Bluetooth: SCO: Fix UAF on sco_sock_timeout

commit 1bf4470a3939c678fb822073e9ea77a0560bc6bb upstream.

conn->sk maybe have been unlinked/freed while waiting for sco_conn_lock
so this checks if the conn->sk is still valid by checking if it part of
sco_sk_list.

Reported-by: syzbot+4c0d0c4cde787116d465@syzkaller.appspotmail.com
Tested-by: syzbot+4c0d0c4cde787116d465@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4c0d0c4cde787116d465
Fixes: ba316be1b6a0 ("Bluetooth: schedule SCO timeouts with delayed_work")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com>
Signed-off-by: He Zhe <zhe.he@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index 7d2bd562da4bebf63d73a4d37c19aa18d0096d20..b08b559f5242145167cc50d368a1be03cefe49ea 100644 (file)
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -314,6 +314,7 @@ int  bt_sock_register(int proto, const struct net_proto_family *ops);
 void bt_sock_unregister(int proto);
 void bt_sock_link(struct bt_sock_list *l, struct sock *s);
 void bt_sock_unlink(struct bt_sock_list *l, struct sock *s);
+bool bt_sock_linked(struct bt_sock_list *l, struct sock *s);
 int  bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
                     int flags);
 int  bt_sock_stream_recvmsg(struct socket *sock, struct msghdr *msg,

diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 9c9c855b9736e066f535a60811d003a80d0c45cf..aebef5cf12d484e52639d781b1206ccf3f821dd4 100644 (file)
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -154,6 +154,28 @@ void bt_sock_unlink(struct bt_sock_list *l, struct sock *sk)
 }
 EXPORT_SYMBOL(bt_sock_unlink);
 
+bool bt_sock_linked(struct bt_sock_list *l, struct sock *s)
+{
+       struct sock *sk;
+
+       if (!l || !s)
+               return false;
+
+       read_lock(&l->lock);
+
+       sk_for_each(sk, &l->head) {
+               if (s == sk) {
+                       read_unlock(&l->lock);
+                       return true;
+               }
+       }
+
+       read_unlock(&l->lock);
+
+       return false;
+}
+EXPORT_SYMBOL(bt_sock_linked);
+
 void bt_accept_enqueue(struct sock *parent, struct sock *sk, bool bh)
 {
        BT_DBG("parent %p, sk %p", parent, sk);

diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index f5192116922d160516f148c876c35e1256967448..83412efe2895352743d5300c56a845c0900e5a87 100644 (file)
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -76,6 +76,16 @@ struct sco_pinfo {
 #define SCO_CONN_TIMEOUT       (HZ * 40)
 #define SCO_DISCONN_TIMEOUT    (HZ * 2)
 
+static struct sock *sco_sock_hold(struct sco_conn *conn)
+{
+       if (!conn || !bt_sock_linked(&sco_sk_list, conn->sk))
+               return NULL;
+
+       sock_hold(conn->sk);
+
+       return conn->sk;
+}
+
 static void sco_sock_timeout(struct work_struct *work)
 {
        struct sco_conn *conn = container_of(work, struct sco_conn,
@@ -87,9 +97,7 @@ static void sco_sock_timeout(struct work_struct *work)
                sco_conn_unlock(conn);
                return;
        }
-       sk = conn->sk;
-       if (sk)
-               sock_hold(sk);
+       sk = sco_sock_hold(conn);
        sco_conn_unlock(conn);
 
        if (!sk)
@@ -191,9 +199,7 @@ static void sco_conn_del(struct hci_conn *hcon, int err)
 
        /* Kill socket */
        sco_conn_lock(conn);
-       sk = conn->sk;
-       if (sk)
-               sock_hold(sk);
+       sk = sco_sock_hold(conn);
        sco_conn_unlock(conn);
 
        if (sk) {