On Tue, Nov 26, 2019 at 07:18:46AM +0100, Marcel Holtmann wrote: > Hi Alexander, > > >>> Syzbot reported an invalid-free that I introduced fixing a memleak. > >>> > >>> bcsp_recv() also frees bcsp->rx_skb but never nullifies its value. > >>> Nullify bcsp->rx_skb every time it is freed. > >>> > >>> Signed-off-by: Tomas Bortoli <tomasbortoli@xxxxxxxxx> > >>> Reported-by: syzbot+a0d209a4676664613e76@xxxxxxxxxxxxxxxxxxxxxxxxx > >>> --- > >>> drivers/bluetooth/hci_bcsp.c | 3 +++ > >>> 1 file changed, 3 insertions(+) > >> > >> patch has been applied to bluetooth-next tree. > > I believe this bug requires stable tags, as it can potentially provide > > an arbitrary write (via __skb_unlink) and is triggerable locally with > > user privileges. > > I do not have a reproducer for it, but if you do, feel free to propose it for -stable inclusion. Now queued up, thanks. greg k-h
