Bluetooth: prefetch channel before killing sock (2a154903) · Commits · 戴 / test

Prefetch channel before killing sock in order to fix UAF like BUG: KASAN: use-after-free in l2cap_sock_release+0x24c/0x290 net/bluetooth/l2cap_sock.c:1212 Read of size 8 at addr ffff8880944904a0 by task syz-fuzzer/9751 Reported-by:

<syzbot+c3c5bdea7863886115dc@syzkaller.appspotmail.com> Fixes: ("Bluetooth: Fix refcount use-after-free issue") Cc: Manish Mandlik <mmandlik@google.com> Signed-off-by:

Hillf Danton <hdanton@sina.com> Signed-off-by:

Marcel Holtmann <marcel@holtmann.org>

net/bluetooth/l2cap_sock.c

+6 −4

Original line number	Diff line number	Diff line
		@@ -1193,6 +1193,7 @@ static int l2cap_sock_release(struct socket *sock)
		{
		struct sock *sk = sock->sk;
		int err;
		struct l2cap_chan *chan;

		BT_DBG("sock %p, sk %p", sock, sk);

		@@ -1202,15 +1203,16 @@ static int l2cap_sock_release(struct socket *sock)
		bt_sock_unlink(&l2cap_sk_list, sk);

		err = l2cap_sock_shutdown(sock, 2);
		chan = l2cap_pi(sk)->chan;

		l2cap_chan_hold(l2cap_pi(sk)->chan);
		l2cap_chan_lock(l2cap_pi(sk)->chan);
		l2cap_chan_hold(chan);
		l2cap_chan_lock(chan);

		sock_orphan(sk);
		l2cap_sock_kill(sk);

		l2cap_chan_unlock(l2cap_pi(sk)->chan);
		l2cap_chan_put(l2cap_pi(sk)->chan);
		l2cap_chan_unlock(chan);
		l2cap_chan_put(chan);

		return err;
		}

Admin message