From patchwork Thu Feb 2 09:05:10 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sungwoo Kim X-Patchwork-Id: 51811 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:7300:2388:b0:96:219d:e725 with SMTP id i8csp179264dyf; Thu, 2 Feb 2023 01:15:32 -0800 (PST) X-Google-Smtp-Source: AK7set/EYn/lpszMmF/4VnzZRulU5doy0oNO9HmS/+4PBpVItloHLpkkc9QbI6FbMf8Wjml2we7F X-Received: by 2002:a17:90b:e0b:b0:230:3af9:16f with SMTP id ge11-20020a17090b0e0b00b002303af9016fmr1402462pjb.0.1675329332545; Thu, 02 Feb 2023 01:15:32 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1675329332; cv=none; d=google.com; s=arc-20160816; b=0Zj57WA1Snc+Qrh4MhQVsKNIhDc/WpP/+lbrfm19x2ojQ8ncS+SANhe6PFALVWeL3+ nEyQ4Q0vlX79ucFp1jNy4j/DUzeJFKFsamHojqib9HEoru7Fm7bYvH53KseoNsNr6FBZ NGP57I35GQcETU3y2vBDdZFJy502XJLGxF9W4RCLHlXk9zqntE/DXI00p7xQd0mXZC+R /8wEvNpLduJ1EVw8zRl/x3hE3uVygpMWZK7ydRkEuegjkugbjXofjSze8tyZiywip7QS 16dr1b/DMwONQPRA0CRhxe9aGDy9DZa3cHdGLhmIUDLgm+BvgDUL8WoOGX84ewXMGMmF JQBw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from; bh=zIRdF85vz4XW6DcLekDt+urDLZMgRkhDxffDT09XGig=; b=vvE9Ir4rDA+f+h4S4Bk8H18bphkaVjqumcdUJv3Ten2js2kXk6qdMLR+TXeO9/AKpR GXpSk+wcmzLnuJBv2fPZtEb4dAQne4ujqF6dj/3zya7d907BYH7+IGHSU1408GLPzI2K zvlP+00INeLnJXUypb8VJzwWlS1VQ5EKAR/PB0FDxDOrdMIA4w5+B3HVCJRsLRMDUE/i c9ro4POaj04G5RDjT71xd63cTQNo1vPlWVrZWp8XpYrlTB7KDbPZ+j2y5oCaNy6wwM0b mnJj/8thGDxoG+5BwNL/TbKSvW/PYC49TnRDHvzarvVf75qh241ciIC3IpH8cS+BCAcD XTig== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id t69-20020a638148000000b004e5460b2e34si14667624pgd.234.2023.02.02.01.15.20; Thu, 02 Feb 2023 01:15:32 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232386AbjBBJH6 (ORCPT + 99 others); Thu, 2 Feb 2023 04:07:58 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50264 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229602AbjBBJH5 (ORCPT ); Thu, 2 Feb 2023 04:07:57 -0500 Received: from mail-il1-f169.google.com (mail-il1-f169.google.com [209.85.166.169]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D19DC5457E; Thu, 2 Feb 2023 01:07:54 -0800 (PST) Received: by mail-il1-f169.google.com with SMTP id k12so511989ilv.10; Thu, 02 Feb 2023 01:07:54 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=zIRdF85vz4XW6DcLekDt+urDLZMgRkhDxffDT09XGig=; b=v3/AjWBkPGYl8kZF6pnz+36Rs5AN0jHmUCERNFHTjZL+/aGN640pU7HIdm3j734V6i Miy1Tcc3w9MfVzJyV8/iEFWWOO3xGh8EzbALzUYhUhD8VwjAKDMpjNO7O6G52etYmiFn XWuqWZT7/M7y9XWEOHnL5f85f6aOxY7gS5x/L9ypzzBGKMlxH6TTZnIew14Vvdy+PvBs yvkq0SWRG8WidfW1jUh4BSbNmZ4u8CfNNtTTeMPwqaiAURiLEJTzA0qONRvJ5FAer6Mk SKzmpouLyjDAih6P8z3qEctda0plgayGq96lZOtyDWwqsfXqovXFOggjPaCsUGRsEWuQ 5M9w== X-Gm-Message-State: AO0yUKXbzENfXT0UsCFweJ1wnERo9ablNIXCQ83wIvQ2WH5q2P105Q/N +p1KJDq17S7c0R9yalFC0X8= X-Received: by 2002:a92:c56a:0:b0:310:eb55:3856 with SMTP id b10-20020a92c56a000000b00310eb553856mr1376591ilj.9.1675328873930; Thu, 02 Feb 2023 01:07:53 -0800 (PST) Received: from noodle.cs.purdue.edu (switch-lwsn2133-z1r11.cs.purdue.edu. [128.10.127.250]) by smtp.googlemail.com with ESMTPSA id x12-20020a92dc4c000000b003110c59e2easm2060637ilq.37.2023.02.02.01.07.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 02 Feb 2023 01:07:53 -0800 (PST) From: Sungwoo Kim To: happiness.sung.woo@gmail.com Cc: benquike@gmail.com, davem@davemloft.net, daveti@purdue.edu, edumazet@google.com, johan.hedberg@gmail.com, kuba@kernel.org, linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, luiz.dentz@gmail.com, marcel@holtmann.org, netdev@vger.kernel.org, pabeni@redhat.com, wuruoyu@me.com, Sungwoo Kim Subject: [PATCH] Bluetooth: L2CAP: Fix use-after-free Date: Thu, 2 Feb 2023 04:05:10 -0500 Message-Id: <20230202090509.2774062-1-iam@sung-woo.kim> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20230123091708.4112735-1-git@sung-woo.kim> References: <20230123091708.4112735-1-git@sung-woo.kim> MIME-Version: 1.0 X-Spam-Status: No, score=-1.4 required=5.0 tests=BAYES_00, FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM,HEADER_FROM_DIFFERENT_DOMAINS, RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1756710129904282596?= X-GMAIL-MSGID: =?utf-8?q?1756710129904282596?= Due to the race condition between l2cap_sock_cleanup_listen and l2cap_sock_close_cb, l2cap_sock_kill can receive already freed sk, resulting in use-after-free inside l2cap_sock_kill. This patch prevent this by adding a null check in l2cap_sock_kill. Context 1: l2cap_sock_cleanup_listen(); // context switched l2cap_chan_lock(chan); l2cap_sock_kill(sk); // <-- sk is already freed below Context 2: l2cap_chan_timeout(); l2cap_chan_lock(chan); chan->ops->close(chan); l2cap_sock_close_cb() l2cap_sock_kill(sk); // <-- sk is freed here l2cap_chan_unlock(chan); Signed-off-by: Sungwoo Kim --- net/bluetooth/l2cap_sock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c index ca8f07f35..657704059 100644 --- a/net/bluetooth/l2cap_sock.c +++ b/net/bluetooth/l2cap_sock.c @@ -1245,7 +1245,7 @@ static int l2cap_sock_recvmsg(struct socket *sock, struct msghdr *msg, */ static void l2cap_sock_kill(struct sock *sk) { - if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket) + if (!sk || !sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket) return; BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));