lkml.org 
[lkml]   [2022]   [Oct]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 6.0 723/862] Bluetooth: L2CAP: Fix user-after-free
    Date
    From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

    [ Upstream commit 35fcbc4243aad7e7d020b7c1dfb14bb888b20a4f ]

    This uses l2cap_chan_hold_unless_zero() after calling
    __l2cap_get_chan_blah() to prevent the following trace:

    Bluetooth: l2cap_core.c:static void l2cap_chan_destroy(struct kref
    *kref)
    Bluetooth: chan 0000000023c4974d
    Bluetooth: parent 00000000ae861c08
    ==================================================================
    BUG: KASAN: use-after-free in __mutex_waiter_is_first
    kernel/locking/mutex.c:191 [inline]
    BUG: KASAN: use-after-free in __mutex_lock_common
    kernel/locking/mutex.c:671 [inline]
    BUG: KASAN: use-after-free in __mutex_lock+0x278/0x400
    kernel/locking/mutex.c:729
    Read of size 8 at addr ffff888006a49b08 by task kworker/u3:2/389

    Link: https://lore.kernel.org/lkml/20220622082716.478486-1-lee.jones@linaro.org
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
    Signed-off-by: Sungwoo Kim <iam@sung-woo.kim>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/bluetooth/l2cap_core.c | 7 +++++++
    1 file changed, 7 insertions(+)

    diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
    index 770891f68703..1f34b82ca0ec 100644
    --- a/net/bluetooth/l2cap_core.c
    +++ b/net/bluetooth/l2cap_core.c
    @@ -4309,6 +4309,12 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
    }
    }

    + chan = l2cap_chan_hold_unless_zero(chan);
    + if (!chan) {
    + err = -EBADSLT;
    + goto unlock;
    + }
    +
    err = 0;

    l2cap_chan_lock(chan);
    @@ -4338,6 +4344,7 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
    }

    l2cap_chan_unlock(chan);
    + l2cap_chan_put(chan);

    unlock:
    mutex_unlock(&conn->chan_lock);
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-10-19 11:32    [W:4.045 / U:0.092 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site