CVE-2022-49910

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Fix use-after-free caused by l2capreassemblesdu

Fix the race condition between the following two flows that run in parallel:

1. l2capreassemblesdu -> chan->ops->recv (l2capsockrecv_cb) -> _sockqueuercvskb.

2. btsockrecvmsg -> skbrecvdatagram, skbfreedatagram.

An SKB can be queued by the first flow and immediately dequeued and freed by the second flow, therefore the callers of l2capreassemblesdu can't use the SKB after that function returns. However, some places continue accessing struct l2capctrl that resides in the SKB's CB for a short time after l2capreassemble_sdu returns, leading to a use-after-free condition (the stack trace is below, line numbers for kernel 5.19.8).

Fix it by keeping a local copy of struct l2cap_ctrl.

BUG: KASAN: use-after-free in l2caprxstaterecv (net/bluetooth/l2capcore.c:6906) bluetooth Read of size 1 at addr ffff88812025f2f0 by task kworker/u17:3/43169

Workqueue: hci0 hcirxwork [bluetooth] Call Trace: <TASK> dumpstacklvl (lib/dumpstack.c:107 (discriminator 4)) printreport.cold (mm/kasan/report.c:314 mm/kasan/report.c:429) ? l2caprxstaterecv (net/bluetooth/l2capcore.c:6906) bluetooth kasanreport (mm/kasan/report.c:162 mm/kasan/report.c:493) ? l2caprxstaterecv (net/bluetooth/l2capcore.c:6906) bluetooth l2caprxstaterecv (net/bluetooth/l2capcore.c:6906) bluetooth l2caprx (net/bluetooth/l2capcore.c:7236 net/bluetooth/l2capcore.c:7271) bluetooth retfromfork (arch/x86/entry/entry_64.S:306) </TASK>

Allocated by task 43169: kasansavestack (mm/kasan/common.c:39) __kasanslaballoc (mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:469) kmem_cacheallocnode (mm/slab.h:750 mm/slub.c:3243 mm/slub.c:3293) _allocskb (net/core/skbuff.c:414) l2caprecvfrag (./include/net/bluetooth/bluetooth.h:425 net/bluetooth/l2capcore.c:8329) bluetooth l2caprecvacldata (net/bluetooth/l2capcore.c:8442) bluetooth hcirxwork (net/bluetooth/hcicore.c:3642 net/bluetooth/hcicore.c:3832) bluetooth processonework (kernel/workqueue.c:2289) workerthread (./include/linux/list.h:292 kernel/workqueue.c:2437) kthread (kernel/kthread.c:376) retfromfork (arch/x86/entry/entry64.S:306)

Freed by task 27920: kasansavestack (mm/kasan/common.c:39) kasansettrack (mm/kasan/common.c:45) kasansetfree_info (mm/kasan/generic.c:372) ___kasanslabfree (mm/kasan/common.c:368 mm/kasan/common.c:328) slabfreefreelisthook (mm/slub.c:1780) kmemcachefree (mm/slub.c:3536 mm/slub.c:3553) skbfreedatagram (./include/net/sock.h:1578 ./include/net/sock.h:1639 net/core/datagram.c:323) btsockrecvmsg (net/bluetooth/afbluetooth.c:295) bluetooth l2capsockrecvmsg (net/bluetooth/l2capsock.c:1212) bluetooth sockreaditer (net/socket.c:1087) newsyncread (./include/linux/fs.h:2052 fs/readwrite.c:401) vfsread (fs/readwrite.c:482) ksysread (fs/readwrite.c:620) dosyscall64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) entrySYSCALL64afterhwframe (arch/x86/entry/entry64.S:120)