mbox series

[BlueZ,0/1] plugins/admin: Fix heap-use-after-free when using 2 controllers

Message ID 20230704055643.296260-1-vlad.pruteanu@nxp.com (mailing list archive)
Headers show
Series plugins/admin: Fix heap-use-after-free when using 2 controllers | expand

Message

Vlad Pruteanu July 4, 2023, 5:56 a.m. UTC 
This commit fixes the heap-use-after-free error when connecting 2
controllers. When a controller is connected
admin_policy_adapter_probe is called. If policy_data was already
allocated it gets freed, if not, it only gets allocated. Eventually
add_interface is called. Here policy_data is put in the "data" variable
(specific for each controller) and the process_changes task is called
with idle priority. This function ultimately accesses policy_data from
the "data" variable.

When Bluez crashes the flow is:
1)first controller is attached
2)admin_policy_adapter_probe is called and policy_data is allocated
4)second controller is attached
5)admin_policy_adapter_probe is called and policy_data is freed, then
allocated again
6)process_changes runs and the policy_data for the first controller is
read, but it was already freed, thus the crash

Vlad Pruteanu (1):
  plugins/admin.c: Fix heap-use-after-free error when connecting 2
    controllers

 plugins/admin.c | 1 -
 1 file changed, 1 deletion(-)

Comments

patchwork-bot+bluetooth@kernel.org July 5, 2023, 6 p.m. UTC | #1 
Hello:

This patch was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Tue,  4 Jul 2023 08:56:42 +0300 you wrote:
> This commit fixes the heap-use-after-free error when connecting 2
> controllers. When a controller is connected
> admin_policy_adapter_probe is called. If policy_data was already
> allocated it gets freed, if not, it only gets allocated. Eventually
> add_interface is called. Here policy_data is put in the "data" variable
> (specific for each controller) and the process_changes task is called
> with idle priority. This function ultimately accesses policy_data from
> the "data" variable.
> 
> [...]

Here is the summary with links:
  - [BlueZ,1/1] plugins/admin: Fix heap-use-after-free when using 2 controllers
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=b74146068892

You are awesome, thank you!