Re: [PATCH] Bluetooth: btwilink: Save the packet type before sending

[Marcel Holtmann]

Hi Laura,

> Running with KASAN produces some messages:
> 
> BUG: KASAN: use-after-free in ti_st_send_frame+0x9c/0x16c at addr
> ffc064868fe8
> Read of size 1 by task kworker/u17:1/1266
> 
> 
> 
> Hardware name: HiKey Development Board (DT)
> Workqueue: hci0 hci_cmd_work
> Call trace:
> [] dump_backtrace+0x0/0x178
> [] show_stack+0x20/0x28
> [] dump_stack+0xa8/0xe0
> [] print_trailer+0x110/0x174
> [] object_err+0x4c/0x5c
> [] kasan_report_error+0x254/0x54c
> [] kasan_report+0x64/0x70
> [] __asan_load1+0x4c/0x54
> [] ti_st_send_frame+0x9c/0x16c
> [] hci_send_frame+0xb4/0x118
> [] hci_cmd_work+0xcc/0x154
> [] process_one_work+0x26c/0x7a4
> [] worker_thread+0x9c/0x73c
> [] kthread+0x138/0x154
> [] ret_from_fork+0x10/0x40
> 
> The packet is being accessed for statistics after it has been freed.
> Save the packet type before sending for statistics afterwards.
> 
> Signed-off-by: Laura Abbott 
> ---
> Originally found and tested on 4.4 based branch.
> ---
> drivers/bluetooth/btwilink.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)

patch has been applied to bluetooth-next tree.

Regards

Marcel

Re: [PATCH] Bluetooth: btwilink: Save the packet type before sending

[Marcel Holtmann]

Hi Laura,

> Running with KASAN produces some messages:
> 
> BUG: KASAN: use-after-free in ti_st_send_frame+0x9c/0x16c at addr
> ffc064868fe8
> Read of size 1 by task kworker/u17:1/1266
> 
> 
> 
> Hardware name: HiKey Development Board (DT)
> Workqueue: hci0 hci_cmd_work
> Call trace:
> [] dump_backtrace+0x0/0x178
> [] show_stack+0x20/0x28
> [] dump_stack+0xa8/0xe0
> [] print_trailer+0x110/0x174
> [] object_err+0x4c/0x5c
> [] kasan_report_error+0x254/0x54c
> [] kasan_report+0x64/0x70
> [] __asan_load1+0x4c/0x54
> [] ti_st_send_frame+0x9c/0x16c
> [] hci_send_frame+0xb4/0x118
> [] hci_cmd_work+0xcc/0x154
> [] process_one_work+0x26c/0x7a4
> [] worker_thread+0x9c/0x73c
> [] kthread+0x138/0x154
> [] ret_from_fork+0x10/0x40
> 
> The packet is being accessed for statistics after it has been freed.
> Save the packet type before sending for statistics afterwards.
> 
> Signed-off-by: Laura Abbott 
> ---
> Originally found and tested on 4.4 based branch.
> ---
> drivers/bluetooth/btwilink.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)

patch has been applied to bluetooth-next tree.

Regards

Marcel