Received-SPF: pass (google.com: domain of linux-bluetooth+bounces-4139-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
Precedence: bulk
MIME-Version: 1.0
References: <20240427051934.879051-1-iam@sung-woo.kim>
In-Reply-To: <20240427051934.879051-1-iam@sung-woo.kim>
From: Sungwoo Kim <iam@sung-woo.kim>
Date: Sat, 27 Apr 2024 23:47:53 -0400
Message-ID: <CAJNyHpJjRoJNUY25MrsAhxdsCVZJVu2AXcstO_t31_xtLWFGJw@mail.gmail.com>
Subject: Re: [PATCH] Bluetooth: msft: fix slab-use-after-free in msft_do_close()
Cc: daveti@purdue.edu, Marcel Holtmann <marcel@holtmann.org>, 
	Johan Hedberg <johan.hedberg@gmail.com>, Luiz Augusto von Dentz <luiz.dentz@gmail.com>, 
	linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hello,

Could you not apply this? I found an error.

On Sat, Apr 27, 2024 at 1:19=E2=80=AFAM Sungwoo Kim <iam@sung-woo.kim> wrot=
e:
>
> +
> +static struct msft_data *msft_data_hold_unless_zero(struct msft_data *ms=
ft)
> +{
> +       BT_DBG("msft %p orig refcnt %u", msft, kref_read(&msft->kref));

Here, msft could be NULL. &msft->kref causes a null-ptr-deref error.
I already sent a v2 patch fixing this.

> +
> +       if (!msft)
> +               return NULL;
> +
> +       if (!kref_get_unless_zero(&msft->kref))
> +               return NULL;
> +
> +       return msft;
> +}
> +

Thanks,
Sungwoo.