Linux-Bluetooth Archive on lore.kernel.org
 help / color / Atom feed
* bluez: NULL pointer dereference in bluetooth-meshd org.bluez.mesh.Network1.Join
@ 2019-10-01 12:57 Matthias Gerstner
  0 siblings, 0 replies; only message in thread
From: Matthias Gerstner @ 2019-10-01 12:57 UTC (permalink / raw)
  To: linux-bluetooth

[-- Attachment #1: Type: text/plain, Size: 1433 bytes --]

Hi,

in the context of a review of the bluetooth-meshd D-Bus service [1] I
noticed a segmentation fault due to NULL pointer dereference. It can be
triggered in bluez version 5.51 via the following D-Bus call:

$ dbus-send --system --type=method_call --print-reply \
  --dest=org.bluez.mesh /org/bluez/mesh org.bluez.mesh.Network1.Join \
  objpath:/org/gnome/DisplayManager \
  array:byte:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16

After the D-Bus timeout the bluetooth-meshd will crash with the
following backtrace:

    node_init_cb (node=0x0, agent=0x0) at mesh/mesh.c:359
    359                     reply = dbus_error(join_pending->msg, MESH_ERROR_FAILED,
    (gdb) bt
        user_data=0x5555555be170) at mesh/node.c:1760
        dbus=<optimized out>) at ell/dbus.c:216
        user_data=0x5555555a6e00) at ell/dbus.c:279
        user_data=0x5555555a7ef0) at ell/io.c:126
        at ell/main.c:642
        at mesh/main.c:205

The reason is probably that the `join_pending` data structure has
already been freed in a different function.

[1]: https://bugzilla.suse.com/show_bug.cgi?id=1151518

Cheers

Matthias

-- 
Matthias Gerstner <matthias.gerstner@suse.de>
Dipl.-Wirtsch.-Inf. (FH), Security Engineer
https://www.suse.com/security
Phone: +49 911 740 53 290
GPG Key ID: 0x14C405C971923553

SUSE Software Solutions Germany GmbH
HRB 247165, AG München
Geschäftsführer: Felix Imendörffer

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

^ permalink raw reply	[flat|nested] only message in thread

only message in thread, back to index

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-10-01 12:57 bluez: NULL pointer dereference in bluetooth-meshd org.bluez.mesh.Network1.Join Matthias Gerstner

Linux-Bluetooth Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-bluetooth/0 linux-bluetooth/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-bluetooth linux-bluetooth/ https://lore.kernel.org/linux-bluetooth \
		linux-bluetooth@vger.kernel.org linux-bluetooth@archiver.kernel.org
	public-inbox-index linux-bluetooth

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-bluetooth


AGPL code for this site: git clone https://public-inbox.org/ public-inbox