Wang ShaoBo c10465f6d6 Bluetooth: fix use-after-free error in lock_sock_nested() ... [ Upstream commit 1bff51ea59 ] use-after-free error in lock_sock_nested is reported: [ 179.140137][ T3731] ===================================================== [ 179.142675][ T3731] BUG: KMSAN: use-after-free in lock_sock_nested+0x280/0x2c0 [ 179.145494][ T3731] CPU: 4 PID: 3731 Comm: kworker/4:2 Not tainted 5.12.0-rc6+ #54 [ 179.148432][ T3731] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 [ 179.151806][ T3731] Workqueue: events l2cap_chan_timeout [ 179.152730][ T3731] Call Trace: [ 179.153301][ T3731] dump_stack+0x24c/0x2e0 [ 179.154063][ T3731] kmsan_report+0xfb/0x1e0 [ 179.154855][ T3731] __msan_warning+0x5c/0xa0 [ 179.155579][ T3731] lock_sock_nested+0x280/0x2c0 [ 179.156436][ T3731] ? kmsan_get_metadata+0x116/0x180 [ 179.157257][ T3731] l2cap_sock_teardown_cb+0xb8/0x890 [ 179.158154][ T3731] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 179.159141][ T3731] ? kmsan_get_metadata+0x116/0x180 [ 179.159994][ T3731] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 179.160959][ T3731] ? l2cap_sock_recv_cb+0x420/0x420 [ 179.161834][ T3731] l2cap_chan_del+0x3e1/0x1d50 [ 179.162608][ T3731] ? kmsan_get_metadata+0x116/0x180 [ 179.163435][ T3731] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 179.164406][ T3731] l2cap_chan_close+0xeea/0x1050 [ 179.165189][ T3731] ? kmsan_internal_unpoison_shadow+0x42/0x70 [ 179.166180][ T3731] l2cap_chan_timeout+0x1da/0x590 [ 179.167066][ T3731] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 179.168023][ T3731] ? l2cap_chan_create+0x560/0x560 [ 179.168818][ T3731] process_one_work+0x121d/0x1ff0 [ 179.169598][ T3731] worker_thread+0x121b/0x2370 [ 179.170346][ T3731] kthread+0x4ef/0x610 [ 179.171010][ T3731] ? process_one_work+0x1ff0/0x1ff0 [ 179.171828][ T3731] ? kthread_blkcg+0x110/0x110 [ 179.172587][ T3731] ret_from_fork+0x1f/0x30 [ 179.173348][ T3731] [ 179.173752][ T3731] Uninit was created at: [ 179.174409][ T3731] kmsan_internal_poison_shadow+0x5c/0xf0 [ 179.175373][ T3731] kmsan_slab_free+0x76/0xc0 [ 179.176060][ T3731] kfree+0x3a5/0x1180 [ 179.176664][ T3731] __sk_destruct+0x8af/0xb80 [ 179.177375][ T3731] __sk_free+0x812/0x8c0 [ 179.178032][ T3731] sk_free+0x97/0x130 [ 179.178686][ T3731] l2cap_sock_release+0x3d5/0x4d0 [ 179.179457][ T3731] sock_close+0x150/0x450 [ 179.180117][ T3731] __fput+0x6bd/0xf00 [ 179.180787][ T3731] ____fput+0x37/0x40 [ 179.181481][ T3731] task_work_run+0x140/0x280 [ 179.182219][ T3731] do_exit+0xe51/0x3e60 [ 179.182930][ T3731] do_group_exit+0x20e/0x450 [ 179.183656][ T3731] get_signal+0x2dfb/0x38f0 [ 179.184344][ T3731] arch_do_signal_or_restart+0xaa/0xe10 [ 179.185266][ T3731] exit_to_user_mode_prepare+0x2d2/0x560 [ 179.186136][ T3731] syscall_exit_to_user_mode+0x35/0x60 [ 179.186984][ T3731] do_syscall_64+0xc5/0x140 [ 179.187681][ T3731] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 179.188604][ T3731] ===================================================== In our case, there are two Thread A and B: Context: Thread A: Context: Thread B: l2cap_chan_timeout() __se_sys_shutdown() l2cap_chan_close() l2cap_sock_shutdown() l2cap_chan_del() l2cap_chan_close() l2cap_sock_teardown_cb() l2cap_sock_teardown_cb() Once l2cap_sock_teardown_cb() excuted, this sock will be marked as SOCK_ZAPPED, and can be treated as killable in l2cap_sock_kill() if sock_orphan() has excuted, at this time we close sock through sock_close() which end to call l2cap_sock_kill() like Thread C: Context: Thread C: sock_close() l2cap_sock_release() sock_orphan() l2cap_sock_kill() #free sock if refcnt is 1 If C completed, Once A or B reaches l2cap_sock_teardown_cb() again, use-after-free happened. We should set chan->data to NULL if sock is destructed, for telling teardown operation is not allowed in l2cap_sock_teardown_cb(), and also we should avoid killing an already killed socket in l2cap_sock_close_cb(). Signed-off-by: Wang ShaoBo <bobo.shaobowang@huawei.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2021-11-18 14:03:52 +01:00
..
