From patchwork Sat May 7 15:06:54 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ildar Kamaletdinov X-Patchwork-Id: 571315 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 99A63C433EF for ; Sat, 7 May 2022 15:13:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1385674AbiEGPQr (ORCPT ); Sat, 7 May 2022 11:16:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40898 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241614AbiEGPQq (ORCPT ); Sat, 7 May 2022 11:16:46 -0400 Received: from mxout01.lancloud.ru (mxout01.lancloud.ru [45.84.86.81]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 85B312D1FE for ; Sat, 7 May 2022 08:12:58 -0700 (PDT) Received: from LanCloud DKIM-Filter: OpenDKIM Filter v2.11.0 mxout01.lancloud.ru 8685020CFFC6 Received: from LanCloud Received: from LanCloud Received: from LanCloud From: Ildar Kamaletdinov To: CC: Ildar Kamaletdinov Subject: [PATCH BlueZ 1/4] tools: Fix memory leak in hciconfig Date: Sat, 7 May 2022 18:06:54 +0300 Message-ID: <20220507150657.28240-2-i.kamaletdinov@omp.ru> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220507150657.28240-1-i.kamaletdinov@omp.ru> References: <20220507150657.28240-1-i.kamaletdinov@omp.ru> MIME-Version: 1.0 X-Originating-IP: [192.168.11.198] X-ClientProxiedBy: LFEXT01.lancloud.ru (fd00:f066::141) To LFEX1910.lancloud.ru (fd00:f066::80) Precedence: bulk List-ID: X-Mailing-List: linux-bluetooth@vger.kernel.org printf() was using function that return dynamic allocated memory as a parameter. Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. --- tools/hciconfig.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tools/hciconfig.c b/tools/hciconfig.c index e4d521583..2619285d5 100644 --- a/tools/hciconfig.c +++ b/tools/hciconfig.c @@ -80,7 +80,10 @@ static void print_pkt_type(struct hci_dev_info *di) static void print_link_policy(struct hci_dev_info *di) { - printf("\tLink policy: %s\n", hci_lptostr(di->link_policy)); + char *str; + str = hci_lptostr(di->link_policy); + printf("\tLink policy: %s\n", str); + bt_free(str); } static void print_link_mode(struct hci_dev_info *di) From patchwork Sat May 7 15:06:55 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ildar Kamaletdinov X-Patchwork-Id: 571314 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D44CAC433F5 for ; Sat, 7 May 2022 15:13:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1446588AbiEGPQt (ORCPT ); Sat, 7 May 2022 11:16:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40896 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354601AbiEGPQr (ORCPT ); Sat, 7 May 2022 11:16:47 -0400 Received: from mxout01.lancloud.ru (mxout01.lancloud.ru [45.84.86.81]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 773F12D1FD for ; Sat, 7 May 2022 08:12:58 -0700 (PDT) Received: from LanCloud DKIM-Filter: OpenDKIM Filter v2.11.0 mxout01.lancloud.ru C539920D0FA5 Received: from LanCloud Received: from LanCloud Received: from LanCloud From: Ildar Kamaletdinov To: CC: Ildar Kamaletdinov Subject: [PATCH BlueZ 2/4] tools: Fix memory leaks in btgatt-server/client Date: Sat, 7 May 2022 18:06:55 +0300 Message-ID: <20220507150657.28240-3-i.kamaletdinov@omp.ru> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220507150657.28240-1-i.kamaletdinov@omp.ru> References: <20220507150657.28240-1-i.kamaletdinov@omp.ru> MIME-Version: 1.0 X-Originating-IP: [192.168.11.198] X-ClientProxiedBy: LFEXT01.lancloud.ru (fd00:f066::141) To LFEX1910.lancloud.ru (fd00:f066::80) Precedence: bulk List-ID: X-Mailing-List: linux-bluetooth@vger.kernel.org According to man buffer allocated by getline() should be freed by the user program even if getline() failed. Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. --- tools/btgatt-client.c | 5 ++++- tools/btgatt-server.c | 5 ++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/tools/btgatt-client.c b/tools/btgatt-client.c index 8c9365aa2..9447062fb 100644 --- a/tools/btgatt-client.c +++ b/tools/btgatt-client.c @@ -1355,12 +1355,15 @@ static void prompt_read_cb(int fd, uint32_t events, void *user_data) return; } - if ((read = getline(&line, &len, stdin)) == -1) + if ((read = getline(&line, &len, stdin)) == -1) { + free(line); return; + } if (read <= 1) { cmd_help(cli, NULL); print_prompt(); + free(line); return; } diff --git a/tools/btgatt-server.c b/tools/btgatt-server.c index 4a5d2b720..90a6c9b0a 100644 --- a/tools/btgatt-server.c +++ b/tools/btgatt-server.c @@ -1080,12 +1080,15 @@ static void prompt_read_cb(int fd, uint32_t events, void *user_data) } read = getline(&line, &len, stdin); - if (read < 0) + if (read < 0) { + free(line); return; + } if (read <= 1) { cmd_help(server, NULL); print_prompt(); + free(line); return; } From patchwork Sat May 7 15:06:56 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ildar Kamaletdinov X-Patchwork-Id: 570519 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 