From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
patches@lists.linux.dev,
syzbot+e5e64cdf8e92046dd3e1@syzkaller.appspotmail.com,
Kuniyuki Iwashima <kuniyu@google.com>,
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.15 12/64] Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
Date: Sun, 7 Sep 2025 21:57:54 +0200 [thread overview]
Message-ID: <20250907195603.744414062@linuxfoundation.org> (raw)
In-Reply-To: <20250907195603.394640159@linuxfoundation.org>
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <kuniyu@google.com>
[ Upstream commit 862c628108562d8c7a516a900034823b381d3cba ]
syzbot reported the splat below without a repro.
In the splat, a single thread calling bt_accept_dequeue() freed sk
and touched it after that.
The root cause would be the racy l2cap_sock_cleanup_listen() call
added by the cited commit.
bt_accept_dequeue() is called under lock_sock() except for
l2cap_sock_release().
Two threads could see the same socket during the list iteration
in bt_accept_dequeue():
CPU1 CPU2 (close())
---- ----
sock_hold(sk) sock_hold(sk);
lock_sock(sk) <-- block close()
sock_put(sk)
bt_accept_unlink(sk)
sock_put(sk) <-- refcnt by bt_accept_enqueue()
release_sock(sk)
lock_sock(sk)
sock_put(sk)
bt_accept_unlink(sk)
sock_put(sk) <-- last refcnt
bt_accept_unlink(sk) <-- UAF
Depending on the timing, the other thread could show up in the
"Freed by task" part.
Let's call l2cap_sock_cleanup_listen() under lock_sock() in
l2cap_sock_release().
[0]:
BUG: KASAN: slab-use-after-free in debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline]
BUG: KASAN: slab-use-after-free in do_raw_spin_lock+0x26f/0x2b0 kernel/locking/spinlock_debug.c:115
Read of size 4 at addr ffff88803b7eb1c4 by task syz.5.3276/16995
CPU: 3 UID: 0 PID: 16995 Comm: syz.5.3276 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xcd/0x630 mm/kasan/report.c:482
kasan_report+0xe0/0x110 mm/kasan/report.c:595
debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline]
do_raw_spin_lock+0x26f/0x2b0 kernel/locking/spinlock_debug.c:115
spin_lock_bh include/linux/spinlock.h:356 [inline]
release_sock+0x21/0x220 net/core/sock.c:3746
bt_accept_dequeue+0x505/0x600 net/bluetooth/af_bluetooth.c:312
l2cap_sock_cleanup_listen+0x5c/0x2a0 net/bluetooth/l2cap_sock.c:1451
l2cap_sock_release+0x5c/0x210 net/bluetooth/l2cap_sock.c:1425
__sock_release+0xb3/0x270 net/socket.c:649
sock_close+0x1c/0x30 net/socket.c:1439
__fput+0x3ff/0xb70 fs/file_table.c:468
task_work_run+0x14d/0x240 kernel/task_work.c:227
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:43
exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2accf8ebe9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdb6cb1378 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00000000000426fb RCX: 00007f2accf8ebe9
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f2acd1b7da0 R08: 0000000000000001 R09: 00000012b6cb166f
R10: 0000001b30e20000 R11: 0000000000000246 R12: 00007f2acd1b609c
R13: 00007f2acd1b6090 R14: ffffffffffffffff R15: 00007ffdb6cb1490
</TASK>
Allocated by task 5326:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:388 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:405
kasan_kmalloc include/linux/kasan.h:260 [inline]
__do_kmalloc_node mm/slub.c:4365 [inline]
__kmalloc_noprof+0x223/0x510 mm/slub.c:4377
kmalloc_noprof include/linux/slab.h:909 [inline]
sk_prot_alloc+0x1a8/0x2a0 net/core/sock.c:2239
sk_alloc+0x36/0xc20 net/core/sock.c:2295
bt_sock_alloc+0x3b/0x3a0 net/bluetooth/af_bluetooth.c:151
l2cap_sock_alloc.constprop.0+0x33/0x1d0 net/bluetooth/l2cap_sock.c:1894
l2cap_sock_new_connection_cb+0x101/0x240 net/bluetooth/l2cap_sock.c:1482
l2cap_connect_cfm+0x4c4/0xf80 net/bluetooth/l2cap_core.c:7287
hci_connect_cfm include/net/bluetooth/hci_core.h:2050 [inline]
hci_remote_features_evt+0x4dd/0x970 net/bluetooth/hci_event.c:3712
hci_event_func net/bluetooth/hci_event.c:7519 [inline]
hci_event_packet+0xa0d/0x11c0 net/bluetooth/hci_event.c:7573
hci_rx_work+0x2c5/0x16b0 net/bluetooth/hci_core.c:4071
process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3236
process_scheduled_works kernel/workqueue.c:3319 [inline]
worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400
kthread+0x3c2/0x780 kernel/kthread.c:463
ret_from_fork+0x5d7/0x6f0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Freed by task 16995:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:243 [inline]
__kasan_slab_free+0x60/0x70 mm/kasan/common.c:275
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2417 [inline]
slab_free mm/slub.c:4680 [inline]
kfree+0x2b4/0x4d0 mm/slub.c:4879
sk_prot_free net/core/sock.c:2278 [inline]
