All of lore.kernel.org
 help / color / mirror / Atom feed
From: Anmol Karn <anmol.karan123@gmail.com>
To: Marcel Holtmann <marcel@holtmann.org>
Cc: Johan Hedberg <johan.hedberg@gmail.com>,
	linux-kernel-mentees@lists.linuxfoundation.org,
	open list <linux-kernel@vger.kernel.org>,
	syzkaller-bugs@googlegroups.com,
	"open list:NETWORKING [GENERAL]" <netdev@vger.kernel.org>,
	linux-bluetooth <linux-bluetooth@vger.kernel.org>,
	Jakub Kicinski <kuba@kernel.org>,
	"David S. Miller" <davem@davemloft.net>,
	syzbot+0bef568258653cff272f@syzkaller.appspotmail.com
Subject: Re: [PATCH] net: bluetooth: Fix null pointer dereference in hci_event_packet()
Date: Thu, 1 Oct 2020 13:15:40 +0530	[thread overview]
Message-ID: <20201001074540.GA428447@Thinkpad> (raw)
In-Reply-To: <6F6EF48D-561E-4628-A4F1-F1AF28743CAF@holtmann.org>

On Thu, Oct 01, 2020 at 09:06:42AM +0200, Marcel Holtmann wrote:
> Hi Anmol,
> 
> > AMP_MGR is getting derefernced in hci_phy_link_complete_evt(), when called from hci_event_packet() and there is a possibility, that hcon->amp_mgr may not be found when accessing after initialization of hcon.
> > 
> > - net/bluetooth/hci_event.c:4945
> > The bug seems to get triggered in this line:
> > 
> > bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
> > 
> > Fix it by adding a NULL check for the hcon->amp_mgr before checking the ev-status.
> > 
> > Fixes: d5e911928bd8 ("Bluetooth: AMP: Process Physical Link Complete evt")
> > Reported-and-tested-by: syzbot+0bef568258653cff272f@syzkaller.appspotmail.com 
> > Link: https://syzkaller.appspot.com/bug?extid=0bef568258653cff272f 
> > Signed-off-by: Anmol Karn <anmol.karan123@gmail.com>
> > ---
> > Change in v3:
> >  - changed return o; to return; (Reported-by: kernel test robot <lkp@intel.com>
> > )
> > 
> > net/bluetooth/hci_event.c | 5 +++++
> > 1 file changed, 5 insertions(+)
> 
> patch has been applied to bluetooth-next tree.
> 
> Regards
> 
> Marcel
> 

Thank you :)

Best,
Anmol

WARNING: multiple messages have this Message-ID (diff)
From: Anmol Karn <anmol.karan123@gmail.com>
To: Marcel Holtmann <marcel@holtmann.org>
Cc: Johan Hedberg <johan.hedberg@gmail.com>,
	"open list:NETWORKING \[GENERAL\]" <netdev@vger.kernel.org>,
	syzbot+0bef568258653cff272f@syzkaller.appspotmail.com,
	syzkaller-bugs@googlegroups.com,
	open list <linux-kernel@vger.kernel.org>,
	linux-bluetooth <linux-bluetooth@vger.kernel.org>,
	Jakub Kicinski <kuba@kernel.org>,
	linux-kernel-mentees@lists.linuxfoundation.org,
	"David S. Miller" <davem@davemloft.net>
Subject: Re: [Linux-kernel-mentees] [PATCH] net: bluetooth: Fix null pointer dereference in hci_event_packet()
Date: Thu, 1 Oct 2020 13:15:40 +0530	[thread overview]
Message-ID: <20201001074540.GA428447@Thinkpad> (raw)
In-Reply-To: <6F6EF48D-561E-4628-A4F1-F1AF28743CAF@holtmann.org>

On Thu, Oct 01, 2020 at 09:06:42AM +0200, Marcel Holtmann wrote:
> Hi Anmol,
> 
> > AMP_MGR is getting derefernced in hci_phy_link_complete_evt(), when called from hci_event_packet() and there is a possibility, that hcon->amp_mgr may not be found when accessing after initialization of hcon.
> > 
> > - net/bluetooth/hci_event.c:4945
> > The bug seems to get triggered in this line:
> > 
> > bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
> > 
> > Fix it by adding a NULL check for the hcon->amp_mgr before checking the ev-status.
> > 
> > Fixes: d5e911928bd8 ("Bluetooth: AMP: Process Physical Link Complete evt")
> > Reported-and-tested-by: syzbot+0bef568258653cff272f@syzkaller.appspotmail.com 
> > Link: https://syzkaller.appspot.com/bug?extid=0bef568258653cff272f 
> > Signed-off-by: Anmol Karn <anmol.karan123@gmail.com>
> > ---
> > Change in v3:
> >  - changed return o; to return; (Reported-by: kernel test robot <lkp@intel.com>
> > )
> > 
> > net/bluetooth/hci_event.c | 5 +++++
> > 1 file changed, 5 insertions(+)
> 
> patch has been applied to bluetooth-next tree.
> 
> Regards
> 
> Marcel
> 

Thank you :)

Best,
Anmol
_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees

  reply	other threads:[~2020-10-01  7:46 UTC|newest]

Thread overview: 24+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-09-10  4:34 [Linux-kernel-mentees] [PATCH] net: bluetooth: Fix null pointer dereference in hci_event_packet() Anmol Karn
2020-09-10  4:34 ` Anmol Karn
2020-09-10  5:06 ` Eric Biggers
2020-09-10  5:06   ` [Linux-kernel-mentees] " Eric Biggers
2020-09-10  6:02   ` Anmol Karn
2020-09-10  6:02     ` [Linux-kernel-mentees] " Anmol Karn
2020-09-10 10:49 ` Dan Carpenter
2020-09-10 10:49   ` Dan Carpenter
2020-09-10 14:58   ` Anmol Karn
2020-09-10 14:58     ` Anmol Karn
2020-09-12  9:10   ` Anmol Karn
2020-09-12  9:10     ` Anmol Karn
2020-09-14 15:44     ` Dan Carpenter
2020-09-14 15:44       ` Dan Carpenter
2020-09-14 18:37       ` Anmol Karn
2020-09-14 18:37         ` Anmol Karn
2020-09-29 17:32       ` Anmol Karn
2020-09-29 17:32         ` Anmol Karn
2020-09-30 14:18         ` Anmol Karn
2020-09-30 14:18           ` [Linux-kernel-mentees] " Anmol Karn
2020-10-01  7:06           ` Marcel Holtmann
2020-10-01  7:06             ` [Linux-kernel-mentees] " Marcel Holtmann
2020-10-01  7:45             ` Anmol Karn [this message]
2020-10-01  7:45               ` Anmol Karn

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20201001074540.GA428447@Thinkpad \
    --to=anmol.karan123@gmail.com \
    --cc=davem@davemloft.net \
    --cc=johan.hedberg@gmail.com \
    --cc=kuba@kernel.org \
    --cc=linux-bluetooth@vger.kernel.org \
    --cc=linux-kernel-mentees@lists.linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=marcel@holtmann.org \
    --cc=netdev@vger.kernel.org \
    --cc=syzbot+0bef568258653cff272f@syzkaller.appspotmail.com \
    --cc=syzkaller-bugs@googlegroups.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.