[5.10,067/171] Bluetooth: Fix use after free in hci_send_acl

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

[ Upstream commit f63d24baff787e13b723d86fe036f84bdbc35045 ]

This fixes the following trace caused by receiving
HCI_EV_DISCONN_PHY_LINK_COMPLETE which does call hci_conn_del without
first checking if conn->type is in fact AMP_LINK and in case it is
do properly cleanup upper layers with hci_disconn_cfm:

 ==================================================================
    BUG: KASAN: use-after-free in hci_send_acl+0xaba/0xc50
    Read of size 8 at addr ffff88800e404818 by task bluetoothd/142

    CPU: 0 PID: 142 Comm: bluetoothd Not tainted
    5.17.0-rc5-00006-gda4022eeac1a #7
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
    rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
    Call Trace:
     <TASK>
     dump_stack_lvl+0x45/0x59
     print_address_description.constprop.0+0x1f/0x150
     kasan_report.cold+0x7f/0x11b
     hci_send_acl+0xaba/0xc50
     l2cap_do_send+0x23f/0x3d0
     l2cap_chan_send+0xc06/0x2cc0
     l2cap_sock_sendmsg+0x201/0x2b0
     sock_sendmsg+0xdc/0x110
     sock_write_iter+0x20f/0x370
     do_iter_readv_writev+0x343/0x690
     do_iter_write+0x132/0x640
     vfs_writev+0x198/0x570
     do_writev+0x202/0x280
     do_syscall_64+0x38/0x90
     entry_SYSCALL_64_after_hwframe+0x44/0xae
    RSP: 002b:00007ffce8a099b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000014
    Code: 0f 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3
    0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 14 00 00 00 0f 05
    <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
    RDX: 0000000000000001 RSI: 00007ffce8a099e0 RDI: 0000000000000015
    RAX: ffffffffffffffda RBX: 00007ffce8a099e0 RCX: 00007f788fc3cf77
    R10: 00007ffce8af7080 R11: 0000000000000246 R12: 000055e4ccf75580
    RBP: 0000000000000015 R08: 0000000000000002 R09: 0000000000000001
    </TASK>
    R13: 000055e4ccf754a0 R14: 000055e4ccf75cd0 R15: 000055e4ccf4a6b0

    Allocated by task 45:
        kasan_save_stack+0x1e/0x40
        __kasan_kmalloc+0x81/0xa0
        hci_chan_create+0x9a/0x2f0
        l2cap_conn_add.part.0+0x1a/0xdc0
        l2cap_connect_cfm+0x236/0x1000
        le_conn_complete_evt+0x15a7/0x1db0
        hci_le_conn_complete_evt+0x226/0x2c0
        hci_le_meta_evt+0x247/0x450
        hci_event_packet+0x61b/0xe90
        hci_rx_work+0x4d5/0xc50
        process_one_work+0x8fb/0x15a0
        worker_thread+0x576/0x1240
        kthread+0x29d/0x340
        ret_from_fork+0x1f/0x30

    Freed by task 45:
        kasan_save_stack+0x1e/0x40
        kasan_set_track+0x21/0x30
        kasan_set_free_info+0x20/0x30
        __kasan_slab_free+0xfb/0x130
        kfree+0xac/0x350
        hci_conn_cleanup+0x101/0x6a0
        hci_conn_del+0x27e/0x6c0
        hci_disconn_phylink_complete_evt+0xe0/0x120
        hci_event_packet+0x812/0xe90
        hci_rx_work+0x4d5/0xc50
        process_one_work+0x8fb/0x15a0
        worker_thread+0x576/0x1240
        kthread+0x29d/0x340
        ret_from_fork+0x1f/0x30

    The buggy address belongs to the object at ffff88800c0f0500
    The buggy address is located 24 bytes inside of
    which belongs to the cache kmalloc-128 of size 128
    The buggy address belongs to the page:
    128-byte region [ffff88800c0f0500, ffff88800c0f0580)
    flags: 0x100000000000200(slab|node=0|zone=1)
    page:00000000fe45cd86 refcount:1 mapcount:0
    mapping:0000000000000000 index:0x0 pfn:0xc0f0
    raw: 0000000000000000 0000000080100010 00000001ffffffff
    0000000000000000
    raw: 0100000000000200 ffffea00003a2c80 dead000000000004
    ffff8880078418c0
    page dumped because: kasan: bad access detected
    ffff88800c0f0400: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc
    Memory state around the buggy address:
    >ffff88800c0f0500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
    ffff88800c0f0480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
    ffff88800c0f0580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                                ^
    ==================================================================
    ffff88800c0f0600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb

