public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
From: Jiri Slaby <jslaby@suse.cz>
To: Marcel Holtmann <marcel@holtmann.org>,
	Dmitry Vyukov <dvyukov@google.com>
Cc: "Gustavo F. Padovan" <gustavo@padovan.org>,
	Johan Hedberg <johan.hedberg@gmail.com>,
	linux-bluetooth <linux-bluetooth@vger.kernel.org>,
	LKML <linux-kernel@vger.kernel.org>,
	syzkaller <syzkaller@googlegroups.com>,
	Kostya Serebryany <kcc@google.com>,
	Alexander Potapenko <glider@google.com>,
	Sasha Levin <sasha.levin@oracle.com>
Subject: Re: bluetooth: use-after-free in vhci_send_frame
Date: Fri, 18 Mar 2016 17:59:01 +0100	[thread overview]
Message-ID: <56EC33D5.40008@suse.cz> (raw)
In-Reply-To: <054BECDB-E7C1-4241-B298-FED0CEE6F3B2@holtmann.org>

On 03/08/2016, 07:32 PM, Marcel Holtmann wrote:
> that means very little to me actually. So is the real issue caused by opening /dev/vhci or is that theoretical one via some internal kernel compile time feature.

Hi, what do you think about this one?

--- a/drivers/bluetooth/hci_vhci.c
+++ b/drivers/bluetooth/hci_vhci.c
@@ -196,6 +196,11 @@ static inline ssize_t vhci_get_user(stru

                cancel_delayed_work_sync(&data->open_timeout);

+               if (data->hdev) {
+                       kfree_skb(skb);
+                       return -EBADFD;
+               }
+
                opcode = *((__u8 *) skb->data);
                skb_pull(skb, 1);


open_timeout could be in progress (raced with us) and _sync cancel
waited for vhci_create_device to actually finish and create the device
the second time.

thanks,
-- 
js
suse labs

  parent reply	other threads:[~2016-03-18 16:59 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-01-29  8:50 bluetooth: use-after-free in vhci_send_frame Dmitry Vyukov
2016-03-04  9:15 ` Dmitry Vyukov
2016-03-07 16:27   ` Jiri Slaby
2016-03-07 20:10     ` Marcel Holtmann
2016-03-07 20:16       ` Dmitry Vyukov
2016-03-08 18:32         ` Marcel Holtmann
2016-03-10 16:25           ` Dmitry Vyukov
2016-03-18 16:59           ` Jiri Slaby [this message]
2016-03-18 16:13     ` Jiri Slaby

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=56EC33D5.40008@suse.cz \
    --to=jslaby@suse.cz \
    --cc=dvyukov@google.com \
    --cc=glider@google.com \
    --cc=gustavo@padovan.org \
    --cc=johan.hedberg@gmail.com \
    --cc=kcc@google.com \
    --cc=linux-bluetooth@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=marcel@holtmann.org \
    --cc=sasha.levin@oracle.com \
    --cc=syzkaller@googlegroups.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox