kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/include/net/bluetooth
History
Pauli Virtanen 79a2d4678b Bluetooth: hci_core: lookup hci_conn on RX path on protocol side 
The hdev lock/lookup/unlock/use pattern in the packet RX path doesn't
ensure hci_conn* is not concurrently modified/deleted. This locking
appears to be leftover from before conn_hash started using RCU
commit bf4c632524 ("Bluetooth: convert conn hash to RCU")
and not clear if it had purpose since then.

Currently, there are code paths that delete hci_conn* from elsewhere
than the ordered hdev->workqueue where the RX work runs in. E.g.
commit 5af1f84ed1 ("Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync")
introduced some of these, and there probably were a few others before
it.  It's better to do the locking so that even if these run
concurrently no UAF is possible.

Move the lookup of hci_conn and associated socket-specific conn to
protocol recv handlers, and do them within a single critical section
to cover hci_conn* usage and lookup.

syzkaller has reported a crash that appears to be this issue:

    [Task hdev->workqueue]          [Task 2]
                                    hci_disconnect_all_sync
    l2cap_recv_acldata(hcon)
                                      hci_conn_get(hcon)
                                      hci_abort_conn_sync(hcon)
                                        hci_dev_lock
      hci_dev_lock
                                        hci_conn_del(hcon)
      v-------------------------------- hci_dev_unlock
                                      hci_conn_put(hcon)
      conn = hcon->l2cap_data (UAF)

Fixes: 5af1f84ed1 ("Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync")
Reported-by: syzbot+d32d77220b92eddd89ad@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d32d77220b92eddd89ad
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
History 2025-11-20 17:01:09 -05:00
..
bluetooth.h Bluetooth: Add function and line information to bt_dbg 2025-09-27 11:37:01 -04:00
coredump.h Bluetooth: Add support for hci devcoredump 2023-04-23 21:57:59 -07:00
hci.h Bluetooth: hci_event: Fix not handling PA Sync Lost event 2025-11-11 08:55:18 -05:00
hci_core.h Bluetooth: hci_core: lookup hci_conn on RX path on protocol side 2025-11-20 17:01:09 -05:00
hci_drv.h Bluetooth: Annotate struct hci_drv_rp_read_info with __counted_by_le() 2025-09-27 11:37:00 -04:00
hci_mon.h Bluetooth: Introduce HCI Driver protocol 2025-05-21 10:28:07 -04:00
hci_sock.h Bluetooth: hci_core: Prefer struct_size over open coded arithmetic 2024-07-14 21:33:29 -04:00
hci_sync.h Bluetooth: hci_sync: fix set_local_name race condition 2025-08-22 13:57:31 -04:00
iso.h Bluetooth: ISO: Add broadcast support 2022-07-22 17:14:13 -07:00
l2cap.h Revert "Bluetooth: L2CAP: convert timeouts to secs_to_jiffies()" 2025-10-24 10:30:30 -04:00
mgmt.h Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() 2025-10-31 12:43:05 -04:00
rfcomm.h tty: rfcomm: prefer struct_size over open coded arithmetic 2024-07-14 21:33:31 -04:00
sco.h Bluetooth: af_bluetooth: Make BT_PKT_STATUS generic 2023-08-11 11:49:16 -07:00