6lowpan	6lowpan: iphc: Fix an off-by-one check of array index	2021-09-15 09:50:34 +02:00
9p	9p/trans_virtio: Remove sysfs file on probe failure	2021-09-26 14:08:57 +02:00
802	net/802/garp: fix memleak in garp_request_join()	2021-07-31 08:16:11 +02:00
8021q	net: vlan: avoid leaks on register_vlan_dev() failures	2021-01-17 14:16:55 +01:00
appletalk	appletalk: Fix skb allocation size in loopback case	2021-04-07 15:00:08 +02:00
atm
ax25
batman-adv	net: batman-adv: fix error handling	2021-11-02 19:48:22 +01:00
bluetooth	Bluetooth: fix use-after-free error in lock_sock_nested()	2021-11-18 14:03:52 +01:00
bpf	bpf, test, cgroup: Use sk_{alloc,free} for test cases	2021-10-27 09:56:56 +02:00
bpfilter	bpfilter: Specify the log level for the kmsg message	2021-07-14 16:56:29 +02:00
bridge	net: bridge: mcast: use multicast_membership_interval for IGMPv3	2021-10-27 09:56:54 +02:00
caif	net-caif: avoid user-triggerable WARN_ON(1)	2021-09-22 12:27:56 +02:00
can	can: j1939: j1939_can_recv(): ignore messages with invalid source address	2021-11-18 14:03:48 +01:00
ceph
core	net: multicast: calculate csum of looped-back and forwarded packets	2021-11-18 14:03:43 +01:00
dcb	net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands	2021-01-23 16:04:01 +01:00
dccp	dccp: don't duplicate ccid when cloning dccp sock	2021-09-22 12:27:56 +02:00
decnet	net: decnet: Fix sleeping inside in af_decnet	2021-07-28 14:35:38 +02:00
dns_resolver
dsa	net: dsa: don't allocate the slave_mii_bus using devres	2021-09-30 10:11:02 +02:00
ethernet
ethtool	ethtool: Fix rxnfc copy to user buffer overflow	2021-09-22 12:27:56 +02:00
hsr	net: hsr: fix mac_len checks	2021-06-03 09:00:50 +02:00
ieee802154	net: Fix memory leak in ieee802154_raw_deliver	2021-08-18 08:59:12 +02:00
ife
ipv4	tcp_bpf: Fix one concurrency problem in the tcp_bpf_send_verdict function	2021-11-02 19:48:21 +01:00
ipv6	ipv6: When forwarding count rx stats on the orig netdev	2021-10-27 09:56:48 +02:00
iucv	net/af_iucv: remove WARN_ONCE on malformed RX packets	2021-03-07 12:34:05 +01:00
kcm
key	af_key: relax availability checks for skb size calculation	2021-02-13 13:55:02 +01:00
l2tp	net/l2tp: Fix reference count leak in l2tp_udp_recv_core	2021-09-22 12:27:56 +02:00
l3mdev
lapb	net: lapb: Copy the skb before sending a packet	2021-02-10 09:29:14 +01:00
llc	net: llc: fix skb_over_panic	2021-08-04 12:46:43 +02:00
mac80211	mac80211: check return value of rhashtable_init	2021-10-17 10:43:33 +02:00
mac802154	net: mac802154: Fix general protection fault	2021-04-14 08:42:13 +02:00
