From patchwork Thu May 25 00:04:15 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Zhengping Jiang X-Patchwork-Id: 98731 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:994d:0:b0:3d9:f83d:47d9 with SMTP id k13csp22307vqr; Wed, 24 May 2023 17:49:05 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ6/7f/kiGVSVr6OQdTgVWHo46WhieTjhbZq4+jVrg4p197STbLuQb5ewCnW7R4JUhB2EgJC X-Received: by 2002:a05:6a20:549f:b0:10b:8a3b:1680 with SMTP id i31-20020a056a20549f00b0010b8a3b1680mr14511796pzk.29.1684975744854; Wed, 24 May 2023 17:49:04 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1684975744; cv=none; d=google.com; s=arc-20160816; b=TDyfv6JYP/1SX9c1fcXN1hzwy9x3SgF8W1XGAXkk8i8K06ZECKECgqhoNhIVvcU1ME j/m7lbClu9kyGLA/+M4JVmcM579rzuCNTdNqJx8g5TAat6w7SpRBQrekfFRQMBP/pDoJ ycePkWQYx1CCYALq+tnPIIfpIXk8Vk0vUd1q2rOkbXAXXC1WaGH/RjVgSJwqvGY42fCh Phgj2pb+ztw4kHi/etUiMqLFwcOsrZQNXGuuzTkwFwnPmWMRj+p8uoWuevNW6WYtr3oF yU5cOwKU4uKH3oSx+Lhr5M/jWKVRvGKxXADnwiFoOgTTOCwXARdLF3PF9wU809JBRoDo 7d0Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:cc:to:from:subject:message-id:mime-version:date :dkim-signature; bh=JxmNnYgfaOtAwG3k7PZVh3xrHSOh7px0pgm2Rioiw6o=; b=jg5dkcOuxabxSgbd39xPJVDF4iMCCV4onMfW0XHO6Z9aWjX6xwdLHavhJAbs8vbAoR 47PfuOG9PYsxtBajzvo46QkRR7R9pMGRhA0OLV0AJoGl8R75w5q/U10cMGF+JeymCu44 5C8uhHgoZqejqtA4RIuHQHHfLkv8Rx3JIndJLjwPu/Nbb6yO5OQrtj/DIryz/y6OYpYr c8pY941jmX8Y5lqh0BRA6TGxlgQ8qaOIY2dy9NS9pndkyhbwkiW9WXQquKi4Odp305d4 x7wwYsSKSjQ6+o61od4Umbs2P3M8Kn3KxEL2mp5LnxbSG+W20+Y2K/FVsSINFSHo4plF X9kg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@google.com header.s=20221208 header.b="Zj/fw8nm"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id o28-20020a637e5c000000b00520861f7c0csi1146648pgn.501.2023.05.24.17.48.31; Wed, 24 May 2023 17:49:04 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@google.com header.s=20221208 header.b="Zj/fw8nm"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236001AbjEYAEY (ORCPT + 99 others); Wed, 24 May 2023 20:04:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34986 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229955AbjEYAEX (ORCPT ); Wed, 24 May 2023 20:04:23 -0400 Received: from mail-pl1-x649.google.com (mail-pl1-x649.google.com [IPv6:2607:f8b0:4864:20::649]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 77ACBB3 for ; Wed, 24 May 2023 17:04:22 -0700 (PDT) Received: by mail-pl1-x649.google.com with SMTP id d9443c01a7336-1ae3f6df1afso7973375ad.1 for ; Wed, 24 May 2023 17:04:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20221208; t=1684973062; x=1687565062; h=cc:to:from:subject:message-id:mime-version:date:from:to:cc:subject :date:message-id:reply-to; bh=JxmNnYgfaOtAwG3k7PZVh3xrHSOh7px0pgm2Rioiw6o=; b=Zj/fw8nmn6hoYdeGZf06QX+F1CudDEYVZTfIJKpBptP+hQz+AZfbDSs7kYyL9lhaFA