Hi Michael, > A status field in the skb_cb struct was storing a channel status > based on channel suspend/resume events. This stored status was > then used to return EAGAIN if there were packet sending issues > in snd_pkt(). > > The issue is that the skb has been freed by the time the callback > to 6lowpan's suspend/resume was called. So, this generates a > "use after free" issue that was noticed while running kernel tests > with KASAN debug enabled. > > Let's eliminate the status field entirely as we can use the channel > tx_credits to indicate whether we should return EAGAIN when handling > packets. > > Signed-off-by: Michael Scott <michael.sc...@linaro.org> > --- > net/bluetooth/6lowpan.c | 21 +++------------------ > 1 file changed, 3 insertions(+), 18 deletions(-)
patch has been applied to bluetooth-next tree. Regards Marcel
