linux-kernel - Re: [PATCH] Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250109071102.23a5205d@kernel.org>
Date: Thu, 9 Jan 2025 07:11:02 -0800
From: Jakub Kicinski <kuba@...nel.org>
To: Fedor Pchelkin <pchelkin@...ras.ru>
Cc: Luiz Augusto von Dentz <luiz.dentz@...il.com>, Johan Hedberg
 <johan.hedberg@...il.com>, Marcel Holtmann <marcel@...tmann.org>, Ignat
 Korchagin <ignat@...udflare.com>, Kuniyuki Iwashima <kuniyu@...zon.com>,
 Eric Dumazet <edumazet@...gle.com>, linux-bluetooth@...r.kernel.org,
 linux-kernel@...r.kernel.org, lvc-project@...uxtesting.org,
 netdev@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH] Bluetooth: L2CAP: handle NULL sock pointer in
 l2cap_sock_alloc

On Thu, 9 Jan 2025 10:47:12 +0300 Fedor Pchelkin wrote:
> On Wed, 18. Dec 00:19, Fedor Pchelkin wrote:
> > A NULL sock pointer is passed into l2cap_sock_alloc() when it is called
> > from l2cap_sock_new_connection_cb() and the error handling paths should
> > also be aware of it.
> > 
> > Seemingly a more elegant solution would be to swap bt_sock_alloc() and
> > l2cap_chan_create() calls since they are not interdependent to that moment
> > but then l2cap_chan_create() adds the soon to be deallocated and still
> > dummy-initialized channel to the global list accessible by many L2CAP
> > paths. The channel would be removed from the list in short period of time
> > but be a bit more straight-forward here and just check for NULL instead of
> > changing the order of function calls.
> > 
> > Found by Linux Verification Center (linuxtesting.org) with SVACE static
> > analysis tool.
> > 
> > Fixes: 7c4f78cdb8e7 ("Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()")
> > Cc: stable@...r.kernel.org
> > Signed-off-by: Fedor Pchelkin <pchelkin@...ras.ru>
> > ---  
> 
> Urgh.. a bit confused about which tree the patch should go to - net or
> bluetooth.
> 
> I've now noticed the Fixes commit went directly via net-next as part of a
> series (despite "Bluetooth: L2CAP:" patches usually go through bluetooth
> tree first). So what about this patch?

7c4f78cdb8e7 went directly to net-next because it was a larger series touching
multiple sub-subsystems:

$ git log -12 --graph --oneline 2d859aff775df54
*   2d859aff775d Merge branch 'do-not-leave-dangling-sk-pointers-in-pf-create-functions'
|\  
| * 18429e6e0c2a Revert "net: do not leave a dangling sk pointer, when socket creation fails"
| * 48156296a08c net: warn, if pf->create does not clear sock->sk on error
| * 9df99c395d0f net: inet6: do not leave a dangling sk pointer in inet6_create()
| * 9365fa510c6f net: inet: do not leave a dangling sk pointer in inet_create()
| * b4fcd63f6ef7 net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
| * 811a7ca7320c net: af_can: do not leave a dangling sk pointer in can_create()
| * 3945c799f12b Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc()
| * 7c4f78cdb8e7 Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()
| * 46f2a11cb82b af_packet: avoid erroring out after sock_init_data() in packet_create()
|/  
* 397006ba5d91 net/sched: cbs: Fix integer overflow in cbs_set_port_rate()