[PW_SID:1069344] Bluetooth: L2CAP: Fix use-after-free in l2cap_chan_timeout()#3379
[PW_SID:1069344] Bluetooth: L2CAP: Fix use-after-free in l2cap_chan_timeout()#3379BluezTestBot wants to merge 2 commits intoworkflowfrom
Conversation
This patch adds workflow files for ci: [sync.yml] - The workflow file for scheduled work - Sync the repo with upstream repo and rebase the workflow branch - Review the patches in the patchwork and creates the PR if needed [ci.yml] - The workflow file for CI tasks - Run CI tests when PR is created Signed-off-by: Tedd Ho-Jeong An <tedd.an@intel.com>
l2cap_chan_timeout() reads chan->conn without holding any lock and without taking a reference on the connection. If l2cap_conn_del() frees the connection concurrently, mutex_lock(&conn->lock) operates on freed memory. The existing NULL check is insufficient as it cannot prevent the connection from being freed after the check passes, and the early return also leaks the channel reference held by the timer. Fix by reading chan->conn under l2cap_chan_lock() and holding the connection with l2cap_conn_get(). After acquiring locks in the correct order (conn->lock then chan->lock), re-verify chan->conn in case l2cap_conn_del() already cleaned up the channel. Fixes: 3df91ea ("Bluetooth: Revert to mutexes from RCU list") Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
|
CheckPatch |
|
GitLint |
|
SubjectPrefix |
|
BuildKernel |
|
CheckAllWarning |
|
CheckSparse |
|
BuildKernel32 |
|
TestRunnerSetup |
|
TestRunner_l2cap-tester |
|
TestRunner_iso-tester |
|
TestRunner_bnep-tester |
|
TestRunner_mgmt-tester |
|
TestRunner_rfcomm-tester |
|
TestRunner_sco-tester |
|
TestRunner_ioctl-tester |
|
TestRunner_mesh-tester |
|
TestRunner_smp-tester |
|
TestRunner_userchan-tester |
|
IncrementalBuild |
github-actions
bot
force-pushed
the
workflow
branch
3 times, most recently
from
7362aeb to
fdb4d5e
Compare
github-actions
bot
force-pushed
the
workflow
branch
4 times, most recently
from
9f31ee4 to
19dcf1f
Compare
3 participants
l2cap_chan_timeout() reads chan->conn without holding any lock and
without taking a reference on the connection. If l2cap_conn_del()
frees the connection concurrently, mutex_lock(&conn->lock) operates
on freed memory. The existing NULL check is insufficient as it cannot
prevent the connection from being freed after the check passes, and
the early return also leaks the channel reference held by the timer.
Fix by reading chan->conn under l2cap_chan_lock() and holding the
connection with l2cap_conn_get(). After acquiring locks in the correct
order (conn->lock then chan->lock), re-verify chan->conn in case
l2cap_conn_del() already cleaned up the channel.
Fixes: 3df91ea ("Bluetooth: Revert to mutexes from RCU list")
Signed-off-by: Hyunwoo Kim imv4bel@gmail.com
net/bluetooth/l2cap_core.c | 23 +++++++++++++++++++++--
1 file changed, 21 insertions(+), 2 deletions(-)