Received-SPF: pass (google.com: domain of linux-bluetooth+bounces-4830-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
From: "K, Kiran" <kiran.k@intel.com>
To: Su Hui <suhui@nfschina.com>, "marcel@holtmann.org" <marcel@holtmann.org>,
	"luiz.dentz@gmail.com" <luiz.dentz@gmail.com>, "nathan@kernel.org"
	<nathan@kernel.org>, "ndesaulniers@google.com" <ndesaulniers@google.com>,
	"morbo@google.com" <morbo@google.com>, "justinstitt@google.com"
	<justinstitt@google.com>
CC: "seema.sreemantha@intel.com" <seema.sreemantha@intel.com>,
	"linux-bluetooth@vger.kernel.org" <linux-bluetooth@vger.kernel.org>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	"llvm@lists.linux.dev" <llvm@lists.linux.dev>,
	"kernel-janitors@vger.kernel.org" <kernel-janitors@vger.kernel.org>
Subject: RE: [PATCH 2/2]  Bluetooth: btintel: fix use after free problem in
 btintel_ppag_callback()
Thread-Topic: [PATCH 2/2]  Bluetooth: btintel: fix use after free problem in
 btintel_ppag_callback()
Thread-Index: AQHaqlvaj+o7AieD+kykBUFft0mKDLGg045w
Date: Tue, 21 May 2024 00:19:56 +0000
Message-ID: <PH0PR11MB7585ADB11BA022103C6394EFF5EA2@PH0PR11MB7585.namprd11.prod.outlook.com>
References: <20240520021625.110430-1-suhui@nfschina.com>
 <20240520021625.110430-2-suhui@nfschina.com>
In-Reply-To: <20240520021625.110430-2-suhui@nfschina.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?I0rNb7Rkd4uMO9O47f3EXpKlmaiis2T00x3KSQSRNsR2kI5GmoAg1gKzjI2C?=
 =?us-ascii?Q?wkD9r4QYeNUAfl/j4D9wtluRftjnn1Mbu6lsRjFHyBrKQcIi8H+P8+TF6MBV?=
 =?us-ascii?Q?n3MgNbkkJrKmeHKybik7ltb/ovI/RxIPBVpM8PyMAXS47qiQIvJK9qW3n3co?=
 =?us-ascii?Q?Znc9m9dL583qgf5Hwt0M2so7mwWO9IDrg9B/2FPXPF5CcJe2DtAXC25zmlph?=
 =?us-ascii?Q?Fit9LetKcBOwMkg49JmI1e62ZQKCuXRTO/E2s84mBAxZjCC+OoKM3qS8+AGF?=
 =?us-ascii?Q?V6g8G+hkUhnaWSzqdDE7pCuxlCqDZsD6pvlqoY7tA3MuVc4M9WtNuwmqKSw3?=
 =?us-ascii?Q?4LHplgTqnsVYiuiAOCYZw6Gx6lra01G0QKtXE5h1BT8b7CciFCmG6Th40NYL?=
 =?us-ascii?Q?3xiITu6vgMU+5fy2LvR0CRkERp+bpFkOS3oSz8KE+A1OPcq2Y/Au2oIPm0gp?=
 =?us-ascii?Q?kwX9q2y9IaNjHfJbAoZ2QO1mvoPNCW6MCSfSZMgunSo1o29rSFOVxB534lZT?=
 =?us-ascii?Q?BVDaBRdrfFS8QPObyWWZjeDVLuAqzmv5yXxg88rOLV/RNB64znZKSMsF/Q0w?=
 =?us-ascii?Q?hjDUTq3ehMq0+bXCKTJ11EwrKRXzjzH4Dpc131sNpiYu2FMtPtRQ3NiHzfiA?=
 =?us-ascii?Q?2MQz6dIdQyQCkaaiP04eiCIcG0vfrYLJtqQZS//G3pH70hCKQrAl3Zde5ze7?=
 =?us-ascii?Q?BbWO19SVoA8TZf7rP9EOD2pn0NEGCZ5lzh0uOaV3XeQYQGZBlSpd1Ub48Jit?=
 =?us-ascii?Q?v6wxd+1LJHfV/RWE2fXWs/IN8KptezLF/jbHNptahuFivcrIZdl1B8kiT2+Y?=
 =?us-ascii?Q?lfH0JnJMRbBW2fv3Cy3HQFPvZqiohlefH/ihycmEVpnES2igUHiaatM3Je5P?=
 =?us-ascii?Q?bIS6mrKzOi2L0LorQQuxs0wlYHqNtZ9jxs3U26GYMMWUW57QJAw5yKB87WZy?=
 =?us-ascii?Q?lihEc/d227velg/YhtH4NIt8iS0qRBeMqyuuueYLpes2eSZ0d/W46e0S1TNM?=
 =?us-ascii?Q?rlVSp/aPAjUzOvgd4RhoFUjKXREvS0XfRbMyptYnidAhV59KhEDAqH5IWeYM?=
 =?us-ascii?Q?X6myFdujFftZIK1PyDx88PFrqJtofMffCOAGUbKTvjVLnRNJ4sNtXmY4/BVR?=
 =?us-ascii?Q?2EjPg9pluPMZAAxAvvjGid+n5HBH0IKTvHdLj3UxepGi5PLVb/9Eq59dewPc?=
 =?us-ascii?Q?XVnsm5fypxDppav8r+6fjUg++KGkaa5fCHZWwZzr+xGyi9uocCyDb++tKGT6?=
 =?us-ascii?Q?lV8szmy+Covlodkxu3ntTv4Zijflctx+gYT95SlCerWMSQR+9ijSRv7SqXP4?=
 =?us-ascii?Q?V6Ayhc6VyuoTBu97r/zYjcAr6uqICF4E+Kk3b+WJi8fXQexFfdXRbQUn4KsV?=
 =?us-ascii?Q?7yTnx60xmob2rgDTeeczacmiQyXrD1MCeHEtJnukZNcCguKKBVSCTYUrRHVJ?=
 =?us-ascii?Q?OCXrtT9pUbA5nSYr8jE1X2VHosHoyHF00bCQV1/lC/IgX+/U5KqqbJSobTT2?=
 =?us-ascii?Q?szzGlKsJLod/VHVARVyxxvHzVaGDFOG81a/bqsEhCLvaELtnoLf/xMjBXddV?=
 =?us-ascii?Q?U/3upU4A1gD7vHGBwzk=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk
X-Mailing-List: linux-bluetooth@vger.kernel.org
List-Id: <linux-bluetooth.vger.kernel.org>
List-Subscribe: <mailto:linux-bluetooth+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:linux-bluetooth+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: PH0PR11MB7585.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: a0039e4b-08b1-4275-4ea4-08dc792bbe65
X-MS-Exchange-CrossTenant-originalarrivaltime: 21 May 2024 00:19:56.4172
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: kIdORdhL41/dPm36AmnbeLaXPE+zKdQTWedrL3plmY+IwM7+5J6CPZDnfQ57FPteTIs8GQbs9YJQM+G237InVA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN7PR11MB6969
X-OriginatorOrg: intel.com

