linux-kernel - Re: [PATCH] Bluetooth: hci_conn: Fix potential memleak in iso_listen

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <5096457b-c62b-08c3-d27b-c34ff9409e5a@huawei.com>
Date:   Wed, 9 Nov 2022 10:13:13 +0800
From:   "Wangshaobo (bobo)" <bobo.shaobowang@...wei.com>
To:     Luiz Augusto von Dentz <luiz.dentz@...il.com>
CC:     <luiz.von.dentz@...el.com>, <pabeni@...hat.com>,
        <liwei391@...wei.com>, <linux-bluetooth@...r.kernel.org>,
        <netdev@...r.kernel.org>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] Bluetooth: hci_conn: Fix potential memleak in
 iso_listen_bis()


在 2022/11/9 7:41, Luiz Augusto von Dentz 写道:
> Hi Wang,
>
> On Tue, Nov 8, 2022 at 3:24 AM Wang ShaoBo <bobo.shaobowang@...wei.com> wrote:
>> When hci_pa_create_sync() failed, hdev should be freed as there
>> was no place to handle its recycling after.
> The patch itself seems fine but the description is misleading since we
> are not freeing the hdev instead we are jus releasing the reference we
> got.
>
>> Fixes: f764a6c2c1e4 ("Bluetooth: ISO: Add broadcast support")
>> Signed-off-by: Wang ShaoBo <bobo.shaobowang@...wei.com>
>> ---
>>   net/bluetooth/iso.c | 3 +++
>>   1 file changed, 3 insertions(+)
>>
>> diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
>> index f825857db6d0..4e3867110dc1 100644
>> --- a/net/bluetooth/iso.c
>> +++ b/net/bluetooth/iso.c
>> @@ -880,6 +880,9 @@ static int iso_listen_bis(struct sock *sk)
>>
>>          hci_dev_unlock(hdev);
>>
>> +       if (err)
>> +               hci_dev_put(hdev);
> Not sure why you are not always calling hci_dev_put?

emm, I would have thought that the reference would be released after 
calling hci_cmd_sync_queue(), but in fact actually not.

-- Wang ShaoBo

>
>>          return err;
>>   }
>>
>> --
>> 2.25.1
>>
>