Duoming Zhou e137e2ba96 Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout ... [ Upstream commit adf0398cee ] There is a race condition between l2cap_chan_timeout() and l2cap_chan_del(). When we use l2cap_chan_del() to delete the channel, the chan->conn will be set to null. But the conn could be dereferenced again in the mutex_lock() of l2cap_chan_timeout(). As a result the null pointer dereference bug will happen. The KASAN report triggered by POC is shown below: [ 472.074580] ================================================================== [ 472.075284] BUG: KASAN: null-ptr-deref in mutex_lock+0x68/0xc0 [ 472.075308] Write of size 8 at addr 0000000000000158 by task kworker/0:0/7 [ 472.075308] [ 472.075308] CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 6.9.0-rc5-00356-g78c0094a146b #36 [ 472.075308] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu4 [ 472.075308] Workqueue: events l2cap_chan_timeout [ 472.075308] Call Trace: [ 472.075308] <TASK> [ 472.075308] dump_stack_lvl+0x137/0x1a0 [ 472.075308] print_report+0x101/0x250 [ 472.075308] ? __virt_addr_valid+0x77/0x160 [ 472.075308] ? mutex_lock+0x68/0xc0 [ 472.075308] kasan_report+0x139/0x170 [ 472.075308] ? mutex_lock+0x68/0xc0 [ 472.075308] kasan_check_range+0x2c3/0x2e0 [ 472.075308] mutex_lock+0x68/0xc0 [ 472.075308] l2cap_chan_timeout+0x181/0x300 [ 472.075308] process_one_work+0x5d2/0xe00 [ 472.075308] worker_thread+0xe1d/0x1660 [ 472.075308] ? pr_cont_work+0x5e0/0x5e0 [ 472.075308] kthread+0x2b7/0x350 [ 472.075308] ? pr_cont_work+0x5e0/0x5e0 [ 472.075308] ? kthread_blkcg+0xd0/0xd0 [ 472.075308] ret_from_fork+0x4d/0x80 [ 472.075308] ? kthread_blkcg+0xd0/0xd0 [ 472.075308] ret_from_fork_asm+0x11/0x20 [ 472.075308] </TASK> [ 472.075308] ================================================================== [ 472.094860] Disabling lock debugging due to kernel taint [ 472.096136] BUG: kernel NULL pointer dereference, address: 0000000000000158 [ 472.096136] #PF: supervisor write access in kernel mode [ 472.096136] #PF: error_code(0x0002) - not-present page [ 472.096136] PGD 0 P4D 0 [ 472.096136] Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI [ 472.096136] CPU: 0 PID: 7 Comm: kworker/0:0 Tainted: G B 6.9.0-rc5-00356-g78c0094a146b #36 [ 472.096136] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu4 [ 472.096136] Workqueue: events l2cap_chan_timeout [ 472.096136] RIP: 0010:mutex_lock+0x88/0xc0 [ 472.096136] Code: be 08 00 00 00 e8 f8 23 1f fd 4c 89 f7 be 08 00 00 00 e8 eb 23 1f fd 42 80 3c 23 00 74 08 48 88 [ 472.096136] RSP: 0018:ffff88800744fc78 EFLAGS: 00000246 [ 472.096136] RAX: 0000000000000000 RBX: 1ffff11000e89f8f RCX: ffffffff8457c865 [ 472.096136] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff88800744fc78 [ 472.096136] RBP: 0000000000000158 R08: ffff88800744fc7f R09: 1ffff11000e89f8f [ 472.096136] R10: dffffc0000000000 R11: ffffed1000e89f90 R12: dffffc0000000000 [ 472.096136] R13: 0000000000000158 R14: ffff88800744fc78 R15: ffff888007405a00 [ 472.096136] FS: 0000000000000000(0000) GS:ffff88806d200000(0000) knlGS:0000000000000000 [ 472.096136] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 472.096136] CR2: 0000000000000158 CR3: 000000000da32000 CR4: 00000000000006f0 [ 472.096136] Call Trace: [ 472.096136] <TASK> [ 472.096136] ? __die_body+0x8d/0xe0 [ 472.096136] ? page_fault_oops+0x6b8/0x9a0 [ 472.096136] ? kernelmode_fixup_or_oops+0x20c/0x2a0 [ 472.096136] ? do_user_addr_fault+0x1027/0x1340 [ 472.096136] ? _printk+0x7a/0xa0 [ 472.096136] ? mutex_lock+0x68/0xc0 [ 472.096136] ? add_taint+0x42/0xd0 [ 472.096136] ? exc_page_fault+0x6a/0x1b0 [ 472.096136] ? asm_exc_page_fault+0x26/0x30 [ 472.096136] ? mutex_lock+0x75/0xc0 [ 472.096136] ? mutex_lock+0x88/0xc0 [ 