Bluetooth: prefetch channel before killing sock

Prefetch channel before killing sock in order to fix UAF like

 BUG: KASAN: use-after-free in l2cap_sock_release+0x24c/0x290 net/bluetooth/l2cap_sock.c:1212
 Read of size 8 at addr ffff8880944904a0 by task syz-fuzzer/9751

Reported-by: syzbot+c3c5bdea7863886115dc@syzkaller.appspotmail.com
Fixes: 6c08fc896b60 ("Bluetooth: Fix refcount use-after-free issue")
Cc: Manish Mandlik <mmandlik@google.com>
Signed-off-by: Hillf Danton <hdanton@sina.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index ab65304f3f637d75e03932ebecd63ecf8fef8cfe..390a9afab6473ec51ae54fa810b6f750841d56d2 100644 (file)
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1193,6 +1193,7 @@ static int l2cap_sock_release(struct socket *sock)
 {
        struct sock *sk = sock->sk;
        int err;
+       struct l2cap_chan *chan;
 
        BT_DBG("sock %p, sk %p", sock, sk);
 
@@ -1202,15 +1203,16 @@ static int l2cap_sock_release(struct socket *sock)
        bt_sock_unlink(&l2cap_sk_list, sk);
 
        err = l2cap_sock_shutdown(sock, 2);
+       chan = l2cap_pi(sk)->chan;
 
-       l2cap_chan_hold(l2cap_pi(sk)->chan);
-       l2cap_chan_lock(l2cap_pi(sk)->chan);
+       l2cap_chan_hold(chan);
+       l2cap_chan_lock(chan);
 
        sock_orphan(sk);
        l2cap_sock_kill(sk);
 
-       l2cap_chan_unlock(l2cap_pi(sk)->chan);
-       l2cap_chan_put(l2cap_pi(sk)->chan);
+       l2cap_chan_unlock(chan);
+       l2cap_chan_put(chan);
 
        return err;
 }