コミット: 98ed90c94a3f6c18049f19e3a28d2959e8e5423b - system-bt (git)

system/bt

コミットメタ情報

• リビジョン: 98ed90c94a3f6c18049f19e3a28d2959e8e5423b (tree)
• 日時: 2019-02-13 06:10:31
• 作者: Hansong Zhang <hsz@goog...>
• コミッター: JP Sugarbroad

ログメッセージ

DO NOT MERGE btm_proc_smp_cback: Don't access p_dev_rec if freed

In btm_proc_smp_cback(), return after p_dev_rec is freed in the middle
to prevent use after free

Bug: 120612744
Test: Use ASAN build; connect to a LE device and wait for timeout
Change-Id: I09aa1cf1d1c835146b62d0f4989aeedfb885d95b
(cherry picked from commit 74c6d501ce55e7bbce4129fae26bd0b5f802a7fc)

変更サマリ

• modified: stack/btm/btm_ble.c

差分

--- a/stack/btm/btm_ble.c
+++ b/stack/btm/btm_ble.c
@@ -39,6 +39,7 @@
 #include "device/include/controller.h"
 #include "gap_api.h"
 #include "hcimsgs.h"
+#include "log/log.h"
 #include "l2c_int.h"
 #include "osi/include/log.h"
 #include "smp_api.h"
@@ -2090,6 +2091,13 @@ UINT8 btm_proc_smp_cback(tSMP_EVT event, BD_ADDR bd_addr, tSMP_EVT_DATA *p_data)
 
                 if (event == SMP_COMPLT_EVT)
                 {
+                    p_dev_rec = btm_find_dev(bd_addr);
+                    if (p_dev_rec == NULL)
+                    {
+                        BTM_TRACE_ERROR ("%s: p_dev_rec is NULL", __func__);
+                        android_errorWriteLog(0x534e4554, "120612744");
+                        return 0;
+                    }
                     BTM_TRACE_DEBUG ("evt=SMP_COMPLT_EVT before update sec_level=0x%x sec_flags=0x%x", p_data->cmplt.sec_level , p_dev_rec->sec_flags );
 
                     res = (p_data->cmplt.reason == SMP_SUCCESS) ? BTM_SUCCESS : BTM_ERR_PROCESSING;