Patch "rfkill: Fix use-after-free in rfkill_resume()" has been added to the 5.9-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    rfkill: Fix use-after-free in rfkill_resume()

to the 5.9-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     rfkill-fix-use-after-free-in-rfkill_resume.patch
and it can be found in the queue-5.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 72f6cf4d91ef6114cff2f30627883d0fdf4a7c09
Author: Claire Chang <tientzu@xxxxxxxxxxxx>
Date:   Tue Nov 10 16:49:08 2020 +0800

    rfkill: Fix use-after-free in rfkill_resume()
    
    [ Upstream commit 94e2bd0b259ed39a755fdded47e6734acf1ce464 ]
    
    If a device is getting removed or reprobed during resume, use-after-free
    might happen. For example, h5_btrtl_resume() schedules a work queue for
    device reprobing, which of course requires removal first.
    
    If the removal happens in parallel with the device_resume() and wins the
    race to acquire device_lock(), removal may remove the device from the PM
    lists and all, but device_resume() is already running and will continue
    when the lock can be acquired, thus calling rfkill_resume().
    
    During this, if rfkill_set_block() is then called after the corresponding
    *_unregister() and kfree() are called, there will be an use-after-free
    in hci_rfkill_set_block():
    
    BUG: KASAN: use-after-free in hci_rfkill_set_block+0x58/0xc0 [bluetooth]
    ...
    Call trace:
      dump_backtrace+0x0/0x154
      show_stack+0x20/0x2c
      dump_stack+0xbc/0x12c
      print_address_description+0x88/0x4b0
      __kasan_report+0x144/0x168
      kasan_report+0x10/0x18
      check_memory_region+0x19c/0x1ac
      __kasan_check_write+0x18/0x24
      hci_rfkill_set_block+0x58/0xc0 [bluetooth]
      rfkill_set_block+0x9c/0x120
      rfkill_resume+0x34/0x70
      dpm_run_callback+0xf0/0x1f4
      device_resume+0x210/0x22c
    
    Fix this by checking rfkill->registered in rfkill_resume(). device_del()
    in rfkill_unregister() requires device_lock() and the whole rfkill_resume()
    is also protected by the same lock via device_resume(), we can make sure
    either the rfkill->registered is false before rfkill_resume() starts or the
    rfkill device won't be unregistered before rfkill_resume() returns.
    
    As async_resume() holds a reference to the device, at this level there can
    be no use-after-free; only in the user that doesn't expect this scenario.
    
    Fixes: 8589086f4efd ("Bluetooth: hci_h5: Turn off RTL8723BS on suspend, reprobe on resume")
    Signed-off-by: Claire Chang <tientzu@xxxxxxxxxxxx>
    Link: https://lore.kernel.org/r/20201110084908.219088-1-tientzu@xxxxxxxxxxxx
    [edit commit message for clarity and add more info provided later]
    Signed-off-by: Johannes Berg <johannes.berg@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/rfkill/core.c b/net/rfkill/core.c
index 971c73c7d34cb..97101c55763d7 100644
--- a/net/rfkill/core.c
+++ b/net/rfkill/core.c
@@ -876,6 +876,9 @@ static int rfkill_resume(struct device *dev)
 
 	rfkill->suspended = false;
 
+	if (!rfkill->registered)
+		return 0;
+
 	if (!rfkill->persistent) {
 		cur = !!(rfkill->state & RFKILL_BLOCK_SW);
 		rfkill_set_block(rfkill, cur);