lkml.org 
[lkml]   [2020]   [Sep]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.9 30/90] Bluetooth: prefetch channel before killing sock
    Date
    From: Hillf Danton <hdanton@sina.com>

    [ Upstream commit 2a154903cec20fb64ff4d7d617ca53c16f8fd53a ]

    Prefetch channel before killing sock in order to fix UAF like

    BUG: KASAN: use-after-free in l2cap_sock_release+0x24c/0x290 net/bluetooth/l2cap_sock.c:1212
    Read of size 8 at addr ffff8880944904a0 by task syz-fuzzer/9751

    Reported-by: syzbot+c3c5bdea7863886115dc@syzkaller.appspotmail.com
    Fixes: 6c08fc896b60 ("Bluetooth: Fix refcount use-after-free issue")
    Cc: Manish Mandlik <mmandlik@google.com>
    Signed-off-by: Hillf Danton <hdanton@sina.com>
    Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/bluetooth/l2cap_sock.c | 10 ++++++----
    1 file changed, 6 insertions(+), 4 deletions(-)

    diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
    index 3db8cfebd069a..bbf08c6092f4a 100644
    --- a/net/bluetooth/l2cap_sock.c
    +++ b/net/bluetooth/l2cap_sock.c
    @@ -1189,6 +1189,7 @@ static int l2cap_sock_release(struct socket *sock)
    {
    struct sock *sk = sock->sk;
    int err;
    + struct l2cap_chan *chan;

    BT_DBG("sock %p, sk %p", sock, sk);

    @@ -1198,15 +1199,16 @@ static int l2cap_sock_release(struct socket *sock)
    bt_sock_unlink(&l2cap_sk_list, sk);

    err = l2cap_sock_shutdown(sock, 2);
    + chan = l2cap_pi(sk)->chan;

    - l2cap_chan_hold(l2cap_pi(sk)->chan);
    - l2cap_chan_lock(l2cap_pi(sk)->chan);
    + l2cap_chan_hold(chan);
    + l2cap_chan_lock(chan);

    sock_orphan(sk);
    l2cap_sock_kill(sk);

    - l2cap_chan_unlock(l2cap_pi(sk)->chan);
    - l2cap_chan_put(l2cap_pi(sk)->chan);
    + l2cap_chan_unlock(chan);
    + l2cap_chan_put(chan);

    return err;
    }
    --
    2.25.1
    \
     
     \ /
      Last update: 2020-09-18 04:28    [W:7.568 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site