Received: by 2002:a05:6358:3188:b0:123:57c1:9b43 with SMTP id q8csp234575rwd; Wed, 24 May 2023 17:23:12 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ7Tq9/e6gH3/GiV3H8X2rVjYqfxXOOnDE5QTbOfQ9Ro+D/TgD4QPlOVF1Qr7+5fOWQlQWnL X-Received: by 2002:a05:6a20:1449:b0:10c:8e0f:7b19 with SMTP id a9-20020a056a20144900b0010c8e0f7b19mr8351544pzi.57.1684974192494; Wed, 24 May 2023 17:23:12 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1684974192; cv=none; d=google.com; s=arc-20160816; b=eZLFpbq67adM1H2ncjtEJb2w9iT+IVpARE5jEkS2EYFmR/nrlwcoRZg9T9ezIEAAus SjsammOnslLZhRDSizgFHfTgdMTfu4yHmF6sZpeolVKSUKMb8TJp52GJXUw1AzJzhYoJ NaxgjpyFy3zwTdQ6Go7Jyy+ni+Pwm+xdVItStaRIqBHRk4actxUjzRTVXYuq+Uk4mwyE YYbykLn1adPHYdKLC+LH336mvDHn10BcTU/FxzqDdU9UhSt/ocwzkXXzu4HfFDABqob6 cAJMlk9PtozLgNy177oVhbzLExsVy2xXY94U/fqVzq54sK6bUs/9mFV6mEjiUFr/Crtm S3pw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:cc:to:from:subject:message-id:mime-version:date :dkim-signature; bh=JxmNnYgfaOtAwG3k7PZVh3xrHSOh7px0pgm2Rioiw6o=; b=RvtjYwZqp0wvJ2vXs3zjHKQxBkVIWrPsMNzkslSNI7asIRx/OJJM7dYKuyE8HOotz6 t9num16vXOON4GgXIzvDlUNUzdh80o+JYLGI45PVf89D6mxQqlkaE6u/Zs0XXOHDxifC uipa6Etjv0q5bE1du6RuKXn0u4Q9wjuqa8X5v92X7J5AyddTR1sYXwig4xs9PiqsoPMl JoHxPWQZzYpwlMBjCMGoTk3ffREnfpSs4RJL6Vy0p+J+a7VYjkMAxSEWNfGHhfpRkYOg VX1oxOHRMN/rHamhkShCRdqPkriAQIPGSGRveeVAQC3uR+FJeSkUlVXjH6PQ7c+J9CY5 zJqQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@google.com header.s=20221208 header.b="Zj/fw8nm"; spf=pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-bluetooth-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id lw8-20020a17090b180800b0024e16a5935bsi223536pjb.54.2023.05.24.17.21.58; Wed, 24 May 2023 17:23:12 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@google.com header.s=20221208 header.b="Zj/fw8nm"; spf=pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-bluetooth-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234457AbjEYAEY (ORCPT + 99 others); Wed, 24 May 2023 20:04:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34996 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230214AbjEYAEX (ORCPT ); Wed, 24 May 2023 20:04:23 -0400 Received: from mail-pl1-x64a.google.com (mail-pl1-x64a.google.com [IPv6:2607:f8b0:4864:20::64a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A667E139 for ; Wed, 24 May 2023 17:04:22 -0700 (PDT) Received: by mail-pl1-x64a.google.com with SMTP id d9443c01a7336-1ae818c0fdaso8071925ad.0 for ; Wed, 24 May 2023 17:04:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20221208; t=1684973062; x=1687565062; h=cc:to:from:subject:message-id:mime-version:date:from:to:cc:subject :date:message-id:reply-to; bh=JxmNnYgfaOtAwG3k7PZVh3xrHSOh7px0pgm2Rioiw6o=; b=Zj/fw8nmn6hoYdeGZf06QX+F1CudDEYVZTfIJKpBptP+hQz+AZfbDSs7kYyL9lhaFA FXHGJ5L0Q9h2//2gGs1HpTjxvAE6PdCxlUoHz/4QXOWjMeAV1rbvHhvbLPiIuJ1YeIFE