Pauli Virtanen
66d6ef1854
Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan
...
For L2CAP sockets without owning sk->sk_socket, reading
l2cap_pi(sk)->chan may race against concurrent l2cap_sock_kill() ->
l2cap_sock_put_chan(). This excludes simultaneous proto_ops callbacks,
but access in l2cap_sock_cleanup_listen() has unsafe lockless read.
[Task 1] [Task 2 (hdev->workqueue)]
l2cap_sock_release(parent) l2cap_disconn_cfm
l2cap_sock_cleanup_listen l2cap_conn_del
bt_accept_dequeue l2cap_chan_del
lock_sock(sk) l2cap_sock_teardown_cb
bt_accept_unlink
bt_sk(sk)->parent = NULL
release_sock(sk) ----------------> lock_sock(sk)
parent = /* NULL */
lock_sock(sk) <--------------------- release_sock(sk)
sock_set_flag(sk, SOCK_ZAPPED)
l2cap_sock_close_cb
l2cap_sock_kill(sk)
l2cap_sock_put_chan
chan = READ l2cap_pi(sk)->chan l2cap_pi(sk)->chan = NULL
l2cap_chan_hold_unless_zero l2cap_put_chan(chan)
kref_get_unless_zero(&chan->ref)
Task 1 may observe NULL which causes null-ptr-deref.
Fix the race by taking lock_sock() in l2cap_sock_kill() to
synchronize with l2cap_sock_cleanup_listen(). hold_unless_zero() is not
needed here, l2cap_pi(sk)->chan owns reference if it is non-NULL.
Clarify code comments vs. locking.
Fixes: 6fef032af0 ("Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()")
Reported-by: syzbot+e6382a2f53f5fc7453ac@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e6382a2f53f5fc7453ac
Signed-off-by: Pauli Virtanen <pav@iki.fi >
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com >
2026-08-24 13:06:49 -04:00
..
2026-06-21 05:22:56 +00:00
2026-08-24 13:06:49 -04:00
2026-02-21 01:02:28 -08:00
2026-08-12 13:56:50 -07:00
2026-08-13 13:42:48 +02:00
2026-08-18 00:55:27 +02:00
2026-07-07 10:51:06 +02:00
2026-01-28 19:32:26 -08:00
2026-05-28 18:10:03 -07:00
2024-10-24 16:03:40 +02:00
2026-01-12 19:29:11 -08:00
2026-06-12 18:31:32 -07:00
2026-08-13 11:00:14 -07:00
2026-07-06 12:52:01 +02:00
2026-08-10 16:00:19 -07:00
2026-08-04 14:42:45 -07:00
2025-04-24 17:03:45 -07:00
2026-08-17 18:14:52 -07:00
2026-08-18 14:58:53 +02:00
2025-07-02 14:22:02 -07:00
2026-05-05 17:47:05 -07:00
2026-04-23 10:24:02 -07:00
2026-06-30 17:00:03 -07:00
2024-08-26 09:37:22 -07:00
2026-06-10 07:53:26 -07:00
2026-06-30 17:00:03 -07:00
2025-02-27 14:03:14 +01:00
2024-10-02 17:23:23 -04:00
2026-02-05 11:58:39 +01:00
2026-08-02 17:40:08 +02:00
2025-05-30 19:53:51 -07:00
2024-10-02 17:23:23 -04:00
2025-09-14 11:55:04 -07:00
2026-04-08 19:18:52 -07:00
2026-08-11 18:06:30 -07:00
2026-04-30 17:21:45 -07:00
2026-02-28 15:31:35 -08:00
2026-02-28 15:31:34 -08:00
2026-08-18 15:50:13 +02:00
2024-08-26 09:37:23 -07:00
2026-06-21 14:33:05 -07:00
2024-05-29 17:34:49 -07:00
2026-02-02 17:49:29 -08:00
2024-11-13 18:49:50 -08:00
2024-08-26 09:37:23 -07:00
2024-10-11 15:35:05 -07:00
2026-07-01 18:42:34 +02:00
2024-07-15 09:14:39 -07:00
2026-02-10 15:30:11 +01:00
2025-08-26 17:34:31 -07:00
2026-02-21 17:09:51 -08:00
2026-05-11 18:28:08 -07:00
2026-05-08 15:43:29 -07:00
2026-08-06 15:09:23 +02:00
2026-08-06 15:09:23 +02:00
2026-01-21 19:28:32 -08:00
2026-07-03 09:34:53 +01:00
2026-03-04 16:54:09 -08:00
2024-08-26 09:37:23 -07:00