__sk_destruct+0x75f/0x9a0 net/core/sock.c:2373
sk_destruct+0xc2/0xf0 net/core/sock.c:2401
__sk_free+0xf4/0x3e0 net/core/sock.c:2412
sk_free+0x6a/0x90 net/core/sock.c:2423
sock_put include/net/sock.h:1960 [inline]
bt_accept_unlink+0x245/0x2e0 net/bluetooth/af_bluetooth.c:262
bt_accept_dequeue+0x517/0x600 net/bluetooth/af_bluetooth.c:308
l2cap_sock_cleanup_listen+0x5c/0x2a0 net/bluetooth/l2cap_sock.c:1451
l2cap_sock_release+0x5c/0x210 net/bluetooth/l2cap_sock.c:1425
__sock_release+0xb3/0x270 net/socket.c:649
sock_close+0x1c/0x30 net/socket.c:1439
__fput+0x3ff/0xb70 fs/file_table.c:468
task_work_run+0x14d/0x240 kernel/task_work.c:227
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:43
exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Fixes: 1728137b33c0 ("Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb")
Reported-by: syzbot+e5e64cdf8e92046dd3e1@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-bluetooth/68af6b9d.a70a0220.3cafd4.0032.GAE@google.com/
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/l2cap_sock.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index b2719f1b8adff..8e2e6d1a6dd15 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1416,7 +1416,10 @@ static int l2cap_sock_release(struct socket *sock)
if (!sk)
return 0;
+ lock_sock_nested(sk, L2CAP_NESTING_PARENT);
l2cap_sock_cleanup_listen(sk);
+ release_sock(sk);
+
bt_sock_unlink(&l2cap_sk_list, sk);
err = l2cap_sock_shutdown(sock, SHUT_RDWR);
--
2.50.1
next prev parent reply other threads:[~2025-09-07 20:12 UTC|newest]
Thread overview: 77+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-09-07 19:57 [PATCH 5.15 00/64] 5.15.192-rc1 review Greg Kroah-Hartman
2025-09-07 19:57 ` [PATCH 5.15 01/64] bpf: Add cookie object to bpf maps Greg Kroah-Hartman
2025-09-07 19:57 ` [PATCH 5.15 02/64] bpf: Move cgroup iterator helpers to bpf.h Greg Kroah-Hartman
2025-09-07 19:57 ` [PATCH 5.15 03/64] bpf: Move bpf map owner out of common struct Greg Kroah-Hartman
2025-09-07 19:57 ` [PATCH 5.15 04/64] bpf: Fix oob access in cgroup local storage Greg Kroah-Hartman
2025-09-07 19:57 ` [PATCH 5.15 05/64] drm/amd/display: Dont warn when missing DCE encoder caps Greg Kroah-Hartman
2025-09-07 19:57 ` [PATCH 5.15 06/64] fs: writeback: fix use-after-free in __mark_inode_dirty() Greg Kroah-Hartman
2025-09-07 19:57 ` [PATCH 5.15 07/64] tee: fix NULL pointer dereference in tee_shm_put Greg Kroah-Hartman
2025-09-07 19:57 ` [PATCH 5.15 08/64] arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro Greg Kroah-Hartman
2025-09-07 19:57 ` [PATCH 5.15 09/64] wifi: cfg80211: fix use-after-free in cmp_bss() Greg Kroah-Hartman
2025-09-07 19:57 ` [PATCH 5.15 10/64] netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm Greg Kroah-Hartman
2025-09-07 19:57 ` [PATCH 5.15 11/64] netfilter: conntrack: helper: Replace -EEXIST by -EBUSY Greg Kroah-Hartman
2025-09-07 19:57 ` Greg Kroah-Hartman [this message]
2025-09-07 19:57 ` [PATCH 5.15 13/64] xirc2ps_cs: fix register access when enabling FullDuplex Greg Kroah-Hartman
2025-09-07 19:57 ` [PATCH 5.15 14/64] mISDN: Fix memory leak in dsp_hwec_enable() Greg Kroah-Hartman
2025-09-07 19:57 ` [PATCH 5.15 15/64] icmp: fix icmp_ndo_send address translation for reply direction Greg Kroah-Hartman
2025-09-07 19:57 ` [PATCH 5.15 16/64] i40e: Fix potential invalid access when MAC list is empty Greg Kroah-Hartman
2025-09-07 19:57 ` [PATCH 5.15 17/64] net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 18/64] wifi: cw1200: cap SSID length in cw1200_do_join() Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 19/64] wifi: libertas: cap SSID len in lbs_associate() Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 20/64] net: thunder_bgx: add a missing of_node_put Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 21/64] net: thunder_bgx: decrement cleanup index before use Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 22/64] ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 23/64] ax25: properly unshare skbs in ax25_kiss_rcv() Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 24/64] net: atm: fix memory leak in atm_register_sysfs when device_register fail Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 25/64] ppp: fix memory leak in pad_compress_skb Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 26/64] ptp: Add generic PTP is_sync() function Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 27/64] net: phy: mscc: Fix memory leak when using one step timestamping Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 28/64] phy: mscc: Stop taking ts_lock for tx_queue and use its own