From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Sudip Mukherjee <sudipm.mukherjee@gmail.com>,
Marcel Holtmann <marcel@holtmann.org>
Subject: [PATCH 4.17 35/42] Bluetooth: avoid killing an already killed socket
Date: Tue, 21 Aug 2018 08:21:07 +0200 [thread overview]
Message-ID: <20180821055019.330777960@linuxfoundation.org> (raw)
In-Reply-To: <20180821055017.596264829@linuxfoundation.org>
4.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
commit 4e1a720d0312fd510699032c7694a362a010170f upstream.
slub debug reported:
[ 440.648642] =============================================================================
[ 440.648649] BUG kmalloc-1024 (Tainted: G BU O ): Poison overwritten
[ 440.648651] -----------------------------------------------------------------------------
[ 440.648655] INFO: 0xe70f4bec-0xe70f4bec. First byte 0x6a instead of 0x6b
[ 440.648665] INFO: Allocated in sk_prot_alloc+0x6b/0xc6 age=33155 cpu=1 pid=1047
[ 440.648671] ___slab_alloc.constprop.24+0x1fc/0x292
[ 440.648675] __slab_alloc.isra.18.constprop.23+0x1c/0x25
[ 440.648677] __kmalloc+0xb6/0x17f
[ 440.648680] sk_prot_alloc+0x6b/0xc6
[ 440.648683] sk_alloc+0x1e/0xa1
[ 440.648700] sco_sock_alloc.constprop.6+0x26/0xaf [bluetooth]
[ 440.648716] sco_connect_cfm+0x166/0x281 [bluetooth]
[ 440.648731] hci_conn_request_evt.isra.53+0x258/0x281 [bluetooth]
[ 440.648746] hci_event_packet+0x28b/0x2326 [bluetooth]
[ 440.648759] hci_rx_work+0x161/0x291 [bluetooth]
[ 440.648764] process_one_work+0x163/0x2b2
[ 440.648767] worker_thread+0x1a9/0x25c
[ 440.648770] kthread+0xf8/0xfd
[ 440.648774] ret_from_fork+0x2e/0x38
[ 440.648779] INFO: Freed in __sk_destruct+0xd3/0xdf age=3815 cpu=1 pid=1047
[ 440.648782] __slab_free+0x4b/0x27a
[ 440.648784] kfree+0x12e/0x155
[ 440.648787] __sk_destruct+0xd3/0xdf
[ 440.648790] sk_destruct+0x27/0x29
[ 440.648793] __sk_free+0x75/0x91
[ 440.648795] sk_free+0x1c/0x1e
[ 440.648810] sco_sock_kill+0x5a/0x5f [bluetooth]
[ 440.648825] sco_conn_del+0x8e/0xba [bluetooth]
[ 440.648840] sco_disconn_cfm+0x3a/0x41 [bluetooth]
[ 440.648855] hci_event_packet+0x45e/0x2326 [bluetooth]
[ 440.648868] hci_rx_work+0x161/0x291 [bluetooth]
[ 440.648872] process_one_work+0x163/0x2b2
[ 440.648875] worker_thread+0x1a9/0x25c
[ 440.648877] kthread+0xf8/0xfd
[ 440.648880] ret_from_fork+0x2e/0x38
[ 440.648884] INFO: Slab 0xf4718580 objects=27 used=27 fp=0x (null) flags=0x40008100
[ 440.648886] INFO: Object 0xe70f4b88 @offset=19336 fp=0xe70f54f8
When KASAN was enabled, it reported:
[ 210.096613] ==================================================================
[ 210.096634] BUG: KASAN: use-after-free in ex_handler_refcount+0x5b/0x127
[ 210.096641] Write of size 4 at addr ffff880107e17160 by task kworker/u9:1/2040
[ 210.096651] CPU: 1 PID: 2040 Comm: kworker/u9:1 Tainted: G U O 4.14.47-20180606+ #2
[ 210.096654] Hardware name: , BIOS 2017.01-00087-g43e04de 08/30/2017
[ 210.096693] Workqueue: hci0 hci_rx_work [bluetooth]