KHbnV8A6PvqAovc8k8Ow1+C1zdzBh9oFFbirPuZQQHMW2/PFRTtpPSFlztSli9AdsFYw zWLU8dzks5nY9Ls9UASK0kWl0olJjSKCPycJ3LkGw2YTh+So7V7pSa/nWKz+gshuPSHB jn26lgjzx6kWOCz1yUE5C9ERczfnh3iquHaWH9PKXTkPEZVat7p0W/nI8FiQ1KjumdYd a1jA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1684973062; x=1687565062; h=cc:to:from:subject:message-id:mime-version:date:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=JxmNnYgfaOtAwG3k7PZVh3xrHSOh7px0pgm2Rioiw6o=; b=QtcHCHLBNOmSzSLugdSMvFCWtGdm/qPLmmEi6kH1xKTJAWvdMMCKfSCZdnAR9ANpmw 8Yka3IVHqLM/pyRTCZc7Hg5tVnYeOOyWXnOI4WagMs/OWj0tdZZ+ARDSpLECP7dV0rMi x431p2IYJnDT8klb5Bjfx80LwK5RyL7Wy0fqwsD1lOapQd+S3VbFzy+YI+JhTlG91/h8 bK5pDWEwvHSiSRjjz/sn4zgyIzdYOvxrayLbcDnLRVu77YjzwSAzKA1ekPqr69dQzd20 b5YI8nly9r8p4ZXIA9oFC4IEZmVndhMQxizXyTPkQJgF2/YSZPrWgAka/mMirzFP8TPy ivzA== X-Gm-Message-State: AC+VfDzypB0RqYluGAi0BsieueiaDrLUg0LdkmXTRqpfqHud0HrUAXS/ WR2z848o2NFSi3o+3sX0xav6qfHWEHggDndd9/nvuPAlQ8+HfaStAi9LrAqeykZdsl78lY9+3ib cHTnTPNacxahpJe6tjLvTfWquE3YqBtcm56oY/eJq9f8A4tYKGhyrTVEUInfjD3wlQVf8KbhP9h Sz X-Received: from jiangzp-glinux-dev.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:4c52]) (user=jiangzp job=sendgmr) by 2002:a17:902:7587:b0:1ae:5f7e:c115 with SMTP id j7-20020a170902758700b001ae5f7ec115mr4392038pll.11.1684973061937; Wed, 24 May 2023 17:04:21 -0700 (PDT) Date: Wed, 24 May 2023 17:04:15 -0700 Mime-Version: 1.0 X-Mailer: git-send-email 2.40.1.698.g37aff9b760-goog Message-ID: <20230524170415.kernel.v1.1.I575ec21daa35ebba038fe38e164df60b6121c633@changeid> Subject: [kernel PATCH v1] Bluetooth: L2CAP: Fix use-after-free From: Zhengping Jiang To: linux-bluetooth@vger.kernel.org, marcel@holtmann.org, luiz.dentz@gmail.com Cc: chromeos-bluetooth-upstreaming@chromium.org, Zhengping Jiang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Johan Hedberg , Paolo Abeni , linux-kernel@vger.kernel.org, netdev@vger.kernel.org Content-Type: text/plain; charset="UTF-8" X-Spam-Status: No, score=-9.6 required=5.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE,USER_IN_DEF_DKIM_WL autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-bluetooth@vger.kernel.org Fix potential use-after-free in l2cap_le_command_rej. Signed-off-by: Zhengping Jiang --- Changes in v1: - Use l2cap_chan_hold_unless_zero to prevent adding refcnt when it is already 0. net/bluetooth/l2cap_core.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 376b523c7b26..19b0b1f7ffed 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -6361,9 +6361,14 @@ static inline int l2cap_le_command_rej(struct l2cap_conn *conn, if (!chan) goto done; + chan = l2cap_chan_hold_unless_zero(chan); + if (!chan) + goto done; + l2cap_chan_lock(chan); l2cap_chan_del(chan, ECONNREFUSED); l2cap_chan_unlock(chan); + l2cap_chan_put(chan); done: mutex_unlock(&conn->chan_lock); -- 2.40.1.698.g37aff9b760-goog