Received-SPF: pass (google.com: domain of linux-bluetooth+bounces-2311-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
From: Andrei Istodorescu <andrei.istodorescu@nxp.com>
To: linux-bluetooth@vger.kernel.org
Cc: luiz.dentz@gmail.com,
	mihai-octavian.urzica@nxp.com,
	silviu.barbulescu@nxp.com,
	vlad.pruteanu@nxp.com,
	iulia.tanasescu@nxp.com,
	Andrei Istodorescu <andrei.istodorescu@nxp.com>
Subject: [PATCH BlueZ 1/1] shared/shell: Fix heap use after free on exit
Date: Tue,  5 Mar 2024 16:15:21 +0200
Message-Id: <20240305141521.132865-2-andrei.istodorescu@nxp.com>
In-Reply-To: <20240305141521.132865-1-andrei.istodorescu@nxp.com>
References: <20240305141521.132865-1-andrei.istodorescu@nxp.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
	=?us-ascii?Q?uHpRcX9JTLyTlIFCSXlfaqxpfqpNEPXvJ4xN7kGs/JXjcWG1KT9aGryyfKAG?=
 =?us-ascii?Q?m6WKsv7lkmoFjJQFNsN5+E9EAGp34PzjhzxFdolJ6Dpy+3V56Dyy+OQth0Md?=
 =?us-ascii?Q?aGRPjOj2W8oERM1k/BRpx5ESSYYHWAWVg6M78FuigDlB32zWgIJ5MkQIEpCe?=
 =?us-ascii?Q?+ukTBYWWq5RT8SHdQ/eFOEXM1Nv295K9xNd8MGc9lIozoC+Kd71SmhF0x9Om?=
 =?us-ascii?Q?X7VP63TQiJYOuD+tmRaM9vusX1qIWNqtGB++ZrYxKvaRS6In+iDfEjQrLAoL?=
 =?us-ascii?Q?yip/bh+rt7mBzCx9tOTQ1WUBXp7zAYODaTqZhZ+Pw+oyKGUeTOpLYGpRXZ+0?=
 =?us-ascii?Q?MCNIzYBoXZ52yNVaCK7gbawaF3b7el4ZYllYNWjlS1uV6tXpUktU4PIw3Pdp?=
 =?us-ascii?Q?EYOl03DM20xBK6Fj+E3WlzV9V6q7GBk0E91s0nIj4kYwntFOTlvzrgFHuS15?=
 =?us-ascii?Q?jv7vGgQm9EXIvpsgoqRFvdMoEwZX1PuH2zXlbjBbf/JR+578taSH4GJitqCJ?=
 =?us-ascii?Q?Ny7EVuoio+Kta8C+7ZMJT0SJsixlT7OO760EP/Smqq927sEzGnCEWnM1y7fd?=
 =?us-ascii?Q?Qp42bpLSsk4xOZK16Wj7HhGjYo5/zh3RSA9ZpByo6D6wTvO9HNK9EozMAbI3?=
 =?us-ascii?Q?cX4AH++dtJmcfqUL/MeRA1O3qrAhLncfYPOHaklKP1OHLjAJXhz+bAToTGKm?=
 =?us-ascii?Q?fR9zKbHUu8zvK7ylqh47payx66sH9k4zzQhAAGSqHVDUL8eeEw2lTt8DbEWZ?=
 =?us-ascii?Q?cqDL7+m8ARagXtxSVlPMzOixIjLjhxm9VZXmqr5IJ0x8yfPdz0KTJ3BmGWUI?=
 =?us-ascii?Q?bzpSkoUlqLXnI0+EZ7c6mqp0Mp5yvLtDwDncXk4u5GPA9bSAbYdeYED2NndP?=
 =?us-ascii?Q?9TTqsJ+Vr14Of5RQTq5FlA9Be1tYwLQ6cA6lp4U5oNNr+It+rjpXpEVbtQvo?=
 =?us-ascii?Q?72fsAxYcMvQ6YN8H9TayXhIvyShI/dO21oCMVvo8VLcQWUJY3fJHGcHENe10?=
 =?us-ascii?Q?8XAjFHgCTTadfb04iWUsLO3MfyGuOQsV+UCBoD4+fmIz6rtaYsRhrcWXuZ+4?=
 =?us-ascii?Q?TBwxp0IscRRYFwL0Ea6dqxyYJZWh8MONOsKtM+FiOZxAOQek09a3zaomRMov?=
 =?us-ascii?Q?GnYZi+kIdsnZS6K+emhMK8dGj1NmRVfYhe3lyXkC6fsnqRKIclnUwZbZz726?=
 =?us-ascii?Q?eBs2X+b2ukwDakb95hzWaE/cTCKf1rr//t3X8Ayn905/k5x4PqIJLwj45i4p?=
 =?us-ascii?Q?oYErF7s5UImtHhvyEKOxtbj4jBz3Yi2d0wGHYVOUIU/L3pPKpgpklXTu1NcS?=
 =?us-ascii?Q?vT9eN2wDNpk64xRoYv++JLcB8SuDChUVPe8HmxdrZJOBoRIDpnclf2ya/MRz?=
 =?us-ascii?Q?7huzJ/pgqQ4OSmV/GsUJpqgrWfJ0+xFKEqY9DXOuacBQnGiynuhsGX7XhA43?=
 =?us-ascii?Q?B1XxMdDYzs2XtmmyUMfCFPRmbY8yvWopPsj3BD/w0BP3GwlOIihbjoc4T0GE?=
 =?us-ascii?Q?wiZJ7t6GEt0ZMcaVd3CpenzPNZr2fPX9XNVxs0DUnwbTDEnJ3puunbrlgXQx?=
 =?us-ascii?Q?VIUQqC+Xh/IktjBlzAPUW7hXnkDyQVkzLO9D3nUMbVHRlYFK2X2JgD67QBTN?=
 =?us-ascii?Q?Pw=3D=3D?=
X-OriginatorOrg: nxp.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 8884ebda-4aa4-457a-5769-08dc3d1eb535
X-MS-Exchange-CrossTenant-AuthSource: AM9PR04MB8938.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Mar 2024 14:15:27.9246
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: cE89YKBiqqlZnIB977wn/RMJYL28CjEKpTU3iCZXNERs0EFsg0YocHbiW6WciKrWET1JX0bp1O8Kj6aC7UfXbOCyXIqJyvJjye4NBGlcTHs=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR04MB6814

Set the value for data.inputs and data.queue queues to NULL after
freeing, so that further processes won't use already freed memory
---
 src/shared/shell.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/shared/shell.c b/src/shared/shell.c
index 68499b464b69..7bcfcff3ee76 100644
--- a/src/shared/shell.c
+++ b/src/shared/shell.c
@@ -4,7 +4,7 @@
  *  BlueZ - Bluetooth protocol stack for Linux
  *
  *  Copyright (C) 2017  Intel Corporation. All rights reserved.
- *
+ *  Copyright 2024 NXP
  *
  */
 
@@ -1362,7 +1362,9 @@ void bt_shell_cleanup(void)
 	rl_cleanup();
 
 	queue_destroy(data.inputs, NULL);
+	data.inputs = NULL;
 	queue_destroy(data.queue, free);
+	data.queue = NULL;
 	queue_destroy(data.prompts, prompt_free);
 	data.prompts = NULL;
 
-- 
2.40.1