[ 210.096698] Call Trace:
[ 210.096711] dump_stack+0x46/0x59
[ 210.096722] print_address_description+0x6b/0x23b
[ 210.096729] ? ex_handler_refcount+0x5b/0x127
[ 210.096736] kasan_report+0x220/0x246
[ 210.096744] ex_handler_refcount+0x5b/0x127
[ 210.096751] ? ex_handler_clear_fs+0x85/0x85
[ 210.096757] fixup_exception+0x8c/0x96
[ 210.096766] do_trap+0x66/0x2c1
[ 210.096773] do_error_trap+0x152/0x180
[ 210.096781] ? fixup_bug+0x78/0x78
[ 210.096817] ? hci_debugfs_create_conn+0x244/0x26a [bluetooth]
[ 210.096824] ? __schedule+0x113b/0x1453
[ 210.096830] ? sysctl_net_exit+0xe/0xe
[ 210.096837] ? __wake_up_common+0x343/0x343
[ 210.096843] ? insert_work+0x107/0x163
[ 210.096850] invalid_op+0x1b/0x40
[ 210.096888] RIP: 0010:hci_debugfs_create_conn+0x244/0x26a [bluetooth]
[ 210.096892] RSP: 0018:ffff880094a0f970 EFLAGS: 00010296
[ 210.096898] RAX: 0000000000000000 RBX: ffff880107e170e8 RCX: ffff880107e17160
[ 210.096902] RDX: 000000000000002f RSI: ffff88013b80ed40 RDI: ffffffffa058b940
[ 210.096906] RBP: ffff88011b2b0578 R08: 00000000852f0ec9 R09: ffffffff81cfcf9b
[ 210.096909] R10: 00000000d21bdad7 R11: 0000000000000001 R12: ffff8800967b0488
[ 210.096913] R13: ffff880107e17168 R14: 0000000000000068 R15: ffff8800949c0008
[ 210.096920] ? __sk_destruct+0x2c6/0x2d4
[ 210.096959] hci_event_packet+0xff5/0x7de2 [bluetooth]
[ 210.096969] ? __local_bh_enable_ip+0x43/0x5b
[ 210.097004] ? l2cap_sock_recv_cb+0x158/0x166 [bluetooth]
[ 210.097039] ? hci_le_meta_evt+0x2bb3/0x2bb3 [bluetooth]
[ 210.097075] ? l2cap_ertm_init+0x94e/0x94e [bluetooth]
[ 210.097093] ? xhci_urb_enqueue+0xbd8/0xcf5 [xhci_hcd]
[ 210.097102] ? __accumulate_pelt_segments+0x24/0x33
[ 210.097109] ? __accumulate_pelt_segments+0x24/0x33
[ 210.097115] ? __update_load_avg_se.isra.2+0x217/0x3a4
[ 210.097122] ? set_next_entity+0x7c3/0x12cd
[ 210.097128] ? pick_next_entity+0x25e/0x26c
[ 210.097135] ? pick_next_task_fair+0x2ca/0xc1a
[ 210.097141] ? switch_mm_irqs_off+0x346/0xb4f
[ 210.097147] ? __switch_to+0x769/0xbc4
[ 210.097153] ? compat_start_thread+0x66/0x66
[ 210.097188] ? hci_conn_check_link_mode+0x1cd/0x1cd [bluetooth]
[ 210.097195] ? finish_task_switch+0x392/0x431
[ 210.097228] ? hci_rx_work+0x154/0x487 [bluetooth]
[ 210.097260] hci_rx_work+0x154/0x487 [bluetooth]
[ 210.097269] process_one_work+0x579/0x9e9
[ 210.097277] worker_thread+0x68f/0x804
[ 210.097285] kthread+0x31c/0x32b
[ 210.097292] ? rescuer_thread+0x70c/0x70c
[ 210.097299] ? kthread_create_on_node+0xa3/0xa3
[ 210.097306] ret_from_fork+0x35/0x40
[ 210.097314] Allocated by task 2040:
[ 210.097323] kasan_kmalloc.part.1+0x51/0xc7
[ 210.097328] __kmalloc+0x17f/0x1b6
[ 210.097335] sk_prot_alloc+0xf2/0x1a3
[ 210.097340] sk_alloc+0x22/0x297
[ 210.097375] sco_sock_alloc.constprop.7+0x23/0x202 [bluetooth]
[ 210.097410] sco_connect_cfm+0x2d0/0x566 [bluetooth]
[ 210.097443] hci_conn_request_evt.isra.53+0x6d3/0x762 [bluetooth]
[ 210.097476] hci_event_packet+0x85e/0x7de2 [bluetooth]