Reported-by: Sönke Huster <soenke.huster@eknoes.de>
Tested-by: Sönke Huster <soenke.huster@eknoes.de>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/hci_event.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Message ID	20220412062929.821443635@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, =?utf-8?q?S=C3=B6nke_Huster?= <soenke.huster@eknoes.de>, Luiz Augusto von Dentz <luiz.von.dentz@intel.com>, Marcel Holtmann <marcel@holtmann.org>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.10 067/171] Bluetooth: Fix use after free in hci_send_acl Date: Tue, 12 Apr 2022 08:29:18 +0200 Message-Id: <20220412062929.821443635@linuxfoundation.org> In-Reply-To: <20220412062927.870347203@linuxfoundation.org> References: <20220412062927.870347203@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.10,002/171] gfs2: Check for active reservation in gfs2_release [5.10,003/171] gfs2: Fix gfs2_release for non-writers regression [5.10,004/171] gfs2: gfs2_setattr_size error path fix [5.10,005/171] rtc: wm8350: Handle error for wm8350_register_irq [5.10,006/171] KVM: x86/svm: Clear reserved bits written to PerfEvtSeln MSRs [5.10,010/171] drm/amd/display: Add signal type check when verify stream backends same [5.10,011/171] drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj [5.10,014/171] ptp: replace snprintf with sysfs_emit [5.10,015/171] powerpc: dts: t104xrdb: fix phy type for FMAN 4/5 [5.10,018/171] bpf: Make dst_port field in struct bpf_sock 16-bit wide [5.10,020/171] scsi: bfa: Replace snprintf() with sysfs_emit() [5.10,023/171] cfg80211: dont add non transmitted BSS to 6GHz scanned channels [5.10,025/171] ipv6: make mc_forwarding atomic [5.10,027/171] drm/amdgpu: Fix recursive locking warning [5.10,031/171] PCI: endpoint: Fix alignment fault error in copy tests [5.10,033/171] PCI: pciehp: Add Qualcomm quirk for Command Completed erratum [5.10,034/171] power: supply: axp288-charger: Set Vhold to 4.4V [5.10,036/171] ipv4: Invalidate neighbour for broadcast address upon address addition [5.10,039/171] drm/amdkfd: make CRAT table missing message informational only [5.10,041/171] scsi: pm8001: Fix pm8001_mpi_task_abort_resp() [5.10,042/171] scsi: pm8001: Fix task leak in pm8001_send_abort_all() [5.10,044/171] scsi: pm8001: Fix memory leak in pm8001_chip_fw_flash_update_req() [5.10,046/171] scsi: aha152x: Fix aha152x_setup() __setup handler return value [5.10,047/171] scsi: hisi_sas: Free irq vectors in order for v3 HW [5.10,049/171] mips: ralink: fix a refcount leak in ill_acc_of_setup() [5.10,051/171] tuntap: add sanity checks about msg_controllen in sendmsg [5.10,053/171] Bluetooth: use memset avoid memory leaks [5.10,055/171] PCI: endpoint: Fix misused goto label [5.10,056/171] MIPS: fix fortify panic when copying asm exception handlers [5.10,059/171] scsi: libfc: Fix use after free in fc_exch_abts_resp() [5.10,060/171] can: isotp: set default value for N_As to 50 micro seconds [5.10,063/171] net: sfp: add 2500base-X quirk for Lantech SFP module [5.10,066/171] MIPS: ingenic: correct unit node address [5.10,067/171] Bluetooth: Fix use after free in hci_send_acl [5.10,070/171] init/main.c: return 1 from handled __setup() functions [5.10,073/171] staging: vchiq_core: handle NULL result of find_service_by_handle [5.10,076/171] w1: w1_therm: fixes w1_seq for ds28ea00 sensors [5.10,078/171] NFSv4: Protect the state recovery thread against direct reclaim [5.10,083/171] SUNRPC/xprt: async tasks mustnt block