Wang ShaoBo 1bff51ea59 Bluetooth: fix use-after-free error in lock_sock_nested() ... use-after-free error in lock_sock_nested is reported: [ 179.140137][ T3731] ===================================================== [ 179.142675][ T3731] BUG: KMSAN: use-after-free in lock_sock_nested+0x280/0x2c0 [ 179.145494][ T3731] CPU: 4 PID: 3731 Comm: kworker/4:2 Not tainted 5.12.0-rc6+ #54 [ 179.148432][ T3731] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 [ 179.151806][ T3731] Workqueue: events l2cap_chan_timeout [ 179.152730][ T3731] Call Trace: [ 179.153301][ T3731] dump_stack+0x24c/0x2e0 [ 179.154063][ T3731] kmsan_report+0xfb/0x1e0 [ 179.154855][ T3731] __msan_warning+0x5c/0xa0 [ 179.155579][ T3731] lock_sock_nested+0x280/0x2c0 [ 179.156436][ T3731] ? kmsan_get_metadata+0x116/0x180 [ 179.157257][ T3731] l2cap_sock_teardown_cb+0xb8/0x890 [ 179.158154][ T3731] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 179.159141][ T3731] ? kmsan_get_metadata+0x116/0x180 [ 179.159994][ T3731] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 179.160959][ T3731] ? l2cap_sock_recv_cb+0x420/0x420 [ 179.161834][ T3731] l2cap_chan_del+0x3e1/0x1d50 [ 179.162608][ T3731] ? kmsan_get_metadata+0x116/0x180 [ 179.163435][ T3731] ? kmsan_get_shadow_origin_ptr+0x84/0xb0 [ 179.164406][ T3731] l2cap_chan_close+0xeea/0x1050 [ 179.165189][ T3731] ? kmsan_internal_unpoison_shadow+0x42/0x70 [ 179.166180][ T3731] l2cap_chan_timeout+0x1da/0x590 [ 179.167066][ T3731] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 179.168023][ T3731] ? l2cap_chan_create+0x560/0x560 [ 179.168818][ T3731] process_one_work+0x121d/0x1ff0 [ 179.169598][ T3731] worker_thread+0x121b/0x2370 [ 179.170346][ T3731] kthread+0x4ef/0x610 [ 179.171010][ T3731] ? process_one_work+0x1ff0/0x1ff0 [ 179.171828][ T3731] ? kthread_blkcg+0x110/0x110 [ 179.172587][ T3731] ret_from_fork+0x1f/0x30 [ 179.173348][ T3731] [ 179.173752][ T3731] Uninit was created at: [ 179.174409][ T3731] kmsan_internal_poison_shadow+0x5c/0xf0 [ 179.175373][ T3731] kmsan_slab_free+0x76/0xc0 [ 179.176060][ T3731] kfree+0x3a5/0x1180 [ 179.176664][ T3731] __sk_destruct+0x8af/0xb80 [ 179.177375][ T3731] __sk_free+0x812/0x8c0 [ 179.178032][ T3731] sk_free+0x97/0x130 [ 179.178686][ T3731] l2cap_sock_release+0x3d5/0x4d0 [ 179.179457][ T3731] sock_close+0x150/0x450 [ 179.180117][ T3731] __fput+0x6bd/0xf00 [ 179.180787][ T3731] ____fput+0x37/0x40 [ 179.181481][ T3731] task_work_run+0x140/0x280 [ 179.182219][ T3731] do_exit+0xe51/0x3e60 [ 179.182930][ T3731] do_group_exit+0x20e/0x450 [ 179.183656][ T3731] get_signal+0x2dfb/0x38f0 [ 179.184344][ T3731] arch_do_signal_or_restart+0xaa/0xe10 [ 179.185266][ T3731] exit_to_user_mode_prepare+0x2d2/0x560 [ 179.186136][ T3731] syscall_exit_to_user_mode+0x35/0x60 [ 179.186984][ T3731] do_syscall_64+0xc5/0x140 [ 179.187681][ T3731] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 179.188604][ T3731] ===================================================== In our case, there are two Thread A and B: Context: Thread A: Context: Thread B: l2cap_chan_timeout() __se_sys_shutdown() l2cap_chan_close() l2cap_sock_shutdown() l2cap_chan_del() l2cap_chan_close() l2cap_sock_teardown_cb() l2cap_sock_teardown_cb() Once l2cap_sock_teardown_cb() excuted, this sock will be marked as SOCK_ZAPPED, and can be treated as killable in l2cap_sock_kill() if sock_orphan() has excuted, at this time we close sock through sock_close() which end to call l2cap_sock_kill() like Thread C: Context: Thread C: sock_close() l2cap_sock_release() sock_orphan() l2cap_sock_kill() #free sock if refcnt is 1 If C completed, Once A or B reaches l2cap_sock_teardown_cb() again, use-after-free happened. We should set chan->data to NULL if sock is destructed, for telling teardown operation is not allowed in l2cap_sock_teardown_cb(), and also we should avoid killing an already killed socket in l2cap_sock_close_cb(). Signed-off-by: Wang ShaoBo <bobo.shaobowang@huawei.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>		2021-09-01 07:36:08 +02:00
..
bnep	Bluetooth: bnep: Use the correct print format	2021-06-26 07:12:40 +02:00
cmtp	Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow	2021-08-05 15:05:37 +02:00
hidp	Bluetooth: hidp: Use the correct print format	2021-06-26 07:12:40 +02:00
rfcomm	Bluetooth: switch to lock_sock in RFCOMM	2021-08-10 10:40:48 -07:00
6lowpan.c	Bluetooth: 6lowpan: Use the correct print format	2021-06-26 07:12:41 +02:00
a2mp.c	Bluetooth: a2mp: Use the correct print format	2021-06-26 07:12:41 +02:00
a2mp.h	Bluetooth: Replace zero-length array with flexible-array member	2020-02-28 08:30:02 +01:00
af_bluetooth.c	Bluetooth: fix indentation and alignment reported by checkpatch	2021-01-29 16:51:45 +01:00
amp.c	Bluetooth: amp: Use the correct print format	2021-06-26 07:12:41 +02:00
amp.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 284	2019-06-05 17:36:37 +02:00
aosp.c	Bluetooth: Add support for reading AOSP vendor capabilities	2021-04-06 14:11:23 -07:00
aosp.h	Bluetooth: Add support for reading AOSP vendor capabilities	2021-04-06 14:11:23 -07:00
ecdh_helper.c	crypto: ecdh - move curve_id of ECDH from the key to algorithm name	2021-03-13 00:04:03 +11:00
ecdh_helper.h	Fix misc new gcc warnings	2021-04-27 17:05:53 -07:00
hci_conn.c	Bluetooth: Fix using RPA when address has been resolved	2021-08-30 23:14:55 +02:00
hci_core.c	Bluetooth: Fix using address type from events	2021-08-30 23:14:55 +02:00
hci_debugfs.c	Bluetooth: use inclusive language when filtering devices	2021-06-26 07:12:44 +02:00
hci_debugfs.h	Bluetooth: Provide option to enable/disable debugfs information	2015-02-15 18:54:13 +02:00
hci_event.c	Bluetooth: Fix using RPA when address has been resolved	2021-08-30 23:14:55 +02:00
hci_request.c	Bluetooth: Fix not generating RPA when required	2021-08-03 23:30:50 +02:00
hci_request.h	Bluetooth: Resume advertising after LE connection	2020-11-09 13:33:19 +01:00
hci_sock.c	Bluetooth: reorganize functions from hci_sock_sendmsg()	2021-08-30 16:16:49 +02:00
hci_sysfs.c	bluetooth-next pull request for net-next:	2021-08-20 12:16:05 +01:00
Kconfig	Bluetooth: Add support for reading AOSP vendor capabilities	2021-04-06 14:11:23 -07:00
l2cap_core.c	Bluetooth: Fix using RPA when address has been resolved	2021-08-30 23:14:55 +02:00
l2cap_sock.c	Bluetooth: fix use-after-free error in lock_sock_nested()	2021-09-01 07:36:08 +02:00
leds.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
leds.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
lib.c	Bluetooth: Introduce debug feature when dynamic debug is disabled	2020-05-11 12:16:27 +02:00
Makefile	Bluetooth: Add support for reading AOSP vendor capabilities	2021-04-06 14:11:23 -07:00
mgmt_config.c	Bluetooth: mgmt: Use the correct print format	2021-06-26 07:12:42 +02:00
mgmt_config.h	Bluetooth: mgmt: Add commands for runtime configuration	2020-06-18 13:11:03 +03:00
mgmt_util.c	networking: make skb_push & __skb_push return void pointers	2017-06-16 11:48:40 -04:00
mgmt_util.h	Bluetooth: Add generic mgmt helper API	2015-03-17 18:03:08 +01:00
mgmt.c	Bluetooth: Support the quality report events	2021-08-30 16:44:32 +02:00
msft.c	Bluetooth: msft: Use the correct print format	2021-06-26 07:12:42 +02:00
msft.h	Bluetooth: Allow Microsoft extension to indicate curve validation	2021-04-08 12:26:34 +02:00
sco.c	Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg()	2021-08-30 16:47:31 +02:00
selftest.c	crypto: ecdh - move curve_id of ECDH from the key to algorithm name	2021-03-13 00:04:03 +11:00
selftest.h	Bluetooth: Add support for self testing framework	2014-12-30 08:53:55 +02:00
smp.c	Bluetooth: use inclusive language in HCI role comments	2021-06-26 07:12:43 +02:00
smp.h	Bluetooth: use inclusive language in SMP	2021-06-26 07:12:37 +02:00