Re: [syzbot] KASAN: use-after-free Read in l2cap_conn_del

Re: [syzbot] KASAN: use-after-free Read in l2cap_conn_del

[Hillf Danton]

On 26 Sep 2022 09:43:42 -0700
> syzbot found the following issue on:
> 
> HEAD commit:    aaa11ce2ffc8 Add linux-next specific files for 20220923
> git tree:       linux-next
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=14b32754880000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=186d1ff305f10294
> dashboard link: https://syzkaller.appspot.com/bug?extid=03450dacbc626061c3a3
> compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=12d389c4880000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=14269e38880000

Put refcount in balance for channel in bid to fix uaf.

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git  aaa11ce2ffc8 

--- a/net/bluetooth/a2mp.c
+++ b/net/bluetooth/a2mp.c
@@ -896,6 +896,8 @@ struct l2cap_chan *a2mp_channel_create(s
 		BT_ERR("Could not create AMP manager");
 		return NULL;
 	}
+	/* pair with put in l2cap_data_channel() */
+	l2cap_chan_hold(mgr->a2mp_chan);
 
 	BT_DBG("mgr: %p chan %p", mgr, mgr->a2mp_chan);
 
--

Re: [syzbot] KASAN: use-after-free Read in l2cap_conn_del

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+03450dacbc626061c3a3@syzkaller.appspotmail.com

Tested on:

commit:         aaa11ce2 Add linux-next specific files for 20220923
git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
console output: https://syzkaller.appspot.com/x/log.txt?x=172b6de2880000
kernel config:  https://syzkaller.appspot.com/x/.config?x=186d1ff305f10294
dashboard link: https://syzkaller.appspot.com/bug?extid=03450dacbc626061c3a3
compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch:          https://syzkaller.appspot.com/x/patch.diff?x=1069544a880000

Note: testing is done by a robot and is best-effort only.