472.096136] ? mutex_lock+0x75/0xc0 [ 472.096136] l2cap_chan_timeout+0x181/0x300 [ 472.096136] process_one_work+0x5d2/0xe00 [ 472.096136] worker_thread+0xe1d/0x1660 [ 472.096136] ? pr_cont_work+0x5e0/0x5e0 [ 472.096136] kthread+0x2b7/0x350 [ 472.096136] ? pr_cont_work+0x5e0/0x5e0 [ 472.096136] ? kthread_blkcg+0xd0/0xd0 [ 472.096136] ret_from_fork+0x4d/0x80 [ 472.096136] ? kthread_blkcg+0xd0/0xd0 [ 472.096136] ret_from_fork_asm+0x11/0x20 [ 472.096136] </TASK> [ 472.096136] Modules linked in: [ 472.096136] CR2: 0000000000000158 [ 472.096136] ---[ end trace 0000000000000000 ]--- [ 472.096136] RIP: 0010:mutex_lock+0x88/0xc0 [ 472.096136] Code: be 08 00 00 00 e8 f8 23 1f fd 4c 89 f7 be 08 00 00 00 e8 eb 23 1f fd 42 80 3c 23 00 74 08 48 88 [ 472.096136] RSP: 0018:ffff88800744fc78 EFLAGS: 00000246 [ 472.096136] RAX: 0000000000000000 RBX: 1ffff11000e89f8f RCX: ffffffff8457c865 [ 472.096136] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff88800744fc78 [ 472.096136] RBP: 0000000000000158 R08: ffff88800744fc7f R09: 1ffff11000e89f8f [ 472.132932] R10: dffffc0000000000 R11: ffffed1000e89f90 R12: dffffc0000000000 [ 472.132932] R13: 0000000000000158 R14: ffff88800744fc78 R15: ffff888007405a00 [ 472.132932] FS: 0000000000000000(0000) GS:ffff88806d200000(0000) knlGS:0000000000000000 [ 472.132932] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 472.132932] CR2: 0000000000000158 CR3: 000000000da32000 CR4: 00000000000006f0 [ 472.132932] Kernel panic - not syncing: Fatal exception [ 472.132932] Kernel Offset: disabled [ 472.132932] ---[ end Kernel panic - not syncing: Fatal exception ]--- Add a check to judge whether the conn is null in l2cap_chan_timeout() in order to mitigate the bug. Fixes: 3df91ea20e ("Bluetooth: Revert to mutexes from RCU list") Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-05-17 11:42:42 +02:00
..
6lowpan
9p	net: 9p: avoid freeing uninit memory in p9pdu_vreadf	2024-01-08 11:27:36 +01:00
802	mrp: introduce active flags to prevent UAF when applicant uninit	2023-01-18 11:30:36 +01:00
8021q	vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING	2024-02-23 08:12:41 +01:00
appletalk	appletalk: Fix Use-After-Free in atalk_ioctl	2023-12-20 15:38:01 +01:00
atm	atm: Fix Use-After-Free in do_vcc_ioctl	2023-12-20 15:38:00 +01:00
ax25	ax25: Fix UAF bugs in ax25 timers	2022-04-27 13:39:46 +02:00
batman-adv	batman-adv: Avoid infinite loop trying to resize local TT	2024-05-02 16:17:08 +02:00
bluetooth	Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout	2024-05-17 11:42:42 +02:00
bpf	bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb()	2022-11-25 17:40:29 +01:00
bpfilter
bridge	net: bridge: fix multicast-to-unicast with fraglist GSO	2024-05-17 11:42:38 +02:00
caif	net: caif: Fix use-after-free in cfusbl_device_notify()	2023-03-17 08:31:44 +01:00
can	can: bcm: Fix UAF in bcm_proc_show()	2023-08-11 11:45:24 +02:00
ceph	libceph: use kernel_connect()	2023-10-25 11:16:51 +02:00
core	net: mark racy access on sk->sk_rcvbuf	2024-05-17 11:42:39 +02:00
dcb	net: dcb: disable softirqs in dcbnl_flush_dev()	2022-03-08 19:04:10 +01:00
dccp	dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses.	2023-11-20 10:29:21 +01:00
decnet	Remove DECnet support from kernel	2023-06-21 15:39:57 +02:00
dns_resolver
dsa	net: dsa: Add missing of_node_put() in dsa_port_parse_of	2022-03-23 09:10:44 +01:00
ethernet	ethernet: Add helper for assigning packet type when dest address does not match device address	2024-05-17 11:42:37 +02:00
hsr	hsr: Handle failures in module init	2024-03-26 18:22:42 -04:00
ieee802154	net: ieee802154: fix error return code in dgram_bind()	2022-11-03 23:52:30 +09:00
ife	net: sched: ife: fix potential use-after-free	2024-01-08 11:27:34 +01:00