FXHGJ5L0Q9h2//2gGs1HpTjxvAE6PdCxlUoHz/4QXOWjMeAV1rbvHhvbLPiIuJ1YeIFE KHbnV8A6PvqAovc8k8Ow1+C1zdzBh9oFFbirPuZQQHMW2/PFRTtpPSFlztSli9AdsFYw zWLU8dzks5nY9Ls9UASK0kWl0olJjSKCPycJ3LkGw2YTh+So7V7pSa/nWKz+gshuPSHB jn26lgjzx6kWOCz1yUE5C9ERczfnh3iquHaWH9PKXTkPEZVat7p0W/nI8FiQ1KjumdYd a1jA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1684973062; x=1687565062; h=cc:to:from:subject:message-id:mime-version:date:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=JxmNnYgfaOtAwG3k7PZVh3xrHSOh7px0pgm2Rioiw6o=; b=gDqodg9PaLSyP19RJVabNrc4Dl8KsjuxrjDC8NMwnE7LVnsU55Bsa6zVnM2VgJBi5X H+mnGfe2G/y8OwUBjxDcfHzey6ng3hp6HHRWCoj45H7h4KS8382wfVciVAlSjnnR2n+u 3uYt+TE40BdW7aRQvrgnYaVmR4PdkggQ26SqPqwirKIs4vsZfmp7/v8AHbBZHzoeirx3 5RW00LMmRgrmeRcn0WjEYKeXIySazVCPDwKCnlEkXv9JmtafiDBcHDLj7Glke2or2To4 eA/1y/JiwvR45it+F5c4nQiRBK1x1gyNppY5GJ6bDtC2xW3tK8SaH8xr2SZy/LElVGFb w6sg== X-Gm-Message-State: AC+VfDxEasaCgzxJmAMGOTSkQOxLWz8jmdFrMXz69Sn9ghLnevDI5fT1 mMqcD71SefUAjBgxAyfXMW94pNJtHKWy X-Received: from jiangzp-glinux-dev.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:4c52]) (user=jiangzp job=sendgmr) by 2002:a17:902:7587:b0:1ae:5f7e:c115 with SMTP id j7-20020a170902758700b001ae5f7ec115mr4392038pll.11.1684973061937; Wed, 24 May 2023 17:04:21 -0700 (PDT) Date: Wed, 24 May 2023 17:04:15 -0700 Mime-Version: 1.0 X-Mailer: git-send-email 2.40.1.698.g37aff9b760-goog Message-ID: <20230524170415.kernel.v1.1.I575ec21daa35ebba038fe38e164df60b6121c633@changeid> Subject: [kernel PATCH v1] Bluetooth: L2CAP: Fix use-after-free From: Zhengping Jiang To: linux-bluetooth@vger.kernel.org, marcel@holtmann.org, luiz.dentz@gmail.com Cc: chromeos-bluetooth-upstreaming@chromium.org, Zhengping Jiang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Johan Hedberg , Paolo Abeni , linux-kernel@vger.kernel.org, netdev@vger.kernel.org X-Spam-Status: No, score=-9.6 required=5.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE,USER_IN_DEF_DKIM_WL autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1766825126380336287?= X-GMAIL-MSGID: =?utf-8?q?1766825126380336287?= Fix potential use-after-free in l2cap_le_command_rej. Signed-off-by: Zhengping Jiang --- Changes in v1: - Use l2cap_chan_hold_unless_zero to prevent adding refcnt when it is already 0. net/bluetooth/l2cap_core.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 376b523c7b26..19b0b1f7ffed 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -6361,9 +6361,14 @@ static inline int l2cap_le_command_rej(struct l2cap_conn *conn, if (!chan) goto done; + chan = l2cap_chan_hold_unless_zero(chan); + if (!chan) + goto done; + l2cap_chan_lock(chan); l2cap_chan_del(chan, ECONNREFUSED); l2cap_chan_unlock(chan); + l2cap_chan_put(chan); done: mutex_unlock(&conn->chan_lock);