public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
* [PATCH 6.1 0/1] Bluetooth: hci_sync: cancel cmd_timer if hci_open failed
@ 2023-01-26 13:36 Fedor Pchelkin
  2023-01-26 13:36 ` [PATCH 6.1 1/1] " Fedor Pchelkin
  2023-01-27  2:07 ` [PATCH 6.1 0/1] " Sasha Levin
  0 siblings, 2 replies; 3+ messages in thread
From: Fedor Pchelkin @ 2023-01-26 13:36 UTC (permalink / raw)
  To: stable, Greg Kroah-Hartman
  Cc: Fedor Pchelkin, Archie Pusaka, Abhishek Pandit-Subedi,
	Marcel Holtmann, Johan Hedberg, Luiz Augusto von Dentz,
	David S. Miller, Jakub Kicinski, linux-bluetooth, netdev,
	linux-kernel, Alexey Khoroshilov, lvc-project

Syzkaller reports use-after-free in hci_cmd_timeout(). The bug was fixed
in the following patch and can be cleanly applied to 6.1 stable tree.

Due to some technical rearrangement, the fix for older stable branches
requires a different patch which I'll send you in another thread.

^ permalink raw reply	[flat|nested] 3+ messages in thread

* [PATCH 6.1 1/1] Bluetooth: hci_sync: cancel cmd_timer if hci_open failed
  2023-01-26 13:36 [PATCH 6.1 0/1] Bluetooth: hci_sync: cancel cmd_timer if hci_open failed Fedor Pchelkin
@ 2023-01-26 13:36 ` Fedor Pchelkin
  2023-01-27  2:07 ` [PATCH 6.1 0/1] " Sasha Levin
  1 sibling, 0 replies; 3+ messages in thread
From: Fedor Pchelkin @ 2023-01-26 13:36 UTC (permalink / raw)
  To: stable, Greg Kroah-Hartman
  Cc: Fedor Pchelkin, Archie Pusaka, Abhishek Pandit-Subedi,
	Marcel Holtmann, Johan Hedberg, Luiz Augusto von Dentz,
	David S. Miller, Jakub Kicinski, linux-bluetooth, netdev,
	linux-kernel, Alexey Khoroshilov, lvc-project,
	Luiz Augusto von Dentz

From: Archie Pusaka <apusaka@chromium.org>

commit 97dfaf073f5881c624856ef293be307b6166115c upstream.

If a command is already sent, we take care of freeing it, but we
also need to cancel the timeout as well.

Signed-off-by: Archie Pusaka <apusaka@chromium.org>
Reviewed-by: Abhishek Pandit-Subedi <abhishekpandit@google.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
---
 net/bluetooth/hci_sync.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index 8d6c8cbfe1de..aab3d85f4637 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -4703,6 +4703,7 @@ int hci_dev_open_sync(struct hci_dev *hdev)
 			hdev->flush(hdev);
 
 		if (hdev->sent_cmd) {
+			cancel_delayed_work_sync(&hdev->cmd_timer);
 			kfree_skb(hdev->sent_cmd);
 			hdev->sent_cmd = NULL;
 		}
-- 
2.34.1


^ permalink raw reply related	[flat|nested] 3+ messages in thread

* Re: [PATCH 6.1 0/1] Bluetooth: hci_sync: cancel cmd_timer if hci_open failed
  2023-01-26 13:36 [PATCH 6.1 0/1] Bluetooth: hci_sync: cancel cmd_timer if hci_open failed Fedor Pchelkin
  2023-01-26 13:36 ` [PATCH 6.1 1/1] " Fedor Pchelkin
@ 2023-01-27  2:07 ` Sasha Levin
  1 sibling, 0 replies; 3+ messages in thread
From: Sasha Levin @ 2023-01-27  2:07 UTC (permalink / raw)
  To: Fedor Pchelkin
  Cc: stable, Greg Kroah-Hartman, Archie Pusaka, Abhishek Pandit-Subedi,
	Marcel Holtmann, Johan Hedberg, Luiz Augusto von Dentz,
	David S. Miller, Jakub Kicinski, linux-bluetooth, netdev,
	linux-kernel, Alexey Khoroshilov, lvc-project

On Thu, Jan 26, 2023 at 04:36:12PM +0300, Fedor Pchelkin wrote:
>Syzkaller reports use-after-free in hci_cmd_timeout(). The bug was fixed
>in the following patch and can be cleanly applied to 6.1 stable tree.
>
>Due to some technical rearrangement, the fix for older stable branches
>requires a different patch which I'll send you in another thread.

Queued up, thanks!

-- 
Thanks,
Sasha

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2023-01-27  2:08 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-01-26 13:36 [PATCH 6.1 0/1] Bluetooth: hci_sync: cancel cmd_timer if hci_open failed Fedor Pchelkin
2023-01-26 13:36 ` [PATCH 6.1 1/1] " Fedor Pchelkin
2023-01-27  2:07 ` [PATCH 6.1 0/1] " Sasha Levin

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox