CVE-2023-53252

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: use RCU for hci_conn_params and iterate safely in hci_sync<br /> <br /> hci_update_accept_list_sync iterates over hdev-&gt;pend_le_conns and<br /> hdev-&gt;pend_le_reports, and waits for controller events in the loop body,<br /> without holding hdev lock.<br /> <br /> Meanwhile, these lists and the items may be modified e.g. by<br /> le_scan_cleanup. This can invalidate the list cursor or any other item<br /> in the list, resulting to invalid behavior (eg use-after-free).<br /> <br /> Use RCU for the hci_conn_params action lists. Since the loop bodies in<br /> hci_sync block and we cannot use RCU or hdev-&gt;lock for the whole loop,<br /> copy list items first and then iterate on the copy. Only the flags field<br /> is written from elsewhere, so READ_ONCE/WRITE_ONCE should guarantee we<br /> read valid values.<br /> <br /> Free params everywhere with hci_conn_params_free so the cleanup is<br /> guaranteed to be done properly.<br /> <br /> This fixes the following, which can be triggered e.g. by BlueZ new<br /> mgmt-tester case "Add + Remove Device Nowait - Success", or by changing<br /> hci_le_set_cig_params to always return false, and running iso-tester:<br /> <br /> ==================================================================<br /> BUG: KASAN: slab-use-after-free in hci_update_passive_scan_sync (net/bluetooth/hci_sync.c:2536 net/bluetooth/hci_sync.c:2723 net/bluetooth/hci_sync.c:2841)<br /> Read of size 8 at addr ffff888001265018 by task kworker/u3:0/32<br /> <br /> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38 04/01/2014<br /> Workqueue: hci0 hci_cmd_sync_work<br /> Call Trace:<br /> <br /> dump_stack_lvl (./arch/x86/include/asm/irqflags.h:134 lib/dump_stack.c:107)<br /> print_report (mm/kasan/report.c:320 mm/kasan/report.c:430)<br /> ? __virt_addr_valid (./include/linux/mmzone.h:1915 ./include/linux/mmzone.h:2011 arch/x86/mm/physaddr.c:65)<br /> ? hci_update_passive_scan_sync (net/bluetooth/hci_sync.c:2536 net/bluetooth/hci_sync.c:2723 net/bluetooth/hci_sync.c:2841)<br /> kasan_report (mm/kasan/report.c:538)<br /> ? hci_update_passive_scan_sync (net/bluetooth/hci_sync.c:2536 net/bluetooth/hci_sync.c:2723 net/bluetooth/hci_sync.c:2841)<br /> hci_update_passive_scan_sync (net/bluetooth/hci_sync.c:2536 net/bluetooth/hci_sync.c:2723 net/bluetooth/hci_sync.c:2841)<br /> ? __pfx_hci_update_passive_scan_sync (net/bluetooth/hci_sync.c:2780)<br /> ? mutex_lock (kernel/locking/mutex.c:282)<br /> ? __pfx_mutex_lock (kernel/locking/mutex.c:282)<br /> ? __pfx_mutex_unlock (kernel/locking/mutex.c:538)<br /> ? __pfx_update_passive_scan_sync (net/bluetooth/hci_sync.c:2861)<br /> hci_cmd_sync_work (net/bluetooth/hci_sync.c:306)<br /> process_one_work (./arch/x86/include/asm/preempt.h:27 kernel/workqueue.c:2399)<br /> worker_thread (./include/linux/list.h:292 kernel/workqueue.c:2538)<br /> ? __pfx_worker_thread (kernel/workqueue.c:2480)<br /> kthread (kernel/kthread.c:376)<br /> ? __pfx_kthread (kernel/kthread.c:331)<br /> ret_from_fork (arch/x86/entry/entry_64.S:314)<br /> <br /> <br /> Allocated by task 31:<br /> kasan_save_stack (mm/kasan/common.c:46)<br /> kasan_set_track (mm/kasan/common.c:52)<br /> __kasan_kmalloc (mm/kasan/common.c:374 mm/kasan/common.c:383)<br /> hci_conn_params_add (./include/linux/slab.h:580 ./include/linux/slab.h:720 net/bluetooth/hci_core.c:2277)<br /> hci_connect_le_scan (net/bluetooth/hci_conn.c:1419 net/bluetooth/hci_conn.c:1589)<br /> hci_connect_cis (net/bluetooth/hci_conn.c:2266)<br /> iso_connect_cis (net/bluetooth/iso.c:390)<br /> iso_sock_connect (net/bluetooth/iso.c:899)<br /> __sys_connect (net/socket.c:2003 net/socket.c:2020)<br /> __x64_sys_connect (net/socket.c:2027)<br /> do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)<br /> entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)<br /> <br /> Freed by task 15:<br /> kasan_save_stack (mm/kasan/common.c:46)<br /> kasan_set_track (mm/kasan/common.c:52)<br /> kasan_save_free_info (mm/kasan/generic.c:523)<br /> __kasan_slab_free (mm/kasan/common.c:238 mm/kasan/common.c:200 mm/kasan/common.c:244)<br /> __kmem_cache_free (mm/slub.c:1807 mm/slub.c:3787 mm/slub.c:3800)<br /> hci_conn_params_del (net/bluetooth/hci_core.c:2323)<br /> le_scan_cleanup (net/bluetooth/hci_conn.c:202)<br /> process_one_work (./arch/x86/include/asm/preempt.<br /> ---truncated---