Received: by 2002:a05:7412:419a:b0:f3:1519:9f41 with SMTP id i26csp79533rdh; Wed, 22 Nov 2023 19:19:15 -0800 (PST) X-Google-Smtp-Source: AGHT+IEf+8nwkBrqO7HorAAhwdJOO9IJtshNRMevmWu2FBET3PNBM4lA0MbfGv09l0hDNb90/Yf8 X-Received: by 2002:a05:6a20:8f06:b0:18a:df69:eabe with SMTP id b6-20020a056a208f0600b0018adf69eabemr2079826pzk.11.1700709554748; Wed, 22 Nov 2023 19:19:14 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1700709554; cv=none; d=google.com; s=arc-20160816; b=pYE/ew1vum/JCKFMEuI4wof8rF66Z3SC7PBWfS43yubLS3AQJgxH/3geJfblW7Npd6 xXGTd6TBdvOfKO53zRjyPP1+VYO8oHmBdMyr9GbFPTFlNWq1LSYYAoJWsWPvezVGeZKv J+5VEKQ+ZV2qijP1RVmKd4ZwEgIbrYNIUUCOGnAX+1QFG9GKvnNu/w61NGCI796qfYku B2TT+vFhcprxGLVIg9u+LK6Llq17zscfG7uyRZjPdM9+sFHjbVLoY2eQhL3dWrZHhC1b BzvsRn1/VJfpVByUv6SfFiqICCyTtlyMdiOwRjQt3QMwsvTPKNOK2KjoTgNr68vaUBD1 tg1Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:to:from:subject:message-id:in-reply-to:date :mime-version; bh=4SgUdCsrue3easXW3h1+6ZVf0VEc0EEtfc1xmfLb7x8=; fh=V9AeBafJgTW96HdC48wsxGAfd7Fe9P2uAL8tLCjpUN4=; b=oUCYYD/0W1HpTLzqVQDW+Dj+u2qSBoOjgYhZ+5nRcWa0jr1EGG78Xk9eaanAliD7E/ Tg0IHCHTtLk3N6rWrM8IW/WUTaq7W7DBOE7fTNTBVG1RY+uazF3mHilOJbWElmp22kOg V4/rPzFybNKC6bQp9Nu5jXrICa4YBYWjAqKy9DnwDWqj9mVXGo2fpS8ROcYl0YxLs7og 86zXoahXTD3RMwqgQcVEks2iMntkCL3fT10FFVxaG7SQ7jn/smfXNhO+QtoTyGjqwBRB bdfsaucyvwr8iIgvKW8BS+PJqqWd4vbCql93XyH5G2LF3d12fDn+CgKo4VsonZaWF1ag HDIQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.33 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=appspotmail.com Return-Path: Received: from lipwig.vger.email (lipwig.vger.email. [23.128.96.33]) by mx.google.com with ESMTPS id t3-20020a63d243000000b005c21fbab567si438441pgi.659.2023.11.22.19.19.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 22 Nov 2023 19:19:14 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.33 as permitted sender) client-ip=23.128.96.33; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.33 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=appspotmail.com Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by lipwig.vger.email (Postfix) with ESMTP id 3A130825EFEA; Wed, 22 Nov 2023 19:19:12 -0800 (PST) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.11 at lipwig.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344420AbjKWDS7 (ORCPT + 99 others); Wed, 22 Nov 2023 22:18:59 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53920 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232615AbjKWDS6 (ORCPT ); Wed, 22 Nov 2023 22:18:58 -0500 Received: from mail-pl1-f200.google.com (mail-pl1-f200.google.com [209.85.214.200]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EB76B1B3 for ; Wed, 22 Nov 2023 19:19:04 -0800 (PST) Received: by mail-pl1-f200.google.com with SMTP id d9443c01a7336-1cf6177552cso5785625ad.3 for ; Wed, 22 Nov 2023 19:19:04 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1700709544; x=1701314344; h=to:from:subject:message-id:in-reply-to:date:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=4SgUdCsrue3easXW3h1+6ZVf0VEc0EEtfc1xmfLb7x8=; b=IFFkBs63rFxlYmJLuB/bdI0PvlkfgTc1LWCEapuefyLTZ6sIP3tJehKf5ESOmxafHY vsD2vUO0l0drYzNzau53RckdSlXNzMFDd7d5KWmionJ4ZwX0hD+VI4DYNwq1t7LhU/bR iI7BoQrpOPg2pNCZhmTrn1Hvfo8iNIUmhZy5vPzDielaUTfQ7c72mgmyZbDvezWNDkcS biYQv7zJicgWbTkioVXBsErfedu8IyeHNnN9jV8CdHpie1RGDY0AXQOMRf2vuFqlUV6F pjUGy9GMn1BecWHgjHLOM7p+P267uWKFDoe3CP7J5VO9rwfyK+Hpe2LpJtQ2VEbhgy5R tn5w== X-Gm-Message-State: AOJu0Yw7blanfXmUwGS6sSfTbSvY1GkvroH57Lf5vla31fM3Y3FQLXjC QOM5fhlmcOWmvWaJVdHn6kL6gPbNdOHCYbWyqe+Kbgosq/x/n3k= MIME-Version: 1.0 X-Received: by 2002:a17:902:bb8f:b0:1cf:669f:3a86 with SMTP id m15-20020a170902bb8f00b001cf669f3a86mr934760pls.13.1700709544589; Wed, 22 Nov 2023 19:19:04 -0800 (PST) Date: Wed, 22 Nov 2023 19:19:04 -0800 In-Reply-To: <0000000000007b84a2060ac7d84b@google.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <0000000000004581cd060ac94c84@google.com> Subject: Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in __lock_sock From: syzbot To: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="UTF-8" X-Spam-Status: No, score=-0.4 required=5.0 tests=FROM_LOCAL_HEX, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lipwig.vger.email Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (lipwig.vger.email [0.0.0.0]); Wed, 22 Nov 2023 19:19:12 -0800 (PST) For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org. *** Subject: [bluetooth?] KASAN: slab-use-after-free Read in __lock_sock Author: eadavis@qq.com please test uaf in __lock_sock #syz test https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git 8de1e7afcc1c diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c index c736186aba26..3d76352d3e79 100644 --- a/net/bluetooth/sco.c +++ b/net/bluetooth/sco.c @@ -270,6 +270,7 @@ static int sco_connect(struct sock *sk) goto unlock; } + hci_conn_get(hcon); conn = sco_conn_add(hcon); if (!conn) { hci_conn_drop(hcon); @@ -300,7 +301,6 @@ static int sco_connect(struct sock *sk) unlock: hci_dev_unlock(hdev); - hci_dev_put(hdev); return err; } @@ -438,12 +438,13 @@ static void __sco_sock_close(struct sock *sk) case BT_CONNECTED: case BT_CONFIG: if (sco_pi(sk)->conn->hcon) { + struct hci_conn *hcon = sco_pi(sk)->conn->hcon; sk->sk_state = BT_DISCONN; sco_sock_set_timer(sk, SCO_DISCONN_TIMEOUT); sco_conn_lock(sco_pi(sk)->conn); - hci_conn_drop(sco_pi(sk)->conn->hcon); sco_pi(sk)->conn->hcon = NULL; sco_conn_unlock(sco_pi(sk)->conn); + hci_conn_put(hcon); } else sco_chan_del(sk, ECONNRESET); break;