lock Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 29/64] ALSA: usb-audio: Add mute TLV for playback volumes on some devices Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 30/64] pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 31/64] x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 32/64] mm: move page table sync declarations to linux/pgtable.h Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 33/64] wifi: mwifiex: Initialize the chan_stats array to zero Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 34/64] drm/amdgpu: drop hw access in non-DC audio fini Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 35/64] scsi: lpfc: Fix buffer free/clear order in deferred receive path Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 36/64] batman-adv: fix OOB read/write in network-coding decode Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 37/64] e1000e: fix heap overflow in e1000_set_eeprom Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 38/64] mm/khugepaged: fix ->anon_vma race Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 39/64] cpufreq/sched: Explicitly synchronize limits_changed flag handling Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 40/64] KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 41/64] spi: tegra114: Remove unnecessary NULL-pointer checks Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 42/64] spi: tegra114: Dont fail set_cs_timing when delays are zero Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 43/64] iio: chemical: pms7003: use aligned_s64 for timestamp Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 44/64] iio: light: opt3001: fix deadlock due to concurrent flag access Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 45/64] gpio: pca953x: fix IRQ storm on system wake up Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 46/64] dma-buf: insert memory barrier before updating num_fences Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 47/64] dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 48/64] net: dsa: microchip: update tag_ksz masks for KSZ9477 family Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 49/64] net: dsa: microchip: linearize skb for tail-tagging switches Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 50/64] vmxnet3: update MTU after device quiesce Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 51/64] arm64: dts: marvell: uDPU: define pinctrl state for alarm LEDs Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 52/64] randstruct: gcc-plugin: Remove bogus void member Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 53/64] randstruct: gcc-plugin: Fix attribute addition Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 54/64] mm/slub: avoid accessing metadata when pointer is invalid in object_err() Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 55/64] ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 56/64] pcmcia: Add error handling for add_interval() in do_validate_mem() Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 57/64] spi: spi-fsl-lpspi: Fix transmissions when using CONT Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 58/64] spi: spi-fsl-lpspi: Set correct chip-select polarity bit Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 59/64] spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 60/64] drm/bridge: ti-sn65dsi86: fix REFCLK setting Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 61/64] perf bpf-event: Fix use-after-free in synthesis Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 62/64] clk: qcom: gdsc: Set retain_ff before moving to HW CTRL Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 63/64] spi: tegra114: Use value to check for invalid delays Greg Kroah-Hartman
2025-09-07 19:58 ` [PATCH 5.15 64/64] dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() Greg Kroah-Hartman
2025-09-08 2:35 ` [PATCH 5.15 00/64] 5.15.192-rc1 review Florian Fainelli
2025-09-08 9:27 ` Brett A C Sheffield
2025-09-08 15:01 ` Jon Hunter
2025-09-08 18:24 ` Naresh Kamboju
2025-09-09 10:29 ` Greg Kroah-Hartman
2025-09-09 14:18 ` Naresh Kamboju
2025-09-09 14:37 ` Greg Kroah-Hartman
2025-09-08 22:52 ` Shuah Khan
2025-09-09 6:14 ` Ron Economos
2025-09-09 14:10 ` Vijayendra Suman
2025-09-17 8:03 ` Pavel Machek
2025-09-09 17:36 ` Hardik Garg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250907195603.744414062@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=kuniyu@google.com \
--cc=luiz.von.dentz@intel.com \
--cc=patches@lists.linux.dev \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+e5e64cdf8e92046dd3e1@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).