70B3CC433FE for ; Sat, 7 May 2022 15:13:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1446581AbiEGPQs (ORCPT ); Sat, 7 May 2022 11:16:48 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40878 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238956AbiEGPQo (ORCPT ); Sat, 7 May 2022 11:16:44 -0400 X-Greylist: delayed 351 seconds by postgrey-1.37 at lindbergh.monkeyblade.net; Sat, 07 May 2022 08:12:56 PDT Received: from mxout02.lancloud.ru (mxout02.lancloud.ru [45.84.86.82]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2A3B32D1F0 for ; Sat, 7 May 2022 08:12:55 -0700 (PDT) Received: from LanCloud DKIM-Filter: OpenDKIM Filter v2.11.0 mxout02.lancloud.ru 1AB132323A66 Received: from LanCloud Received: from LanCloud Received: from LanCloud From: Ildar Kamaletdinov To: CC: Ildar Kamaletdinov Subject: [PATCH BlueZ 3/4] tools: Fix handle leak in rfcomm Date: Sat, 7 May 2022 18:06:56 +0300 Message-ID: <20220507150657.28240-4-i.kamaletdinov@omp.ru> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220507150657.28240-1-i.kamaletdinov@omp.ru> References: <20220507150657.28240-1-i.kamaletdinov@omp.ru> MIME-Version: 1.0 X-Originating-IP: [192.168.11.198] X-ClientProxiedBy: LFEXT01.lancloud.ru (fd00:f066::141) To LFEX1910.lancloud.ru (fd00:f066::80) Precedence: bulk List-ID: X-Mailing-List: linux-bluetooth@vger.kernel.org Some branches of execution can make handle (socket) leakage. Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. --- tools/rfcomm.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tools/rfcomm.c b/tools/rfcomm.c index cd520aa44..e013ff588 100644 --- a/tools/rfcomm.c +++ b/tools/rfcomm.c @@ -298,6 +298,7 @@ static void cmd_connect(int ctl, int dev, bdaddr_t *bdaddr, int argc, char **arg if (setsockopt(sk, SOL_SOCKET, SO_LINGER, &l, sizeof(l)) < 0) { perror("Can't set linger option"); + close(sk); return; } } @@ -466,6 +467,7 @@ static void cmd_listen(int ctl, int dev, bdaddr_t *bdaddr, int argc, char **argv if (getsockname(nsk, (struct sockaddr *)&laddr, &alen) < 0) { perror("Can't get RFCOMM socket name"); close(nsk); + close(sk); return; } @@ -475,6 +477,7 @@ static void cmd_listen(int ctl, int dev, bdaddr_t *bdaddr, int argc, char **argv if (setsockopt(nsk, SOL_SOCKET, SO_LINGER, &l, sizeof(l)) < 0) { perror("Can't set linger option"); close(nsk); + close(sk); return; } } @@ -490,6 +493,7 @@ static void cmd_listen(int ctl, int dev, bdaddr_t *bdaddr, int argc, char **argv dev = ioctl(nsk, RFCOMMCREATEDEV, &req); if (dev < 0) { perror("Can't create RFCOMM TTY"); + close(nsk); close(sk); return; } From patchwork Sat May 7 15:06:57 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ildar Kamaletdinov X-Patchwork-Id: 570520 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5CDB7C433F5 for ; Sat, 7 May 2022 15:07:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1446574AbiEGPLF (ORCPT ); Sat, 7 May 2022 11:11:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36022 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1446607AbiEGPLA (ORCPT ); Sat, 7 May 2022 11:11:00 -0400 Received: from mxout04.lancloud.ru (mxout04.lancloud.ru [45.84.86.114]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7824B25289 for ; Sat, 7 May 2022 08:07:05 -0700 (PDT) Received: from LanCloud DKIM-Filter: OpenDKIM Filter v2.11.0 mxout04.lancloud.ru 5B4B52097CDC Received: from LanCloud Received: from LanCloud Received: from LanCloud From: Ildar Kamaletdinov To: CC: Ildar Kamaletdinov Subject: [PATCH BlueZ 4/4] device: Fix uninitialized value usage Date: Sat, 7 May 2022 18:06:57 +0300 Message-ID: <20220507150657.28240-5-i.kamaletdinov@omp.ru> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220507150657.28240-1-i.kamaletdinov@omp.ru> References: <20220507150657.28240-1-i.kamaletdinov@omp.ru> MIME-Version: 1.0 X-Originating-IP: [192.168.11.198] X-ClientProxiedBy: LFEXT01.lancloud.ru (fd00:f066::141) To LFEX1910.lancloud.ru (fd00:f066::80) Precedence: bulk List-ID: X-Mailing-List: linux-bluetooth@vger.kernel.org Definitely `dbus_bool_t b;` must be initialized before comparing it with current value. Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. --- src/device.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/device.c b/src/device.c index 6da5c380b..7114e1b3e 100644 --- a/src/device.c +++ b/src/device.c @@ -1568,6 +1568,8 @@ static void dev_property_set_wake_allowed(const GDBusPropertyTable *property, return; } + dbus_message_iter_get_basic(value, &b); + /* Emit busy or success depending on current value. */ if (b == device->pending_wake_allowed) { if (device->wake_allowed == device->pending_wake_allowed) @@ -1580,7 +1582,6 @@ static void dev_property_set_wake_allowed(const GDBusPropertyTable *property, return; } - dbus_message_iter_get_basic(value, &b); device_set_wake_override(device, b); device_set_wake_allowed(device, b, id); }