2025-09-11 12:22:38 +02:00
2026-07-06 12:41:44 +02:00
2026-02-24 17:47:27 -08:00
2026-03-05 18:50:05 -08:00
2026-03-02 18:17:17 -08:00
2026-02-26 10:23:00 -08:00
2025-08-26 17:34:31 -07:00
2026-02-03 15:13:24 +01:00
2025-12-10 01:15:27 -08:00
2026-03-26 12:09:57 -07:00
2026-02-02 17:49:30 -08:00
2025-09-23 10:12:15 +02:00
2026-08-20 12:55:31 -07:00
2026-02-13 12:24:05 -08:00
2026-02-24 16:30:40 -08:00
2026-08-13 12:30:27 +02:00
2026-08-20 12:14:23 -07:00
2026-03-14 08:38:06 -07:00
2026-07-01 18:42:33 +02:00
2026-08-18 10:42:41 -07:00
2026-08-14 12:23:12 -07:00
2026-08-20 12:14:23 -07:00
2025-03-21 17:36:49 +08:00
2025-12-10 01:15:27 -08:00
2026-06-15 15:57:31 -07:00
2024-10-09 08:53:01 +02:00
2025-08-13 18:18:33 -07:00
2026-02-02 17:09:11 -08:00
2024-12-06 17:43:08 -08:00
2026-05-26 17:27:14 -07:00
2026-05-26 17:27:14 -07:00
2026-05-26 17:27:14 -07:00
2026-05-26 17:27:14 -07:00
2026-05-26 17:27:14 -07:00
2026-05-26 17:27:14 -07:00
2026-05-26 17:27:14 -07:00
2026-05-26 17:27:14 -07:00
2026-05-26 17:27:14 -07:00
2026-05-26 17:27:14 -07:00
2026-05-26 17:26:57 -07:00
2025-07-02 14:32:30 -07:00
2026-07-28 16:02:03 +02:00
2024-10-02 17:23:23 -04:00
2026-05-13 19:03:05 -07:00
2026-04-20 11:46:57 -07:00
2024-11-09 09:04:54 -08:00
2026-05-04 19:09:41 -07:00
2026-08-17 17:25:49 -07:00
2026-06-09 17:18:51 -07:00
2026-08-07 16:32:46 -07:00
2024-11-09 13:22:57 -08:00
2026-05-16 13:22:50 +02:00
2024-11-30 13:41:50 -08:00
2026-08-13 13:12:21 +02:00
2026-08-17 13:54:16 -07:00
2026-06-09 10:13:04 -07:00
2025-03-12 13:32:35 -07:00
2026-04-09 18:21:46 -07:00
2026-04-09 18:26:28 -07:00
2024-11-21 08:28:08 -08:00
2026-05-14 16:49:26 -07:00
2026-05-21 19:06:13 -07:00
2026-07-30 16:09:22 -07:00
2025-10-20 17:13:40 -07:00
2026-05-08 15:32:59 -07:00
2025-06-13 18:17:08 -07:00
2026-04-22 21:12:47 -07:00
2026-03-02 18:17:17 -08:00
2026-07-20 18:16:43 -07:00
2026-02-05 09:32:45 -08:00
2025-10-16 12:04:47 -07:00
2024-07-11 18:11:31 -07:00
2025-09-18 12:32:06 +02:00
2025-09-14 11:35:17 -07:00
2024-08-26 09:37:23 -07:00
2024-08-26 09:37:23 -07:00
2026-02-05 09:23:06 -08:00
2026-04-23 10:24:02 -07:00
2026-08-11 11:25:10 +02:00
2026-03-04 16:54:09 -08:00
2026-03-04 16:54:10 -08:00
2025-04-11 18:58:10 -07:00
2026-06-17 16:01:52 -07:00
2026-08-06 15:24:44 +02:00
2026-01-13 11:54:29 +01:00
2026-08-17 18:14:52 -07:00
2026-03-04 17:44:35 -08:00
2025-08-26 18:11:29 -07:00
2024-06-24 16:41:23 -07:00
2024-05-30 18:29:38 -07:00
2025-11-06 13:38:11 +01:00
2026-05-20 17:13:18 -07:00
2025-09-08 18:06:21 -07:00
2024-08-02 17:16:59 -07:00
2026-06-15 15:57:31 -07:00
2025-05-05 16:48:12 -07:00
2026-03-19 13:14:00 +01:00
2026-03-09 19:31:41 -07:00
2026-06-29 18:14:30 -07:00
2026-04-18 11:10:12 -07:00
2026-08-22 13:05:19 -07:00
2025-07-11 11:00:57 -07:00
2025-08-25 17:53:35 -07:00
2026-06-12 16:43:10 -07:00
2026-03-13 18:57:44 -07:00
2026-04-12 10:54:31 -07:00
2026-05-05 17:47:04 -07:00
2026-07-02 12:29:06 +02:00
2025-11-04 19:10:32 -08:00
2026-08-06 15:09:23 +02:00
2025-07-14 17:19:13 -07:00
2026-08-03 16:43:54 -07:00
2026-08-03 16:43:54 -07:00
2025-09-24 10:22:37 -07:00
2026-07-02 09:12:58 +02:00
2026-07-24 15:12:14 -07:00