From: Lin Ma Date: Sun, 30 May 2021 13:37:43 +0000 (+0800) Subject: Bluetooth: use correct lock to prevent UAF of hdev object X-Git-Tag: v5.15~1018^2~4^2~2 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=e305509e678b3a4af2b3cfd410f409f7cdaabb52;p=platform%2Fkernel%2Flinux-starfive.git Bluetooth: use correct lock to prevent UAF of hdev object The hci_sock_dev_event() function will cleanup the hdev object for sockets even if this object may still be in used within the hci_sock_bound_ioctl() function, result in UAF vulnerability. This patch replace the BH context lock to serialize these affairs and prevent the race condition. Signed-off-by: Lin Ma Signed-off-by: Marcel Holtmann --- diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c index 251b912..eed0dd0 100644 --- a/net/bluetooth/hci_sock.c +++ b/net/bluetooth/hci_sock.c @@ -762,7 +762,7 @@ void hci_sock_dev_event(struct hci_dev *hdev, int event) /* Detach sockets from device */ read_lock(&hci_sk_list.lock); sk_for_each(sk, &hci_sk_list.head) { - bh_lock_sock_nested(sk); + lock_sock(sk); if (hci_pi(sk)->hdev == hdev) { hci_pi(sk)->hdev = NULL; sk->sk_err = EPIPE; @@ -771,7 +771,7 @@ void hci_sock_dev_event(struct hci_dev *hdev, int event) hci_dev_put(hdev); } - bh_unlock_sock(sk); + release_sock(sk); } read_unlock(&hci_sk_list.lock); }