* [PATCH] Bluetooth: HCI: fix use-after-free in hci_remove_ltk/hci_remove_irk
@ 2023-05-23 11:56 Min Li
2023-05-24 2:34 ` bluez.test.bot
0 siblings, 1 reply; 2+ messages in thread
From: Min Li @ 2023-05-23 11:56 UTC (permalink / raw)
To: luiz.dentz; +Cc: marcel, johan.hedberg, linux-bluetooth, linux-kernel
Similar to commit 0f7d9b31ce7a ("netfilter: nf_tables: fix use-after-free
in nft_set_catchall_destroy()"). We can not access k after kfree_rcu()
call.
Signed-off-by: Min Li <lm0963hack@gmail.com>
---
net/bluetooth/hci_core.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index a856b1051d35..0164b56de12d 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1416,10 +1416,10 @@ int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type)
{
- struct smp_ltk *k;
+ struct smp_ltk *k, *tmp;
int removed = 0;
- list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
+ list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
if (bacmp(bdaddr, &k->bdaddr) || k->bdaddr_type != bdaddr_type)
continue;
@@ -1435,9 +1435,9 @@ int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type)
void hci_remove_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type)
{
- struct smp_irk *k;
+ struct smp_irk *k, *tmp;
- list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) {
+ list_for_each_entry_safe(k, tmp, &hdev->identity_resolving_keys, list) {
if (bacmp(bdaddr, &k->bdaddr) || k->addr_type != addr_type)
continue;
--
2.34.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* RE: Bluetooth: HCI: fix use-after-free in hci_remove_ltk/hci_remove_irk
2023-05-23 11:56 [PATCH] Bluetooth: HCI: fix use-after-free in hci_remove_ltk/hci_remove_irk Min Li
@ 2023-05-24 2:34 ` bluez.test.bot
0 siblings, 0 replies; 2+ messages in thread
From: bluez.test.bot @ 2023-05-24 2:34 UTC (permalink / raw)
To: linux-bluetooth, lm0963hack
[-- Attachment #1: Type: text/plain, Size: 1424 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=750457
---Test result---
Test Summary:
CheckPatch PASS 0.66 seconds
GitLint PASS 0.26 seconds
SubjectPrefix PASS 0.09 seconds
BuildKernel PASS 41.83 seconds
CheckAllWarning PASS 45.95 seconds
CheckSparse PASS 51.32 seconds
CheckSmatch PASS 139.19 seconds
BuildKernel32 PASS 40.19 seconds
TestRunnerSetup PASS 580.00 seconds
TestRunner_l2cap-tester PASS 20.75 seconds
TestRunner_iso-tester PASS 28.64 seconds
TestRunner_bnep-tester PASS 7.25 seconds
TestRunner_mgmt-tester PASS 140.80 seconds
TestRunner_rfcomm-tester PASS 11.32 seconds
TestRunner_sco-tester PASS 10.43 seconds
TestRunner_ioctl-tester PASS 12.18 seconds
TestRunner_mesh-tester PASS 9.19 seconds
TestRunner_smp-tester PASS 10.39 seconds
TestRunner_userchan-tester PASS 7.73 seconds
IncrementalBuild PASS 38.00 seconds
---
Regards,
Linux Bluetooth
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2023-05-24 2:35 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-05-23 11:56 [PATCH] Bluetooth: HCI: fix use-after-free in hci_remove_ltk/hci_remove_irk Min Li
2023-05-24 2:34 ` bluez.test.bot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).