Commit 2a154903 authored by Hillf Danton's avatar Hillf Danton Committed by Marcel Holtmann

Bluetooth: prefetch channel before killing sock

Prefetch channel before killing sock in order to fix UAF like

 BUG: KASAN: use-after-free in l2cap_sock_release+0x24c/0x290 net/bluetooth/l2cap_sock.c:1212
 Read of size 8 at addr ffff8880944904a0 by task syz-fuzzer/9751

Reported-by: syzbot+c3c5bdea7863886115dc@syzkaller.appspotmail.com
Fixes: 6c08fc89 ("Bluetooth: Fix refcount use-after-free issue")
Cc: Manish Mandlik <mmandlik@google.com>
Signed-off-by: default avatarHillf Danton <hdanton@sina.com>
Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
parent 89bd6147
...@@ -1193,6 +1193,7 @@ static int l2cap_sock_release(struct socket *sock) ...@@ -1193,6 +1193,7 @@ static int l2cap_sock_release(struct socket *sock)
{ {
struct sock *sk = sock->sk; struct sock *sk = sock->sk;
int err; int err;
struct l2cap_chan *chan;
BT_DBG("sock %p, sk %p", sock, sk); BT_DBG("sock %p, sk %p", sock, sk);
...@@ -1202,15 +1203,16 @@ static int l2cap_sock_release(struct socket *sock) ...@@ -1202,15 +1203,16 @@ static int l2cap_sock_release(struct socket *sock)
bt_sock_unlink(&l2cap_sk_list, sk); bt_sock_unlink(&l2cap_sk_list, sk);
err = l2cap_sock_shutdown(sock, 2); err = l2cap_sock_shutdown(sock, 2);
chan = l2cap_pi(sk)->chan;
l2cap_chan_hold(l2cap_pi(sk)->chan); l2cap_chan_hold(chan);
l2cap_chan_lock(l2cap_pi(sk)->chan); l2cap_chan_lock(chan);
sock_orphan(sk); sock_orphan(sk);
l2cap_sock_kill(sk); l2cap_sock_kill(sk);
l2cap_chan_unlock(l2cap_pi(sk)->chan); l2cap_chan_unlock(chan);
l2cap_chan_put(l2cap_pi(sk)->chan); l2cap_chan_put(chan);
return err; return err;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment