Ksawlii/kernel_samsung_a53x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
kernel_samsung_a53x/net/bluetooth
History
Dmitry Antipov ea90455828 Bluetooth: fix use-after-free in device_for_each_child() 
[ Upstream commit 27aabf27fd014ae037cc179c61b0bee7cff55b3d ]

Syzbot has reported the following KASAN splat:

BUG: KASAN: slab-use-after-free in device_for_each_child+0x18f/0x1a0
Read of size 8 at addr ffff88801f605308 by task kbnepd bnep0/4980

CPU: 0 UID: 0 PID: 4980 Comm: kbnepd bnep0 Not tainted 6.12.0-rc4-00161-gae90f6a6170d #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0x100/0x190
 ? device_for_each_child+0x18f/0x1a0
 print_report+0x13a/0x4cb
 ? __virt_addr_valid+0x5e/0x590
 ? __phys_addr+0xc6/0x150
 ? device_for_each_child+0x18f/0x1a0
 kasan_report+0xda/0x110
 ? device_for_each_child+0x18f/0x1a0
 ? __pfx_dev_memalloc_noio+0x10/0x10
 device_for_each_child+0x18f/0x1a0
 ? __pfx_device_for_each_child+0x10/0x10
 pm_runtime_set_memalloc_noio+0xf2/0x180
 netdev_unregister_kobject+0x1ed/0x270
 unregister_netdevice_many_notify+0x123c/0x1d80
 ? __mutex_trylock_common+0xde/0x250
 ? __pfx_unregister_netdevice_many_notify+0x10/0x10
 ? trace_contention_end+0xe6/0x140
 ? __mutex_lock+0x4e7/0x8f0
 ? __pfx_lock_acquire.part.0+0x10/0x10
 ? rcu_is_watching+0x12/0xc0
 ? unregister_netdev+0x12/0x30
 unregister_netdevice_queue+0x30d/0x3f0
 ? __pfx_unregister_netdevice_queue+0x10/0x10
 ? __pfx_down_write+0x10/0x10
 unregister_netdev+0x1c/0x30
 bnep_session+0x1fb3/0x2ab0
 ? __pfx_bnep_session+0x10/0x10
 ? __pfx_lock_release+0x10/0x10
 ? __pfx_woken_wake_function+0x10/0x10
 ? __kthread_parkme+0x132/0x200
 ? __pfx_bnep_session+0x10/0x10
 ? kthread+0x13a/0x370
 ? __pfx_bnep_session+0x10/0x10
 kthread+0x2b7/0x370
 ? __pfx_kthread+0x10/0x10
 ret_from_fork+0x48/0x80
 ? __pfx_kthread+0x10/0x10
 ret_from_fork_asm+0x1a/0x30
 </TASK>

Allocated by task 4974:
 kasan_save_stack+0x30/0x50
 kasan_save_track+0x14/0x30
 __kasan_kmalloc+0xaa/0xb0
 __kmalloc_noprof+0x1d1/0x440
 hci_alloc_dev_priv+0x1d/0x2820
 __vhci_create_device+0xef/0x7d0
 vhci_write+0x2c7/0x480
 vfs_write+0x6a0/0xfc0
 ksys_write+0x12f/0x260
 do_syscall_64+0xc7/0x250
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 4979:
 kasan_save_stack+0x30/0x50
 kasan_save_track+0x14/0x30
 kasan_save_free_info+0x3b/0x60
 __kasan_slab_free+0x4f/0x70
 kfree+0x141/0x490
 hci_release_dev+0x4d9/0x600
 bt_host_release+0x6a/0xb0
 device_release+0xa4/0x240
 kobject_put+0x1ec/0x5a0
 put_device+0x1f/0x30
 vhci_release+0x81/0xf0
 __fput+0x3f6/0xb30
 task_work_run+0x151/0x250
 do_exit+0xa79/0x2c30
 do_group_exit+0xd5/0x2a0
 get_signal+0x1fcd/0x2210
 arch_do_signal_or_restart+0x93/0x780
 syscall_exit_to_user_mode+0x140/0x290
 do_syscall_64+0xd4/0x250
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

In 'hci_conn_del_sysfs()', 'device_unregister()' may be called when
an underlying (kobject) reference counter is greater than 1. This
means that reparenting (happened when the device is actually freed)
is delayed and, during that delay, parent controller device (hciX)
may be deleted. Since the latter may create a dangling pointer to
freed parent, avoid that scenario by reparenting to NULL explicitly.

Reported-by: syzbot+6cf5652d3df49fae2e3f@syzkaller.appspotmail.com
Tested-by: syzbot+6cf5652d3df49fae2e3f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6cf5652d3df49fae2e3f
Fixes: a85fb91e3d72 ("Bluetooth: Fix double free in hci_conn_cleanup")
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-12-17 13:24:07 +01:00
..
bnep Revert "Bluetooth: bnep: Fix out-of-bound access" 2024-11-24 00:23:52 +01:00
cmtp exit: Rename module_put_and_exit to module_put_and_kthread_exit 2024-11-19 12:27:50 +01:00
hidp exit: Rename module_put_and_exit to module_put_and_kthread_exit 2024-11-19 12:27:50 +01:00
rfcomm Revert "Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change" 2024-11-24 00:22:57 +01:00
6lowpan.c
a2mp.c
a2mp.h
af_bluetooth.c Revert "Bluetooth: Remove debugfs directory on module init failure" 2024-11-24 00:22:52 +01:00
amp.c
amp.h
ecdh_helper.c
ecdh_helper.h
hci_conn.c Bluetooth: Fix bogus check for re-auth no supported with non-ssp 2024-11-18 12:12:38 +01:00
hci_core.c Revert "Bluetooth: hci_core: Fix LE quote calculation" 2024-11-24 00:23:52 +01:00
hci_debugfs.c Bluetooth: Fix TOCTOU in HCI debugfs implementation 2024-11-19 09:22:45 +01:00
hci_debugfs.h
hci_event.c Bluetooth: hci_event: set the conn encrypted before conn establishes 2024-11-19 09:22:44 +01:00
hci_request.c Bluetooth: Fix memory leak in hci_req_sync_complete() 2024-11-19 11:32:19 +01:00
hci_request.h
hci_sock.c Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name 2024-11-08 11:26:20 +01:00
hci_sysfs.c Bluetooth: fix use-after-free in device_for_each_child() 2024-12-17 13:24:07 +01:00
Kconfig
l2cap_core.c Bluetooth: l2cap: always unlock channel in l2cap_conless_channel() 2024-11-23 23:20:22 +01:00
l2cap_sock.c Revert "Bluetooth: L2CAP: Fix not validating setsockopt user input" 2024-11-24 00:23:11 +01:00
leds.c
leds.h
lib.c
Makefile
mgmt.c Revert "Bluetooth: MGMT: Add error handling to pair_device()" 2024-11-24 00:23:50 +01:00
mgmt_config.c
mgmt_config.h
mgmt_util.c
mgmt_util.h
msft.c
msft.h
sco.c Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout 2024-11-19 11:32:45 +01:00
selftest.c
selftest.h
smp.c Revert "Bluetooth: SMP: Fix assumption of Central always being Initiator" 2024-11-24 00:23:52 +01:00
smp.h Bluetooth: use inclusive language in SMP 2024-11-18 12:12:01 +01:00