* [PATCH v3 2/2] Bluetooth: hci_sync: Don't double print name in add/remove adv_monitor
2023-06-30 22:33 [PATCH v3 1/2] Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() Douglas Anderson
@ 2023-06-30 22:33 ` Douglas Anderson
2023-07-05 23:00 ` [PATCH v3 1/2] Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() patchwork-bot+bluetooth
1 sibling, 0 replies; 3+ messages in thread
From: Douglas Anderson @ 2023-06-30 22:33 UTC (permalink / raw)
To: Marcel Holtmann, Johan Hedberg, Luiz Augusto von Dentz
Cc: Stephen Boyd, Douglas Anderson, linux-bluetooth, linux-kernel
The hci_add_adv_monitor() hci_remove_adv_monitor() functions call
bt_dev_dbg() to print some debug statements. The bt_dev_dbg() macro
automatically adds in the device's name. That means that we shouldn't
include the name in the bt_dev_dbg() calls.
Suggested-by: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
---
(no changes since v2)
Changes in v2:
- ("Don't double print name...") new for v2.
net/bluetooth/hci_core.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index dbb2043a9112..de15a2c77e9f 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1949,14 +1949,14 @@ int hci_add_adv_monitor(struct hci_dev *hdev, struct adv_monitor *monitor)
switch (hci_get_adv_monitor_offload_ext(hdev)) {
case HCI_ADV_MONITOR_EXT_NONE:
- bt_dev_dbg(hdev, "%s add monitor %d status %d", hdev->name,
+ bt_dev_dbg(hdev, "add monitor %d status %d",
monitor->handle, status);
/* Message was not forwarded to controller - not an error */
break;
case HCI_ADV_MONITOR_EXT_MSFT:
status = msft_add_monitor_pattern(hdev, monitor);
- bt_dev_dbg(hdev, "%s add monitor %d msft status %d", hdev->name,
+ bt_dev_dbg(hdev, "add monitor %d msft status %d",
monitor->handle, status);
break;
}
@@ -1976,15 +1976,15 @@ static int hci_remove_adv_monitor(struct hci_dev *hdev,
switch (hci_get_adv_monitor_offload_ext(hdev)) {
case HCI_ADV_MONITOR_EXT_NONE: /* also goes here when powered off */
- bt_dev_dbg(hdev, "%s remove monitor %d status %d", hdev->name,
+ bt_dev_dbg(hdev, "remove monitor %d status %d",
monitor->handle, status);
goto free_monitor;
case HCI_ADV_MONITOR_EXT_MSFT:
handle = monitor->handle;
status = msft_remove_monitor(hdev, monitor);
- bt_dev_dbg(hdev, "%s remove monitor %d msft status %d",
- hdev->name, handle, status);
+ bt_dev_dbg(hdev, "remove monitor %d msft status %d",
+ handle, status);
break;
}
--
2.41.0.255.g8b1d071c50-goog
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH v3 1/2] Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor()
2023-06-30 22:33 [PATCH v3 1/2] Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() Douglas Anderson
2023-06-30 22:33 ` [PATCH v3 2/2] Bluetooth: hci_sync: Don't double print name in add/remove adv_monitor Douglas Anderson
@ 2023-07-05 23:00 ` patchwork-bot+bluetooth
1 sibling, 0 replies; 3+ messages in thread
From: patchwork-bot+bluetooth @ 2023-07-05 23:00 UTC (permalink / raw)
To: Doug Anderson
Cc: marcel, johan.hedberg, luiz.dentz, swboyd, mmandlik, mcchou,
linux-bluetooth, linux-kernel
Hello:
This series was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
On Fri, 30 Jun 2023 15:33:14 -0700 you wrote:
> KASAN reports that there's a use-after-free in
> hci_remove_adv_monitor(). Trawling through the disassembly, you can
> see that the complaint is from the access in bt_dev_dbg() under the
> HCI_ADV_MONITOR_EXT_MSFT case. The problem case happens because
> msft_remove_monitor() can end up freeing the monitor
> structure. Specifically:
> hci_remove_adv_monitor() ->
> msft_remove_monitor() ->
> msft_remove_monitor_sync() ->
> msft_le_cancel_monitor_advertisement_cb() ->
> hci_free_adv_monitor()
>
> [...]
Here is the summary with links:
- [v3,1/2] Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor()
https://git.kernel.org/bluetooth/bluetooth-next/c/2648c5eb33ca
- [v3,2/2] Bluetooth: hci_sync: Don't double print name in add/remove adv_monitor
https://git.kernel.org/bluetooth/bluetooth-next/c/22d2055a576d
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 3+ messages in thread