.kernel.org
Subject: Re: [PATCH BlueZ] transport: fix crash when freeing transport
Date: Mon, 17 Jun 2024 19:10:32 +0000 [thread overview]
Message-ID: <171865143265.1080.60294571697268947.git-patchwork-notify@kernel.org> (raw)
In-Reply-To: <ee5b81f6306bb9ac014b02c028d159295acc469a.1718644267.git.pav@iki.fi>
Hello:
This patch was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
On Mon, 17 Jun 2024 20:11:53 +0300 you wrote:
> Fix UAF by freeing transport->remote_endpoint in media_transport_free,
> which also frees the struct (not in destroy after the struct is freed).
>
> ERROR: AddressSanitizer: heap-use-after-free
> READ of size 8 at 0x508000022ab8 thread T0
> #0 0x493624 in media_transport_destroy profiles/audio/transport.c:223
> ...
> freed by thread T0 here:
> #1 0x7fb057d10294 in g_free (/lib64/libglib-2.0.so.0+0x5d294)
> #2 0x49dd2d in media_transport_free profiles/audio/transport.c:1276
> #3 0x7e0e99 in remove_interface gdbus/object.c:682
> #4 0x7e8f40 in g_dbus_unregister_interface gdbus/object.c:1430
> #5 0x4935a2 in media_transport_destroy profiles/audio/transport.c:220
>
> [...]
Here is the summary with links:
- [BlueZ] transport: fix crash when freeing transport
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=87ad4c66b934
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
prev parent reply other threads:[~2024-06-17 19:10 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-06-17 17:11 [PATCH BlueZ] transport: fix crash when freeing transport Pauli Virtanen
2024-06-17 19:00 ` [BlueZ] " bluez.test.bot
2024-06-17 19:10 ` patchwork-bot+bluetooth [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=171865143265.1080.60294571697268947.git-patchwork-notify@kernel.org \
--to=patchwork-bot+bluetooth@kernel.org \
--cc=linux-bluetooth@vger.kernel.org \
--cc=pav@iki.fi \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.