Commit: b741460688925448807c7532fe96182e4d32ec42
Parent: f9557931ad361e08f1f1537ea670fedd1dd0138d
Author: Vlad Pruteanu <vlad.pruteanu@nxp.com>
Committer: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: 2023-07-05 20:48:31
Tree: 9eb81eb099b162068ead2786e296f75b9aaf778b

plugins/admin: Fix heap-use-after-free when using 2 controllers This commit fixes the heap-use-after-free error when connecting 2 controllers. When a controller is connected admin_policy_adapter_probe is called. If policy_data was already allocated it gets freed, if not, it only gets allocated. Eventually add_interface is called. Here policy_data is put in the "data" variable (specific for each controller) and the process_changes task is called with idle priority. This function ultimately accesses policy_data from the "data" variable. When Bluez crashes the flow is: 1)first controller is attached 2)admin_policy_adapter_probe is called and policy_data is allocated 4)second controller is attached 5)admin_policy_adapter_probe is called and policy_data is freed, then allocated again 6)process_changes runs and the policy_data for the first controller is read, but it was already freed, thus the crash

Diffstat

M plugins/admin.c | 1 -

1 files changed, 0 insertions(+), 1 deletions(-)

View Full Diff | Patch