Bluetooth: SCO: Fix UAF on sco_sock_timeout

conn->sk maybe have been unlinked/freed while waiting for sco_conn_lock
so this checks if the conn->sk is still valid by checking if it part of
sco_sk_list.

Reported-by: syzbot+4c0d0c4cde787116d465@syzkaller.appspotmail.com
Tested-by: syzbot+4c0d0c4cde787116d465@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4c0d0c4cde787116d465
Fixes: ba316be1b6a0 ("Bluetooth: schedule SCO timeouts with delayed_work")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index 5d655e109b2c0a14146a620955d163a02efd4cba..f66bc85c6411dd5d49eca7756577fea05feaf144 100644 (file)
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -403,6 +403,7 @@ int  bt_sock_register(int proto, const struct net_proto_family *ops);
 void bt_sock_unregister(int proto);
 void bt_sock_link(struct bt_sock_list *l, struct sock *s);
 void bt_sock_unlink(struct bt_sock_list *l, struct sock *s);
+bool bt_sock_linked(struct bt_sock_list *l, struct sock *s);
 struct sock *bt_sock_alloc(struct net *net, struct socket *sock,
                           struct proto *prot, int proto, gfp_t prio, int kern);
 int  bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,

diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 67604ccec2f42739a554bc93d7834ebc4177589c..bdce9270487d150fa928d600f77180f8e7e5862c 100644 (file)
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -185,6 +185,28 @@ void bt_sock_unlink(struct bt_sock_list *l, struct sock *sk)
 }
 EXPORT_SYMBOL(bt_sock_unlink);
 
+bool bt_sock_linked(struct bt_sock_list *l, struct sock *s)
+{
+       struct sock *sk;
+
+       if (!l || !s)
+               return false;
+
+       read_lock(&l->lock);
+
+       sk_for_each(sk, &l->head) {
+               if (s == sk) {
+                       read_unlock(&l->lock);
+                       return true;
+               }
+       }
+
+       read_unlock(&l->lock);
+
+       return false;
+}
+EXPORT_SYMBOL(bt_sock_linked);
+
 void bt_accept_enqueue(struct sock *parent, struct sock *sk, bool bh)
 {
        const struct cred *old_cred;

diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index a5ac160c592eb94dc93936932d77b05f8c825295..1c7252a3686694284b0b1e1101e3d16b90d906c4 100644 (file)
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -76,6 +76,16 @@ struct sco_pinfo {
 #define SCO_CONN_TIMEOUT       (HZ * 40)
 #define SCO_DISCONN_TIMEOUT    (HZ * 2)
 
+static struct sock *sco_sock_hold(struct sco_conn *conn)
+{
+       if (!conn || !bt_sock_linked(&sco_sk_list, conn->sk))
+               return NULL;
+
+       sock_hold(conn->sk);
+
+       return conn->sk;
+}
+
 static void sco_sock_timeout(struct work_struct *work)
 {
        struct sco_conn *conn = container_of(work, struct sco_conn,
@@ -87,9 +97,7 @@ static void sco_sock_timeout(struct work_struct *work)
                sco_conn_unlock(conn);
                return;
        }
-       sk = conn->sk;
-       if (sk)
-               sock_hold(sk);
+       sk = sco_sock_hold(conn);
        sco_conn_unlock(conn);
 
        if (!sk)
@@ -194,9 +202,7 @@ static void sco_conn_del(struct hci_conn *hcon, int err)
 
        /* Kill socket */
        sco_conn_lock(conn);
-       sk = conn->sk;
-       if (sk)
-               sock_hold(sk);
+       sk = sco_sock_hold(conn);
        sco_conn_unlock(conn);
 
        if (sk) {