From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Takashi Iwai <tiwai@suse.de>,
Marcel Holtmann <marcel@holtmann.org>,
Sasha Levin <sashal@kernel.org>,
johan.hedberg@gmail.com, luiz.dentz@gmail.com,
davem@davemloft.net, kuba@kernel.org,
linux-bluetooth@vger.kernel.org, netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 4.4 01/30] Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg()
Date: Mon, 8 Nov 2021 20:08:49 -0500 [thread overview]
Message-ID: <20211109010918.1192063-1-sashal@kernel.org> (raw)
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 99c23da0eed4fd20cae8243f2b51e10e66aa0951 ]
The sco_send_frame() also takes lock_sock() during memcpy_from_msg()
call that may be endlessly blocked by a task with userfaultd
technique, and this will result in a hung task watchdog trigger.
Just like the similar fix for hci_sock_sendmsg() in commit
92c685dc5de0 ("Bluetooth: reorganize functions..."), this patch moves
the memcpy_from_msg() out of lock_sock() for addressing the hang.
This should be the last piece for fixing CVE-2021-3640 after a few
already queued fixes.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/sco.c | 24 ++++++++++++++++--------
1 file changed, 16 insertions(+), 8 deletions(-)
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 701d230fb9cf6..b9d0d1d6a4be1 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -269,7 +269,8 @@ static int sco_connect(struct sock *sk)
return err;
}
-static int sco_send_frame(struct sock *sk, struct msghdr *msg, int len)
+static int sco_send_frame(struct sock *sk, void *buf, int len,
+ unsigned int msg_flags)
{
struct sco_conn *conn = sco_pi(sk)->conn;
struct sk_buff *skb;
@@ -281,15 +282,11 @@ static int sco_send_frame(struct sock *sk, struct msghdr *msg, int len)
BT_DBG("sk %p len %d", sk, len);
- skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err);
+ skb = bt_skb_send_alloc(sk, len, msg_flags & MSG_DONTWAIT, &err);
if (!skb)
return err;
- if (memcpy_from_msg(skb_put(skb, len), msg, len)) {
- kfree_skb(skb);
- return -EFAULT;
- }
-
+ memcpy(skb_put(skb, len), buf, len);
hci_send_sco(conn->hcon, skb);
return len;
@@ -700,6 +697,7 @@ static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg,
size_t len)
{
struct sock *sk = sock->sk;
+ void *buf;
int err;
BT_DBG("sock %p, sk %p", sock, sk);
@@ -711,14 +709,24 @@ static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg,
if (msg->msg_flags & MSG_OOB)
return -EOPNOTSUPP;
+ buf = kmalloc(len, GFP_KERNEL);
+ if (!buf)
+ return -ENOMEM;
+
+ if (memcpy_from_msg(buf, msg, len)) {
+ kfree(buf);
+ return -EFAULT;
+ }
+
lock_sock(sk);
if (sk->sk_state == BT_CONNECTED)
- err = sco_send_frame(sk, msg, len);
+ err = sco_send_frame(sk, buf, len, msg->msg_flags);
else
err = -ENOTCONN;
release_sock(sk);
+ kfree(buf);
return err;
}
--
2.33.0
next reply other threads:[~2021-11-09 1:27 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-11-09 1:08 Sasha Levin [this message]
2021-11-09 1:08 ` [PATCH AUTOSEL 4.4 02/30] Bluetooth: fix use-after-free error in lock_sock_nested() Sasha Levin
2021-11-09 1:08 ` [PATCH AUTOSEL 4.4 03/30] platform/x86: wmi: do not fail if disabling fails Sasha Levin
2021-11-09 1:08 ` [PATCH AUTOSEL 4.4 04/30] MIPS: lantiq: dma: add small delay after reset Sasha Levin
2021-11-09 1:08 ` [PATCH AUTOSEL 4.4 05/30] MIPS: lantiq: dma: reset correct number of channel Sasha Levin
