From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Lin Ma <linma@zju.edu.cn>, Marcel Holtmann <marcel@holtmann.org>,
Sasha Levin <sashal@kernel.org>,
linux-bluetooth@vger.kernel.org, netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 5.4 15/29] Bluetooth: use correct lock to prevent UAF of hdev object
Date: Mon, 7 Jun 2021 12:13:56 -0400 [thread overview]
Message-ID: <20210607161410.3584036-15-sashal@kernel.org> (raw)
In-Reply-To: <20210607161410.3584036-1-sashal@kernel.org>
From: Lin Ma <linma@zju.edu.cn>
[ Upstream commit e305509e678b3a4af2b3cfd410f409f7cdaabb52 ]
The hci_sock_dev_event() function will cleanup the hdev object for
sockets even if this object may still be in used within the
hci_sock_bound_ioctl() function, result in UAF vulnerability.
This patch replace the BH context lock to serialize these affairs
and prevent the race condition.
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/hci_sock.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 8159b344deef..8d2c26c4b6d3 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -755,7 +755,7 @@ void hci_sock_dev_event(struct hci_dev *hdev, int event)
/* Detach sockets from device */
read_lock(&hci_sk_list.lock);
sk_for_each(sk, &hci_sk_list.head) {
- bh_lock_sock_nested(sk);
+ lock_sock(sk);
if (hci_pi(sk)->hdev == hdev) {
hci_pi(sk)->hdev = NULL;
sk->sk_err = EPIPE;
@@ -764,7 +764,7 @@ void hci_sock_dev_event(struct hci_dev *hdev, int event)
hci_dev_put(hdev);
}
- bh_unlock_sock(sk);
+ release_sock(sk);
}
read_unlock(&hci_sk_list.lock);
}
--
2.30.2
next prev parent reply other threads:[~2021-06-07 16:19 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-07 16:13 [PATCH AUTOSEL 5.4 01/29] net: ieee802154: fix null deref in parse dev addr Sasha Levin
2021-06-07 16:13 ` [PATCH AUTOSEL 5.4 02/29] HID: quirks: Set INCREMENT_USAGE_ON_DUPLICATE for Saitek X65 Sasha Levin
2021-06-07 16:13 ` [PATCH AUTOSEL 5.4 03/29] HID: hid-input: add mapping for emoji picker key Sasha Levin
2021-06-07 16:13 ` [PATCH AUTOSEL 5.4 04/29] HID: hid-sensor-hub: Return error for hid_set_field() failure Sasha Levin
2021-06-07 16:13 ` [PATCH AUTOSEL 5.4 05/29] HID: quirks: Add quirk for Lenovo optical mouse Sasha Levin
2021-06-07 16:13 ` [PATCH AUTOSEL 5.4 06/29] HID: multitouch: set Stylus suffix for Stylus-application devices, too Sasha Levin
2021-06-07 16:13 ` [PATCH AUTOSEL 5.4 07/29] HID: Add BUS_VIRTUAL to hid_connect logging Sasha Levin
2021-06-07 16:13 ` [PATCH AUTOSEL 5.4 08/29] HID: usbhid: fix info leak in hid_submit_ctrl Sasha Levin
2021-06-07 16:13 ` [PATCH AUTOSEL 5.4 09/29] drm/tegra: sor: Do not leak runtime PM reference Sasha Levin
2021-06-07 16:13 ` [PATCH AUTOSEL 5.4 10/29] ARM: OMAP2+: Fix build warning when mmc_omap is not built Sasha Levin
2021-06-07 16:13 ` [PATCH AUTOSEL 5.4 11/29] gfs2: Prevent direct-I/O write fallback errors from getting lost Sasha Levin
2021-06-07 16:13 ` [PATCH AUTOSEL 5.4 12/29] HID: gt683r: add missing MODULE_DEVICE_TABLE Sasha Levin
2021-06-07 16:13 ` [PATCH AUTOSEL 5.4 13/29] riscv: Use -mno-relax when using lld linker Sasha Levin
2021-06-07 16:13 ` [PATCH AUTOSEL 5.4 14/29] gfs2: Fix use-after-free in gfs2_glock_shrink_scan Sasha Levin
2021-06-07 16:13 ` Sasha Levin [this message]
2021-06-07 16:13 ` [PATCH AUTOSEL 5.4 16/29] scsi: target: core: Fix warning on realtime kernels Sasha Levin
2021-06-07 16:13 ` [PATCH AUTOSEL 5.4 17/29] ethernet: myri10ge: Fix missing error code in myri10ge_probe() Sasha Levin
2021-06-07 16:13 ` [PATCH AUTOSEL 5.4 18/29] scsi: qedf: Do not put host in qedf_vport_create() unconditionally Sasha Levin
2021-06-07 16:14 ` [PATCH AUTOSEL 5.4 19/29] scsi: scsi_devinfo: Add blacklist entry for HPE OPEN-V Sasha Levin
2021-06-07 16:14 ` [PATCH AUTOSEL 5.4 20/29] nvme-loop: reset queue count to 1 in nvme_loop_destroy_io_queues() Sasha Levin
2021-06-07 16:14 ` [PATCH AUTOSEL 5.4 21/29] nvme-loop: clear NVME_LOOP_Q_LIVE when nvme_loop_configure_admin_queue() fails Sasha Levin
2021-06-07 16:14 ` [PATCH AUTOSEL 5.4 22/29] nvme-loop: check for NVME_LOOP_Q_LIVE in nvme_loop_destroy_admin_queue() Sasha Levin
2021-06-07 16:14 ` [PATCH AUTOSEL 5.4 23/29] net: ipconfig: Don't override command-line hostnames or domains Sasha Levin
2021-06-07 16:14 ` [PATCH AUTOSEL 5.4 24/29] drm/amd/display: Allow bandwidth validation for 0 streams Sasha Levin
2021-06-07 16:14 ` [PATCH AUTOSEL 5.4 25/29] drm/amd/display: Fix overlay validation by considering cursors Sasha Levin
2021-06-07 16:14 ` [PATCH AUTOSEL 5.4 26/29] rtnetlink: Fix missing error code in rtnl_bridge_notify() Sasha Levin
2021-06-07 16:14 ` [PATCH AUTOSEL 5.4 27/29] net/x25: Return the correct errno code Sasha Levin
2021-06-07 16:14 ` [PATCH AUTOSEL 5.4 28/29] net: " Sasha Levin
2021-06-07 16:14 ` [PATCH AUTOSEL 5.4 29/29] fib: " Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210607161410.3584036-15-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=linma@zju.edu.cn \
--cc=linux-bluetooth@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=marcel@holtmann.org \
--cc=netdev@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox