All of lore.kernel.org
 help / color / mirror / Atom feed
From: Anmol Karn <anmol.karan123@gmail.com>
To: marcel@holtmann.org, johan.hedberg@gmail.com
Cc: linux-kernel-mentees@lists.linuxfoundation.org,
	linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com,
	netdev@vger.kernel.org, linux-bluetooth@vger.kernel.org,
	kuba@kernel.org, davem@davemloft.net, anmol.karan123@gmail.com,
	syzbot+0bef568258653cff272f@syzkaller.appspotmail.com
Subject: [Linux-kernel-mentees] [PATCH] net: bluetooth: Fix null pointer deref in hci_phy_link_complete_evt
Date: Sat, 29 Aug 2020 18:11:12 +0530	[thread overview]
Message-ID: <20200829124112.227133-1-anmol.karan123@gmail.com> (raw)

Fix null pointer deref in hci_phy_link_complete_evt, there was no checking there for
the hcon->amp_mgr->l2cap_conn->hconn, and also in hci_cmd_work, for
hdev->sent_cmd. 

To fix this issue Add pointer checking in hci_cmd_work and
hci_phy_link_complete_evt.
[Linux-next-20200827]

Reported-by: syzbot+0bef568258653cff272f@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?id=0d93140da5a82305a66a136af99b088b75177b99
Signed-off-by: Anmol Karn <anmol.karan123@gmail.com>
---
 net/bluetooth/hci_core.c  | 4 ++++
 net/bluetooth/hci_event.c | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 68bfe57b6625..533048d2a624 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -4922,6 +4922,10 @@ static void hci_cmd_work(struct work_struct *work)
 
 		kfree_skb(hdev->sent_cmd);
 
+		if(hdev->sent_cmd) {
+			hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
+		}
+
 		hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
 		if (hdev->sent_cmd) {
 			if (hci_req_status_pend(hdev))
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 4b7fc430793c..c621c8a20ea4 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -4941,6 +4941,10 @@ static void hci_phy_link_complete_evt(struct hci_dev *hdev,
 		hci_dev_unlock(hdev);
 		return;
 	}
+	if(!(hcon->amp_mgr->l2cap_conn->hcon)) {
+		hci_dev_unlock(hdev);
+		return;
+	}
 
 	bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
 
-- 
2.28.0


WARNING: multiple messages have this Message-ID (diff)
From: Anmol Karn <anmol.karan123@gmail.com>
To: marcel@holtmann.org, johan.hedberg@gmail.com
Cc: netdev@vger.kernel.org,
	syzbot+0bef568258653cff272f@syzkaller.appspotmail.com,
	syzkaller-bugs@googlegroups.com, linux-kernel@vger.kernel.org,
	linux-bluetooth@vger.kernel.org, kuba@kernel.org,
	linux-kernel-mentees@lists.linuxfoundation.org,
	davem@davemloft.net
Subject: [Linux-kernel-mentees] [PATCH] net: bluetooth: Fix null pointer deref in hci_phy_link_complete_evt
Date: Sat, 29 Aug 2020 18:11:12 +0530	[thread overview]
Message-ID: <20200829124112.227133-1-anmol.karan123@gmail.com> (raw)

Fix null pointer deref in hci_phy_link_complete_evt, there was no checking there for
the hcon->amp_mgr->l2cap_conn->hconn, and also in hci_cmd_work, for
hdev->sent_cmd. 

To fix this issue Add pointer checking in hci_cmd_work and
hci_phy_link_complete_evt.
[Linux-next-20200827]

Reported-by: syzbot+0bef568258653cff272f@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?id=0d93140da5a82305a66a136af99b088b75177b99
Signed-off-by: Anmol Karn <anmol.karan123@gmail.com>
---
 net/bluetooth/hci_core.c  | 4 ++++
 net/bluetooth/hci_event.c | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 68bfe57b6625..533048d2a624 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -4922,6 +4922,10 @@ static void hci_cmd_work(struct work_struct *work)
 
 		kfree_skb(hdev->sent_cmd);
 
+		if(hdev->sent_cmd) {
+			hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
+		}
+
 		hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
 		if (hdev->sent_cmd) {
 			if (hci_req_status_pend(hdev))
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 4b7fc430793c..c621c8a20ea4 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -4941,6 +4941,10 @@ static void hci_phy_link_complete_evt(struct hci_dev *hdev,
 		hci_dev_unlock(hdev);
 		return;
 	}
+	if(!(hcon->amp_mgr->l2cap_conn->hcon)) {
+		hci_dev_unlock(hdev);
+		return;
+	}
 
 	bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
 
-- 
2.28.0

_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees

             reply	other threads:[~2020-08-29 12:41 UTC|newest]

Thread overview: 14+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-08-29 12:41 Anmol Karn [this message]
2020-08-29 12:41 ` [Linux-kernel-mentees] [PATCH] net: bluetooth: Fix null pointer deref in hci_phy_link_complete_evt Anmol Karn
2020-08-29 16:57 ` Anmol Karn
2020-08-29 16:57   ` Anmol Karn
2020-08-30  9:18   ` Greg KH
2020-08-30  9:18     ` Greg KH
2020-08-30  9:19   ` Greg KH
2020-08-30  9:19     ` Greg KH
2020-08-30 12:26     ` Anmol Karn
2020-08-30 12:26       ` Anmol Karn
2020-08-30 17:30       ` Greg KH
2020-08-30 17:30         ` Greg KH
2020-08-30 20:42         ` Anmol Karn
2020-08-30 20:42           ` Anmol Karn

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200829124112.227133-1-anmol.karan123@gmail.com \
    --to=anmol.karan123@gmail.com \
    --cc=davem@davemloft.net \
    --cc=johan.hedberg@gmail.com \
    --cc=kuba@kernel.org \
    --cc=linux-bluetooth@vger.kernel.org \
    --cc=linux-kernel-mentees@lists.linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=marcel@holtmann.org \
    --cc=netdev@vger.kernel.org \
    --cc=syzbot+0bef568258653cff272f@syzkaller.appspotmail.com \
    --cc=syzkaller-bugs@googlegroups.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.