2021-11-09 1:08 ` [PATCH AUTOSEL 4.4 06/30] smackfs: Fix use-after-free in netlbl_catmap_walk() Sasha Levin
2021-11-09 1:08 ` [PATCH AUTOSEL 4.4 07/30] NET: IPV4: fix error "do not initialise globals to 0" Sasha Levin
2021-11-09 1:08 ` [PATCH AUTOSEL 4.4 08/30] x86: Increase exception stack sizes Sasha Levin
2021-11-09 1:08 ` [PATCH AUTOSEL 4.4 09/30] media: mt9p031: Fix corrupted frame after restarting stream Sasha Levin
2021-11-09 1:08 ` [PATCH AUTOSEL 4.4 10/30] media: netup_unidvb: handle interrupt properly according to the firmware Sasha Levin
2021-11-09 1:08 ` [PATCH AUTOSEL 4.4 11/30] media: uvcvideo: Set capability in s_param Sasha Levin
2021-11-09 1:09 ` [PATCH AUTOSEL 4.4 12/30] media: s5p-mfc: fix possible null-pointer dereference in s5p_mfc_probe() Sasha Levin
2021-11-09 1:09 ` [PATCH AUTOSEL 4.4 13/30] media: mceusb: return without resubmitting URB in case of -EPROTO error Sasha Levin
2021-11-09 1:09 ` [PATCH AUTOSEL 4.4 14/30] ia64: don't do IA64_CMPXCHG_DEBUG without CONFIG_PRINTK Sasha Levin
2021-11-09 1:09 ` [PATCH AUTOSEL 4.4 15/30] ACPICA: Avoid evaluating methods too early during system resume Sasha Levin
2021-11-10 15:10 ` Moore, Robert
2021-11-10 15:18 ` Rafael J. Wysocki
2021-11-10 15:52 ` Moore, Robert
2021-11-09 1:09 ` [PATCH AUTOSEL 4.4 16/30] media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte() Sasha Levin
2021-11-09 1:09 ` [PATCH AUTOSEL 4.4 17/30] tracefs: Have tracefs directories not set OTH permission bits by default Sasha Levin
2021-11-09 1:09 ` [PATCH AUTOSEL 4.4 18/30] ath: dfs_pattern_detector: Fix possible null-pointer dereference in channel_detector_create() Sasha Levin
2021-11-09 1:09 ` [PATCH AUTOSEL 4.4 19/30] ACPI: battery: Accept charges over the design capacity as full Sasha Levin
2021-11-09 1:09 ` [PATCH AUTOSEL 4.4 20/30] memstick: r592: Fix a UAF bug when removing the driver Sasha Levin
2021-11-09 1:09 ` [PATCH AUTOSEL 4.4 21/30] lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression Sasha Levin
2021-11-09 1:09 ` [PATCH AUTOSEL 4.4 22/30] lib/xz: Validate the value before assigning it to an enum variable Sasha Levin
2021-11-09 1:09 ` [PATCH AUTOSEL 4.4 23/30] mwl8k: Fix use-after-free in mwl8k_fw_state_machine() Sasha Levin
2021-11-09 1:09 ` [PATCH AUTOSEL 4.4 24/30] PM: hibernate: Get block device exclusively in swsusp_check() Sasha Levin
2021-11-09 1:09 ` [PATCH AUTOSEL 4.4 25/30] iwlwifi: mvm: disable RX-diversity in powersave Sasha Levin
2021-11-09 1:09 ` [PATCH AUTOSEL 4.4 26/30] smackfs: use __GFP_NOFAIL for smk_cipso_doi() Sasha Levin
2021-11-09 1:09 ` [PATCH AUTOSEL 4.4 27/30] ARM: clang: Do not rely on lr register for stacktrace Sasha Levin
2021-11-09 1:09 ` [PATCH AUTOSEL 4.4 28/30] ARM: 9136/1: ARMv7-M uses BE-8, not BE-32 Sasha Levin
2021-11-09 1:09 ` [PATCH AUTOSEL 4.4 29/30] parisc: fix warning in flush_tlb_all Sasha Levin
2021-11-09 1:09 ` [PATCH AUTOSEL 4.4 30/30] parisc/kgdb: add kgdb_roundup() to make kgdb work with idle polling Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211109010918.1192063-1-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=davem@davemloft.net \
--cc=johan.hedberg@gmail.com \
--cc=kuba@kernel.org \
--cc=linux-bluetooth@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luiz.dentz@gmail.com \
--cc=marcel@holtmann.org \
--cc=netdev@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=tiwai@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).