Linux-Bluetooth Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH BlueZ] mesh: Fix double free of a pointer in mesh-io-generic
@ 2019-08-07 20:06 Inga Stotland
  2019-08-08 18:57 ` Gix, Brian
  0 siblings, 1 reply; 2+ messages in thread
From: Inga Stotland @ 2019-08-07 20:06 UTC (permalink / raw)
  To: linux-bluetooth; +Cc: brian.gix, Inga Stotland

This fixes a crash in bluetooth-meshd due to freeing the same pointer
twice. The fix is to initialize the address of freed TX buffer to NULL.
---
 mesh/mesh-io-generic.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/mesh/mesh-io-generic.c b/mesh/mesh-io-generic.c
index 576c5df1b..cc91f494e 100644
--- a/mesh/mesh-io-generic.c
+++ b/mesh/mesh-io-generic.c
@@ -654,8 +654,12 @@ static bool tx_cancel(struct mesh_io *io, const uint8_t *data, uint8_t len)
 			tx = l_queue_remove_if(pvt->tx_pkts, find_by_ad_type,
 							L_UINT_TO_PTR(data[0]));
 			l_free(tx);
+
+			if (tx == pvt->tx)
+				pvt->tx = NULL;
+
 		} while (tx);
-	}  else {
+	} else {
 		struct tx_pattern pattern = {
 			.data = data,
 			.len = len
@@ -665,6 +669,10 @@ static bool tx_cancel(struct mesh_io *io, const uint8_t *data, uint8_t len)
 			tx = l_queue_remove_if(pvt->tx_pkts, find_by_pattern,
 								&pattern);
 			l_free(tx);
+
+			if (tx == pvt->tx)
+				pvt->tx = NULL;
+
 		} while (tx);
 	}
 
-- 
2.21.0


^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: [PATCH BlueZ] mesh: Fix double free of a pointer in mesh-io-generic
  2019-08-07 20:06 [PATCH BlueZ] mesh: Fix double free of a pointer in mesh-io-generic Inga Stotland
@ 2019-08-08 18:57 ` Gix, Brian
  0 siblings, 0 replies; 2+ messages in thread
From: Gix, Brian @ 2019-08-08 18:57 UTC (permalink / raw)
  To: linux-bluetooth, Stotland, Inga

Applied

On Wed, 2019-08-07 at 13:06 -0700, Inga Stotland wrote:
> This fixes a crash in bluetooth-meshd due to freeing the same pointer
> twice. The fix is to initialize the address of freed TX buffer to NULL.
> ---
>  mesh/mesh-io-generic.c | 10 +++++++++-
>  1 file changed, 9 insertions(+), 1 deletion(-)
> 
> diff --git a/mesh/mesh-io-generic.c b/mesh/mesh-io-generic.c
> index 576c5df1b..cc91f494e 100644
> --- a/mesh/mesh-io-generic.c
> +++ b/mesh/mesh-io-generic.c
> @@ -654,8 +654,12 @@ static bool tx_cancel(struct mesh_io *io, const uint8_t *data, uint8_t len)
>  			tx = l_queue_remove_if(pvt->tx_pkts, find_by_ad_type,
>  							L_UINT_TO_PTR(data[0]));
>  			l_free(tx);
> +
> +			if (tx == pvt->tx)
> +				pvt->tx = NULL;
> +
>  		} while (tx);
> -	}  else {
> +	} else {
>  		struct tx_pattern pattern = {
>  			.data = data,
>  			.len = len
> @@ -665,6 +669,10 @@ static bool tx_cancel(struct mesh_io *io, const uint8_t *data, uint8_t len)
>  			tx = l_queue_remove_if(pvt->tx_pkts, find_by_pattern,
>  								&pattern);
>  			l_free(tx);
> +
> +			if (tx == pvt->tx)
> +				pvt->tx = NULL;
> +
>  		} while (tx);
>  	}
>  

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, back to index

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-08-07 20:06 [PATCH BlueZ] mesh: Fix double free of a pointer in mesh-io-generic Inga Stotland
2019-08-08 18:57 ` Gix, Brian

Linux-Bluetooth Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-bluetooth/0 linux-bluetooth/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-bluetooth linux-bluetooth/ https://lore.kernel.org/linux-bluetooth \
		linux-bluetooth@vger.kernel.org linux-bluetooth@archiver.kernel.org
	public-inbox-index linux-bluetooth


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-bluetooth


AGPL code for this site: git clone https://public-inbox.org/ public-inbox