github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-23 22:14:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind

Browse Source 
hci_conn::l2cap_data is accessed without locks in l2cap_disconn_ind via
hci_conn_timeout (disc_work) -> hci_proto_disconn_ind ->
l2cap_disconn_ind.  This is UAF if the l2cap_conn is deleted
concurrently.

disc_work is disabled sync in hci_conn_del(), so we cannot take
hci_dev_lock in disc_work.

Fix by using proto_lock to guard l2cap_data, in addition to hdev->lock
which is held in other access paths.

Fixes: ab4eedb790 ("Bluetooth: L2CAP: Fix corrupted list in hci_chan_del")
Reported-by: syzbot+9c40ad7c6ed7165e46e8@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9c40ad7c6ed7165e46e8
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This commit is contained in:
Pauli Virtanen 2026-08-01 21:37:23 +03:00 committed by Luiz Augusto von Dentz
parent 502adc06ba
commit 2b66c83ff1
1 changed files with 17 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
net/bluetooth/l2cap_core.c
View File

@ -1833,7 +1833,10 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
hci_chan_del(conn->hchan);
conn->hchan = NULL;
spin_lock(&hcon->proto_lock);
hcon->l2cap_data = NULL;
spin_unlock(&hcon->proto_lock);
mutex_unlock(&conn->lock);
l2cap_conn_put(conn);
}
@ -7168,8 +7171,6 @@ static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon)
}
kref_init(&conn->ref);
hcon->l2cap_data = conn;
conn->hcon = hci_conn_get(hcon);
conn->hchan = hchan;
BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan);
@ -7198,6 +7199,11 @@ static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon)
conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
spin_lock(&hcon->proto_lock);
conn->hcon = hci_conn_get(hcon);
hcon->l2cap_data = conn;
spin_unlock(&hcon->proto_lock);
return conn;
}
@ -7582,13 +7588,18 @@ static void l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
int l2cap_disconn_ind(struct hci_conn *hcon)
{
struct l2cap_conn *conn = hcon->l2cap_data;
struct l2cap_conn *conn;
int ret = HCI_ERROR_REMOTE_USER_TERM;
BT_DBG("hcon %p", hcon);
if (!conn)
return HCI_ERROR_REMOTE_USER_TERM;
return conn->disc_reason;
spin_lock(&hcon->proto_lock);
conn = hcon->l2cap_data;
if (conn)
ret = conn->disc_reason;
spin_unlock(&hcon->proto_lock);
return ret;
}
static void l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)