[ 210.097507] hci_rx_work+0x154/0x487 [bluetooth]
[ 210.097512] process_one_work+0x579/0x9e9
[ 210.097517] worker_thread+0x68f/0x804
[ 210.097523] kthread+0x31c/0x32b
[ 210.097529] ret_from_fork+0x35/0x40
[ 210.097533] Freed by task 2040:
[ 210.097539] kasan_slab_free+0xb3/0x15e
[ 210.097544] kfree+0x103/0x1a9
[ 210.097549] __sk_destruct+0x2c6/0x2d4
[ 210.097584] sco_conn_del.isra.1+0xba/0x10e [bluetooth]
[ 210.097617] hci_event_packet+0xff5/0x7de2 [bluetooth]
[ 210.097648] hci_rx_work+0x154/0x487 [bluetooth]
[ 210.097653] process_one_work+0x579/0x9e9
[ 210.097658] worker_thread+0x68f/0x804
[ 210.097663] kthread+0x31c/0x32b
[ 210.097670] ret_from_fork+0x35/0x40
[ 210.097676] The buggy address belongs to the object at ffff880107e170e8
which belongs to the cache kmalloc-1024 of size 1024
[ 210.097681] The buggy address is located 120 bytes inside of
1024-byte region [ffff880107e170e8, ffff880107e174e8)
[ 210.097683] The buggy address belongs to the page:
[ 210.097689] page:ffffea00041f8400 count:1 mapcount:0 mapping: (null) index:0xffff880107e15b68 compound_mapcount: 0
[ 210.110194] flags: 0x8000000000008100(slab|head)
[ 210.115441] raw: 8000000000008100 0000000000000000 ffff880107e15b68 0000000100170016
[ 210.115448] raw: ffffea0004a47620 ffffea0004b48e20 ffff88013b80ed40 0000000000000000
[ 210.115451] page dumped because: kasan: bad access detected
[ 210.115454] Memory state around the buggy address:
[ 210.115460] ffff880107e17000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 210.115465] ffff880107e17080: fc fc fc fc fc fc fc fc fc fc fc fc fc fb fb fb
[ 210.115469] >ffff880107e17100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 210.115472] ^
[ 210.115477] ffff880107e17180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 210.115481] ffff880107e17200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 210.115483] ==================================================================
And finally when BT_DBG() and ftrace was enabled it showed:
<...>-14979 [001] .... 186.104191: sco_sock_kill <-sco_sock_close
<...>-14979 [001] .... 186.104191: sco_sock_kill <-sco_sock_release
<...>-14979 [001] .... 186.104192: sco_sock_kill: sk ef0497a0 state 9
<...>-14979 [001] .... 186.104193: bt_sock_unlink <-sco_sock_kill
kworker/u9:2-792 [001] .... 186.104246: sco_sock_kill <-sco_conn_del
kworker/u9:2-792 [001] .... 186.104248: sco_sock_kill: sk ef0497a0 state 9
kworker/u9:2-792 [001] .... 186.104249: bt_sock_unlink <-sco_sock_kill
kworker/u9:2-792 [001] .... 186.104250: sco_sock_destruct <-__sk_destruct
kworker/u9:2-792 [001] .... 186.104250: sco_sock_destruct: sk ef0497a0
kworker/u9:2-792 [001] .... 186.104860: hci_conn_del <-hci_event_packet
kworker/u9:2-792 [001] .... 186.104864: hci_conn_del: hci0 hcon ef0484c0 handle 266
Only in the failed case, sco_sock_kill() gets called with the same sock
pointer two times. Add a check for SOCK_DEAD to avoid continue killing
a socket which has already been killed.
