From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1757688AbcIVTsu (ORCPT <rfc822;w@1wt.eu>);
        Thu, 22 Sep 2016 15:48:50 -0400
Received: from coyote.holtmann.net ([212.227.132.17]:37713 "EHLO
        mail.holtmann.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1757450AbcIVTss (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Thu, 22 Sep 2016 15:48:48 -0400
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 10.0 \(3226\))
Subject: Re: [PATCH] Bluetooth: btwilink: Save the packet type before sending
From: Marcel Holtmann <marcel@holtmann.org>
In-Reply-To: <1474568442-4810-1-git-send-email-labbott@redhat.com>
Date: Thu, 22 Sep 2016 21:48:43 +0200
Cc: "Gustavo F. Padovan" <gustavo@padovan.org>,
        Johan Hedberg <johan.hedberg@gmail.com>,
        "open list:BLUETOOTH DRIVERS" <linux-bluetooth@vger.kernel.org>,
        LKML <linux-kernel@vger.kernel.org>,
        John Stultz <john.stultz@linaro.org>
Content-Transfer-Encoding: 7bit
Message-Id: <D4615527-A180-477F-A944-3AD8CE082DF9@holtmann.org>
References: <1474568442-4810-1-git-send-email-labbott@redhat.com>
To: Laura Abbott <labbott@redhat.com>
X-Mailer: Apple Mail (2.3226)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Hi Laura,

> Running with KASAN produces some messages:
> 
> BUG: KASAN: use-after-free in ti_st_send_frame+0x9c/0x16c at addr
> ffffffc064868fe8
> Read of size 1 by task kworker/u17:1/1266
> 
> <KASAN output trimmed>
> 
> Hardware name: HiKey Development Board (DT)
> Workqueue: hci0 hci_cmd_work
> Call trace:
> [<ffffffc00008c00c>] dump_backtrace+0x0/0x178
> [<ffffffc00008c1a4>] show_stack+0x20/0x28
> [<ffffffc00067da38>] dump_stack+0xa8/0xe0
> [<ffffffc000288430>] print_trailer+0x110/0x174
> [<ffffffc00028aedc>] object_err+0x4c/0x5c
> [<ffffffc00028f714>] kasan_report_error+0x254/0x54c
> [<ffffffc00028fa70>] kasan_report+0x64/0x70
> [<ffffffc00028eb8c>] __asan_load1+0x4c/0x54
> [<ffffffc000b59b24>] ti_st_send_frame+0x9c/0x16c
> [<ffffffc000ee8dcc>] hci_send_frame+0xb4/0x118
> [<ffffffc000ee8efc>] hci_cmd_work+0xcc/0x154
> [<ffffffc0000f6c48>] process_one_work+0x26c/0x7a4
> [<ffffffc0000f721c>] worker_thread+0x9c/0x73c
> [<ffffffc000100250>] kthread+0x138/0x154
> [<ffffffc000085c50>] ret_from_fork+0x10/0x40
> 
> The packet is being accessed for statistics after it has been freed.
> Save the packet type before sending for statistics afterwards.
> 
> Signed-off-by: Laura Abbott <labbott@redhat.com>
> ---
> Originally found and tested on 4.4 based branch.
> ---
> drivers/bluetooth/btwilink.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)

patch has been applied to bluetooth-next tree.

Regards

Marcel