OpenE2K
/
linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Bluetooth: prefetch channel before killing sock 

[ Upstream commit 2a154903ce ]

Prefetch channel before killing sock in order to fix UAF like

 BUG: KASAN: use-after-free in l2cap_sock_release+0x24c/0x290 net/bluetooth/l2cap_sock.c:1212
 Read of size 8 at addr ffff8880944904a0 by task syz-fuzzer/9751

Reported-by: syzbot+c3c5bdea7863886115dc@syzkaller.appspotmail.com
Fixes: 6c08fc896b ("Bluetooth: Fix refcount use-after-free issue")
Cc: Manish Mandlik <mmandlik@google.com>
Signed-off-by: Hillf Danton <hdanton@sina.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Hillf Danton 2020-02-05 10:31:59 +08:00 committed by Greg Kroah-Hartman
parent 4c67f0b1ea
commit 54d9839877
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
net/bluetooth/l2cap_sock.c
View File

@ -1193,6 +1193,7 @@ static int l2cap_sock_release(struct socket *sock)
{
struct sock *sk = sock->sk;
int err;
struct l2cap_chan *chan;
BT_DBG("sock %p, sk %p", sock, sk);
@ -1202,15 +1203,16 @@ static int l2cap_sock_release(struct socket *sock)
bt_sock_unlink(&l2cap_sk_list, sk);
err = l2cap_sock_shutdown(sock, 2);
chan = l2cap_pi(sk)->chan;
l2cap_chan_hold(l2cap_pi(sk)->chan);
l2cap_chan_lock(l2cap_pi(sk)->chan);
l2cap_chan_hold(chan);
l2cap_chan_lock(chan);
sock_orphan(sk);
l2cap_sock_kill(sk);
l2cap_chan_unlock(l2cap_pi(sk)->chan);
l2cap_chan_put(l2cap_pi(sk)->chan);
l2cap_chan_unlock(chan);
l2cap_chan_put(chan);
return err;
}