waiting for memory [5.10,085/171] NFS: swap IO handling is slightly different for O_DIRECT IO [5.10,087/171] x86/Kconfig: Do not allow CONFIG_X86_X32_ABI=y with llvm-objcopy [5.10,088/171] serial: samsung_tty: do not unlock port->lock for uart_write_wakeup() [5.10,089/171] virtio_console: eliminate anonymous module_init & module_exit [5.10,090/171] jfs: prevent NULL deref in diFree [5.10,093/171] NFS: Avoid writeback threads getting stuck in mempool_alloc() [5.10,095/171] parisc: Fix patch code locking and flushing [5.10,096/171] mm: fix race between MADV_FREE reclaim and blkdev direct IO read [5.10,100/171] Revert "NFSv4: Handle the special Linux file open access mode" [5.10,102/171] scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one() [5.10,104/171] ice: Clear default forwarding VSI during VSI release [5.10,106/171] net: stmmac: Fix unset max_speed difference between DT and non-DT platforms [5.10,108/171] drm/imx: Fix memory leak in imx_pd_connector_get_modes [5.10,109/171] bnxt_en: reserve space inside receive page for skb_shared_info [5.10,111/171] RDMA/mlx5: Dont remove cache MRs when a delay is needed [5.10,113/171] dpaa2-ptp: Fix refcount leak in dpaa2_ptp_probe [5.10,114/171] ice: Set txq_teid to ICE_INVAL_TEID on ring creation [5.10,116/171] ipv6: Fix stats accounting in ip6_pkt_drop [5.10,119/171] net: openvswitch: fix leak of nested actions [5.10,121/171] net: phy: mscc-miim: reject clause 45 register accesses [5.10,125/171] drbd: Fix five use after free bugs in get_initial_state [5.10,126/171] io_uring: dont touch scm_fp_list after queueing skb [5.10,129/171] SUNRPC: svc_tcp_sendmsg() should handle errors from xdr_alloc_bvec() [5.10,130/171] iommu/omap: Fix regression in probe for NULL pointer dereference [5.10,131/171] perf: arm-spe: Fix perf report --mem-mode [5.10,132/171] perf tools: Fix perfs libperf_print callback [5.10,135/171] Revert "mmc: sdhci-xenon: fix annoying 1.8V regulator warning" [5.10,137/171] mmc: renesas_sdhi: dont overwrite TAP settings when HS400 tuning is complete [5.10,139/171] mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0) [5.10,140/171] mm/mempolicy: fix mpol_new leak in shared_policy_replace [5.10,143/171] x86/speculation: Restore speculation related MSRs during S3 resume [5.10,145/171] btrfs: prevent subvol with swapfile from being deleted [5.10,148/171] gpio: Restrict usage of GPIO chip irq members before initialization [5.10,150/171] perf: qcom_l2_pmu: fix an incorrect NULL check on list iterator [5.10,152/171] drm/amdgpu/smu10: fix SoC/fclk units in auto mode [5.10,153/171] drm/nouveau/pmu: Add missing callbacks for Tegra devices [5.10,155/171] perf build: Dont use -ffat-lto-objects in the python feature test when building wi... [5.10,156/171] perf python: Fix probing for some clang command line options [5.10,158/171] tools build: Use $(shell ) instead of `` to get embedded libperls ccopts [5.10,159/171] dmaengine: Revert "dmaengine: shdma: Fix runtime PM imbalance on error" [5.10,161/171] mm: dont skip swap entry even if zap_details specified [5.10,164/171] selftests: cgroup: Make cg_create() use 0755 for permission instead of 0644 [5.10,166/171] selftests: cgroup: Test open-time cgroup namespace usage for migration checks [5.10,170/171] mm/sparsemem: fix mem_section will never be NULL gcc 12 warning [5.10,171/171] powerpc: Fix virt_addr_valid() for 64-bit Book3E & 32-bit

[5.10,067/171] Bluetooth: Fix use after free in hci_send_acl

Commit Message

Patch