linux

mirror of https://github.com/torvalds/linux.git synced 2026-06-05 21:15:53 +02:00

Linux kernel source tree

Go to file

Zhengchao Shao d9ec6e2fbd Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del() [ Upstream commit `0d0e2d0328` ] When l2cap_recv_frame() is invoked to receive data, and the cid is L2CAP_CID_A2MP, if the channel does not exist, it will create a channel. However, after a channel is created, the hold operation of the channel is not performed. In this case, the value of channel reference counting is 1. As a result, after hci_error_reset() is triggered, l2cap_conn_del() invokes the close hook function of A2MP to release the channel. Then l2cap_chan_unlock(chan) will trigger UAF issue. The process is as follows: Receive data: l2cap_data_channel() a2mp_channel_create() --->channel ref is 2 l2cap_chan_put() --->channel ref is 1 Triger event: hci_error_reset() hci_dev_do_close() ... l2cap_disconn_cfm() l2cap_conn_del() l2cap_chan_hold() --->channel ref is 2 l2cap_chan_del() --->channel ref is 1 a2mp_chan_close_cb() --->channel ref is 0, release channel l2cap_chan_unlock() --->UAF of channel The detailed Call Trace is as follows: BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0xa6/0x5e0 Read of size 8 at addr ffff8880160664b8 by task kworker/u11:1/7593 Workqueue: hci0 hci_error_reset Call Trace: <TASK> dump_stack_lvl+0xcd/0x134 print_report.cold+0x2ba/0x719 kasan_report+0xb1/0x1e0 kasan_check_range+0x140/0x190 __mutex_unlock_slowpath+0xa6/0x5e0 l2cap_conn_del+0x404/0x7b0 l2cap_disconn_cfm+0x8c/0xc0 hci_conn_hash_flush+0x11f/0x260 hci_dev_close_sync+0x5f5/0x11f0 hci_dev_do_close+0x2d/0x70 hci_error_reset+0x9e/0x140 process_one_work+0x98a/0x1620 worker_thread+0x665/0x1080 kthread+0x2e4/0x3a0 ret_from_fork+0x1f/0x30 </TASK> Allocated by task 7593: kasan_save_stack+0x1e/0x40 __kasan_kmalloc+0xa9/0xd0 l2cap_chan_create+0x40/0x930 amp_mgr_create+0x96/0x990 a2mp_channel_create+0x7d/0x150 l2cap_recv_frame+0x51b8/0x9a70 l2cap_recv_acldata+0xaa3/0xc00 hci_rx_work+0x702/0x1220 process_one_work+0x98a/0x1620 worker_thread+0x665/0x1080 kthread+0x2e4/0x3a0 ret_from_fork+0x1f/0x30 Freed by task 7593: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_set_free_info+0x20/0x30 ____kasan_slab_free+0x167/0x1c0 slab_free_freelist_hook+0x89/0x1c0 kfree+0xe2/0x580 l2cap_chan_put+0x22a/0x2d0 l2cap_conn_del+0x3fc/0x7b0 l2cap_disconn_cfm+0x8c/0xc0 hci_conn_hash_flush+0x11f/0x260 hci_dev_close_sync+0x5f5/0x11f0 hci_dev_do_close+0x2d/0x70 hci_error_reset+0x9e/0x140 process_one_work+0x98a/0x1620 worker_thread+0x665/0x1080 kthread+0x2e4/0x3a0 ret_from_fork+0x1f/0x30 Last potentially related work creation: kasan_save_stack+0x1e/0x40 __kasan_record_aux_stack+0xbe/0xd0 call_rcu+0x99/0x740 netlink_release+0xe6a/0x1cf0 __sock_release+0xcd/0x280 sock_close+0x18/0x20 __fput+0x27c/0xa90 task_work_run+0xdd/0x1a0 exit_to_user_mode_prepare+0x23c/0x250 syscall_exit_to_user_mode+0x19/0x50 do_syscall_64+0x42/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Second to last potentially related work creation: kasan_save_stack+0x1e/0x40 __kasan_record_aux_stack+0xbe/0xd0 call_rcu+0x99/0x740 netlink_release+0xe6a/0x1cf0 __sock_release+0xcd/0x280 sock_close+0x18/0x20 __fput+0x27c/0xa90 task_work_run+0xdd/0x1a0 exit_to_user_mode_prepare+0x23c/0x250 syscall_exit_to_user_mode+0x19/0x50 do_syscall_64+0x42/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Fixes: `d0be8347c6` ("Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put") Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-11-10 18:14:19 +01:00
arch	KVM: x86: Add compat handler for KVM_X86_SET_MSR_FILTER	2022-11-10 18:14:15 +01:00
block	blk-wbt: fix that 'rwb->wc' is always set to 1 in wbt_init()	2022-10-30 09:41:19 +01:00
certs	certs/blacklist_hashes.c: fix const confusion in certs blacklist	2022-06-22 14:13:17 +02:00
crypto	crypto: akcipher - default implementation for setting a private key	2022-10-26 13:25:42 +02:00
Documentation	arm64: errata: Remove AES hwcap for COMPAT tasks	2022-10-30 09:41:16 +01:00
drivers	isdn: mISDN: netjet: fix wrong check of device registration	2022-11-10 18:14:19 +01:00
fs	btrfs: fix ulist leaks in error paths of qgroup self tests	2022-11-10 18:14:19 +01:00
include	serial: 8250: Let drivers request full 16550A feature probing	2022-11-10 18:14:14 +01:00
init	Kconfig: Add option for asm goto w/ tied outputs to workaround clang-13 bug	2022-06-09 10:21:25 +02:00
ipc	ipc/mqueue: use get_tree_nodev() in mqueue_get_tree()	2022-06-09 10:21:17 +02:00
kernel	PM: hibernate: Allow hybrid sleep to work with s2idle	2022-11-03 23:57:52 +09:00
lib	dyndbg: drop EXPORTed dynamic_debug_exec_queries	2022-10-26 13:25:34 +02:00
LICENSES
mm	mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages	2022-11-03 23:57:50 +09:00
net	Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del()	2022-11-10 18:14:19 +01:00
samples	x86: Prepare inline-asm for straight-line-speculation	2022-07-25 11:26:29 +02:00
scripts	kbuild: Add skip_encoding_btf_enum64 option to pahole	2022-10-28 12:57:12 +02:00
security	selinux: enable use of both GFP_KERNEL and GFP_ATOMIC in convert_context()	2022-10-30 09:41:15 +01:00
sound	ALSA: aoa: Fix I2S device accounting	2022-11-03 23:57:53 +09:00
tools	perf auxtrace: Fix address filter symbol name match for modules	2022-11-03 23:57:50 +09:00
usr	usr/include/Makefile: add linux/nfc.h to the compile-test coverage	2022-02-01 17:25:48 +01:00
virt	kvm: Add support for arch compat vm ioctls	2022-10-30 09:41:15 +01:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore	kbuild: generate Module.symvers only when vmlinux exists	2021-05-19 10:12:59 +02:00
.mailmap	mailmap: add two more addresses of Uwe Kleine-König	2020-12-06 10:19:07 -08:00
COPYING
CREDITS	MAINTAINERS: Move Jason Cooper to CREDITS	2020-11-30 10:20:34 +01:00
Kbuild
Kconfig
MAINTAINERS	MAINTAINERS: add Amir as xfs maintainer for 5.10.y	2022-07-02 16:39:22 +02:00
Makefile	Linux 5.10.153	2022-11-03 23:57:54 +09:00
README

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.