ipv4	tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().	2024-05-17 11:42:41 +02:00
ipv6	udp: preserve the connected status if only UDP cmsg	2024-05-02 16:17:14 +02:00
iucv	net/iucv: fix the allocation size of iucv_path_table array	2024-03-26 18:22:33 -04:00
kcm	net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function	2024-03-26 18:22:36 -04:00
key	net: af_key: fix sadb_x_filter validation	2023-08-30 16:31:48 +02:00
l2tp	net l2tp: drop flow hash on forward	2024-05-17 11:42:38 +02:00
l3mdev
lapb	net: lapb: Copy the skb before sending a packet	2021-02-10 09:21:06 +01:00
llc	llc: call sock_orphan() at release time	2024-02-23 08:12:52 +01:00
mac80211	wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc	2024-05-17 11:42:39 +02:00
mac802154	mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()	2022-12-14 11:28:28 +01:00
mpls	net: mpls: fix stale pointer if allocation fails during device rename	2023-02-22 12:47:21 +01:00
ncsi	net/ncsi: Fix netlink major/minor version numbers	2024-01-25 14:33:33 -08:00
netfilter	ipvs: Fix checksumming on GSO of SCTP packets	2024-05-02 16:17:12 +02:00
netlabel	calipso: fix memory leak in netlbl_calipso_add_pass()	2024-01-25 14:33:32 -08:00
netlink	netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter	2024-03-06 14:35:22 +00:00
netrom	netrom: Fix data-races around sysctl_net_busy_read	2024-03-15 10:48:16 -04:00
nfc	nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet	2024-04-13 12:50:11 +02:00
nsh	nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().	2024-05-17 11:42:38 +02:00
openvswitch	net: openvswitch: Fix Use-After-Free in ovs_ct_exit	2024-05-02 16:17:12 +02:00
packet	packet: move from strlcpy with unused retval to strscpy	2024-03-01 13:06:11 +01:00
phonet	phonet: refcount leak in pep_sock_accep	2022-01-11 13:58:50 +01:00
psample	psample: Require 'CAP_NET_ADMIN' when joining "packets" group	2023-12-13 17:42:20 +01:00
qrtr	net: qrtr: fix another OOB Read in qrtr_endpoint_post	2021-09-03 09:58:00 +02:00
rds	net/rds: fix possible cp null dereference	2024-04-13 12:50:12 +02:00
rfkill	net: rfkill: gpio: set GPIO direction	2024-01-08 11:27:36 +01:00
rose	net/rose: fix races in rose_kill_by_device()	2024-01-08 11:27:34 +01:00
rxrpc	rxrpc: Fix response to PING RESPONSE ACKs to a dead call	2024-02-23 08:12:54 +01:00
sched	net/sched: act_skbmod: prevent kernel-infoleak	2024-04-13 12:50:12 +02:00
sctp	sctp: update hb timer immediately after users change hb_interval	2023-10-10 21:45:01 +02:00
smc	net/smc: fix illegal rmb_desc access in SMC-D connection dump	2024-02-23 08:12:41 +01:00
strparser
sunrpc	net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr()	2024-03-26 18:22:42 -04:00
switchdev
tipc	tipc: fix a possible memleak in tipc_buf_append	2024-05-17 11:42:38 +02:00
tls	net/tls: Fix race in TLS device down flow	2022-07-29 17:10:32 +02:00
unix	af_unix: Annotate data-race of gc_in_progress in wait_for_unix_gc().	2024-03-26 18:22:35 -04:00
vmw_vsock	vsock/virtio: Fix unsigned integer wrap around in virtio_transport_has_space()	2023-12-20 15:38:01 +01:00
wimax
wireless	wifi: nl80211: don't free NULL coalescing rule	2024-05-17 11:42:36 +02:00
x25	net/x25: fix incorrect parameter validation in the x25_getsockopt() function	2024-03-26 18:22:37 -04:00
xdp	xsk: Simplify detection of empty and full rings	2021-05-22 10:59:48 +02:00
xfrm	xfrm: Avoid clang fortify warning in copy_to_user_tmpl()	2024-04-13 12:50:08 +02:00
compat.c	net: Return the correct errno code	2021-06-30 08:48:13 -04:00
Kconfig	Remove DECnet support from kernel	2023-06-21 15:39:57 +02:00
Makefile	Remove DECnet support from kernel	2023-06-21 15:39:57 +02:00
socket.c	net: Save and restore msg_namelen in sock_sendmsg	2024-01-15 18:23:42 +01:00
sysctl_net.c