From: Greg Kroah-Hartman Date: Tue, 26 Nov 2019 08:21:34 +0000 (+0100) Subject: 5.3-stable patches X-Git-Tag: v4.4.204~76 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=8327569d7df8d82ab5772afdd920ebf321e7c31d;p=thirdparty%2Fkernel%2Fstable-queue.git 5.3-stable patches added patches: bluetooth-fix-invalid-free-in-bcsp_close.patch --- diff --git a/queue-5.3/bluetooth-fix-invalid-free-in-bcsp_close.patch b/queue-5.3/bluetooth-fix-invalid-free-in-bcsp_close.patch new file mode 100644 index 00000000000..ee77944cbae --- /dev/null +++ b/queue-5.3/bluetooth-fix-invalid-free-in-bcsp_close.patch @@ -0,0 +1,50 @@ +From cf94da6f502d8caecabd56b194541c873c8a7a3c Mon Sep 17 00:00:00 2001 +From: Tomas Bortoli +Date: Fri, 1 Nov 2019 21:42:44 +0100 +Subject: Bluetooth: Fix invalid-free in bcsp_close() + +From: Tomas Bortoli + +commit cf94da6f502d8caecabd56b194541c873c8a7a3c upstream. + +Syzbot reported an invalid-free that I introduced fixing a memleak. + +bcsp_recv() also frees bcsp->rx_skb but never nullifies its value. +Nullify bcsp->rx_skb every time it is freed. + +Signed-off-by: Tomas Bortoli +Reported-by: syzbot+a0d209a4676664613e76@syzkaller.appspotmail.com +Signed-off-by: Marcel Holtmann +Cc: Alexander Potapenko +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/hci_bcsp.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/bluetooth/hci_bcsp.c ++++ b/drivers/bluetooth/hci_bcsp.c +@@ -591,6 +591,7 @@ static int bcsp_recv(struct hci_uart *hu + if (*ptr == 0xc0) { + BT_ERR("Short BCSP packet"); + kfree_skb(bcsp->rx_skb); ++ bcsp->rx_skb = NULL; + bcsp->rx_state = BCSP_W4_PKT_START; + bcsp->rx_count = 0; + } else +@@ -606,6 +607,7 @@ static int bcsp_recv(struct hci_uart *hu + bcsp->rx_skb->data[2])) != bcsp->rx_skb->data[3]) { + BT_ERR("Error in BCSP hdr checksum"); + kfree_skb(bcsp->rx_skb); ++ bcsp->rx_skb = NULL; + bcsp->rx_state = BCSP_W4_PKT_DELIMITER; + bcsp->rx_count = 0; + continue; +@@ -630,6 +632,7 @@ static int bcsp_recv(struct hci_uart *hu + bscp_get_crc(bcsp)); + + kfree_skb(bcsp->rx_skb); ++ bcsp->rx_skb = NULL; + bcsp->rx_state = BCSP_W4_PKT_DELIMITER; + bcsp->rx_count = 0; + continue; diff --git a/queue-5.3/series b/queue-5.3/series index 0a559fbb40b..1941af8c932 100644 --- a/queue-5.3/series +++ b/queue-5.3/series @@ -34,3 +34,4 @@ drm-amd-powerplay-issue-no-ppsmc_msg_getcurrpkgpwr-on-unsupported-asics.patch drm-i915-don-t-oops-in-dumb_create-ioctl-if-we-have-no-crtcs.patch drm-i915-pmu-frequency-is-reported-as-accumulated-cycles.patch drm-i915-userptr-try-to-acquire-the-page-lock-around-set_page_dirty.patch +bluetooth-fix-invalid-free-in-bcsp_close.patch