mpls	net: avoid infinite loop in mpls_gso_segment when mpls_hlen == 0	2021-03-17 17:06:11 +01:00
mptcp	mptcp: don't return sockets in foreign netns	2021-10-06 15:55:52 +02:00
ncsi	net/ncsi: Avoid channel_monitor hrtimer deadlock	2021-04-14 08:42:08 +02:00
netfilter	netfilter: Kconfig: use 'default y' instead of 'm' for bool config option	2021-10-27 09:56:53 +02:00
netlabel	net: fix NULL pointer reference in cipso_v4_doi_free	2021-09-18 13:40:35 +02:00
netlink	netlink: annotate data races around nlk->bound	2021-10-13 10:04:27 +02:00
netrom	netrom: Decrease sock refcount when sock timers expire	2021-07-28 14:35:38 +02:00
nfc	nfc: nci: fix the UAF of rf_conn_info object	2021-10-27 09:56:53 +02:00
nsh
openvswitch	ovs: clear skb->tstamp in forwarding path	2021-08-26 08:35:50 -04:00
packet	net/packet: annotate accesses to po->ifindex	2021-06-30 08:47:22 -04:00
phonet
psample	net: psample: Fix netlink skb length with tunnel info	2021-03-07 12:34:07 +01:00
qrtr	net: qrtr: fix another OOB Read in qrtr_endpoint_post	2021-09-03 10:09:21 +02:00
rds	rds: stop using dmapool	2021-11-18 14:03:44 +01:00
rfkill
rose	rose: Fix Null pointer dereference in rose_send_frame()	2020-11-20 10:04:58 -08:00
rxrpc	rxrpc: Fix clearance of Tx/Rx ring when releasing a call	2021-02-17 11:02:28 +01:00
sched	mqprio: Correct stats in mqprio_dump_class_stats().	2021-10-20 11:45:06 +02:00
sctp	sctp: add vtag check in sctp_sf_ootb	2021-11-02 19:48:24 +01:00
smc	net/smc: Correct spelling mistake to TCPF_SYN_RECV	2021-11-18 14:03:44 +01:00
strparser
sunrpc	SUNRPC: fix sign error causing rpcsec_gss drops	2021-10-13 10:04:24 +02:00
switchdev	net: switchdev: don't set port_obj_info->handled true when -EOPNOTSUPP	2021-02-07 15:37:12 +01:00
tipc	tipc: fix size validations for the MSG_CRYPTO type	2021-11-02 19:48:19 +01:00
tls	net/tls: Fix flipped sign in async_wait.err assignment	2021-11-02 19:48:23 +01:00
unix	af_unix: fix races in sk_peer_pid and sk_peer_cred accesses	2021-10-06 15:55:58 +02:00
vmw_vsock	vsock/virtio: avoid potential deadlock when vsock device remove	2021-08-18 08:59:14 +02:00
wimax
wireless	cfg80211: correct bridge/4addr mode check	2021-11-02 19:48:22 +01:00
x25	net/x25: Return the correct errno code	2021-06-18 10:00:06 +02:00
xdp	xsk: Fix broken Tx ring validation	2021-07-14 16:56:23 +02:00
xfrm	net: xfrm: Fix end of loop tests for list_for_each_entry	2021-08-26 08:35:35 -04:00
compat.c	net: Return the correct errno code	2021-06-18 10:00:06 +02:00
devres.c
Kconfig
Makefile
socket.c	ethtool: improve compat ioctl handling	2021-09-18 13:40:21 +02:00
sysctl_net.c