Hi Su Hui,

Thanks for your patch. 'btintel_ppag_callback' has been removed as part of =
287da9035b2e.

>-----Original Message-----
>From: Su Hui <suhui@nfschina.com>
>Sent: Monday, May 20, 2024 7:46 AM
>To: marcel@holtmann.org; luiz.dentz@gmail.com; nathan@kernel.org;
>ndesaulniers@google.com; morbo@google.com; justinstitt@google.com
>Cc: Su Hui <suhui@nfschina.com>; K, Kiran <kiran.k@intel.com>;
>seema.sreemantha@intel.com; linux-bluetooth@vger.kernel.org; linux-
>kernel@vger.kernel.org; llvm@lists.linux.dev; kernel-janitors@vger.kernel.=
org
>Subject: [PATCH 2/2] Bluetooth: btintel: fix use after free problem in
>btintel_ppag_callback()
>
>Clang static checker(scan-build) warning:
>drivers/bluetooth/btintel.c:1369:8: Use of memory after it is freed.
>
>'p' is equal to 'buffer.pointer', using of 'p->type' after releasing 'buff=
er.pointer'
>causes this use after free problem.
>Change the order of releasing buffer.pointer to fix this problem.
>
>Fixes: c585a92b2f9c ("Bluetooth: btintel: Set Per Platform Antenna
>Gain(PPAG)")
>Signed-off-by: Su Hui <suhui@nfschina.com>
>---
> drivers/bluetooth/btintel.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c ind=
ex
>f1c101dc0c28..d94a8ccd1428 100644
>--- a/drivers/bluetooth/btintel.c
>+++ b/drivers/bluetooth/btintel.c
>@@ -1364,9 +1364,9 @@ static acpi_status btintel_ppag_callback(acpi_handle
>handle, u32 lvl, void *data
> 	ppag =3D (struct btintel_ppag *)data;
>
> 	if (p->type !=3D ACPI_TYPE_PACKAGE || p->package.count !=3D 2) {
>-		kfree(buffer.pointer);
> 		bt_dev_warn(hdev, "PPAG-BT: Invalid object type: %d or
>package count: %d",
> 			    p->type, p->package.count);
>+		kfree(buffer.pointer);
> 		ppag->status =3D AE_ERROR;
> 		return AE_ERROR;
> 	}
>--
>2.30.2

Thanks,
Kiran