Skip to contentSkip to conversation

Bluetooth: 6lowpan: use after free in disconnect_devices()

PATCH In review Dan Carpenter 3 participants 3 messages Oct 29, 2014 – Oct 30, 2014

Subsystems (5)
Networking Network drivers Bluetooth drivers Kernel janitors +1 more subsystems
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 Bluetooth: 6lowpan: use after free in disconnect_devices()

This was accidentally changed from list_for_each_entry_safe() to list_for_each_entry() so now it has a use after free bug. I've changed it back.

Fixes 90305829635d ('Bluetooth: 6lowpan: Converting rwlocks to use RCU')
Signed-off-by Dan Carpenter <[email protected]>
net/bluetooth/6lowpan.c +2 -2
index 7254bdd..eef298d 100644
@@ -1383,7 +1383,7 @@ static const struct file_operations lowpan_control_fops = {
 
 static void disconnect_devices(void)
 {
-	struct lowpan_dev *entry, *new_dev;
+	struct lowpan_dev *entry, *tmp, *new_dev;
 	struct list_head devices;
 
 	INIT_LIST_HEAD(&devices);

@@ -1408,7 +1408,7 @@ static void disconnect_devices(void)
 
 	rcu_read_unlock();
 
-	list_for_each_entry(entry, &devices, list) {
+	list_for_each_entry_safe(entry, tmp, &devices, list) {
 		ifdown(entry->netdev);
 		BT_DBG("Unregistering netdev %s %p",
 		       entry->netdev->name, entry->netdev);
Acked-by on v1 1/1
#1 lore raw

Hi Dan,

Quoted 3 lines · Dan Carpenter

This was accidentally changed from list_for_each_entry_safe() to list_for_each_entry() so now it has a use after free bug. I've changed it back.

Good catch! Thanks for the patch.

Acked-by Jukka Rissanen <[email protected]>
Quoted 27 lines
Fixes 90305829635d ('Bluetooth: 6lowpan: Converting rwlocks to use RCU')
Signed-off-by Dan Carpenter <[email protected]>
net/bluetooth/6lowpan.c +2 -3
index 7254bdd..eef298d 100644
@@ -1383,7 +1383,7 @@ static const struct file_operations lowpan_control_fops = {
 
 static void disconnect_devices(void)
 {
-	struct lowpan_dev *entry, *new_dev;
+	struct lowpan_dev *entry, *tmp, *new_dev;
 	struct list_head devices;
 
 	INIT_LIST_HEAD(&devices);

@@ -1408,7 +1408,7 @@ static void disconnect_devices(void)
 
 	rcu_read_unlock();
 
-	list_for_each_entry(entry, &devices, list) {
+	list_for_each_entry_safe(entry, tmp, &devices, list) {
 		ifdown(entry->netdev);
 		BT_DBG("Unregistering netdev %s %p",
 		       entry->netdev->name, entry->netdev);
--
Quoted 3 lines

To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Cheers,
Jukka

maintainer
#2 lore raw
In reply to Dan Carpenter

Hi Dan,

Quoted 6 lines

This was accidentally changed from list_for_each_entry_safe() to list_for_each_entry() so now it has a use after free bug. I've changed it back.

Fixes 90305829635d ('Bluetooth: 6lowpan: Converting rwlocks to use RCU')
Signed-off-by Dan Carpenter <[email protected]>

patch has been applied to bluetooth-next tree.

Regards

Marcel