All of lore.kernel.org
 help / color / mirror / Atom feed
From: Anmol Karn <anmol.karan123@gmail.com>
To: marcel@holtmann.org, johan.hedberg@gmail.com
Cc: linux-kernel-mentees@lists.linuxfoundation.org,
	linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com,
	netdev@vger.kernel.org, linux-bluetooth@vger.kernel.org,
	kuba@kernel.org, davem@davemloft.net, anmol.karan123@gmail.com,
	syzbot+0bef568258653cff272f@syzkaller.appspotmail.com
Subject: [Linux-kernel-mentees] [PATCH] net: bluetooth: Fix null pointer deref in hci_phy_link_complete_evt
Date: Sat, 29 Aug 2020 22:27:12 +0530	[thread overview]
Message-ID: <20200829165712.229437-1-anmol.karan123@gmail.com> (raw)
In-Reply-To: <20200829124112.227133-1-anmol.karan123@gmail.com>

Fix null pointer deref in hci_phy_link_complete_evt, there was no 
checking there for the hcon->amp_mgr->l2cap_conn->hconn, and also 
in hci_cmd_work, for hdev->sent_cmd.

To fix this issue Add pointer checking in hci_cmd_work and
hci_phy_link_complete_evt.
[Linux-next-20200827]

This patch corrected some mistakes from previous patch.

Reported-by: syzbot+0bef568258653cff272f@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?id=0d93140da5a82305a66a136af99b088b75177b99
Signed-off-by: Anmol Karn <anmol.karan123@gmail.com>
---
 net/bluetooth/hci_core.c  | 5 ++++-
 net/bluetooth/hci_event.c | 4 ++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 68bfe57b6625..996efd654e7a 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -4922,7 +4922,10 @@ static void hci_cmd_work(struct work_struct *work)
 
 		kfree_skb(hdev->sent_cmd);
 
-		hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
+		if (hdev->sent_cmd) {
+			hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
+		}
+
 		if (hdev->sent_cmd) {
 			if (hci_req_status_pend(hdev))
 				hci_dev_set_flag(hdev, HCI_CMD_PENDING);
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 4b7fc430793c..1e7d9bee9111 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -4941,6 +4941,10 @@ static void hci_phy_link_complete_evt(struct hci_dev *hdev,
 		hci_dev_unlock(hdev);
 		return;
 	}
+	if (!(hcon->amp_mgr->l2cap_conn->hcon)) {
+		hci_dev_unlock(hdev);
+		return;
+	}
 
 	bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
 
-- 
2.28.0


WARNING: multiple messages have this Message-ID (diff)
From: Anmol Karn <anmol.karan123@gmail.com>
To: marcel@holtmann.org, johan.hedberg@gmail.com
Cc: netdev@vger.kernel.org,
	syzbot+0bef568258653cff272f@syzkaller.appspotmail.com,
	syzkaller-bugs@googlegroups.com, linux-kernel@vger.kernel.org,
	linux-bluetooth@vger.kernel.org, kuba@kernel.org,
	linux-kernel-mentees@lists.linuxfoundation.org,
	davem@davemloft.net
Subject: [Linux-kernel-mentees] [PATCH] net: bluetooth: Fix null pointer deref in hci_phy_link_complete_evt
Date: Sat, 29 Aug 2020 22:27:12 +0530	[thread overview]
Message-ID: <20200829165712.229437-1-anmol.karan123@gmail.com> (raw)
In-Reply-To: <20200829124112.227133-1-anmol.karan123@gmail.com>

Fix null pointer deref in hci_phy_link_complete_evt, there was no 
checking there for the hcon->amp_mgr->l2cap_conn->hconn, and also 
in hci_cmd_work, for hdev->sent_cmd.

To fix this issue Add pointer checking in hci_cmd_work and
hci_phy_link_complete_evt.
[Linux-next-20200827]

This patch corrected some mistakes from previous patch.

Reported-by: syzbot+0bef568258653cff272f@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?id=0d93140da5a82305a66a136af99b088b75177b99
Signed-off-by: Anmol Karn <anmol.karan123@gmail.com>
---
 net/bluetooth/hci_core.c  | 5 ++++-
 net/bluetooth/hci_event.c | 4 ++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 68bfe57b6625..996efd654e7a 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -4922,7 +4922,10 @@ static void hci_cmd_work(struct work_struct *work)
 
 		kfree_skb(hdev->sent_cmd);
 
-		hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
+		if (hdev->sent_cmd) {
+			hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
+		}
+
 		if (hdev->sent_cmd) {
 			if (hci_req_status_pend(hdev))
 				hci_dev_set_flag(hdev, HCI_CMD_PENDING);
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 4b7fc430793c..1e7d9bee9111 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -4941,6 +4941,10 @@ static void hci_phy_link_complete_evt(struct hci_dev *hdev,
 		hci_dev_unlock(hdev);
 		return;
 	}
+	if (!(hcon->amp_mgr->l2cap_conn->hcon)) {
+		hci_dev_unlock(hdev);
+		return;
+	}
 
 	bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
 
-- 
2.28.0

_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees

  reply	other threads:[~2020-08-29 16:57 UTC|newest]

Thread overview: 14+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-08-29 12:41 [Linux-kernel-mentees] [PATCH] net: bluetooth: Fix null pointer deref in hci_phy_link_complete_evt Anmol Karn
2020-08-29 12:41 ` Anmol Karn
2020-08-29 16:57 ` Anmol Karn [this message]
2020-08-29 16:57   ` Anmol Karn
2020-08-30  9:18   ` Greg KH
2020-08-30  9:18     ` Greg KH
2020-08-30  9:19   ` Greg KH
2020-08-30  9:19     ` Greg KH
2020-08-30 12:26     ` Anmol Karn
2020-08-30 12:26       ` Anmol Karn
2020-08-30 17:30       ` Greg KH
2020-08-30 17:30         ` Greg KH
2020-08-30 20:42         ` Anmol Karn
2020-08-30 20:42           ` Anmol Karn

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200829165712.229437-1-anmol.karan123@gmail.com \
    --to=anmol.karan123@gmail.com \
    --cc=davem@davemloft.net \
    --cc=johan.hedberg@gmail.com \
    --cc=kuba@kernel.org \
    --cc=linux-bluetooth@vger.kernel.org \
    --cc=linux-kernel-mentees@lists.linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=marcel@holtmann.org \
    --cc=netdev@vger.kernel.org \
    --cc=syzbot+0bef568258653cff272f@syzkaller.appspotmail.com \
    --cc=syzkaller-bugs@googlegroups.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.