Hello,
I am writing to report a potential use-after-free that our fuzzing tool
found in the 'bt_accept_poll' function. The bug was encountered while
testing kernel 6.7-rc2 during a Bluetooth pairing procedure. Due to the
non-determinism of concurrent execution, this bug cannot be stably
reproduced in my testing.
Through disassembly, we have pinpointed the code at
'bt_sock_poll+0x233', which corresponds to the inline function
'bt_accept_poll', specifically at the line:
···
File: net/bluetooth/af_bluetooth.c
Line: 492
list_for_each_entry_safe(s, n, &bt_sk(parent)->accept_q, accept_q)
···
Based on the allocate and free tasks reported by KASAN, we suspect that
the use-after-free issue originates from the 'parent' variable in the
'bt_accept_poll' function, which corresponds to the 'sk' from
'bt_sock_poll' that is passed into it.
The 'bt_accept_poll' function is called from 'bt_sock_poll' as follows:
···
File: net/bluetooth/af_bluetooth.c
Line: 506
struct sock *sk = sock->sk;
__poll_t mask = 0;
poll_wait(file, sk_sleep(sk), wait);
if (sk->sk_state == BT_LISTEN)
return bt_accept_poll(sk);
···
This suggests that at the time of evaluating 'if (sk->sk_state ==
BT_LISTEN)', 'sk' is likely not NULL, and its 'sk_state' is 'BT_LISTEN'.
However, by the time the execution reaches the section of code in
'bt_accept_poll' mentioned above, 'sk' seems to have been freed. This
appears to be a very subtle timing issue, which may explain the
difficulty we have had in reproducing the bug.
KASAN report：
==================================================================
BUG: KASAN: slab-use-after-free in bt_sock_poll+0x233/0x9d0 [bluetooth]
Read of size 8 at addr ffff888005f142f8 by task bluetoothd/521
CPU: 0 PID: 521 Comm: bluetoothd Tainted: G O 6.7.0-rc2 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xbf/0xf0
print_address_description+0x7f/0x3d0
print_report+0x11d/0x250
? __virt_addr_valid+0xc5/0xf0
? bt_sock_poll+0x233/0x9d0 [bluetooth]
kasan_report+0x137/0x170
? bt_sock_poll+0x233/0x9d0 [bluetooth]
bt_sock_poll+0x233/0x9d0 [bluetooth]
sock_poll+0x2a0/0x350
do_sys_poll+0x926/0x11a0
? __ia32_compat_sys_ppoll_time64+0x290/0x290
? __ia32_compat_sys_ppoll_time64+0x290/0x290
? __ia32_compat_sys_ppoll_time64+0x290/0x290
? __ia32_compat_sys_ppoll_time64+0x290/0x290
? __ia32_compat_sys_ppoll_time64+0x290/0x290
? __ia32_compat_sys_ppoll_time64+0x290/0x290
? __ia32_compat_sys_ppoll_time64+0x290/0x290
? __ia32_compat_sys_ppoll_time64+0x290/0x290
__se_sys_poll+0x15d/0x340
? fpregs_assert_state_consistent+0x24/0xa0
do_syscall_64+0x32/0xa0
entry_SYSCALL_64_after_hwframe+0x63/0x6b
RIP: 0033:0x7f6c44c1f933
Code: 49 8b 45 10 5d 41 5c 41 5d 41 5e c3 66 2e 0f 1f 84 00 00 00 00 00
90 64 8b 04 25 18 00 00 00 85 c0 75 14 b8 07 00 00 00 0f 05 <48> 3d 00
f0 ff ff 77 55 c3 0f 1f 40 00 48 83 ec 28 89 54 24 1c 48
RSP: 002b:00007ffe74204ad8 EFLAGS: 00000246 ORIG_RAX: 0000000000000007
RAX: ffffffffffffffda RBX: 00007f6c44ee1410 RCX: 00007f6c44c1f933
RDX: 00000000ffffffff RSI: 000000000000000f RDI: 00005614a8807720
RBP: 00005614a8807720 R08: 0000000000000010 R09: 0000000000000002
R10: 000000000000000f R11: 0000000000000246 R12: 000000000000000f
R13: 00007ffe74204af4 R14: 00000000ffffffff R15: 00005614a87f8bd0
</TASK>
Allocated by task 671:
kasan_set_track+0x4c/0x70
__kasan_kmalloc+0x82/0x90
__kmalloc+0xac/0x1d0
sk_prot_alloc+0xdd/0x1a0
sk_alloc+0x2c/0x4f0
bt_sock_alloc+0x43/0x440 [bluetooth]
l2cap_sock_alloc+0x3f/0x160 [bluetooth]
l2cap_sock_new_connection_cb+0x12f/0x240 [bluetooth]
l2cap_connect+0x7f1/0x1490 [bluetooth]
l2cap_bredr_sig_cmd+0x45c/0x71c0 [bluetooth]
l2cap_recv_frame+0xd46/0x1610 [bluetooth]
l2cap_recv_acldata+0x2c5/0xd00 [bluetooth]
hci_rx_work+0x67b/0xd00 [bluetooth]
process_one_work+0x4f0/0xab0
worker_thread+0x8af/0xee0
kthread+0x275/0x300
ret_from_fork+0x30/0x60
ret_from_fork_asm+0x11/0x20
Freed by task 670:
kasan_set_track+0x4c/0x70
kasan_save_free_info+0x24/0x40
____kasan_slab_free+0x118/0x190
slab_free_freelist_hook+0xd1/0x160
__kmem_cache_free+0xa3/0x170
__sk_destruct+0x317/0x400
sock_put+0x81/0xd0 [bluetooth]
l2cap_sock_kill+0xf6/0x110 [bluetooth]
l2cap_sock_close_cb+0x66/0x80 [bluetooth]
l2cap_conn_del+0x345/0x640 [bluetooth]
l2cap_connect_cfm+0xdb/0x1060 [bluetooth]
hci_connect_cfm+0x100/0x1c0 [bluetooth]
hci_conn_failed+0x1c8/0x280 [bluetooth]
hci_abort_conn_sync+0x7d9/0xaf0 [bluetooth]
hci_disconnect_all_sync+0x152/0x1b0 [bluetooth]
hci_set_powered_sync+0x499/0x6c0 [bluetooth]
hci_cmd_sync_work+0x1f7/0x2b0 [bluetooth]
process_one_work+0x4f0/0xab0
worker_thread+0x8af/0xee0
kthread+0x275/0x300
ret_from_fork+0x30/0x60
ret_from_fork_asm+0x11/0x20
Last potentially related work creation:
kasan_save_stack+0x3b/0x60
kasan_record_aux_stack_noalloc+0x96/0xa0
__call_rcu_common+0x75/0xb40
addrconf_ifdown+0x147a/0x1680
addrconf_notify+0x161/0x1900
notifier_call_chain+0xcd/0x1e0
unregister_netdevice_many_notify+0xaa1/0x1230
sit_exit_batch_net+0x53c/0x570
cleanup_net+0x51f/0x970
process_one_work+0x4f0/0xab0
worker_thread+0x8af/0xee0
kthread+0x275/0x300
ret_from_fork+0x30/0x60
ret_from_fork_asm+0x11/0x20