summaryrefslogtreecommitdiff
path: root/net/bluetooth
diff options
context:
space:
mode:
authorHillf Danton <hdanton@sina.com>2020-02-05 10:31:59 +0800
committerMarcel Holtmann <marcel@holtmann.org>2020-02-05 09:05:04 +0100
commit2a154903cec20fb64ff4d7d617ca53c16f8fd53a (patch)
tree7c1dfbe14f16ab556ffec7dccfd946816ca51415 /net/bluetooth
parent89bd6147964ea3d72708ee30ba309ac675a5b997 (diff)
Bluetooth: prefetch channel before killing sock
Prefetch channel before killing sock in order to fix UAF like BUG: KASAN: use-after-free in l2cap_sock_release+0x24c/0x290 net/bluetooth/l2cap_sock.c:1212 Read of size 8 at addr ffff8880944904a0 by task syz-fuzzer/9751 Reported-by: syzbot+c3c5bdea7863886115dc@syzkaller.appspotmail.com Fixes: 6c08fc896b60 ("Bluetooth: Fix refcount use-after-free issue") Cc: Manish Mandlik <mmandlik@google.com> Signed-off-by: Hillf Danton <hdanton@sina.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Diffstat (limited to 'net/bluetooth')
-rw-r--r--net/bluetooth/l2cap_sock.c10
1 files changed, 6 insertions, 4 deletions
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index ab65304f3f63..390a9afab647 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1193,6 +1193,7 @@ static int l2cap_sock_release(struct socket *sock)
{
struct sock *sk = sock->sk;
int err;
+ struct l2cap_chan *chan;
BT_DBG("sock %p, sk %p", sock, sk);
@@ -1202,15 +1203,16 @@ static int l2cap_sock_release(struct socket *sock)
bt_sock_unlink(&l2cap_sk_list, sk);
err = l2cap_sock_shutdown(sock, 2);
+ chan = l2cap_pi(sk)->chan;
- l2cap_chan_hold(l2cap_pi(sk)->chan);
- l2cap_chan_lock(l2cap_pi(sk)->chan);
+ l2cap_chan_hold(chan);
+ l2cap_chan_lock(chan);
sock_orphan(sk);
l2cap_sock_kill(sk);
- l2cap_chan_unlock(l2cap_pi(sk)->chan);
- l2cap_chan_put(l2cap_pi(sk)->chan);
+ l2cap_chan_unlock(chan);
+ l2cap_chan_put(chan);
return err;
}