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/sco.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -393,7 +393,8 @@ static void sco_sock_cleanup_listen(stru
*/
static void sco_sock_kill(struct sock *sk)
{
- if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
+ if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket ||
+ sock_flag(sk, SOCK_DEAD))
return;
BT_DBG("sk %p state %d", sk, sk->sk_state);
next prev parent reply other threads:[~2018-08-21 6:25 UTC|newest]
Thread overview: 46+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-08-21 6:20 [PATCH 4.17 00/42] 4.17.18-stable review Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 01/42] dccp: fix undefined behavior with cwnd shift in ccid2_cwnd_restart() Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 02/42] l2tp: use sk_dst_check() to avoid race on sk->sk_dst_cache Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 03/42] llc: use refcount_inc_not_zero() for llc_sap_find() Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 04/42] net_sched: fix NULL pointer dereference when delete tcindex filter Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 05/42] vsock: split dwork to avoid reinitializations Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 06/42] net_sched: Fix missing res info when create new tc_index filter Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 07/42] vhost: reset metadata cache when initializing new IOTLB Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 08/42] mlxsw: core_acl_flex_actions: Return error for conflicting actions Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 09/42] net: aquantia: Fix IFF_ALLMULTI flag functionality Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 10/42] ip6_tunnel: use the right value for ipv4 min mtu check in ip6_tnl_xmit Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 11/42] mlxsw: core_acl_flex_actions: Remove redundant resource destruction Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 12/42] mlxsw: core_acl_flex_actions: Remove redundant counter destruction Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 13/42] mlxsw: core_acl_flex_actions: Remove redundant mirror resource destruction Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 14/42] net/mlx5e: Properly check if hairpin is possible between two functions Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 15/42] r8169: dont use MSI-X on RTL8168g Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 16/42] rxrpc: Fix the keepalive generator [ver #2] Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 17/42] ALSA: hda - Sleep for 10ms after entering D3 on Conexant codecs Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 18/42] ALSA: hda - Turn CX8200 into D3 as well upon reboot Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 19/42] ALSA: vx222: Fix invalid endian conversions Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 20/42] ALSA: virmidi: Fix too long output trigger loop Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 21/42] ALSA: cs5535audio: Fix invalid endian conversion Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 22/42] ALSA: hda: Correct Asrock B85M-ITX power_save blacklist entry Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 23/42] ALSA: memalloc: Dont exceed over the requested size Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 24/42] ALSA: vxpocket: Fix invalid endian conversions Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 25/42] ALSA: seq: Fix poll() error return Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 26/42] USB: serial: sierra: fix potential deadlock at close Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 27/42] USB: serial: pl2303: add a new device id for ATEN Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 28/42] USB: option: add support for DW5821e Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 29/42] ACPI / PM: save NVS memory for ASUS 1025C laptop Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 30/42] tty: serial: 8250: Revert NXP SC16C2552 workaround Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 31/42] serial: 8250_exar: Read INT0 from slave device, too Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 32/42] serial: 8250_dw: always set baud rate in dw8250_set_termios Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 33/42] serial: 8250_dw: Add ACPI support for uart on Broadcom SoC Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 34/42] misc: sram: fix resource leaks in probe error path Greg Kroah-Hartman
2018-08-21 6:21 ` Greg Kroah-Hartman [this message]
2018-08-21 6:21 ` [PATCH 4.17 36/42] isdn: Disable IIOCDBGVAR Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 37/42] net: sock_diag: Fix spectre v1 gadget in __sock_diag_cmd() Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 38/42] r8169: dont use MSI-X on RTL8106e Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 39/42] ip_vti: fix a null pointer deferrence when create vti fallback tunnel Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 40/42] cls_matchall: fix tcf_unbind_filter missing Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 41/42] net: ethernet: mvneta: Fix napi structure mixup on armada 3700 Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 42/42] net: mvneta: fix mvneta_config_rss " Greg Kroah-Hartman
2018-08-21 14:58 ` [PATCH 4.17 00/42] 4.17.18-stable review Guenter Roeck
2018-08-21 18:04 ` Naresh Kamboju
2018-08-21 19:44 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180821055019.330777960@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=marcel@holtmann.org \
--cc=stable@vger.kernel.org \
--cc=sudipm.mukherjee@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.